In This Article
The first call I take from a new victim is almost always within hours of them realizing what happened. They're shaking, they can't think straight, and the first thing they want to do is message the scammer one more time. Don't do that.
What you do in the next 24 hours has more impact on what's actually recoverable than anything else you'll do. Bank wire recalls, exchange freezes, evidence preservation, forensic tracing, law enforcement reports. All of it has a clock running, and some of those clocks expire in hours, not days.
Here's the exact sequence I tell victims to follow, in order, when they call me in panic.
Time is extremely critical. Read the immediate steps section first, then come back to this article. Bank wire recalls and exchange intervention windows close fast — sometimes within hours.
Why the First 24 Hours Are Critical
Scammers move fast. The second your USDT or BTC lands in their wallet, automated sweepers fire. The funds get split across wallets, converted, bridged, routed. On Tron I've watched it happen in 4 to 7 hops in under an hour. On Ethereum it can be even faster when the gas is right.
The blockchain itself doesn't forget. The trail is permanent and I've traced cases that were a year old and still found useful endpoints. But from a practical recovery standpoint, the first 24 to 72 hours are a different game because three specific clocks are running:
- Bank wire recalls. If you wired cash to a bank or to an exchange before sending the crypto out, your bank has roughly a 24 to 72 hour window to attempt a recall before the funds clear. After that the wire is gone, regardless of fault. Most victims I work with miss this window because nobody told them to make the call. The first 72 hours checklist walks through the full sequence.
- Exchange freezes. If the scam wallet eventually deposits to a compliant exchange and you report it quickly, the compliance team there can sometimes freeze the account before withdrawal. Not guaranteed, and not every exchange responds the same. But I've had cases where a same-day notification preserved the funds long enough for a subpoena to land.
- Evidence rots. Platform URLs go dark within days. WhatsApp accounts get deleted. Telegram channels get nuked. The screenshot you take today captures what next week's screenshot might not. Take everything now, even the stuff you think is obvious.
Immediate Steps, the First 60 Minutes
Do these in order. Don't skip ahead. And do not contact the scammer first, no matter what you think saying one more thing will accomplish.
Stop All Contact and Stop Sending Money
Cut off contact with the scammer completely and immediately. Do not respond to messages. Do not send any additional funds for any reason — not to pay a "tax fee," not to "unlock" your account, not to "verify" your identity. Every additional payment is pure theft. The platform is fake. Your balance is a number in a database. No fee will release it.
Call Your Bank If Any Fiat Wire Transfers Were Involved
If you sent money from your bank account — via wire transfer, ACH, or Zelle — to purchase cryptocurrency or to the scammer directly, call your bank's fraud department immediately. Ask specifically about a wire recall or reversal. Be direct: "I was scammed and need to recall a wire transfer." Give them the date, amount, and destination account. The window for this is narrow — sometimes 24 hours, rarely more than 72. After that, it is almost certainly gone.
Secure Your Accounts
Change passwords for any accounts the scammer may have had access to — email, financial accounts, cryptocurrency exchanges, social media. Enable two-factor authentication everywhere it's available. If you shared your screen with the scammer at any point, assume they have seen your login credentials and act accordingly. Check for any devices or sessions still logged in to your accounts and revoke them.
Screenshot and Document Everything — Before It Disappears
Scammers deactivate platforms, delete accounts, and vanish within hours of the final payment. Document everything now, before it's gone. The more complete your documentation, the stronger your position for every subsequent step.
- Every conversation thread (WhatsApp, Telegram, text, email, dating app)
- The scam platform — URL, login screen, portfolio screen, withdrawal error
- Any website, app, or domain used
- Profile photos of the scammer
- Any phone numbers, email addresses, or usernames used
- Your exchange transaction history showing every outgoing transfer
How to Preserve Evidence Properly
Evidence preservation isn't just taking a few screenshots. Half the cases that come across my desk are missing the one piece of evidence we actually need, usually because the victim screenshotted the wrong page or the platform went dark before they captured the URL. To make your documentation actually useful in a forensic trace, a law enforcement report, or a civil filing, here's exactly what to capture and how.
Transaction Records
These are the most critical piece of evidence. Every cryptocurrency transfer has a permanent record on the blockchain, but you need to capture your side of it from your exchange or wallet.
Communication Records
Export or screenshot full conversation histories, not just highlights. In legal proceedings, the full context matters — including the trust-building phase, the introduction of the investment opportunity, and any pressure tactics used. For apps that allow export (WhatsApp, Telegram), use the built-in export function to get a complete log rather than individual screenshots.
Platform and Domain Records
Take full-page screenshots of the fake investment platform — homepage, login page, portfolio/dashboard, and the withdrawal page where you were blocked. Note the full URL and any app store listings. Run a WHOIS lookup on the domain (who.is) and screenshot the results — this captures registration data that may disappear if the scammer deletes the domain.
Identity Artifacts
Anything the scammer sent you that implies an identity — photos, video screenshots, business cards, documents, company names, "trading licenses" — keep all of it. Profile photos from social media can be run through reverse image search to identify the real person whose photos were stolen.
