In This Article
The moment you realize you've been scammed is one of the worst moments of a person's life. The instinct is to freeze, to panic, or to keep trying to reach the platform or "contact" who defrauded you. All of those responses cost you time you don't have.
What you do in the first 24 hours after a cryptocurrency scam has a direct impact on every option available to you afterward — forensic tracing, law enforcement reporting, bank intervention, civil action, and exchange disclosure requests. Every hour that passes, evidence degrades, funds move further, and doors close.
This guide gives you the exact sequence of steps to take, in order, right now.
Time is extremely critical. Read the immediate steps section first, then come back to this article. Bank wire recalls and exchange intervention windows close fast — sometimes within hours.
Why the First 24 Hours Are Critical
Cryptocurrency scammers operate with speed and precision. The moment your funds arrive at their wallet, an automated system begins moving them — splitting across wallets, converting between assets, and routing toward exit points. This process can unfold in under an hour on fast networks like Ethereum or Tron.
From an investigative standpoint, the chain of custody doesn't disappear — the blockchain is permanent. But from a practical recovery standpoint, time matters for three specific reasons:
- Bank wire recalls have hard deadlines. If you sent a domestic wire transfer to purchase crypto before sending it to the scammer, your bank has a narrow window — often 24–72 hours — to attempt a recall before the funds clear. After that window, they cannot intervene.
- Exchanges can freeze accounts if notified promptly. If the scam platform or a known scammer's account is on a compliant exchange and you report it quickly, the exchange's compliance team may be able to freeze the account before funds are withdrawn. This is time-sensitive and never guaranteed, but it does happen.
- Fresh evidence is more complete. Platform URLs, wallet addresses, and communication accounts get deactivated quickly after a scam. Screenshots taken now capture what screenshots taken next week may not.
Immediate Steps — First 60 Minutes
Do these in order. Don't skip ahead. Don't contact the scammer first.
Stop All Contact and Stop Sending Money
Cut off contact with the scammer completely and immediately. Do not respond to messages. Do not send any additional funds for any reason — not to pay a "tax fee," not to "unlock" your account, not to "verify" your identity. Every additional payment is pure theft. The platform is fake. Your balance is a number in a database. No fee will release it.
Call Your Bank If Any Fiat Wire Transfers Were Involved
If you sent money from your bank account — via wire transfer, ACH, or Zelle — to purchase cryptocurrency or to the scammer directly, call your bank's fraud department immediately. Ask specifically about a wire recall or reversal. Be direct: "I was scammed and need to recall a wire transfer." Give them the date, amount, and destination account. The window for this is narrow — sometimes 24 hours, rarely more than 72. After that, it is almost certainly gone.
Secure Your Accounts
Change passwords for any accounts the scammer may have had access to — email, financial accounts, cryptocurrency exchanges, social media. Enable two-factor authentication everywhere it's available. If you shared your screen with the scammer at any point, assume they have seen your login credentials and act accordingly. Check for any devices or sessions still logged in to your accounts and revoke them.
Screenshot and Document Everything — Before It Disappears
Scammers deactivate platforms, delete accounts, and vanish within hours of the final payment. Document everything now, before it's gone. The more complete your documentation, the stronger your position for every subsequent step.
- Every conversation thread (WhatsApp, Telegram, text, email, dating app)
- The scam platform — URL, login screen, portfolio screen, withdrawal error
- Any website, app, or domain used
- Profile photos of the scammer
- Any phone numbers, email addresses, or usernames used
- Your exchange transaction history showing every outgoing transfer
How to Preserve Evidence Properly
Evidence preservation is not just about taking screenshots. To be useful in legal proceedings, reports to law enforcement, or forensic investigation, your documentation needs to be complete and organized. Here's exactly what to capture and how.
Transaction Records
These are the most critical piece of evidence. Every cryptocurrency transfer has a permanent record on the blockchain, but you need to capture your side of it from your exchange or wallet.
Communication Records
Export or screenshot full conversation histories, not just highlights. In legal proceedings, the full context matters — including the trust-building phase, the introduction of the investment opportunity, and any pressure tactics used. For apps that allow export (WhatsApp, Telegram), use the built-in export function to get a complete log rather than individual screenshots.
Platform and Domain Records
Take full-page screenshots of the fake investment platform — homepage, login page, portfolio/dashboard, and the withdrawal page where you were blocked. Note the full URL and any app store listings. Run a WHOIS lookup on the domain (who.is) and screenshot the results — this captures registration data that may disappear if the scammer deletes the domain.
Identity Artifacts
Anything the scammer sent you that implies an identity — photos, video screenshots, business cards, documents, company names, "trading licenses" — keep all of it. Profile photos from social media can be run through reverse image search to identify the real person whose photos were stolen.
Create a single folder on your computer, label it with the date, and consolidate every piece of evidence into it. Include a plain-text notes file with a timeline of events in chronological order — when first contact was made, when crypto was first mentioned, each transfer date and amount. This document becomes the foundation of any law enforcement report or forensic investigation brief.
Where and How to Report the Fraud
Reporting a crypto scam will not automatically result in your money being returned. I want to be honest about that upfront. But reporting serves several important purposes: it creates an official record, contributes intelligence to ongoing investigations that do lead to prosecutions and seizures, and may be required if you pursue civil legal action later.
FBI Internet Crime Complaint Center (IC3) — ic3.gov
This is the most important report to file if you are in the United States. The IC3 is the FBI's central intake for internet-based financial crime. They share intelligence across federal agencies, and large cryptocurrency fraud cases — particularly pig butchering operations — are actively investigated at the federal level. Your report contributes to cases that are already in progress. File at ic3.gov. Include all transaction hashes, wallet addresses, platform URLs, and communication records.
