Crypto Recovery Scam: How the Second Fraud Works (2026)

If you're reading this, there's a decent chance you've just lived through the worst week of your financial life, and the person who caused it has already moved on to someone else. The platform stopped answering. The 'withdrawal' never landed. And then, right on cue, a stranger appeared with the exact words you were desperate to hear: we can get your money back.

Stop there. That stranger is the subject of this guide.

A crypto recovery scam is the second fraud — the one aimed squarely at people who already lost money to a crypto scheme. The pitch barely varies: for an upfront fee, a 'fund recovery agent,' a 'blockchain forensics firm,' or a 'crypto recovery law firm' will trace your coins and bring them home. The FBI's own guidance is blunt: be wary of anyone claiming they can recover your funds, because it may be another scam. Real recovery does exist. It is narrow and slow, it comes with no guarantees, and it never begins with an unsolicited DM.

Here is how the con operates, why the pitcher knows your case, when stolen crypto genuinely comes back, and what real help looks like.

What is a crypto recovery scam, exactly?

It is a fraud that feeds on a previous fraud. The setup assumes you've already been burned — by a fake trading platform, a pig-butchering scheme, a drained wallet — and that you're now primed to pay for hope.

The scale is not small. According to the FBI's Internet Crime Complaint Center, cryptocurrency-related fraud accounted for $9.3 billion in reported losses across 149,686 complaints in 2024 — a 66 percent jump in a single year, inside a record $16.6 billion in total reported internet-crime losses. The FTC separately counts $12.5 billion lost to fraud of every kind in 2024, with investment scams the costliest category at $5.7 billion. Hidden inside those numbers sits a shadow industry devoted to re-victimizing the victims.

Regulators now name it openly. California's Department of Financial Protection and Innovation, whose Crypto Scam Tracker drew more than 2,668 complaints in 2024 and helped the state shut down over 26 scam websites, explicitly warns consumers to 'stay wary of crypto recovery scam sites.' When a state regulator's checklist includes the rescuers, the rescue market has a problem.

How does the recovery scam find you?

You didn't find them. They found you.

The FTC has documented the mechanics for years: criminals buy, sell, and trade what they bluntly call 'sucker lists' — rosters of people who already paid a scammer, complete with names, contact details, the scheme that worked, and how much was taken. Someone who has been defrauded once, the logic goes, is a proven payer.

Sometimes the recovery crew is the original crew, cycling you to a 'partner firm' the moment your account goes dark — same people, new costumes, fresh invoice. Other times they trawl the comment sections of crypto news articles and YouTube videos, plant ads in search results for phrases like 'get stolen crypto back,' or materialize within minutes under a distressed Reddit post, each armed with the same miracle story about a firm that 'worked for them.'

The detail that unnerves victims most: the agent frequently knows exactly how much you lost, and when you lost it. The FBI treats that precision as evidence against them, not for them — it means your case file was sold, or it never left the room.

The advance-fee playbook, step by step

Every recovery pitch we have examined runs on the same rails. The costumes change; the script doesn't.

1. The approach. A DM, email, or comment reply that references your specific loss — sometimes your exact dollar amount — and offers a 'free case evaluation.'
2. Credibility theater. A glossy site for a law firm or 'forensics' company, borrowed attorney headshots, a bar number lifted from a real lawyer's public listing, letterhead that looks official because it was copied from something official.
3. The tracing report. Within days a PDF arrives: wallet addresses, transaction hashes, a flow chart of your coins crossing the blockchain. It looks like forensic science. It is public data with a logo on it.
4. The first fee. A 'retainer,' a 'processing charge,' a 'case-opening fee' — modest on purpose, a few hundred dollars to learn whether you pay.
5. The mirage. Wonderful news: your funds have been 'located' in an account at a foreign bank or exchange, and you merely need to register there to receive them. The bank is fake too — a prop website run by the same crew.
6. The meter runs. Now come the 'taxes,' the 'anti-money-laundering clearance,' the 'gas fees,' the 'exchange commission' — each framed as the final obstacle, each payable in crypto or gift cards, often inside a WhatsApp group chat staffed by 'attorneys' and 'bank officers' who keep you paying.
7. The vanishing. One morning the chat is silent, the site returns an error, the phone numbers are dead.

