Crypto Recovery Scam

RECOVERY-FRAUD Last fact-checked: April 18, 2026

▲ SCAM PROFILE

A parasitic follow-up scam in which fraudsters target people who have already lost money to cryptocurrency fraud (most often pig butchering, fake investment platforms, or rug-pull tokens). The 'recovery agent' — variously styled as a crypto investigator, blockchain forensic analyst, attorney, or ex-FBI consultant — promises to trace and recover the lost funds for an upfront fee. No funds are ever recovered; the fee is simply a second harvest from the same victim. The FBI IC3 published a dedicated 2023 public service announcement ('Increase in Companies Falsely Claiming an Ability to Recover Funds Lost in Cryptocurrency Investment Scams') warning of rapid growth in this category, and it remains on the IC3's active advisory list in 2024-2025.

How the scam works

Step 1 — Identifying the victim. Crypto-recovery scammers find their targets through several channels:

Leaked victim lists from prior scam operations (pig-butchering rings frequently share databases or sell victim lists to adjacent operations)
Social media posts by victims describing their loss (Reddit r/Scams, Twitter, Telegram groups)
Cold outreach via email, Telegram, or WhatsApp to addresses previously associated with crypto wallets
Replying to victim comments on news articles about crypto fraud

Step 2 — The cold outreach. The scammer contacts the victim with a variant of:

'Saw your post about losing $X to a pig-butchering platform. I work with a crypto recovery firm. We recovered a similar case last month. Interested?'
'Hi, I'm an ex-FBI cyber investigator who now helps crypto-fraud victims. Read about your case. We can trace the funds through blockchain analysis.'
'You lost money to [specific fake platform]? We have the wallet addresses already mapped and are coordinating with exchanges to freeze them. Act fast.'

The outreach is deliberately targeted — naming the specific fake platform or approximate loss amount lends credibility.

Step 3 — The credibility building. The scammer provides:

A professional-looking website (dead giveaway: domain younger than 6 months, no real team page, no verifiable track record)
Fake testimonials from 'prior recovered victims' (stock photos, fake reviews)
A 'case file' showing wallet addresses, exchange deposit records, supposed 'tracing' done on your funds
Claims of partnerships with Chainalysis, TRM Labs, or named law enforcement agencies
A 'consultation' or 'initial assessment' — often free — to build trust

Step 4 — The upfront fee. To 'begin the recovery process', you must pay:

A 'retainer' — typically $500 to $5,000
'Gas fees' to interact with the recovery wallet smart contract
'Exchange coordination fees' to unfreeze funds once located
'Legal filing fees' for court orders to freeze wallets
'Blockchain analysis fees' for tracing reports

Step 5 — Escalation. After the first payment, more fees arise. 'We found the funds but need a $3,000 court filing fee to release them.' 'The exchange requires a $5,000 bond to release your balance.' Each is framed as one last step.

Step 6 — The exit. Eventually the victim runs out or catches on. The scammer disappears. Some operations keep the case open indefinitely, extracting $500-$2,000 every few months until the victim stops.

Why it works

Crypto-recovery-scam victims are uniquely vulnerable because:

They are grieving a prior loss and grasping at any hope of recovery.
The original scam was sophisticated, so a second sophisticated operation feels plausible.
Blockchain forensics is real — firms like Chainalysis and TRM Labs do legitimately help law enforcement trace funds — which makes the fake versions hard to distinguish from real service.
The first scammer may even refer the victim to the 'recovery' scammer as part of the same coordinated double-harvest.

The honest reality of crypto recovery

Legitimate crypto recovery is extremely rare and works through a narrow set of channels:

Exchange-side freezes. If the scammer deposited funds into a KYC-compliant exchange (Binance, Coinbase, Kraken), and you report quickly with wallet addresses and transaction hashes, the exchange may freeze the account pending a law-enforcement subpoena.
Law-enforcement civil forfeiture. In rare cases, DOJ or FBI seizes crypto from mixers or wallets and returns funds to identified victims. This is a multi-year process and you cannot initiate it yourself.
Chainalysis / TRM Labs. These firms do blockchain tracing but do not work directly for individual victims — they contract with law enforcement, exchanges, and corporate clients. No legitimate Chainalysis employee will cold-contact you.

No private 'recovery agent' can force a foreign exchange, decentralized wallet, or mixer to return your funds. If your crypto has moved through Tornado Cash, a foreign non-KYC exchange, or into fiat through a foreign off-ramp, recovery is essentially impossible regardless of what any 'service' claims.

