Scammed in Crypto? What to Do Next (and the Recovery Scam to Avoid)

If you’re reading this because you just realized you’ve been scammed, take a breath. You’re not stupid, and you’re far from alone – Americans reported $11.4 billion in crypto-related fraud losses to the FBI in 2025. Scams are run by professionals who do this all day. What matters now is the next few hours.

The short answer: stop sending money immediately, move whatever is left to a safe new wallet, write down every detail of what happened, and report it to the FBI at ic3.gov. Then be very careful – the people most likely to contact you next are recovery scammers who promise to get your money back for a fee. Getting stolen crypto back is rare, but acting fast gives you the best chance and protects what you still have.

This guide walks through it step by step.

Step 1 – Stop Sending Money. Right Now.

This is the single most important thing on this page. Most scams don’t end with the first loss. They end when the victim stops paying.

If you’re being asked for a “withdrawal fee,” a “tax,” an “unlock payment,” a “verification deposit,” or money to clear a “negative balance” – that’s the scam continuing. The balance you’re trying to reach doesn’t exist. No payment will release it. Every extra dollar is simply more money lost.

Stop replying to the scammer too. You don’t owe them an explanation. Expect pressure, guilt trips, fake deadlines, or even threats when you go quiet – they’re all designed to pull you back in.

Step 2 – Figure Out What Kind of Scam It Was

What you do next depends on how the money left. Most crypto scams fall into one of four types:

A. You sent crypto to someone. A fake investment platform, a “trading mentor,” a new online friend or romance, a fake job paying you to complete tasks, a “send 1 get 2 back” giveaway. Your wallet itself is fine – you sent the funds yourself because you were tricked. See our guides to pig butchering and crypto task scams.

B. Your wallet was drained after you signed something. You connected to a site – a fake airdrop, a “claim” page, an “unlock” tool – and approved a transaction or signed a message. Tokens disappeared afterward. Your recovery phrase may still be private. See our wallet drainer approvals guide.

C. Your recovery phrase was exposed. You typed your 12 or 24 words into an app or website, shared them with “support,” stored them in a photo or note, or installed malware. The attacker now controls the wallet itself. See our fake crypto apps guide.

D. Your exchange account was taken over. Someone logged into your Coinbase, Kraken, or other exchange account – often through a stolen password, a SIM swap, or a fake support call – and withdrew your funds.

Step 3 – Protect What’s Left (The First Hour)

If it was type A (you sent it): Your wallet isn’t compromised, but the scammer may know your address and contact details. Don’t send anything else, and don’t connect your wallet to any site they gave you. If you did connect it, treat it as type B too.

If it was type B (you signed something):

• On Ethereum and other EVM chains, go to Revoke.cash and revoke every approval you don’t recognize – the drainer may still have permission for tokens it hasn’t taken yet
• Then move everything that’s left to a brand-new wallet with a brand-new recovery phrase
• On Solana, drainers usually take funds inside the transaction you signed, so moving what’s left is the priority
• On the XRP Ledger, look up your account on an explorer like XRPScan and check whether someone added a key or signer you didn’t set up

If it was type C (recovery phrase exposed):

• Create a brand-new wallet on a clean device and move anything that can still be moved, on every chain that phrase controls
• Don’t send more crypto into the compromised wallet to pay for gas – automated “sweeper” bots often grab anything that arrives
• Assume the old wallet is permanently lost. There’s no way to “change” a recovery phrase
• If you installed software as part of the scam, treat that whole device as compromised and do all of this from a different one

If it was type D (exchange account):

• Contact the exchange immediately through its official app or website – never through a phone number or link someone sent you
• Change your email password first, then the exchange password, from a clean device
• Turn on app-based 2FA or a passkey, and remove any withdrawal addresses or devices you don’t recognize
• Call your phone carrier if you suspect a SIM swap and ask for a port-out lock

Step 4 – Write Everything Down (The First Day)

Scammers delete chats, accounts, and websites quickly. Capture the evidence before it disappears. The FBI’s Internet Crime Complaint Center asks crypto fraud victims to include:

• The wallet addresses you sent crypto to
• The amounts and types of crypto sent
• Transaction hashes (transaction IDs), with dates and times
• How you met the scammer and which apps you used to talk
• Any websites, app names, phone numbers, usernames, or email addresses involved

Screenshot your conversations, the fake platform’s dashboard, and any payment instructions. You can find transaction hashes in your wallet’s activity history or on a block explorer like Etherscan by searching your own wallet address.

Step 5 – Report It

Report even if you think nothing will come of it. Reports are how investigators connect cases and find the wallets behind them.

