What you seeMy crypto was just stolen and now someone says they can recover it
Someone Offers to Recover Your Stolen Crypto: How to Tell It's a Second Scam
Your coins just left the account. The thing you most want to hear is “we can get it back.” Recovery scammers aim at exactly that moment. In November 2022, after a major crypto exchange collapsed and wiped out a lot of investors, the US Federal Trade Commission (FTC) put out a consumer alert. Its title is the advice: Worried about crypto exchange losses? Don’t pay money for “help” recovering money.
Check three things about the message in front of you. Did they reach out to you first? Do they want money before they do anything? Do they promise you’ll get it back? One yes is enough to stop the conversation. As for whether these people can actually recover anything, the FTC alert answers in a bracket: “(Spoiler alert: they can’t.)”
How do they know you just lost money?
The FTC’s Refund and Recovery Scams page calls these “the worst of the worst”, because they go after people who have already been scammed once. The page lays out the usual pattern.
Scammers keep what they call a “sucker list”. It holds names, addresses and phone numbers of people who have paid scammers, plus the kind of scam that got them and how much they paid. Scammers buy, sell and trade these lists, on the theory that someone scammed once is a good target for a second round.
Then the contact comes. A call, an email, a text, a social media message or a letter, saying they’ll get back what you lost. The FTC adds that you don’t even need to know you were scammed. Using the bought information, they can build a believable story and “helpfully” tell you about the earlier fraud.
Knowing the platform and the amount you lost does not prove they can help. The FTC describes traded victim lists as one way scammers get those details; you cannot tell from the message how this sender obtained them.
The disguise varies. The FTC lists a government agency, a consumer advocacy group, a law firm, or some other organization. Some pretend to be the same company that took your money and say they’re refunding “dissatisfied customers”. Some claim they’re holding money for you, offer to file complaints with government agencies on your behalf, or say they can move your name to the top of a reimbursement list. The FTC’s verdict: whatever they say, it’s a lie designed to gain your trust, and your money. If the person claims to be exchange support, run the call or DM through fake Binance support calls and DMs.
B-01On screenThey sent an official-looking authorization letter with a stamp or seal
Posing as a government body, a company or another organization is a tactic both FTC pages name. A stamped document doesn’t change that. The crypto alert puts it plainly: contacting you to recover your money is not how government agencies work, and no legit company or organization will contact you about getting your money back.
To check, the FTC says to look up the agency’s number on your own and call to confirm they contacted you. Don’t use the number they gave you or the one on your caller ID. Also search the organization’s name online with “complaint”, “scam” or “review”. Until you’ve done that, leave every signature line, payment field and account-details box in that document empty.
Four signs the FTC names: check your message against them
The FTC is the US federal consumer protection agency. Two of its pages, as they read in November 2026, are the source for this section: Worried about crypto exchange losses? Don’t pay money for “help” recovering money and the Refund and Recovery Scams page linked above. Whether the sender calls themselves a hacker, a tech team or an agency, the same four signs apply.
They want money first. The FTC leaves no room here. However someone unexpectedly contacts you, by mail, online, phone, social media or text, if they ask for an upfront fee, it’s a scam. The label changes. The page lists “retainer fee”, “processing fee”, “administrative charge”, “tax” and “shipment and handling charge”. In a crypto recovery pitch it reads as “send a deposit before we start”. Service fee, gas fee, security deposit: same sign.
They guarantee you’ll get it back. The FTC says government agencies and legitimate organizations will not guarantee that you’ll get your money back. “100% recovery” is such a guarantee. “No recovery, no fee” describes when a fee is due; by itself, it neither guarantees recovery nor proves the service is trustworthy.
They ask for your account details. The crypto alert says scammers ask for your financial information so they can “put those lost funds back into your account”. The refund page gives examples: Social Security number, checking, debit or other financial account numbers. Hand them over and the money disappears, and your identity can be stolen too. The crypto version sounds like “send us your account info and we’ll return the funds the same way.”
They tell you how to pay: gift cards, crypto or wire. The crypto alert says only scammers will tell you to pay by gift card, cryptocurrency or wire transfer, and calls it a sure way to know you’re dealing with one. The refund page’s list is longer: cash, gift cards, crypto, wire transfers through Western Union or MoneyGram, or a payment app. In practice: “send the USDT to this address.”
B-02On screenWe've traced your funds. Pay the release fee and they'll be unfrozen
That message hits the “money first” sign. If they want the fee in crypto, it hits the payment sign as well. “Release fee”, “unlock fee” and “tax” are just names. Processing fees and tax are already on the FTC’s list of upfront charges.
They may quote your transfer’s exact amount and the address it went to. That proves nothing either. The FTC’s What To Know About Cryptocurrency and Scams page says crypto transactions are typically recorded on a public ledger, the blockchain. Depending on the chain, that can include the amount and the sender’s and recipient’s wallet addresses. Anyone can read it. No special access needed.
Don’t pay. Don’t reply. Screenshot the chat and keep it for your police report.
