Crypto Recovery Scams: How Victims Get Robbed Twice
A crypto recovery scam targets people who have already lost money. A supposed investigator, lawyer, hacker, or government agent offers to get it back. The offer leads to another payment, a stolen wallet, or both.
The FBI recorded 10,516 recovery-scam complaints and $1.4 billion in reported losses in 2025. That total can include losses from the original scam as well as the recovery scam. It is not a measure of recovery fees alone.
Documented cases
Josh Kern: a recovery offer cost his family another $41,000
Colorado novelist Josh Kern described his experience on AARP's The Perfect Scam in February 2026. After losing roughly $100,000 through a crypto dating and investment scam, he searched online for help.
A recovery company initially offered to work for a share of whatever it recovered. It then claimed his money was ready, but he needed to deposit $35,000 to access it. Kern borrowed that amount from his retired parents.
When the money disappeared, the company blamed a technical error and demanded a gas fee. His brother supplied about $3,000, then another $3,000 after another claimed error. Kern described losses of roughly $100,000 of his own money, $35,000 from his parents, and $6,000 from his brother.
The trap: a service can promise no upfront fee, then introduce deposits and transfer charges after claiming the recovery succeeded.
Coin Dispute Network: over 200 customers reported no recovery
In May 2025, Manhattan prosecutors announced charges against Michael Lauchlan and Gary Zaydman over Coin Dispute Network. Prosecutors alleged that the business used false tracing reports, fake news articles, paid actors in testimonials, and invented online identities to attract customers.
The company allegedly claimed it recovered some crypto for about 80% of clients within roughly six months. Customers paid an initial consultation fee of 0.1 ETH, followed by fees typically equal to 10% to 15% of the amount they wanted recovered.
Prosecutors said exchanges repeatedly rejected the company's dispute letters, while customers received false progress updates. Investigators had spoken with more than 200 customers in the United States and Canada; none had recovered cryptocurrency through the company. These were allegations in an indictment.
The trap: a tracing report, a busy support team, and convincing customer videos can all be part of the fraud.
The Albanian call centers: the same operation approached victims again
Eurojust reported in April 2026 that an investigation into call centers in Tirana led to 10 arrests. Authorities linked the wider operation to more than €50 million in suspected investment-fraud losses.
The recovery pitch was a second stage. Operators contacted people who had already lost money through fraudulent platforms and offered to help them recover it. Interested victims were told to open accounts on cryptocurrency platforms and make an initial €500 deposit.
The €50 million figure covers the wider alleged fraud operation. Eurojust did not identify that entire amount as recovery-scam losses.
The trap: the people offering help may belong to the operation that took the money first. Knowing the victim's history helps them sound credible.
MyChargeBack, Payback LTD, and Claim Justice: an FBI recovery-fraud investigation
In September 2024, the FBI announced that it had seized web domains belonging to MyChargeBack, Payback LTD, and Claim Justice during a cryptocurrency recovery-fraud investigation.
The agency sought people who had paid upfront expecting direct recovery help but instead received questionable tracing reports and form letters to send to financial institutions. Its notice described an investigation and asked potential victims to come forward; it did not announce convictions.
The trap: receiving documents after paying does not establish that useful recovery work happened. A report should contain evidence that another investigator or lawyer can check.
What research shows beyond the usual warnings
Researchers have tested these scams by posting invented requests for help and engaging with the accounts that replied.
The findings below come from two 2024 studies: Conning the Crypto Conman, published at the IEEE Symposium on Security and Privacy, and ScamChatBot, released as a research preprint. The preprint had not undergone peer review when first released.
| Research finding | What it means for readers |
|---|---|
| In ScamChatBot, 6,106 of 12,780 invented crypto-wallet help posts received replies from potential scammers: 47.8%. The rate for invented social-account recovery posts was 10.8%. | Publicly asking for crypto help can attract a concentrated stream of fake assistance. |
| In the Conning the Crypto Conman wallet test, scammers moved funds from 35 of 100 wallets whose recovery phrases were supplied. Nine scammers asked for larger deposits, ranging from $500 to $3,500. | A request to add money to a wallet for recovery or validation can set up another theft. |
| Among 74 email responders in that study, 27 requested secret keys. The other 47 requested payment, split between PayPal and cryptocurrency. | Recovery scams can steal access or charge for fake help. A familiar payment service does not establish legitimacy. |
| In ScamChatBot, 48 of 156 initial email responses arrived in under one second and were identified as automated replies. | An immediate, polished response may be a script directing people toward a payment or phishing page. |
These were controlled experiments using decoy requests. Their percentages are not estimates of how many real victims get scammed, and they say nothing about the chances of recovering stolen funds.
Why the next scammer already knows your details
Scammers buy, sell, and trade lists containing victims' contact details, the type of scam, and how much they paid. The original fraudsters may also run the recovery operation themselves.
That explains why a caller might know your loss amount before you tell them. It does not prove the caller works with police or has located your money.
Fake reporting websites create another source of information. In July 2026, the FBI described AI-generated videos directing victims to a copied IC3 complaint site. The fake form collected names, contact details, scam types, and estimated losses, then issued a reference number.
A case number is easy to invent. Verify the website and organization that issued it.
How to detect a crypto recovery scam
1. Verify the person outside the conversation
Find the organization through an independent source. Call the number published by the regulator, law firm, police agency, or other official directory. Ask whether the named person works there and whether the offer is genuine.
