Crypto Recovery Scams: The Second Scam
If someone contacted you promising to get your crypto back, stop. There is a good chance you are about to be scammed a second time by the same industry that scammed you first.
Most "crypto recovery services" that contact you are a second scam. Recovery fraud is advance-fee fraud aimed at people who were already defrauded, and regulators including the CFTC, NASAA and the FBI have all warned about it. The rule that catches nearly all of them: if they contacted you first, or they guarantee results, or they want money upfront, it is a scam.
Why they find you so fast
Victims are often astonished that a "recovery expert" appears within hours of their loss. It is not luck. It is a business model:
- You made your loss public. A wallet address or complaint posted in a forum, Telegram group or review site is scraped within hours.
- Victim lists are resold. The group that scammed you knows exactly who you are and what you lost. That list has resale value.
- Sometimes it is the same people. Running the recovery scam against your own victims is the cheapest lead generation in fraud.
This is why unsolicited contact is not a coincidence to be evaluated on its merits. It is the single strongest signal you are being targeted again.
The red flags
| Red flag | Why it is disqualifying |
|---|---|
| They contacted you first | On WhatsApp, Telegram, Instagram or email. Legitimate firms do not cold-call fraud victims. |
| They guarantee recovery | Nobody can. The outcome depends on law enforcement and exchanges, not on them. |
| Large upfront fee | The entire mechanic of advance-fee fraud. Payment is the product. |
| They ask for your seed phrase | Instant, absolute disqualifier. No exceptions, ever. |
| They claim to "hack" it back | Not a real service. Blockchain transactions cannot be reversed by hacking. |
| "Special access" to exchanges | Claimed backdoors and insider contacts do not exist. |
| They already have your money | They just need a fee, tax or "release payment" first. Classic setup. |
| Pressure and deadlines | Urgency exists to stop you checking. Real cases are not lost by thinking overnight. |
How the con actually runs
- Contact. They reach out claiming to be an investigator, lawyer, or government-affiliated recovery agent.
- Credibility. A slick website, fake certificates, invented case studies, sometimes a cloned identity of a real firm.
- The hook. They claim your funds are located, or already frozen, and just need releasing.
- The fee. A retainer, "gas fee", "tax", or "unlock" payment. Modest enough to feel reasonable against your loss.
- The escalation. The first payment is never the last. Each one is the final obstacle.
- Silence. When you stop paying, they disappear.
What a legitimate firm looks like
Real blockchain forensics firms do exist and do recover funds. They behave differently:
- You found them, not the reverse.
- They assess your case for free and tell you honestly if it is not viable, which is most of the time.
- They talk in probabilities, not promises. Expect "this may be possible if", not "we will get it back".
- They have a real, verifiable identity: registered company, physical address, named staff.
- They work with law enforcement rather than claiming to bypass it.
- They have a minimum case size, because tracing costs real money and small cases do not justify it.
- They never ask for your seed phrase.
How to verify anyone before you pay
- Check the website with our free website safety checker. A domain registered weeks ago is a serious warning.
- Search the company name plus "scam" and read past page one.
- Verify registration in the country they claim. A real firm is a real legal entity.
- Check the regulator warning lists. The CFTC, NASAA and your national regulator publish them.
- Reverse image search staff photos. Stock photos and stolen headshots are routine.
- Never act under time pressure. If a delay of one day "loses" the case, it was never real.
If you already paid a recovery scammer
- Stop paying immediately. There is no final fee. Sunk cost is exactly what they exploit.
- Report it to the FBI IC3 and your national police, as a separate crime from the original scam. Use our reporting guide.
- Preserve everything: messages, invoices, wallet addresses, TXIDs, the website.
- Expect more attempts. Having paid once marks you as a paying victim, and that list gets sold too.
Common questions
Are all crypto recovery services scams?
Not all, but many are, and regulators have warned about the pattern specifically. Legitimate blockchain forensics firms exist. The difference is behavioural: real firms do not contact you first, do not guarantee outcomes, and do not need a large payment before doing anything.
Why did a recovery agent contact me so fast?
Because your loss became visible, usually because you posted about it, or because your details were resold. Sometimes the recovery crew and the original scammers are the same operation. Unsolicited contact after a loss is a red flag on its own.
Can anyone guarantee recovery?
No. The outcome depends on where the funds went and whether an exchange or law enforcement acts. Roughly 10 to 25 percent of stolen crypto is recovered. A guarantee is not confidence, it is a tell.
They asked for my seed phrase. Is that normal?
Never. Your seed phrase is total control of your wallet. No investigator, exchange, lawyer or agency needs it, in any legitimate process, ever. Anyone asking is trying to take whatever you have left.
Related reading
- Can stolen crypto be traced? — the honest odds
- Trace your transaction yourself — for free, before paying anyone
- Recovery eligibility checker — a free assessment
Fraud analysts and cybersecurity researchers specializing in online scam detection, phishing analysis, and victim fund-recovery guidance. About our team →