If someone contacts you after you lost crypto and offers to recover it for an upfront fee, it is almost certainly a second scam. Recovery scammers pose as blockchain investigators, law firms, “ethical hackers” or even government agencies, show convincing reports with real transaction hashes, and ask for payment before anything is returned. Nothing is returned. Real recovery happens through police, exchanges and stablecoin issuers that freeze funds — and none of them charge victims a fee to do it.
How they find you
- Replies to your posts about a loss on X, Reddit, Telegram or review sites, often from several “satisfied clients” at once.
- Search ads and SEO pages for “recover stolen crypto”, “crypto lawyer”, “USDT recovery”.
- Lists of victims shared between scam groups: if you lost money to a fake platform, the same people may call back as “investigators”.
- Letters and calls claiming to be from a regulator, the FBI, Interpol or a court, saying your funds were found.
The FBI has repeatedly warned through IC3 public service announcements about fraudsters posing as law firms and government officials who target earlier crypto-fraud victims and demand fees to “release” recovered funds.
Fake recovery vs real help
The two can look similar from the outside: reports, case numbers, talk of tracing. The differences are in who contacts whom, what they promise and how money flows.
- Real: you contact the police or an established firm yourself. Fake: they contact you first.
- Real: no guarantees; tracing shows where funds went, recovery depends on freezes and court orders. Fake: “95% success rate”, “funds located, ready to release”.
- Real: law enforcement does not charge victims; legitimate forensic firms work under a contract with a company or a lawyer, invoice like any business and do not “hack back”. Fake: fee up front, in crypto, then a “tax”, “transfer fee”, “court fee”…
- Real: freezes are done by exchanges and issuers such as Tether and Circle at the request of authorities. Fake: they claim they can reverse blockchain transactions or access the scammer’s wallet.
What tracing can and cannot do
Blockchains are public, so anyone can follow funds from your address through the next ones — you can start yourself with an explorer, see how to check a transaction hash. Tracing becomes useful when funds reach a regulated exchange or a stablecoin that can be frozen: then the police can request account data or a freeze. It cannot undo a confirmed transaction, cannot open someone else’s wallet and cannot work quickly enough once funds pass through mixers or many hops. Anyone promising otherwise is selling a story.
What to do after a loss
- Write down everything now: transaction hashes, addresses, amounts, times, website domains, usernames and chat logs. Export chats before accounts disappear.
- Report to the police where you live; in the US to IC3 (ic3.gov) and the FTC (reportfraud.ftc.gov), in the UK to Action Fraud. Ask for a reference number.
- If funds went to an exchange, contact that exchange’s support through its official website with the hashes and police reference. Speed matters for freezes.
- If funds were USDT or USDC, contact Tether or Circle with the same data; they act on law-enforcement requests.
- Secure what is left: new wallet if any key or seed could be exposed, revoke approvals, change passwords and 2FA.
- Ignore every unsolicited offer of help. Block, do not argue.
A typical recovery-scam conversation
It often starts warmly: “We saw your post, we helped people in the same situation, here is a trace of your funds.” The trace is real data copied from an explorer, which makes it convincing. Then comes the first fee — for “opening a case” or “a blockchain node fee”. After payment, a report says the funds are “located at an exchange” and a second fee is needed for “legal release” or “tax”. The last stage is usually an appeal to emotions or a threat: the funds will be confiscated, or you will be liable if you stop now.
Red flags in one place
- Contact you did not initiate, especially soon after you posted about a loss.
- A guarantee or a percentage of success.
- Fees payable in crypto, to a personal wallet, before any result.
- Requests for your seed phrase or remote access “to trace the funds” — see fake support scams.
- Pressure: the “recovered funds will be lost” if you do not pay today.
- Official-looking letters with seals but e-mail addresses on free mail services.
Losses hurt, and the wish to undo them is exactly what these schemes use. A plain report to the police and the exchange is slower and less dramatic, but it is the route through which frozen funds are actually returned.
FAQ
Can stolen crypto really be recovered?
Sometimes, when funds reach an exchange or a freezable stablecoin and police act quickly. Confirmed transactions cannot be reversed.
Are crypto recovery services legit?
Firms that contact you first and ask for an upfront fee are scams. Legitimate forensic firms work through lawyers or companies and make no guarantees.
Does the FBI charge fees to return crypto?
No. Law enforcement does not charge victims. Messages claiming otherwise are fraud.
Can a hacker get my money back from the scammer’s wallet?
No. That claim is the core of the recovery scam.
What information should I give the police?
Transaction hashes, addresses, amounts, times, domains, usernames and chat exports.