Recovery Scams: The Second Theft
Anyone who contacts a victim offering to recover stolen funds is running a follow-on fraud. There are no exceptions to this.
Priya Raman · 2 min read
After a loss, victims are approached by people offering to trace and recover the funds. Every unsolicited approach of this kind is fraudulent.
This is the most reliable rule on this site and it is the one victims most often disregard, for reasons that are entirely understandable.
How they find victims
Public posts. Anyone posting about a loss is identified within minutes.
Victim lists. Operators of the original scam sell or reuse their contact lists. The people who fell for one attempt are the best possible targets for another.
Monitoring reports. Comment sections of news coverage, forum threads, and complaint sites.
The pitch
Several formats, all ending the same way.
A recovery service claiming specialist blockchain analysis capability, requesting an upfront fee.
A fake law enforcement or regulatory contact claiming funds have been seized and can be returned after payment of a processing fee or tax.
A hacker for hire offering to retrieve funds from the thief.
A fake exchange representative claiming the funds were traced to their platform and can be released after verification, which requires a deposit or a recovery phrase.
Why victims engage
Because the alternative is accepting a total loss, and the approach arrives when that acceptance is hardest.
The approaches are also professional. They reference details of the original loss, obtained from the public post or from the original operator. That specificity is persuasive and it is the strongest indication that the two operations are connected.
The rules
Nobody legitimate contacts a victim. Law enforcement does not cold-call about recovered funds. Exchanges do not proactively message individuals. Analysis firms do not solicit.
No legitimate recovery requires an upfront payment to you personally. Legal firms that handle asset recovery work on contract, through identified entities, for cases of a size that justifies it, and they do not find you.
No recovery process ever requires a recovery phrase. Under any circumstances, for any reason.
Blockchain transactions are not reversible by anyone. No service can undo one. Tracing is possible; reversal is not.
What can actually be done
Report to your national fraud body. Reports build cases that occasionally reach prosecution.
Contact the receiving exchange. If the funds moved to a labelled exchange deposit address, that venue’s compliance team can sometimes freeze them if contacted quickly. This is the only realistic recovery route and it works in a minority of cases.
Venues with a real compliance function, such as platforms with a real complaints process, have a documented channel for this. Speed matters enormously.
Document everything. Hashes, timestamps, addresses, screenshots. Required for any report.
Report the addresses to chain analysis databases, which feed exchange screening.
The hardest part
Accepting the loss is the correct action in most cases, and it is the one nobody wants to take.
The recovery scam exists precisely in that gap. Its entire business model is the reluctance to accept a loss, which is why it targets people who have just experienced one.
Move any remaining funds to a wallet with a newly generated seed phrase before anything else. Then revoke token approvals, and report the incident to your local authorities and the exchange involved. Do not pay anyone who promises to "recover" your coins. That is a second scam, aimed at victims of the first.