Create a single folder on your computer, label it with the date, and consolidate every piece of evidence into it. Include a plain-text notes file with a timeline of events in chronological order — when first contact was made, when crypto was first mentioned, each transfer date and amount. This document becomes the foundation of any law enforcement report or forensic investigation brief.
Where and How to Report the Fraud
Let me be direct: filing a report doesn't get your money back. Nobody from IC3 is going to call you next week with a check. What reporting actually does is create an official paper trail, feed your wallet addresses into investigations that are already running, and unlock options like insurance claims or civil suits later. It's not pointless. It's just not recovery. Treat it as the foundation step, not the answer.
FBI Internet Crime Complaint Center (IC3) — ic3.gov
This is the most important report to file if you are in the United States. The IC3 is the FBI's central intake for internet-based financial crime. They share intelligence across federal agencies, and large cryptocurrency fraud cases — particularly pig butchering operations — are actively investigated at the federal level. Your report contributes to cases that are already in progress. File at ic3.gov. Include all transaction hashes, wallet addresses, platform URLs, and communication records.
Federal Trade Commission (FTC) — ReportFraud.ftc.gov
The FTC tracks fraud trends across the country and uses complaint data to identify and pursue large-scale operations. Filing a report here is straightforward and takes about 15 minutes. The FTC also publishes consumer alerts based on complaint trends, which indirectly protects future victims.
Your State Attorney General
Many state attorneys general have cybercrime units that accept cryptocurrency fraud reports. Some have been more aggressive than federal agencies in pursuing crypto fraud cases. Find your state's consumer protection office at naag.org.
Your Local Police Department
File a local police report even if you expect little action. A police report number creates an official record that is often required by insurance companies, banks, and civil attorneys. When filing, bring your documented evidence folder — the more specific you can be (transaction hashes, wallet addresses, platform URLs), the better the report will be.
The Cryptocurrency Exchange(s) Involved
If you can identify which exchange the scammer was using to receive or liquidate funds, report the wallet addresses directly to that exchange's compliance or fraud team. Coinbase, Binance, Kraken, and others have compliance teams that respond to law enforcement requests and, in some cases, to direct victim reports. This is a long shot for immediate action but costs nothing and occasionally results in account flagging.
Contacting Your Bank and Exchanges
Your Bank
Beyond the wire recall attempt (covered in the immediate steps), your bank's fraud department should receive a full notification of what occurred. Provide the complete timeline, amounts, and destination accounts. Ask specifically:
- Whether any wire recall or reversal is still possible
- Whether a Suspicious Activity Report (SAR) will be filed
- Whether your account needs additional security measures
- For a written confirmation of your fraud report for your records
Your Cryptocurrency Exchange
Contact the exchange you used to purchase and send cryptocurrency. Report the fraud and provide the wallet addresses you sent to. Ask whether those addresses are flagged in their system. Also request a complete transaction history export — formatted with transaction hashes — for your records.
Starting a Blockchain Forensic Investigation
Once the urgent stuff is handled, the next move is a forensic trace. This is what I do. It's the step that tells you where the money actually went and which exchanges are now holding it under a real person's KYC. Without that, every "report to the FBI" or "talk to a lawyer" hits a wall because there's no target to point at. Here's what actually happens inside a forensic investigation at each stage.
What I do in a trace is follow the money out of your wallet, through every hop, split, swap, bridge, mixer attempt, and consolidation, until it lands somewhere actionable, usually a centralized exchange deposit. The output is a written report with the transaction hashes, the wallet addresses, the methodology, and the endpoint. That report is what your attorney or law enforcement contact uses to send a subpoena, or what your insurance carrier needs to process a claim.
The on-chain part doesn't expire. The blockchain is permanent and I've traced cases that were a year old. But the off-chain stuff (platform pages, WhatsApp threads, exchange records before they get aged out) does. The sooner we start, the more complete the picture.
Learn what a crypto scam investigation covers →
Warning: The Recovery Scam Is Already Targeting You
This section is probably the most important thing in the entire guide.
Within hours, sometimes minutes of getting scammed, someone is going to contact you claiming they can get your money back. They'll find you on the same platforms the original scam happened on, or through Reddit threads, or in scam-victim Facebook groups, or by scraping public complaint boards where you posted what happened. They'll call themselves blockchain investigators, ethical hackers, recovery specialists, or legal liaisons.
It's the same crew, or a partner crew, hitting you a second time.
The recovery scam exists because the victim pool just got created. You're emotionally cooked, desperate for a solution, and you'll click on someone who says the right words. They ask for an upfront fee, sometimes called a "tax" or a "smart contract gas fee." Some string victims along for weeks across multiple payments before vanishing. The worst ones get you to share wallet credentials during the "investigation" and clean out anything you have left.
Unsolicited contact offering recovery services. Guaranteed recovery promises. Upfront fees before any work is done. Requests for your private keys, seed phrase, or remote access to your device. Pressure to act quickly. No verifiable identity, website, or professional history. Any of these signals means walk away immediately — you are being targeted for a second theft.
A legitimate blockchain forensic investigator will give you a free initial consultation, provide a clear scope of work before any payment, never guarantee recovery, and never ask for your private keys or seed phrases under any circumstances.
