That call offering to recover your stolen crypto?
It's the second scam.

You lost money to a crypto scam. Maybe a fake investment platform, a romance scammer, a phishing link. Doesn't matter how. The money is gone, and you know it.

Then, a few days later, someone calls. They already know what happened. They say they specialize in exactly this type of case — trace the blockchain, contact the exchange, get your funds back. They just need a fee upfront to start.

Don't pay it. What you're looking at is the second scam.

This has a name: a "recovery room" scheme. It's one of the fastest-growing fraud categories in the world right now, and it works because you're already in a desperate state. The people running it aren't going to recover anything. They're going to take more of your money, then disappear.

How they got your phone number

This is what trips people up. The caller seems to already know things: that you lost money, roughly how much, sometimes even which platform was involved. It feels like proof that whoever called must know what they're doing.

Here's what actually happened. After you were scammed the first time, your contact details ended up in a database. Databases of fraud victims get bought and sold in the same underground markets where scam operations run. Your name, phone number, and the rough story of what happened to you is a commodity. A few dollars per record.

Sometimes the recovery operation is run by the same people who took your money in the first place. Once they've cleaned out one account, they sell or reuse the data for a second pass. It's not a coincidence. It's planned.

Recovery scammers also run paid Google ads aimed at people searching for "how to recover stolen crypto" after a loss. If you went looking for help online, you may have clicked an ad they paid for. Those ads are not from people trying to help you.

What the call actually sounds like

These callers are practiced. Here's the pattern, pretty much word for word across hundreds of documented cases.

They open with credibility. "We're a blockchain forensics firm" or "we work alongside exchanges and law enforcement." They drop real-sounding terms: Etherscan, on-chain analysis, wallet tracing. They might name-drop Interpol or Chainalysis — which is a real company doing real forensic work for governments and corporations, and doesn't offer private recovery services to individuals.

Then comes urgency. "We've already located your funds, but the window to freeze them is closing." Nothing about this is true. Blockchain records don't expire, and frozen funds don't vanish on a deadline. But under stress, it sounds plausible enough.

Then they ask for money. Usually something small first: a "processing fee," a "compliance deposit," a "tax on released funds." You pay. They find a reason to ask for more. Some victims go through three or four rounds of this before realizing the same people are on the other end every time.

8 things scammers say — and what they actually mean

Every one of these shows up in documented cases. If you hear any of them, that's your answer.

• !
  They contacted you first Legitimate forensic firms and legal professionals don't cold-call fraud victims. If they reached out to you rather than the other way around, that alone tells you enough.
• !
  "We guarantee full recovery" or "97% success rate" Nobody can promise a specific outcome before examining a case. NASAA lists this as a marker of fraud. Real blockchain forensics is uncertain and frequently unsuccessful. Any quoted guarantee is made up.
• !
  "We need a fee before we can start" The only credible payment model for any recovery service is contingency: they take a percentage after your funds actually land back in your account. Any upfront payment, framed any way at all, is how they steal from you.
• !
  "You need to act now — the trail goes cold fast" Blockchain records don't expire. A wallet address from two years ago is just as traceable today. Urgency is a pressure tactic to stop you thinking clearly before you hang up.
• !
  They want payment in crypto, gift cards, or wire transfer All three are untraceable and non-reversible. No registered business accepts gift cards for professional services. This is the clearest operational signal that you're talking to a criminal.
• !
  They can't explain their method Ask them directly: which blockchain explorer do you use? How do you get exchanges to freeze accounts? What legal mechanism makes that possible? A real expert answers in specifics. Vague talk about "proprietary tools" and "law enforcement contacts" means there's nothing behind the pitch.
• !
  No verifiable address or registered company A real firm has a company registration, a physical address you can look up, and a name that appears in business registries. If you can only reach them through Telegram or a generic Gmail address, there is no company.
• !
  All their reviews are on their own website Testimonials a company publishes on its own site prove nothing. Search the company name on Trustpilot and Reddit. No results is a red flag. Posts from other victims describing the same experience you're having right now is your answer.

Why getting your crypto back is so hard

I want to be honest about this, because most articles aren't.

When a blockchain transaction is confirmed, it's permanent. There's no central authority that can reverse it — not you, not an exchange, not a court, not a forensics firm. The money moves and stays moved.

The one narrow window where something might happen: if the scammer sent your funds to a centralized exchange like Binance or Coinbase, and you contact that exchange immediately with your transaction evidence, there's a chance the exchange freezes the receiving account before funds are withdrawn. That window is measured in hours, not days. Most people don't know about it until it's already closed.

Law enforcement in some countries does trace and recover crypto from large organized criminal operations, using enterprise tools like Chainalysis and Elliptic. But those are multi-year investigations into criminal networks. The FBI is not going to assign an agent to your personal $5,000 case.

What you can actually do right now

Six steps. None of them cost money. They won't feel satisfying, because the honest version of this advice never does. But they're what matters.

1. 01
   Write everything down before you forget it Every transaction ID, every wallet address, every timestamp. Screenshot your conversations with the scammer. Save URLs of any websites they used. Details disappear faster than you'd think, and platforms get taken down. Do this today, not tomorrow.
2. 02
   Trace where the money went using free tools Etherscan tracks Ethereum transactions. Blockchain.com covers Bitcoin. Paste the recipient wallet address and follow where it leads. Note every address the funds touched. This is what you hand to authorities. It costs nothing.
3. 03
   Contact the receiving exchange right now If your trace shows funds arriving on a known exchange, go to that exchange's fraud reporting page immediately. Provide your transaction IDs. Exchanges sometimes freeze accounts — but only if you report before the scammer moves funds off the platform. Hours matter here.
4. 04
   File official reports In the US: the FTC at reportfraud.ftc.gov and the Internet Crime Complaint Center at ic3.gov. In the UK: Action Fraud. These reports rarely result in your personal recovery, but they build the cases that eventually lead to arrests. Your report matters for the next victim.
5. 05
   Report the wallet addresses on Chainabuse Chainabuse.com is free, requires no account, and shares your report with exchanges and law enforcement globally. When someone else searches those wallet addresses later, your report is what they'll find.
6. 06
   If you already paid a recovery service, report that too Being scammed a second time is also a crime. File a separate report. If you paid by credit card, call your bank about a chargeback — unlikely to succeed, but worth trying. If you paid in crypto, that money is almost certainly gone. Report it anyway.

Where to report by country

One case where crypto recovery is actually real

There's a distinction most articles skip over, and it matters.

If you lost access to your own wallet because of a forgotten password or corrupted file, that's a technical problem — not fraud recovery. Companies do exist that run password-cracking tools against wallet files you already have. If you have the file and lost the password, that's a legitimate service. The only trustworthy fee model: contingency, after access is restored.

That's completely different from someone promising to recover funds you sent to a scammer. Don't let them blur the two.

Free resources — no payment, no catch

Questions people ask after getting these calls