Stop the bleeding
If a wallet is compromised, assume every asset in it and every wallet that shares its seed phrase is at risk. Move any remaining funds to a brand-new wallet created on a clean device. Revoke outstanding token approvals if you can still transact safely.
Preserve evidence
Record the transaction hashes of the theft, the addresses involved, and the approximate time. Screenshot everything. This is the raw material a trace and any later legal action are built from — do not rely on being able to reconstruct it later.
Trace and target the cash-out
Stolen funds are most freezable while they are still sitting at, or moving toward, a centralized exchange. A fast trace that reaches an exchange deposit address gives you a concrete freeze target and the evidence to support the request.
This is the window where tooling matters most: the sooner the funds are followed to an endpoint, the sooner a freeze request or law-enforcement referral can go out — ideally before the attacker withdraws.
Get the right help
Report to law enforcement and, for a theft of any size, consult qualified counsel. On-chain tracing produces investigative leads and evidence; actual freezes and recovery run through exchanges, courts, and law enforcement.