Crypto Recovery Scams: How to Verify Recovery Firms, Lawyers and Investigators

Crypto recovery scams target people who have already lost money and offer a second promise:

“We found your crypto. Pay us and we can get it back.”

The person making that promise may claim to be:

A blockchain investigator
A law firm
A government officer
An exchange employee
A regulator
A cybersecurity company
An asset-recovery specialist
Another victim who “successfully recovered” funds

The story changes, but the objective is often the same: persuade the victim to send more money, disclose more personal information, connect a wallet or grant access to accounts.

This is commonly called revictimization, reload fraud or advance-fee recovery fraud.

The important distinction is that crypto tracing and legal recovery can be legitimate activities. Lawyers, forensic investigators, exchanges and law-enforcement agencies can sometimes help trace assets, preserve evidence or pursue lawful recovery.

What they cannot honestly do is guarantee that a blockchain transaction can be reversed or that stolen funds will definitely be returned.

The verification question is therefore:

Who is offering recovery → what evidence do they actually have → what legal or technical power do they claim → can that power be independently verified → what are they asking you to pay or disclose?

The short answer

Treat a crypto recovery offer as high risk when it involves several of these signs:

The person contacted you unexpectedly.
They already know the amount you lost and use that knowledge as proof of legitimacy.
They claim your funds have already been “located,” “frozen” or “approved for release.”
They impersonate a regulator, police agency, law firm or exchange.
They guarantee recovery.
They demand an upfront crypto payment.
Each payment creates another tax, bond, gas fee or verification requirement.
They ask you to connect a wallet or sign a transaction.
They ask for a seed phrase, private key or remote access.
They cannot prove their legal identity and professional credentials independently.
The alleged court, regulator or exchange case cannot be verified.
They pressure you not to contact the real institution directly.

If a recovery company, lawyer or investigator is legitimate, verification should survive independent contact with the organization they claim to represent.

Why crypto scam victims are targeted again

A previous crypto scam can expose valuable information about the victim.

That information may include:

Name
Email
Phone number
Country
Amount lost
Crypto exchange used
Wallet addresses
Transaction hashes
Bank used to fund the transaction
Communication platform
Emotional circumstances surrounding the loss

Recovery scammers can obtain this information in several ways.

Public complaint posts

A victim may publish:

“I lost $35,000 through Example Exchange and sent funds to this wallet.”

That post gives a recovery scammer an immediate script.

The scammer can reply:

“We traced the exact $35,000 and found the destination exchange.”

The apparent inside knowledge came from the victim's own post.

Data from the original scam

Victim information can also be reused, shared or sold.

The person offering recovery may be connected to the original operation or may have obtained its victim list.

This explains why a recovery scammer can sometimes know:

Exact loss amount
Exact date
Fake platform name
Previous payment instructions
Names used by the original scammers

That knowledge is not proof that the new contact is legitimate.

Public blockchain data

If a wallet address or transaction hash is known, anyone can inspect the public transaction history on the relevant blockchain.

A recovery agent can therefore show real blockchain transactions without having any legal authority over the destination assets.

Knowing where crypto moved is not the same as controlling it or being able to recover it.

Cexvia's recovery-offer verification model

Before responding to a recovery offer, verify six layers:

Identity
   ↓
Professional credentials
   ↓
Evidence of the loss
   ↓
Asset-tracing claim
   ↓
Legal / technical authority
   ↓
Payment and access request

The strongest question is not:

“Does the tracing report look professional?”

It is:

What action can this person legally or technically take that I cannot independently verify?

1. Unsolicited recovery contact is a major warning sign

Be cautious when someone contacts you first and claims to know about your loss.

Common contact channels include:

Telegram
WhatsApp
Signal
Facebook
Instagram
LinkedIn
Reddit
X
Email
Phone
Victim-support forums

The person may say:

“Your wallet was flagged in our investigation.”

or:

“Your name is on a government compensation list.”

or:

“We saw your complaint and recovered funds from the same exchange.”

The FBI has specifically warned about recovery fraud targeting previous cryptocurrency scam victims, including fictitious law firms and people impersonating the FBI's Internet Crime Complaint Center.

A genuine professional may contact a client through a legitimate referral or an existing case.

But unexpected contact plus a recovery promise should trigger independent verification before any response, payment or document submission.

2. Fake IC3, police and regulator impersonation

Government authority is a powerful persuasion tool.