Common red flags

Upfront payment required to 'begin' recovery
Claims of partnerships with government agencies (FBI, DOJ, IRS)
Guarantees of success ('We have never failed a case')
Domain registered in the last 3-6 months
Contact through Telegram, WhatsApp, or encrypted channels instead of established business email
Pressure to act fast before 'the funds move again'
Requests for your private keys, seed phrases, or wallet passwords (never share these with anyone — ever)

Financial exposure

Crypto-recovery scams are not a discrete category in the FBI IC3 annual report — losses are rolled into the broader Investment Fraud and Advance Fee categories ($4.57 billion and $134.5 million respectively in 2023). FBI advisories and FTC consumer alerts describe typical per-victim additional losses of $2,000 to $25,000 on top of the original scam, with outlier cases exceeding $100,000 across multiple sequential 'recovery firms'.

Sources

FBI IC3 PSA: Companies Falsely Claiming Ability to Recover Lost Crypto (2023)
FBI 2023 Internet Crime Report — Investment fraud and Advance Fee category totals
FTC Consumer Sentinel Network Data Book 2023 — Cryptocurrency payment method $1.41B (page 11)
FTC Consumer Alert: Avoiding cryptocurrency recovery scams

Warning signs

Red flags — stop the call if you see any of these

Cold outreach (email, Telegram, WhatsApp, Twitter DM) from someone claiming to help recover your crypto
Knowledge of your specific prior scam, platform name, or loss amount — this was sold or shared between operations
Upfront fee required before any recovery work begins
Claims of partnership with FBI, DOJ, Chainalysis, TRM Labs, or foreign law enforcement
Guarantees of success or specific success rates ('98% recovery rate', 'We've recovered $50M')
Website domain registered recently (check whois lookup — if under 6 months old, major red flag)
No verifiable track record, no real LinkedIn team members, no licensed attorneys listed
Requests for your wallet private keys, seed phrase, or exchange passwords — no legitimate service ever asks for these
Pressure to act fast before funds 'move to a non-recoverable wallet'

What to do if you've been targeted

Action steps

Do not engage with any inbound recovery offers. Treat all cold outreach as scam by default.
Never share your wallet private keys, seed phrase, or exchange passwords with anyone, ever.
If you have lost crypto, report to the real channels: FBI IC3 (ic3.gov), FTC (reportfraud.ftc.gov), and the exchange you used (they have fraud teams).
Submit wallet addresses to Chainalysis Reactor or TRM Labs public reporting forms — they use victim reports to feed law-enforcement investigations, but will not contact you directly.
Check any recovery firm's claims: look up the domain's whois registration date, verify any claimed law-enforcement partnership (call the agency directly), verify attorneys through state bar websites.
If you have already paid a recovery scammer, stop further payment, gather documentation, and report.
Join legitimate victim-support communities (r/Scams on Reddit has moderators experienced in recovery scams) — they can help identify specific scammer operations.
Accept, eventually, that most crypto lost to scams is not recoverable. This is painful but protects you from the second harvest.

How to report

Report to FBI IC3 at ic3.gov — they maintain the Virtual Asset Exploitation Unit which tracks crypto fraud operations including recovery-scam rings. Report to FTC at reportfraud.ftc.gov. If the recovery scammer impersonated a specific firm (Chainalysis, a law firm, an agency), report to that firm's fraud email. State securities regulators (through NASAA at nasaa.org) also track investment-related fraud.

Statistics

Crypto-recovery scams are not a discrete category in the FBI IC3 annual report — losses roll into Investment Fraud ($4.57 billion in 2023) and Advance Fee ($134.5 million in 2023). For context on crypto-facilitated fraud more broadly: FTC Consumer Sentinel 2023 reported $1.41 billion in fraud losses where cryptocurrency was the payment method (across all scam categories), second only to bank transfers ($1.86 billion). The FBI IC3 issued a dedicated 2023 public service announcement (Alert I-080923) documenting rapid growth in recovery fraud targeting prior crypto victims. FBI and FTC advisories describe typical per-victim additional losses of $2,000 to $25,000 on top of original scam losses, with outlier cases exceeding $100,000 across multiple sequential 'recovery firms'. Under-reporting is significant because victims are often embarrassed after being scammed twice. Source: FTC Consumer Sentinel Network Data Book 2023, page 11; FBI IC3 2023 Internet Crime Report.

Country codes most associated with this scam

These country codes appear most frequently in crypto recovery scam reports. Scammers rotate origins constantly — treat this as historical context, not a whitelist.