Where to seek help, and where not to

A crypto scam can take many forms: a fake "exchange" introduced through chat, a romance or investment scam, "support" asking for a seed phrase, a P2P counterparty using fake screenshots, or a counterfeit dApp. The common feature is that you were induced to send assets or disclose credentials. This is not the same as a withdrawal freeze in your genuine exchange account. Useful steps include preserving evidence, stopping further payments, assessing the transaction path, and, where relevant, contacting the destination exchange and filing a report. Avoid chats promising 100% recovery for an up-front payment, remote-access requests, and repeated "fees."

Do not confuse deception with an unauthorized transfer from an already compromised wallet where you did not knowingly send the assets. That requires a different checklist: see crypto stolen from a wallet. If the scheme used an "investment platform" introduced in a messenger, review the signs of a crypto exchange scam. If you also see a series of transfers following a malicious approve, see the first 60 minutes after a drainer approval.

First steps after a crypto scam

1. Stop every additional payment to the scammers, including a "tax," "withdrawal fee," "unlock fee," "insurance," or "recovery deposit."
2. Preserve correspondence, usernames, phone numbers, URLs, account or withdrawal-error screenshots, dates, and amounts.
3. In the relevant explorer, record every outgoing TxID, network, destination address, and block time as screenshots and a text list.
4. Change passwords for your email and genuine exchange accounts if you shared codes or signed in through third-party links. Never enter a seed phrase anywhere.
5. Do not install APKs, "recovery bots," or browser extensions advertised for recovering stolen crypto.
6. Build a short timeline: contact, transfer, and demand for another payment.

At the same time, submit the TxID package for an initial assessment. If the assets are still at an exchange deposit address, the window for a freeze request may be shorter than it appears. This is a task for blockchain analytics and exchange engagement, but stopping further losses comes first. If the assets left your wallet through a series of outgoing transfers you did not initiate, also see unauthorized crypto wallet withdrawals.

Why "recovery services" can become a second loss

After a crypto scam, victims are often approached by purported recovery services that promise to return funds through an intermediary, a "law-enforcement channel," a "white-hat hacker," or "licensed recovery." FBI IC3 warns that companies promising to recover stolen crypto for an up-front fee are often fraudulent themselves. They take the payment and disappear or demand more. Private firms cannot issue asset-seizure orders; exchanges freeze accounts under their own procedures or in response to a lawful request.

• A near-certain recovery percentage.
• Payment accepted only in crypto to an "intermediary account."
• Pressure that the window will close today.
• A request for a seed phrase "for an audit."
• Refusal to provide a written agreement with a clear payment model.

A legitimate assessment starts with evidence and the blockchain trail, without promises of a miracle. If you are considering an engagement tied to a defined result, review the success-fee model: payment follows the agreement's terms and result rather than an up-front "recovery" fee.

Evidence, police reports, and realistic expectations

The evidence package for law enforcement and exchanges is generally the same: wallet addresses, TxIDs or hashes, amounts and asset types, dates and times, how the scheme made contact, communication platforms, domains, and identifiers. The FTC notes that cryptocurrency payments are generally irreversible; recovery may be possible only if the recipient returns the funds or a platform can act while assets remain in a custodial account. A report records the incident but does not reverse the blockchain.

A realistic objective is to stop further losses, preserve a complete evidence package, and assess whether the trail reaches an exchange. Partial recovery may occur when the route is still recent and the platform is willing to review the deposit, but there is no guarantee. Do not spend the available window arguing in comments or searching for a magical recovery; stop further payments and preserve the trail first.

Related resources

Need an assessment of your situation?

Briefly describe what happened ? without seed phrases or private keys. We will outline possible routes and assess their feasibility.

Describe what happened

Answer a few questions so we can assess the situation and suggest the next steps.

Crypto investigations, support with exchange restrictions, and asset access recovery.