Scammers may impersonate:

FBI
IC3
SEC
FTC
Local police
Foreign regulators
Financial intelligence units
Tax agencies
Courts
International organizations that do not actually exist

They can create:

Fake email signatures
Government-looking documents
Case numbers
Seizure notices
Official seals
Fake websites
Telegram accounts
Social-media profiles

FBI warning about IC3 impersonation

The FBI warned in April 2025 that scammers were impersonating IC3 employees and approaching people who had already lost money.

The FBI stated that IC3:

Does not directly contact people through phone, email, social media, messaging apps or public forums to recover funds
Does not ask victims to pay to recover funds
Does not refer victims to a company that charges for recovery

The FBI reported receiving more than 100 reports of IC3 impersonation scams between December 2023 and February 2025.

Official reference:

FBI IC3 — Scammers Impersonating the IC3

Verification rule

If someone claims to represent a government agency:

End the conversation.
Find the agency's official contact information independently.
Contact the agency through that channel.
Provide the alleged employee name and case number.
Do not use a phone number or link supplied by the person being verified.

Government logos are not authentication.

3. Fake law firms can look extremely convincing

Recovery scams increasingly use legal identities.

The scammer may:

Invent a law firm
Clone a real law firm's name
Copy a lawyer's professional biography
Use a real lawyer's bar number
Create a fake legal website
Send court-looking documents
Claim to represent a class action
Claim to control settlement or restitution funds

In August 2025, the FBI warned that fictitious law firms were targeting cryptocurrency scam victims with recovery offers.

The FBI described tactics including:

Claiming victims appear on government-affiliated lists
Claiming funds can be recovered through “legal channels”
Knowing exact prior transaction amounts and dates
Referring victims to supposed crypto recovery law firms
Sending victims to fake foreign-bank websites
Creating messaging groups involving fake lawyers and bank personnel
Demanding bank, legal or identity-verification fees
Requesting cryptocurrency or prepaid gift-card payments

Official reference:

FBI IC3 — Fictitious Law Firms Targeting Cryptocurrency Scam Victims

How to verify a law firm

Do not verify the lawyer through the website or phone number they sent you.

Check independently:

Law firm legal name
Lawyer full name
Bar / professional registration
Office address
Official website
Official phone number
Jurisdiction
Case number
Court
Written engagement terms

Call the firm's independently located office number.

Ask:

“Does this person work for your firm, and does this case exist?”

If a court case is cited, verify:

Court
Case number
Parties
Filing date
Current status

A professional-looking PDF is not enough.

4. A blockchain tracing report does not prove funds are recoverable

Blockchain analysis can be legitimate.

A forensic investigator can sometimes identify:

Transaction paths
Wallet clusters
Exposure to known services
Cross-chain movements
Bridge usage
Exchange deposit addresses
Known illicit-service exposure

But a blockchain graph can also be used as theatre.

A scammer may take real transaction data and add a false conclusion:

“Your funds are frozen at Exchange X and ready for release.”

The transaction path may be real.

The recovery claim may be invented.

What tracing can establish

Depending on the evidence:

Wallet A
→ Wallet B
→ known exchange cluster

can support a conclusion that assets appear to have moved toward infrastructure associated with a particular service.

What tracing alone does not establish

It does not automatically prove:

The real-world identity of every wallet owner
Legal ownership of the assets
That the assets remain at the destination
That the exchange has frozen them
That the analyst has authority to seize them
That the destination will return them
That a court order exists
That recovery is guaranteed

If a recovery provider claims an exchange has frozen the funds, ask:

Where is the confirmation from the exchange or relevant authority?

Do not accept the investigator's own dashboard as proof of the exchange's action.

5. “Your funds are already frozen” requires independent confirmation

This is a common recovery scam claim.

The victim is shown:

Recovered balance: $82,450
Status: Frozen
Release: Pending

Then comes the condition:

“Pay $4,000 in gas / tax / legal fees to release the funds.”

The displayed number may have no connection to recoverable assets.

Ask who controls the funds

Possible controllers include:

Centralized exchange
Custodian
Bank
Law-enforcement authority
Court-appointed receiver
Private wallet owner

The recovery company itself usually cannot create legal control over a third party's wallet or account merely by tracing it.

If the assets are genuinely restricted at a centralized service, there should normally be an identifiable legal or compliance process behind that restriction.

6. Advance-fee recovery is the core scam pattern

The SEC describes recovery or “reload” scams as a form of advance-fee fraud in which previous fraud victims are asked to pay additional money to supposedly recover earlier losses.

