If you have just lost cryptocurrency, someone is already looking for you. Recovery scams are a second robbery aimed at the same person on their worst day, and they work because the pitch answers exactly the question you are asking.
The short version, before anything else: a confirmed blockchain transaction cannot be reversed by anyone. Not by a company, not by a hacker-for-hire, not by a “blockchain forensics expert”, not by the network. Any service promising to retrieve stolen crypto for an up-front fee is taking your money.
This page carries no advertising. Someone in this position should not be monetised on the way past.
Why recovery is not possible
A blockchain confirms transactions by consensus and then treats them as settled. There is no administrator, no chargeback, and no dispute process. Moving coins back requires the private key of the address now holding them — which the thief has and nobody else does.
Two things genuinely exist, and neither is what is being sold to you:
- Tracing. Analytics firms really can follow funds across addresses. Tracing is not recovery — knowing precisely where your money went does not give you the key to it. Tracing matters only when it feeds law enforcement with jurisdiction over a real person.
- Seizure. Law enforcement occasionally recovers funds, by arresting people and compelling keys, or by seizing an exchange account the thief cashed out through. That is a criminal process taking months or years, and it is never initiated by a private company that direct-messaged you.
How they find you
They monitor the places people go immediately after losing money. Post about a theft in a subreddit, a Telegram group, a Discord server, an exchange’s support forum, or under a news article, and replies and direct messages arrive within minutes.
They also buy search advertisements against exactly the phrases a victim types — recovery, stolen, scammed, help. The sponsored results above genuine information are frequently the scam.
And the same lists circulate. People who have lost money once are marketed to repeatedly, sometimes for years, sometimes by the original thieves under a new name.
The tells
- They contacted you. Nearly decisive on its own. Legitimate firms do not cold-message theft victims.
- An up-front fee, a “deposit”, a “gas fee”, a “tax”, or a payment to “unlock” recovered funds.
- They guarantee recovery. Nobody honest can.
- They ask for your recovery phrase or private key — to “verify ownership” or “access the wallet”. This is simply the theft repeating.
- They want remote access to your computer.
- Screenshots of past successes, testimonials, and a certificate-covered website. All trivially fabricated.
- They claim to be white-hat hackers who will hack the thief. Not a service that exists.
- Urgency — the funds are “about to be moved to a mixer” and you must act now.
The cruellest variant: after you pay, they report partial success and request a further fee to release the rest. This can continue for as long as you keep paying, because each payment proves you will pay again.
What to actually do
- Secure what is left first. If a phrase was exposed, move any remaining funds to a new wallet with a phrase that has never been typed into anything, created on a device you trust. Do this before anything else.
- Record the evidence. Transaction hashes, destination addresses, timestamps, screenshots, and how the contact reached you. You will need these and they are easier to gather now.
- Report it to the police in your country, and to the national cybercrime or fraud reporting body. This feels futile and is not: seizures happen through aggregated reports, and yours may connect to a case already open.
- Tell any exchange involved, quickly. If the thief moves funds to an exchange, a fast report can occasionally get an account frozen. This is the only realistic route to getting money back, and it is time-sensitive.
- Do not post publicly asking for help. It marks you for the second wave.
- Assume it is gone, and act accordingly. Hoping otherwise is what the next scam sells.
The one real exception
There is a genuine service that resembles this and is not a scam: recovering a wallet you still own but cannot open — a forgotten password on an encrypted wallet file, an incomplete recovery phrase, a corrupted backup. That is a computational problem on data you possess, and specialists really do solve it.
The distinction is absolute. Nobody stole from you in that scenario; you are locked out of your own property. Legitimate operators in that space are identifiable, charge on success rather than up front, never contact you first, and never ask for a complete recovery phrase.
If you are in that position, understanding what you actually hold is the first step, and the work should happen offline with open-source tooling wherever possible.
If funds have already left your wallet to somebody else’s address, no such service applies. That money is gone, and everyone telling you otherwise is selling the same thing.