Crypto Recovery Scams: How the Second Theft Works

A person who has lost crypto to a scam is in a specific and dangerous position: they know funds are gone, they have a transaction hash that proves it, and they are searching for anyone who can undo it. That search is the raw material for a second scam. Recovery fraud is not a separate crime from the first theft so much as its sequel. The same victim list, or the same public blockchain record, is used again, this time by someone claiming to be the remedy.

The mechanism is worth understanding before the red flags, because the red flags change and the mechanism does not. A recovery scam works by selling hope of reversal to someone who has already demonstrated willingness to move money to strangers. The fraudster needs the victim to believe two things: that reversal is technically possible for the right specialist, and that the specialist is that person. Neither is true, but the first belief is plausible enough that the second only has to survive a short conversation.

What a recovery scam actually asks for

The approaches arrive by direct message on social media, in the comments of a post about the loss, by email to an address scraped from a support forum, or through a website that ranks for phrases like “crypto recovery company” and “fund recovery service”. The opening claim varies: blockchain investigator, forensic analyst, lawyer specialising in digital assets, employee of a regulator, or a “white-hat” hacker who can front-run the thief. The request that follows is one of a small set.

• An upfront fee. A retainer, case-opening fee, or “recovery deposit”, usually payable in crypto, sometimes by card. Once paid, the case either goes quiet or generates a second fee.
• A “gas” or “unlock” payment. The claim is that the stolen funds sit in a wallet or smart contract that needs a transaction fee, a tax clearance, or a liquidity deposit before release. Each payment unlocks a request for the next.
• Wallet access. A request to connect the victim’s wallet to a “recovery portal”, or to install remote-support software so the “investigator” can look at the wallet. Connecting a wallet to a malicious site can authorise token approvals that drain whatever remains.
• The seed phrase. Framed as necessary to “verify ownership” or to “restore the compromised wallet to a secure recovery address”. No legitimate recovery process requires it, and any request for it is the clearest possible signal that the counterparty intends to take control of the wallet rather than return funds to it.
• Identity documents. Passport or ID copies presented as KYC for the recovery firm. These are collected for later fraud or sold.

A single case often uses several of these in sequence. The first payment establishes that the victim pays; the second is justified by progress; the third by a new obstacle.

Why on-chain transfers are generally not reversible

A confirmed transfer on a public blockchain is a state change that every node has accepted. There is no central help desk that can edit it. Reversal would require the cooperation of a majority of the network’s block production, which does not happen for individual thefts, or a coordinated protocol change, which is reserved for extraordinary events and is not available to a private client at any price.

This is the fact that recovery fraud is built to obscure. It is not that recovery is hard and specialists are expensive; it is that the class of service being sold generally does not exist. A person or firm that could reverse arbitrary on-chain transfers could also rewrite balances at will, which would end the ledger’s usefulness. The economics of the network are the reason the service cannot be offered, not a matter of the right contact or the right fee.

There are narrow exceptions that fraudsters exploit rhetorically. An exchange can freeze deposits to an account it controls if it is notified quickly and chooses to act. A stablecoin issuer can, in some circumstances, blacklist an address holding its token. A court order can compel a custodial intermediary to act. Each of these depends on the funds reaching a custodial chokepoint and on an institution with legal obligations choosing to respond. None of them is a private recovery service, and none of them is guaranteed.

What legitimate routes exist, and what they can do

The honest answer is that the realistic routes are reporting and notification, and their outcomes are uncertain. They are still worth doing, and they are free.

• Report to the police in the jurisdiction where the loss occurred. This creates a record, and in some countries it is a precondition for any later action by an exchange or a financial institution. The police cannot generally reverse a transfer either, but they can issue requests to custodial services and can connect a case to a wider investigation.
• Report to the national fraud reporting body. Most countries have one: the agency that collects fraud reports and may pass them to banks and platforms. Which body applies depends entirely on where the victim is, and the report should be filed there rather than with an international-sounding organisation invented by the fraudster.
• Notify the exchange that received the funds, if the trail shows a deposit to one. Exchanges have compliance teams that handle law-enforcement requests and, in some cases, freeze accounts. They will usually require a police report. They are not obliged to respond to an individual, and they will not return funds on a victim’s word alone.
• Preserve the evidence. Transaction hashes, wallet addresses, chat logs, the fraudster’s payment addresses, and timestamps. This costs nothing and is the only material any later investigation will use.

What these routes cannot do: they cannot promise a return of funds, they cannot act within hours, and they cannot be accelerated by paying anyone. A firm that claims a relationship with a regulator or an exchange that guarantees action is describing a service that does not exist in that form.

Comparison: when a recovery claim does not apply

What people get wrong about recovery scams

The common misdiagnosis is that the victim believes they are being careful because they are skeptical of the first offer and accept the second. A person who has already been defrauded often becomes more, not less, exposed: they have a concrete loss to recover, they have learned that strangers on the internet can be convincing, and they are now looking for a professional. The recovery fraudster’s pitch is calibrated to that state. It uses the vocabulary of the first scam’s aftermath, cites the victim’s own transaction hash, and offers the one thing the victim wants, which is a route back.

This is a natural mistake rather than a stupid one. The victim has correctly identified that a crime occurred and that institutions exist to address crimes. In most areas of life, reporting a theft to a professional who investigates it is exactly the right move. The error is in the assumption that the crypto context preserves that structure, when in fact the absence of reversal is the defining property of the system. The fraudster does not need to overcome skepticism; they need only redirect it toward a different stranger.

A second error is treating a plausible-looking website as evidence of a firm. A site that ranks for recovery terms, lists an address, and shows testimonials is cheap to produce and is not a credential. The relevant question is not whether the firm looks real but whether the service it sells is technically possible, and for reversal of a confirmed transfer the answer is generally no.

Checking a claim without paying for it

A few checks cost nothing and can be run before any money moves. The commands below use a public block explorer’s API; the same information is visible in any explorer’s web interface.

curl -s "https://api.blockcypher.com/v1/btc/main/addrs/<address>/full?limit=50"

This returns the transaction history for a Bitcoin address. If a “recovery firm” claims funds are held at an address, the history shows whether anything is there and when it moved. A claim that does not match the chain is fabricated.

whois <recovery-site-domain>

This returns registration data for a domain. A registration date of weeks or months, rather than years, is consistent with a site built for a campaign rather than an established firm.

dig <recovery-site-domain> MX

This returns the mail exchangers for a domain. A domain with no mail service, or one pointing at a consumer provider, is unusual for an organisation that claims a legal or forensic practice.

None of these checks proves a firm is legitimate. They only catch claims that are contradicted by public data.

Red flags, stated plainly

The strongest signal is a request for payment before any result. A fee to unlock, release or reverse a confirmed transfer pays for something that does not exist, whatever it is called. A request for a seed phrase, a wallet connection, or remote access to a device is disqualifying on its own; there is no legitimate recovery step that requires any of them. Urgency is another: deadlines, “your case expires”, or a claim that funds will be moved if payment is not made today. Impersonation of a regulator or an exchange is common, and the check is to contact that institution through its own published channel rather than a number or address supplied by the caller.

A final pattern is the approach that arrives unsolicited and already knows the details of the loss. Public blockchains are public; anyone can read a victim’s transaction history and quote it back. Knowledge of the loss is not evidence of an investigation.