One test settles almost every version of this: legitimate help in this area is paid for by an institution, or paid by you to somebody you went and found. It is never paid in advance to somebody who found you.
Nothing about this is specific to crypto. The US Federal Trade Commission files it under refund and recovery scams, and has done for years — the approach predates crypto by decades and was run on people who had lost money to timeshares and fake charities long before anyone lost a wallet. What crypto added is a loss that is public by default.
People who have just lost money post about it. In a forum thread, under an exchange's social account, in a comment on a video about the same thing that happened to them. It is a completely human response and it is also a signal that goes straight onto a list, because it identifies someone with a loss, an emotional stake, and a demonstrated willingness to act.
Which is why the approach usually arrives a few days later, in a private message, from an account that appears to have read your post carefully.
How a recovery scam reaches you
The variants are cosmetic. The structure is consistent: a specialist capability, a plausible technical story, a fee that comes before the result, and a reason why this has to happen quickly.
Common dressings include a blockchain forensics firm, a former law-enforcement investigator, a lawyer who has recovered funds from the same exchange, and — the boldest one — a message from the platform's own fraud department. Some come with a website that has existed for three weeks, testimonials, and a case dashboard showing your funds being traced.
The dashboard is the detail that convinces. Nothing is easier to build than a page showing a progress bar and a set of addresses. It will show recovery advancing right up to the point where one more payment is needed, and never past it.
Three claims that show a crypto recovery service is a scam
"We can reverse the transaction"
A confirmed on-chain transfer cannot be reversed by anyone, the exchange and the network included.
"There is a fee to start, and a tax or release payment at the end"
Fees before results are the business model. The second payment is the actual mechanism — the first fee is small enough to seem like a reasonable risk, and its purpose is to establish that you will pay.
"Give us your keys, or connect your wallet, or share your screen"
No legitimate process requires a recovery phrase, a private key, a wallet connection or remote control of your computer. This is the request that turns a loss into a total loss.
There is a fourth, subtler one: they contacted you. The same rule from the piece on unsolicited support contact applies here with even more force, because a real investigator has no way of knowing your case exists.
Tracing is not recovery. Blockchain analysis firms genuinely can follow funds across addresses, and that is a real service — but it is sold to exchanges, insurers and law enforcement, not to individuals by private message. Knowing where funds went does not give anyone the ability to take them back.
Where to report stolen crypto instead
Short list, and honest about the odds.
- Report to the exchange, quickly. If the funds move into another regulated platform, a fast report with transaction identifiers can support a freeze there. This is the route with the best chance and it costs nothing.
- Report to the police or the national fraud reporting body in your country. It often produces no individual outcome, and it is still worth doing: it puts the loss on record with a date, and a report reference is something a bank, insurer or exchange may ask you for later.
- A regulated lawyer you found yourself, if the sum justifies it. Found by you, through a professional register, not one who found you.
- An insurance or chargeback claim, in the narrow situations where a card payment or a covered service was involved.
None of these are quick and most produce nothing. That is the uncomfortable fact the second approach is built on — it offers the certainty that none of the real routes can.
How real blockchain tracing works, and who it is for
Blockchain analysis is a genuine industry, which is what gives the imitation something to copy. Worth knowing how the real version is shaped, because almost nothing about it matches the message in your inbox.
The firms doing this work sell to institutions: exchanges, insurers, banks, law enforcement, and occasionally a law firm acting for a client whose loss is large enough to justify the fee. Their customer is rarely the victim directly. They do not prospect for individuals, they are not cheap, and they cannot do the one thing the messages promise — the analysis produces a report about where funds went, which somebody with legal or platform authority then has to act on. Tracing is evidence. Recovery is a legal or platform process that may follow from it, and usually does not.
So if you are ever genuinely in that market, the path runs backwards from how the scam presents it: you engage a lawyer, and the lawyer commissions the analysis, because the report is only useful attached to a case. Anybody selling you the report on its own is selling you a document with nowhere to go.
Why the second approach is usually bigger
Two reasons, and neither is accidental.
The first is selection. Everyone who receives this message has already demonstrated two things: that they hold crypto, and that they will act on a message from a stranger. That is a far better prospect than a name on a bulk list, and it justifies more effort per target — better writing, a working website, someone willing to spend an hour on a call.
The second is the sunk cost. Somebody who has already lost money has a reason to want the second offer to be true that they did not have for the first. The pitch does not have to be more convincing than an ordinary scam. It only has to be convincing enough to beat the alternative, which is accepting that the money is gone — and that is a much lower bar than it sounds from the outside.
What to do in the days after losing crypto to a scam
Three things, in this order.
- Stop posting details publicly, including transaction identifiers and amounts. That is what the list is built from.
- Finish the security work if you have not. The first-hour sequence ends with a rebuild that people often abandon halfway through, leaving the account in the state that allowed the first loss.
- Treat every unsolicited message as part of the same event rather than as a new one.
If a message does arrive and part of you wants it to be real — which is normal, and is the point — the test that works when judgement is tired is the money direction. Legitimate help in this area is paid for by institutions, or paid for by you to someone you sought out, or free. It is never paid in advance to someone who found you.
No statistics here, deliberately. Figures on how much is lost to follow-up approaches circulate widely and we could not trace them to a source we would stand behind, so this piece describes mechanics instead. The one technical claim worth stating flatly is the irreversibility of a confirmed on-chain transaction, which is a property of how these networks settle rather than a policy any company could change. Nothing here is legal advice.