It never was there. The located funds, the foreign account, the recovery that was nearly complete — stage props, all of it, arranged to keep the meter running until you stopped.

The first fraud has its own tells — we catalog them in how to spot a crypto scam — but the second fraud wears a kinder mask. If any scene of this script is playing out in your inbox right now, pause and read our walkthrough of what to do in the first 48 hours after a scam before you send another dollar.

Fake law firms and fake 'blockchain tracing' reports

Federal investigators have watched this corner of the con harden into an industry of its own. Between February 2023 and February 2024, victims who were then exploited by fictitious law firms reported more than $9.9 million in additional losses — money paid not to the original scammers but to the people promising to undo them. The Bureau's updated advisory reads like a casting sheet: impersonation of real attorneys, fictitious documents on genuine letterhead, invented agencies with gravitas-soaked names like the 'International Financial Trading Commission,' and the claim that you appear on a 'government-affiliated list of scam victims.'

One line from that advisory deserves to be taped to every monitor in America: there are no law firms that are officially authorized partners of US government agencies. None. So when a 'recovery lawyer' says they work alongside the FBI or the CFPB, they have already told you what they are. Why would a genuine attorney cold-message a stranger about a case that was never filed?

The tracing PDF earns the same skepticism. Blockchain data is public by design, so a report proving your coins moved from wallet A to wallet B shows nothing a free block explorer couldn't — and no document, however many seals and case numbers it carries, can compel a single satoshi to move. The FBI states it plainly: private-sector recovery companies cannot issue seizure orders, and exchanges freeze accounts only through their own internal processes or in response to legal process.

Can you ever get stolen crypto back?

Sometimes. You've earned the honest version: most stolen cryptocurrency is never recovered, and anyone who quotes you a success rate over the phone is selling something. Three real routes exist, though, and all three are worth the effort.

Route one: the exchange freeze. If the scammer's cash-out path touches a regulated exchange, that exchange's compliance team can freeze the account — but only through internal processes or legal process, and the window is measured in hours and days, not weeks. Report to the exchange's fraud desk immediately with every transaction hash you have, and file at ic3.gov the same day, because the FBI asks for exactly those identifiers — wallet addresses, amounts, timestamps, hashes — when it moves to freeze funds.

The second route: law enforcement. Slow, and not yours to schedule — but real. The IC3's own reporting describes how it can alert financial institutions to fraudulent transactions quickly enough to freeze victim funds when reporting criteria are met, and asset recovery sits on its list of core functions. If agents ever contact you about your case, the interaction will look nothing like a recovery pitch: no fees, no urgency, no gift cards.

Route three: civil litigation. For larger losses with an identifiable person or company on the other side, a licensed attorney can sue, subpoena exchanges, and chase a judgment. Expensive and uncertain — but occasionally effective.

What will never happen: nobody can reverse a confirmed blockchain transaction, and no hired 'hacker' can simply take your coins back from the scammer's wallet. That capability does not exist outside of movies. Promises are the product.

What does legitimate help look like?

It is quieter than the scam version, and it never finds you first.

• A licensed attorney you located yourself — through your state bar's directory, not a DM — who puts the engagement in writing, explains fees without pressure, and promises nothing about outcomes.
• Forensic accountants and blockchain investigators retained through counsel, whose reports are built to survive cross-examination rather than to impress you, and who tell you plainly when a case is not worth pursuing.
• Free government channels that actually move: a report at ic3.gov, a fraud report with the FTC, a complaint to your state regulator.
• Zero-trust verification of anyone already in your inbox: ask for the law license and check it with the bar yourself, insist on a video call, and verify any claimed government affiliation through the agency's published number. The FBI's advice to targets of the fictitious-firm scam is to assume nobody should be trusted by default.

Two further checks cost nothing. Look up the firm's domain age — our guide to checking whether a website is legit walks through WHOIS lookups step by step — because a 'firm with 15 years of experience' rarely owns a 6-month-old domain by accident. And treat glowing Trustpilot pages as unverified marketing; review farms sell five stars by the hundred. You can see how we run these checks on our methodology page.

What should you do if a recovery agent contacts you?

Work this list in order, and let nobody rush you through it.