The structure is simple:

You lost money
      ↓
Scammer offers recovery
      ↓
You must pay first
      ↓
New obstacle appears
      ↓
Another payment required
      ↓
No recovery

Common labels include:

Recovery fee
Legal fee
Gas fee
Validation fee
Tax
AML certificate
Court bond
Security deposit
Wallet synchronization
Blockchain activation
Custody fee
Customs charge
Clearance fee
Insurance
Exchange release fee
Percentage of recovered balance

The label is less important than the structure:

give money now to receive much more money later.

Official reference:

SEC Investor.gov — Advance Fee Fraud

7. A “tax before recovery” claim requires independent verification

Scammers frequently tell victims that recovered funds cannot be released until tax is paid.

Do not assume that because the word tax is used, the demand is official.

Check:

Which jurisdiction supposedly imposes the tax?
Which law or tax rule applies?
Who is the taxpayer?
Who should legally receive the payment?
Is the tax authority actually involved?
Is the payment going to a government account or a private crypto wallet?

A private recovery agent should not be treated as the tax authority.

If there could genuinely be tax consequences, verify them with:

The relevant tax authority
A qualified tax professional
A verified lawyer

reached independently.

Do not pay a “tax” to a wallet supplied in a recovery chat simply because the payment is described as refundable or mandatory.

8. Wallet connection can replace the obvious advance fee

Not every recovery scam asks for money directly.

Some ask the victim to connect a wallet to:

Verify ownership
Receive recovered tokens
Synchronize the wallet
Activate a refund
Confirm a blockchain address
Sign a release transaction

The website may then request:

Token approval
Permit signature
Smart-contract interaction
Asset transfer
Malicious transaction

A wallet signature can create risk even if the user never types a seed phrase.

Recovery rule

Do not connect a wallet containing valuable assets to an unverified recovery website.

Do not sign a transaction you do not fully understand.

A blockchain investigator does not need control of your wallet to inspect public transaction history.

9. Seed phrase or private-key requests are disqualifying

Anyone with a wallet's seed phrase or private key can potentially control its assets.

No legitimate blockchain investigator needs a seed phrase to trace public blockchain transactions.

No legitimate lawyer needs it to file a case.

No regulator needs it to confirm a transaction hash.

Do not provide:

Seed phrase
Private key
Keystore password
Full wallet backup
Exchange password
Authentication code
API secret
Remote-control access

If a recovery provider asks for these, stop the interaction.

10. Fake exchange employees can create a second fake platform

Another recovery pattern is:

“We work for Exchange X. We recovered your stolen funds.”

The victim receives a link to a supposed exchange page showing a recovered balance.

Then the victim must:

Complete verification
Deposit money
Pay a fee
Pay tax
Activate the account

The site may be another clone.

Verify through the real exchange

Do not log in through the recovery link.

Navigate to the exchange's known official domain independently.

Contact support and provide:

Transaction hash
Alleged employee name
Case number
Screenshot of the recovery claim

Ask whether the case exists.

A genuine exchange may be limited in what it can disclose about another account or law-enforcement request. That limitation is normal.

An “insider” who claims they can bypass the official process for payment should be treated with extreme caution.

11. “We work with the FBI / regulator” requires direct verification

Recovery companies sometimes claim:

“We are partnered with IC3.”
“We work with the FBI.”
“The SEC assigned this case to us.”
“The regulator approved our recovery.”
“Police transferred your case to our firm.”

These claims should be verified with the agency itself.

The FBI's IC3 currently warns that it does not work with non-law-enforcement entities such as law firms or crypto services to recuperate lost funds or investigate cases.

That makes a supposed private recovery company's claim of being an “IC3 recovery partner” particularly important to verify.

12. Real recovery does exist—but it is conditional

The correct lesson is not:

“Crypto can never be recovered.”

That is too absolute.

Recovery can sometimes occur when circumstances allow.

Potential mechanisms can include:

A centralized exchange freezes assets
Law enforcement obtains control or seizure authority
A court issues an appropriate order
A receiver controls assets
A fraudster's assets are recovered through enforcement
Bankruptcy or insolvency proceedings distribute assets
A securities enforcement action results in distributions
A cooperative financial institution recalls or freezes funds before final settlement

Investor.gov explains that some investors may receive recovered funds through mechanisms such as enforcement distributions, receiverships, bankruptcy proceedings or private litigation.

It also emphasizes that not all victims recover money and that recovered amounts can be materially lower than the original loss.