The Emotional Reality of Crypto Fraud
Most guides on crypto scams skip this part. They shouldn't.
Cryptocurrency fraud — particularly pig butchering and romance-based investment scams — causes a level of psychological trauma that is qualitatively different from most financial crimes. The victim didn't just lose money. They lost a relationship they believed was real. They made decisions based on trust that was manufactured and weaponized against them by professionals. Many victims also carry significant shame, which makes them less likely to report, less likely to seek help, and more vulnerable to a recovery scam that offers a way to "fix" what happened quietly.
Being defrauded by a professional criminal operation is not a reflection of your intelligence. The people behind these scams are trained, scripted, and experienced. They are effective against people of all backgrounds, income levels, and education. The FBI's own data shows that the most targeted demographic for investment fraud is not the elderly — it is adults between 30 and 60 with above-average financial literacy and disposable income.
If you're struggling with the aftermath, the FINRA Investor Education Foundation and Global Anti-Scam Organization (GASO) both offer support resources specifically for investment fraud victims.
Summary: Your 24-Hour Checklist
- Stop all contact with the scammer — do not send any additional funds
- Call your bank immediately if fiat wire transfers were involved
- Change passwords and secure all accounts
- Screenshot and document everything before it disappears
- Collect all transaction hashes and wallet addresses
- File a report with IC3 (ic3.gov) and the FTC
- File a local police report for an official record number
- Report to your exchange's fraud team
- Begin a forensic investigation while the evidence is fresh
- Be on guard for recovery scammers — they are already looking for you
Frequently Asked Questions
What should I do first after realizing I've been scammed in crypto?
Stop all contact with the scammer and stop sending money — including any "tax," "unlock," or "verification" fees. Then call your bank's fraud department immediately if any wire transfer was involved, since wire recalls have hard windows of 24–72 hours. Change passwords on every account the scammer may have had access to. Then screenshot every conversation, platform URL, and transaction record before they disappear.
Can I reverse a crypto transaction after a scam?
No. Confirmed cryptocurrency transactions are permanent and cannot be reversed by anyone — not the network, not law enforcement, not the exchange. However, recovery is still possible through other paths: bank wire recall (if the funds left your bank by wire transfer to buy crypto), exchange account freezes (if the scammer's exchange account is identified quickly), and civil legal action against identified defendants. Forensic tracing makes those paths possible.
How long do I have to report a crypto scam?
There is no statute of limitations on filing a report — you can file with IC3, the FTC, or law enforcement at any time. But specific recovery actions are time-sensitive. Bank wire recalls typically work only within 24–72 hours. Exchange compliance freezes are most effective in the first few days while funds are still in the destination account. Forensic evidence (platform URLs, scammer accounts) degrades rapidly. Speed matters even though there is no formal deadline.
Will the FBI investigate my crypto scam?
The FBI rarely directly contacts individual victims, but your IC3 report contributes to investigations the bureau is already running. IC3 cross-references reports against active cases — including pig butchering operations and the SE Asia compounds — and patterns of activity drive enforcement. Cases with detailed forensic evidence (transaction hashes, exchange deposit addresses, screenshots) are far more likely to surface in active casework than narrative complaints alone.
Should I pay the "tax" or "unlock" fee my crypto platform is asking for?
No. Real cryptocurrency exchanges never charge a "tax," "verification fee," "unlock fee," or "compliance fee" to release your own funds. If a platform is demanding any payment to let you withdraw, it is a scam — your balance is a number in their database, not real cryptocurrency you can recover by paying more. Every additional payment goes straight to the scammer. Stop paying immediately.
What evidence should I preserve after a crypto scam?
Transaction hashes (TXIDs) for every transfer you made, the wallet addresses you sent funds to, exact dates and amounts, full conversation histories (export from WhatsApp/Telegram if possible, not just screenshots), screenshots of the scam platform (URL, login, dashboard, withdrawal error), all communication metadata (phone numbers, emails, usernames), profile photos used by the scammer, and your exchange's full transaction history export. Organize everything into one folder with a chronological timeline document.
Is the recovery service that contacted me real?
Almost certainly not. Within hours or days of a crypto scam, victims are typically contacted by "recovery services" on Telegram, social media, email, or victim forums. These are second-wave scams targeting the same victim pool. Real blockchain forensic investigators do not cold-DM victims, do not promise guaranteed recovery, do not ask for upfront fees, and never request your private keys or seed phrases. Any contact violating these rules is a scam. See how to spot a fake recovery service for the full red-flag list.
How much does a blockchain forensic investigation cost after a scam?
Initial case assessments from legitimate firms are free. Full investigations typically range from $500–$1,200 for simple single-chain traces, $1,200–$3,500 for standard multi-hop cases, and $4,000–$10,000+ for litigation-grade reports with expert witness preparation. Most firms scope and quote before any retainer. Avoid any service charging large upfront fees without a documented scope. See our full cost breakdown.
Just Got Scammed? Start Here.
Initial case assessments are free. Tell us what happened — we will scope what forensic tracing can do, identify your legal options, and respond within 24 hours.
Start a Free Case Review