• FBI Internet Crime Complaint Center: ic3.gov – the main US report for crypto fraud. Include everything from Step 4.
• Federal Trade Commission: reportfraud.ftc.gov
• The exchange you used to buy or send the crypto – through its official support channel. If stolen funds are still sitting on a regulated exchange, it can sometimes freeze them.
• Your bank or card issuer, if you sent money by bank transfer or card to buy the crypto. Ask whether any transfer can still be stopped.
• Local police – a police report can help with your bank and with taxes later.
• The platform where the scam started – X, Telegram, WhatsApp, Instagram, a dating app – so the account gets shut down.
• Identity theft: if you shared your ID, Social Security number, or bank details, go to identitytheft.gov for a recovery plan.

You can also report the scammer’s wallet address on Chainabuse, a public scam-reporting database used by investigators, so others get warned.

Can You Get Your Crypto Back?

Honestly: usually not. Crypto transactions can’t be reversed, and the groups behind large scams are international and move funds quickly. Anyone who promises you a recovery is not telling the truth.

But recovery isn’t impossible, and fast reporting is what makes it possible at all:

• Exchanges can freeze stolen funds that land on their platforms when they’re alerted in time.
• Stablecoin issuers can freeze tokens. In April 2026, Tether froze about $344 million in USDT after US authorities flagged the wallets holding it.
• Law enforcement seizes scam funds. In October 2025, the US Justice Department filed its largest-ever forfeiture action – about $15 billion in bitcoin – against the Cambodia-based Prince Group, accused of running pig butchering compounds. Seized funds can eventually be returned to victims through official processes, but only to people who reported.

One more thing to know: the FBI’s Operation Level Up contacts victims directly, often people who don’t yet realize they’re being scammed. If someone claims to be from the FBI, verify it by calling your local FBI field office using the number on fbi.gov. The real FBI will never ask you for money.

The Recovery Scam – Don’t Get Hit Twice

This is where many victims lose even more. Once you’ve been scammed, your name, contact details, and even the exact amount you lost often end up on lists that scammers share and sell. Within days or weeks, someone contacts you offering to get it back.

In August 2025, the FBI warned specifically about fake law firms targeting crypto scam victims. They impersonate real lawyers, invent official-sounding agencies (one called itself the “International Financial Trading Commission”), produce fake documents, and win trust by already knowing details of your loss. Then they ask for fees – in crypto or gift cards – or send you to a fake “foreign bank” site to “release” your funds.

Red flags of a recovery scam:

• They contacted you first, out of the blue
• They want an upfront fee, a “retainer,” or a “tax” before releasing anything
• They ask to be paid in crypto or gift cards
• They claim to be “ethical hackers” who can reverse blockchain transactions
• They say they work with, or are, a government agency
• They move you to WhatsApp or Telegram and avoid video calls
• They can’t or won’t show a verifiable license

The FBI’s advice is a “zero trust” approach: verify anyone claiming to be a lawyer or official independently, and remember that the government never charges you for law enforcement help. If you do want legal help, find a licensed attorney yourself through your state bar association – never one who found you.

A Note on Taxes

In the US, some scam losses may be tax-deductible. In 2025, an IRS Chief Counsel memo said victims who sent money with a profit motive – for example, into a fake investment platform like those used in pig butchering – may be able to claim a theft loss, while some losses without an investment motive, like pure romance scams, didn’t qualify. The rules are specific and depend on your situation, so talk to a tax professional. Our crypto taxes guide covers the basics of reporting crypto.

Take Care of Yourself

Being scammed can bring shame, anger, and sleepless nights – especially when the scam involved someone you trusted or cared about. That’s normal, and it isn’t a reflection of your intelligence. These operations are built by professionals to beat ordinary human instincts.

Tell someone you trust. Scammers rely on secrecy, and talking it through helps you see clearly and avoid the follow-up scams. If you’d like to talk to someone trained in this, the AARP Fraud Watch Network Helpline is free and open to everyone, not just AARP members: 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. They offer guidance and support, not investigations or recovery.

Making Sure It Doesn’t Happen Again

Once the immediate crisis is handled, a few habits close off nearly every route scammers use:

• Never share your recovery phrase – no legitimate person or app needs it
• Never send money to receive money, and never pay to “unlock” or withdraw earnings
• Treat anyone who contacts you first about crypto as a scammer until proven otherwise
• Use app-based 2FA or passkeys, and keep larger holdings on a hardware wallet
• Read what you’re signing before you approve anything

Our complete crypto security guide covers all of it, and every scam breakdown we’ve documented is on our Crypto Security hub.

Sources

• FBI IC3 – Fictitious law firms targeting cryptocurrency scam victims (Aug 2025)
• FBI IC3 – Cryptocurrency fraud: what to include in your complaint
• The Block – FBI: crypto-related fraud losses hit record $11.4 billion in 2025
• CoinDesk – Tether freezes $344 million in USDT tied to illicit activity (Apr 2026)
• Elliptic – Prince Group $15B crypto seizure and sanctions (Oct 2025)
• HLB Gross Collins – IRS clarifies theft and fraud loss deductions
• AARP – Fraud Watch Network Helpline

📖 In This Section Pig Butchering · Crypto Task Scams · Wallet Drainer Approvals · Complete Security Guide

← Back to Crypto Security