Just lost crypto? Here's the 15-minute playbook.
Honest, free, no upsell. Most "recovery services" are themselves scams. The real path is fast: freeze, document, report, trace — in that order.
Open the panic guideRecovery-scam warning
If someone DMs you on Telegram, X, Reddit, or YouTube comments promising to recover your stolen crypto — they are a scammer. Real recovery never starts with a stranger's DM. It never asks for upfront fees. It never asks you to connect your wallet to a "recovery dApp". Block and report.
The 4-step playbook
- 1
Freeze (minute 0–5)
Revoke every token approval at revoke.cash. Disconnect every wallet from every dApp. If the seed is compromised, move remaining funds to a brand-new wallet on a brand-new seed — never reuse.
- 2
Document (minute 5–10)
Screenshot the transaction hash, source + destination addresses, the scam URL, any Telegram / WhatsApp / email contact. Save the timestamp. Without this evidence, exchanges and police can't act.
- 3
Report (minute 10–60)
File with ic3.gov (US) / Action Fraud (UK) / your local cybercrime unit. Email the receiving exchange's compliance team directly with the transaction hash and destination address.
- 4
Trace (hour 1+)
Open the destination address on Etherscan / Solscan and follow the funds. When they land on a centralized exchange, that exchange + a law-enforcement request is your freeze path.
Why speed matters
Stolen crypto typically moves through 3–6 intermediary wallets and into a mixer or exchange within 60 minutes. After that, recovery odds drop sharply. If you're still in the first hour, every minute counts — open the panic guide now and report in parallel.
FAQ
Can stolen crypto actually be recovered?
Sometimes — but only through three legitimate channels: (1) exchanges freezing funds before they're cashed out (works if you report within hours, not days), (2) law-enforcement seizure of mixer or exchange accounts, (3) civil court action against an identified person. Anyone promising 'guaranteed recovery' for a fee is running a recovery scam.
How fast do I need to act?
The first 15 minutes matter most. Stolen funds typically move through 3–6 wallets and into a mixer or exchange within an hour. The faster you alert centralized exchanges with the destination address, the better the chance of a freeze.
What is a 'crypto recovery service' and should I use one?
Most 'recovery services' that find you on Telegram, X, Reddit, or YouTube comments are recovery scams — a second scam targeting people who just lost money. Real recovery requires court orders, exchange compliance teams, and licensed forensic firms (Chainalysis, TRM Labs, CipherTrace) — not random DMs offering '100% money back'.
Who should I actually report a crypto theft to?
United States: ic3.gov (FBI) + ftc.gov/complaint. UK: Action Fraud. EU: your country's cybercrime unit + the receiving exchange's compliance email. Australia: Scamwatch. Always file with your local police too — many countries require a police report number before exchanges will share KYC data.
Should I sign anything to 'reverse' the transaction?
No. Blockchain transactions are irreversible. Anyone asking you to sign a 'reversal transaction', connect your wallet to a 'recovery dApp', or pay a 'gas fee to release funds' is stealing the rest of what you have. Disconnect everything and treat that wallet as compromised.
What if the scam was on a centralized exchange?
Open a ticket immediately with the exchange's compliance team (not regular support). Include the transaction hash, your account ID, and the destination address. Most major exchanges (Binance, Coinbase, Kraken, OKX) will freeze funds within hours if they receive a verified law-enforcement request.
Stay one step ahead of the scammers
Weekly digest of the newest crypto scams, drainer wallets, and recovery cons — so you know the playbook before they hit you.
Free · No spam · Unsubscribe anytime · We never sell your email.
Report the scammer too.
Adding the scam to the public registry warns the next victim. Free, anonymous, takes 2 minutes.
Also see: panic guide · spot recovery scams · live alerts