Crypto recovery scams: how to spot fake “recovery experts”

After a theft, people search for help, post publicly, or reply to unsolicited DMs. Scammers monitor those channels. They offer hope: “we reverse the hack,” “we have exchange contacts,” “pay this fee and funds unlock.” The pitch works because the victim is already in loss.

The blockchain does not care about urgency. Confirmed transfers stay confirmed. What scammers sell is usually a second theft: more money, keys, or remote access.

• Guaranteed recovery or a promised percentage returned.
• Any request for seed phrases, private keys, or wallet passwords.
• Upfront “recovery fees,” “taxes,” or “gas to release funds.”
• Pressure to move the chat off-platform or keep the deal secret.
• Fake screenshots of frozen balances or police portals.
• Claims they can “hack the blockchain” or reverse a tx from your seed.

MBTrace never asks for seeds or keys, never takes a percentage of “recovered” value, and never promises recovery. Payment happens only after an analyst accepts the case.

Impersonation of exchange support. Someone DMs after you post a tx hash, claims to be from “compliance,” and sends a phishing link to “verify” the wallet.

Recovery firm theater. A polished site or Telegram bot shows a fake progress bar, then invents a fee to finish the job.

Refund bait. You are told stolen funds are “held” and will be released after you send more crypto to cover network costs.

An investigation sells a deliverable you can evaluate: a path analysis with cited hashes, labeled hops where defensible, and explicit limits. Sometimes the finding is that there is nobody to write to. That outcome is still a completed analysis — not a failed magic recovery.

• You provide network, address or hash, time window, and a short description.
• An analyst reviews before payment; decline means you pay nothing.
• If accepted, you receive a quote (from $50+ at MBTrace) and a PDF after work.
• The PDF is for you, counsel, police, or exchange contact — not a recovery button.

Preserve payment hashes, chat logs, and wallet addresses used by the scammer. Report to your local authorities and to platforms where the contact happened. Do not send more funds to “unlock” the previous payment. Consider whether a separate on-chain path for the second loss is useful for reporting — again without expecting a guaranteed refund.

This is general information, not legal advice.

• Official domain and support channels you navigate to yourself — not links from DMs.
• Clear statement of deliverable (PDF path, hop table) vs outcome (coins returned).
• Written refusal to accept seeds or remote access.
• Payment only after a human reviews whether the case is in scope.
• Sample or fictional demo that admits limits, including dead ends.

Search the exact brand name with “scam” and “review,” but remember fake review farms exist. Primary test remains behavioral: guarantees and key requests fail it immediately.

If someone offers to “introduce you to exchange compliance for a fee,” ask what document they produce. Introductions without a defensible path are usually worthless or worse.

Scammers manufacture deadlines: “funds leave the exchange in two hours,” “only today we can freeze.” Real compliance processes are not closed in anonymous Telegram windows. Slowing down is a defense.

Share the red-flag list with a trusted person before you pay anyone. A second pair of eyes breaks urgency scripts. Then return to evidence: hashes, times, and whether a KYC door even exists on-chain.

Paid ads and SEO spam often rank above useful public information for queries like “recover stolen USDT.” Lookalike domains, stock-photo “analysts,” and cloned chat widgets are common. Type URLs yourself. Prefer services that publish a clear deliverable and a sample document over those that only publish testimonials.

If a site asks you to install remote-access software, connect a hardware wallet to “sync evidence,” or paste a seed into a form, stop. Those steps are not part of honest path analysis. MBTrace works from public hashes and addresses you already control — never from your phrase.

1. Secure remaining funds and revoke approvals if relevant.
2. Export primary hashes and a short timeline.
3. File a police report when you can do so safely.
4. If a labeled custodial cash-out appears on-chain, prepare a factual exchange contact — or commission a path PDF first.
5. Ignore DMs that promise percentages back.

That sequence is slower than a scam pitch and far less likely to compound the loss. For how tracing actually works, see our on-chain tracing guide; for day-one actions, see the first-24-hours checklist.