1. Pay nothing. Not a retainer, not a 'verification deposit,' not a tax.
2. Share nothing — no ID, no banking details, no one-time codes, and under no circumstances your wallet's seed phrase. No legitimate professional will ever ask for it.
3. Verify independently: the state bar for lawyers, the local FBI field office for anyone claiming federal affiliation. They will confirm or deny.
4. Preserve everything: chats, emails, the tracing PDF, payment receipts, wallet addresses, transaction hashes. This is evidence, and it matters.
5. Report it — ic3.gov for the FBI, ReportFraud.ftc.gov for the FTC, and your state regulator. If you're still inside the first two days, our guide to the first 48 hours after a scam is the checklist to follow, because speed is the one variable you control.
6. Brace for the third act. Your name now sits on a fresher, more valuable list, and the next savior may arrive in a different costume. When one does, tell us.

Frequently asked questions

Can you get stolen crypto back?

Occasionally — through an exchange freeze executed in the first hours, a law-enforcement seizure, or a civil judgment — but the honest base rate is low, and anyone guaranteeing an outcome is lying to you. The routes that work run through institutions: exchanges, courts, agencies. Never through a stranger's Telegram account.

How can I tell if a crypto recovery company is legitimate?

Apply the FTC's upfront-fee test: did they contact you, and do they want money or personal information before delivering anything? Then it's a scam — full stop. A legitimate firm is one you found independently, that verifies cleanly with its state bar, that puts everything in writing, and that never requests payment in crypto or gift cards.

The agent knew exactly how much I lost. Doesn't that prove they're official?

It proves the opposite. The FBI lists knowledge of your exact amounts and transfer dates as a red-flag indicator of a fictitious recovery operation, because it means your details were sold on a victim list — or the 'agent' is the original scammer returning for a second pass.

I already paid a recovery fee. What now?

Stop all payments today and cut contact. Preserve every record — chats, receipts, wallet addresses, transaction hashes — and report both scams to ic3.gov and the FTC, then work through our first-48-hours checklist. Expect a follow-on approach months from now under a new name, and treat it identically. None of this was your fault; these operations are engineered by professionals.

Can't a hacker just take my crypto back from the scammer's wallet?

No. Blockchain transactions are irreversible by design, no private company can issue a seizure order, and 'hack-back' recovery is either fiction or a crime you would be financing. The FBI's guidance could not be clearer: be wary of anyone claiming they can recover your funds.

Frequently asked questions

Can you get stolen crypto back?+

Occasionally — through an exchange freeze executed in the first hours, a law-enforcement seizure, or a civil judgment — but the honest base rate is low, and anyone guaranteeing an outcome is lying to you. The routes that work run through institutions: exchanges, courts, agencies. Never through a stranger's Telegram account.

How can I tell if a crypto recovery company is legitimate?+

Apply the FTC's upfront-fee test: did they contact you, and do they want money or personal information before delivering anything? Then it is a scam, full stop. A legitimate firm is one you found independently, that verifies cleanly with its state bar, that puts everything in writing, and that never requests payment in crypto or gift cards.

The agent knew exactly how much I lost. Doesn't that prove they're official?+

It proves the opposite. The FBI lists knowledge of your exact loss amounts and transfer dates as a red-flag indicator of a fictitious recovery operation, because it means your details were sold on a victim list — or the 'agent' is the original scammer returning for a second pass.

I already paid a recovery fee. What now?+

Stop all payments today and cut contact. Preserve every record — chats, receipts, wallet addresses, transaction hashes — and report both scams to the FBI at ic3.gov and to the FTC at ReportFraud.ftc.gov. Expect a follow-on approach months from now under a new name, and treat it identically. None of this was your fault; these operations are engineered by professionals.

Can't a hacker just take my crypto back from the scammer's wallet?+

No. Blockchain transactions are irreversible by design, no private company can issue a seizure order, and 'hack-back' recovery is either fiction or a crime you would be financing. The FBI's guidance could not be clearer: be wary of anyone claiming they can recover your funds.

About the investigator

Elena Ross

Consumer advocate · victim-first reporting

Elena Ross came to ScamTrix from consumer protection work, where she spent a decade helping fraud victims navigate banks, regulators and police reports that went nowhere. She knows exactly where the system abandons people, because she has sat with them there.

All investigations by Elena →