Federal Trade Commission (FTC) — ReportFraud.ftc.gov
The FTC tracks fraud trends across the country and uses complaint data to identify and pursue large-scale operations. Filing a report here is straightforward and takes about 15 minutes. The FTC also publishes consumer alerts based on complaint trends, which indirectly protects future victims.
Your State Attorney General
Many state attorneys general have cybercrime units that accept cryptocurrency fraud reports. Some have been more aggressive than federal agencies in pursuing crypto fraud cases. Find your state's consumer protection office at naag.org.
Your Local Police Department
File a local police report even if you expect little action. A police report number creates an official record that is often required by insurance companies, banks, and civil attorneys. When filing, bring your documented evidence folder — the more specific you can be (transaction hashes, wallet addresses, platform URLs), the better the report will be.
The Cryptocurrency Exchange(s) Involved
If you can identify which exchange the scammer was using to receive or liquidate funds, report the wallet addresses directly to that exchange's compliance or fraud team. Coinbase, Binance, Kraken, and others have compliance teams that respond to law enforcement requests and, in some cases, to direct victim reports. This is a long shot for immediate action but costs nothing and occasionally results in account flagging.
Contacting Your Bank and Exchanges
Your Bank
Beyond the wire recall attempt (covered in the immediate steps), your bank's fraud department should receive a full notification of what occurred. Provide the complete timeline, amounts, and destination accounts. Ask specifically:
- Whether any wire recall or reversal is still possible
- Whether a Suspicious Activity Report (SAR) will be filed
- Whether your account needs additional security measures
- For a written confirmation of your fraud report for your records
Your Cryptocurrency Exchange
Contact the exchange you used to purchase and send cryptocurrency. Report the fraud and provide the wallet addresses you sent to. Ask whether those addresses are flagged in their system. Also request a complete transaction history export — formatted with transaction hashes — for your records.
Starting a Blockchain Forensic Investigation
Once immediate actions are taken, forensic blockchain investigation is the step that gives you the clearest picture of what happened to your money and opens the most legal doors.
A forensic investigator traces your funds from the moment they left your wallet — through every intermediary wallet, exchange deposit, chain swap, and mixing attempt — and produces a documented report showing where the money ended up and which exchanges hold relevant KYC data. That report is the foundation for law enforcement referrals, civil subpoenas, and exchange disclosure requests.
The on-chain evidence never disappears — the blockchain is permanent. But exchange records, platform data, and communication artifacts are not. The sooner forensic investigation begins, the more complete and actionable the picture will be.
Learn what a crypto scam investigation covers →
Warning: The Recovery Scam Is Already Targeting You
This section may be the most important thing in this entire guide.
Within hours or days of being scammed, you will likely be contacted by someone offering to recover your stolen cryptocurrency. They may reach out on the same platforms where the original scam occurred. They may find you through forums, Facebook groups for scam victims, or by scraping public complaint databases. They will claim to be blockchain investigators, legal specialists, or "hacker collectives" that can get your money back.
These are almost always scams.
The recovery scam is the second wave of fraud targeting the same victim pool, exploiting the desperation and grief that follows a major financial loss. They will ask for an upfront fee. Some will string victims along through multiple payments before disappearing. A few will steal the wallet credentials you share with them in the process of "investigating."
Unsolicited contact offering recovery services. Guaranteed recovery promises. Upfront fees before any work is done. Requests for your private keys, seed phrase, or remote access to your device. Pressure to act quickly. No verifiable identity, website, or professional history. Any of these signals means walk away immediately — you are being targeted for a second theft.
A legitimate blockchain forensic investigator will give you a free initial consultation, provide a clear scope of work before any payment, never guarantee recovery, and never ask for your private keys or seed phrases under any circumstances.
The Emotional Reality of Crypto Fraud
Most guides on crypto scams skip this part. They shouldn't.
Cryptocurrency fraud — particularly pig butchering and romance-based investment scams — causes a level of psychological trauma that is qualitatively different from most financial crimes. The victim didn't just lose money. They lost a relationship they believed was real. They made decisions based on trust that was manufactured and weaponized against them by professionals. Many victims also carry significant shame, which makes them less likely to report, less likely to seek help, and more vulnerable to a recovery scam that offers a way to "fix" what happened quietly.
Being defrauded by a professional criminal operation is not a reflection of your intelligence. The people behind these scams are trained, scripted, and experienced. They are effective against people of all backgrounds, income levels, and education. The FBI's own data shows that the most targeted demographic for investment fraud is not the elderly — it is adults between 30 and 60 with above-average financial literacy and disposable income.
If you're struggling with the aftermath, the FINRA Investor Education Foundation and Global Anti-Scam Organization (GASO) both offer support resources specifically for investment fraud victims.
Summary: Your 24-Hour Checklist
- Stop all contact with the scammer — do not send any additional funds
- Call your bank immediately if fiat wire transfers were involved
- Change passwords and secure all accounts
- Screenshot and document everything before it disappears
- Collect all transaction hashes and wallet addresses
- File a report with IC3 (ic3.gov) and the FTC
- File a local police report for an official record number
- Report to your exchange's fraud team
- Begin a forensic investigation while the evidence is fresh
- Be on guard for recovery scammers — they are already looking for you
If you've been scammed and want to understand what forensic investigation can find in your specific case, Wallet Witness offers a free initial consultation — no commitment, no pressure. Book your free consultation →