Scammers copy real firms' names, addresses, and registration numbers. Check that the website, email address, phone number, and any claimed authorization match the details in an independent official directory.
If someone claims to represent the FBI, verify that through a local FBI field office. Law enforcement does not charge victims to investigate crimes.
2. Ask what would actually make recovery possible
A credible explanation should identify concrete steps and their limits. Ask:
- What evidence connects these transactions to my loss?
- Who currently controls the funds, and what evidence supports that conclusion?
- Which exchange, court, or other party could take action?
- What work will I receive for the fee, even if nothing is recovered?
Private recovery companies cannot issue seizure orders. Exchanges freeze accounts through their own processes or in response to legal action.
A diagram showing where money moved does not, by itself, establish who owns the receiving account, whether the funds remain there, or whether they can be returned.
A promise of 100% recovery is a red flag. The outcome depends on the evidence, who controls the assets, and what legal action is possible.
3. Check what the payment is supposed to buy
These demands should stop the payment:
| Demand | Why it is a problem |
|---|---|
| Pay a tax or clearance charge to release money supposedly recovered for you. | The claimed recovery is being used to obtain another payment. Verify any real tax obligation directly with the relevant authority. |
| Deposit more crypto to activate, synchronize, or validate the recovered balance. | Adding money does not prove the existing balance is real or spendable. |
| Pay another fee because the previous recovery step failed. | Repeated errors can keep a victim paying, as Kern's account illustrates. |
| Pay a government investigator or an IC3 representative. | The FBI does not charge victims an investigation fee. |
Real blockchain transactions can require network fees. Ask which transaction needs the fee and check the amount in your own wallet software. Calling an invoice a gas fee does not prove that recovered funds exist.
Legitimate lawyers can charge retainers or other agreed fees. Get the scope of work and fee arrangement in writing before work starts. A professional fee pays for defined work; a release-fee scam charges you to unlock a promised balance. Independently verify the provider as well as the contract.
4. Protect wallet access during any assessment
Tracing stolen funds uses transaction records. A stranger should not need your seed phrase, private key, exchange password, or one-time login code to examine that trail.
A seed phrase is a wallet's set of recovery words. Anyone with it may control the wallet. The IEEE team confirmed key theft using decoy wallets.
Also examine any request to sign a transaction or message. A token approval can let a contract move particular assets from your wallet. Disconnecting a website does not cancel approvals already granted.
Open official wallet support yourself. Do not use a recovery agent's link to install software, restore a wallet, or approve a “verification” transaction.
5. Verify transactions instead of trusting a screenshot
Ask for the transaction IDs, blockchain network, and exact asset involved. Check the records using a block explorer you open independently, rather than a dashboard supplied by the recovery service.
A screenshot of a large balance does not show that anyone recovered your money. Even a real transaction needs an explanation connecting it to your loss and to funds that can legally be returned.
Do not connect your wallet or sign anything merely to view public blockchain records.
6. Treat testimonials and media mentions as claims to investigate
Coin Dispute Network allegedly used actors, invented social profiles, and false news articles. Those details matter when several supposedly unrelated people recommend the same recovery business.
Recovery scammers can use press release distribution services to place promotional material on news websites. A familiar publication's logo does not establish that its reporters investigated the company.
Look for evidence outside the provider's own website: an independently verifiable court case, a confirmed professional identity, or a client willing to discuss the actual work. A claimed success rate needs an explanation of how it was calculated.
What real recovery looks like
Real recovery can happen. It usually involves separate steps:
- Tracing: investigators establish where the assets moved.
- Securing assets: an exchange or other party with control takes action, or authorities obtain the necessary legal orders.
- Returning assets: ownership and victim claims are checked through the applicable process.
A successful trace is only one part of that work.
A documented example comes from Richmond Hill, Georgia. A resident reported roughly $124,000 in unauthorized crypto transfers in October 2024. The FBI traced and seized assets, and a federal civil forfeiture case followed. In November 2025, the U.S. Attorney's Office announced that $84,327.50 had been returned to the victim after forfeiture and liquidation.
That was a partial recovery supported by an investigation and a court process. It does not establish a typical recovery rate or guarantee the same outcome in another case.
If you already paid a recovery service
- Stop further payments. Save the messages before blocking the sender. Do not pay a final release charge or an extra fee to obtain a refund.
- Contact the payment provider immediately. Tell your bank, card issuer, exchange, or payment app that you suspect fraud. Ask whether it can stop, recall, dispute, or flag the payment. Available remedies depend on how you paid.
- Preserve both sets of evidence. Keep the original scam records and the recovery-service records, including receipts, transaction IDs, wallet addresses, websites, emails, and chat exports.
- Secure any remaining assets. If you granted suspicious token approvals, use your wallet provider's official guidance to revoke them. Disconnecting the site alone is insufficient.
- Treat a disclosed seed phrase as compromised. Follow official wallet support instructions for moving remaining assets to a new wallet with a new phrase. If a bot is draining the old wallet, do not add more crypto to pay gas. Revoking approvals cannot make an exposed phrase secret again.
- Report the second scam as well as the first. Contact your country's police or cybercrime reporting service. In the United States, report to IC3 and the FTC. Include details of the people who offered recovery help.