What a real agency or company won’t do
The FTC refund page is specific. Government agencies and legitimate organizations will never ask for money to help you get a refund. They will never ask for your financial account numbers or other personal information. They will not guarantee you’ll get your money back. Anyone who does any of these things, the FTC says, is a scammer.
The FTC itself gets impersonated. Its own example is someone claiming to be from the Federal Trade Commission and asking for payment or personal details. And the crypto alert adds that no legit company or organization will contact you about getting your money back. You didn’t go looking, and they showed up anyway. That alone is a signal.
Stolen or scammed crypto: what you can do yourself
None of this needs a helper, and none of it costs anything up front.
- Keep evidence. The transaction hash (TxID), your sending address, the receiving address, the time of the transfer, and every message with the other person. Screenshot their profile and any links they sent. Keep the “we can recover it” messages too. Don’t delete them.
- Contact the exchange. If the coins left an exchange account, contact that exchange. The FTC’s crypto page lists “the cryptocurrency exchange company you used to send the money” as one of the places to report. If the receiving address belongs to an exchange too, contact that one as well. Find support only through the exchange’s official website or app, never through a link or number someone sent you.
- Report it to police. Bring what you gathered in step 1.
- If you’re in the US, the FTC also lists: ReportFraud.ftc.gov, your state attorney general, and for crypto the Commodity Futures Trading Commission (CFTC.gov/complaint), the Securities and Exchange Commission (sec.gov/tcr) and the FBI’s Internet Crime Complaint Center (ic3.gov/Home/FileComplaint). Those are US channels. Elsewhere, go through your local police and financial regulator.
Be ready for this: you can do all of it and still not get the coins back. The FTC’s crypto page says payments typically aren’t reversible, and you can usually only get money back if the person you paid sends it back. If your digital wallet is stolen or compromised, you’re “likely to find that no one can step in to help you recover your funds.” Why report, then? The refund page answers: it helps law enforcement stop these scammers and warns others in your community.
Did the coins move because someone got into your email or exchange account? Treat that access as an ongoing risk. Use the exchange’s official support to secure the account while you recover the email; the order depends on which account you can still access. See email hacked and linked to Binance.
B-03On screenI already paid them a fee
Act fast. The FTC refund page says the sooner you act, the better, and its section “How To Get a Refund If You Already Paid a Scammer” covers ways to try to stop the transaction, get it reversed or get a refund.
If you paid in crypto, go back to step 2 and contact the official support of the exchange you sent it from. In the US, the FTC says to report refund and recovery scam losses to ReportFraud.ftc.gov and your state attorney general.
Whatever they say next, don’t send a second payment. In the FTC’s words: if you do, you’ll lose more money. If you gave them account details, change that account’s password and its two-factor method now.
Is a lawyer or a forensics firm a “recovery service” too?
The two FTC pages don’t rule on legitimate lawyers or blockchain forensics firms. They warn that scammers pose as law firms and demand advance payments for supposed refunds. These pages do not establish the payment rules for legal advice you seek independently.
Ask what the proposed work actually is: documenting transactions, advising you on a complaint, or promising to return the coins. A tracing report can describe where funds went without giving its author control over them.
Here you have to choose, and the safer choice is to hire no one rather than someone who approached you. If they came to you, you can’t check them with the phone number, website or credentials they supplied; those can be invented together. And per the crypto alert, no legit company contacts you about getting your money back, so reaching out first already matches one sign. If you want advice, find the firm yourself and run the FTC’s check: search its name with “complaint”, “scam” or “review”, and in the US ask your state attorney general whether people have complained. If the talk turns to paying first and guaranteed recovery, stop right there.
What to do with the “we can recover it” message on your screen
Don’t reply. Don’t tap any link in it. Screenshot the message along with the sender’s account or number and add it to your evidence from step 1. In the US, report it to ReportFraud.ftc.gov as well. Then report the sender on the platform where the message arrived, and block them.
Short answers
Can stolen crypto be recovered at all?
Sometimes, but don't count on it. The FTC's page What To Know About Cryptocurrency and Scams says crypto payments typically are not reversible, and you can usually only get your money back if the person you paid sends it back. Save the transaction hash, the addresses and the chats, contact the official support of the exchange you sent from, and report it to police. Even after all that, the coins may stay gone.
A hacker says he can trace my USDT but needs a fee first. Should I pay?
No. The FTC's Refund and Recovery Scams page says that if someone contacts you unexpectedly and asks for an upfront fee, that's a scammer. Government agencies and legitimate organizations won't charge you to help get a refund and won't guarantee you'll get your money back. A fee, an unlocking charge or a tax is the same request under another name.
What about a lawyer or a blockchain forensics firm?
The FTC doesn't rule on legitimate lawyers or forensics services. It does say scammers pose as law firms, and it says never to pay upfront for a refund or help with a refund. If you consult anyone, find them yourself and check them yourself. Skip anyone who approached you. If they want payment first and promise a result, stop there.
Filed under these lines
T-10ScamsT-8Account restrictions