Official reference:

Investor.gov — Recovering Funds

Recovery is evidence-dependent

The probability can depend on:

How quickly the fraud is reported
Whether assets reached a centralized service
Whether the destination can be identified
Whether assets remain available
Jurisdiction
Law-enforcement cooperation
Legal process
Evidence quality
Payment rail
Whether funds were converted, bridged or moved again

That uncertainty is exactly why a professional should not guarantee success before reviewing the case.

What legitimate professionals can actually do

Different professionals have different roles.

Blockchain forensic provider

Can potentially:

Trace transaction paths
Identify known-service exposure
Build a transaction chronology
Produce evidence for law enforcement or counsel

Cannot independently:

Reverse the blockchain
Compel an exchange to return assets
Issue a court order
Guarantee recovery

Lawyer

Can potentially:

Assess legal options
Identify relevant jurisdictions
Contact exchanges or counterparties
Seek disclosure or preservation orders where available
Coordinate litigation
Advise on legal process

Cannot honestly guarantee:

That funds still exist
That a court will grant relief
That an overseas defendant can be reached
That recovery will exceed legal costs

Exchange

Can potentially:

Investigate internal accounts
Preserve relevant records
Restrict an account under its legal/compliance procedures
Cooperate with authorities

May be unable to:

Disclose another user's identity directly to the victim
Return funds without legal authority
Reverse completed blockchain transfers

Law enforcement

Can potentially:

Investigate
Request records
Coordinate across agencies
Seek seizure or restraint where legally available

Does not guarantee recovery.

Recovery-provider verification checklist

Before engaging a recovery provider, verify each category.

Identity

[ ] Full legal company name
[ ] Company number
[ ] Registered address
[ ] Official website
[ ] Corporate email domain
[ ] Named professionals

Credentials

[ ] Lawyer / bar registration where claimed
[ ] Investigator credentials where claimed
[ ] Regulator authorisation if the business claims regulated status
[ ] Professional insurance where relevant
[ ] Independent references

Case claim

[ ] Transaction hashes identified
[ ] Loss chronology matches your records
[ ] Alleged destination service identified
[ ] Evidence distinguishes fact from inference
[ ] No unsupported guarantee of recovery

Authority

[ ] Legal basis for action explained
[ ] Jurisdiction identified
[ ] Court / police / regulator involvement independently verified
[ ] Exchange freeze independently confirmed where claimed

Fees

[ ] Written engagement
[ ] Transparent fee structure
[ ] Invoice from identified legal entity
[ ] No changing “release” fees
[ ] No unexplained payments to third-party wallets

Wallet security

[ ] No seed phrase request
[ ] No private-key request
[ ] No unexplained wallet connection
[ ] No remote-access request
[ ] No blind signature request

If a provider fails the identity or authority checks, do not rely on its tracing report or recovery promise.

Questions to ask a recovery firm before paying anything

Ask these questions in writing:

What is your full legal company name?
In which jurisdiction are you registered?
Who specifically will handle the case?
What professional licence or credential does that person hold?
Which transaction hashes have you traced?
Which conclusions are confirmed facts and which are analytical inferences?
Which exchange or custodian allegedly controls the destination?
Has that institution independently confirmed a freeze?
What legal mechanism would allow the funds to be returned?
Which country or court has jurisdiction?
What exactly does your fee pay for?
What happens if nothing is recovered?
Do you guarantee recovery?
Why did you contact me?
Where did you obtain information about my loss?

A legitimate professional may not be able to answer every investigative detail immediately.

They should be able to establish who they are, what service they provide and what they do not control.

Red flags by recovery persona

Persona	Typical claim	Verification problem
Fake investigator	“We traced and froze your crypto.”	Tracing does not itself create control over assets
Fake lawyer	“A court recovered your funds.”	Law firm, lawyer and case must be independently verifiable
Fake IC3 / police officer	“Government recovered your money.”	Verify directly with the agency; IC3 does not charge recovery fees
Fake exchange employee	“Your funds are waiting in an exchange account.”	Contact the real exchange through its official domain
Recovery company	“Guaranteed 100% recovery.”	Outcome cannot normally be guaranteed
Wallet-recovery site	“Connect wallet to receive refund.”	May request malicious approvals or signatures
Tax agent	“Pay tax before release.”	Tax authority and payment destination must be independently verified

What to do immediately after an initial crypto loss

The period immediately after discovering a scam is important.

1. Stop additional payments

Do not send:

More investment capital
Withdrawal fees
Taxes
Recovery fees
Verification deposits
Account-upgrade payments

until the request is independently verified.

2. Preserve the original evidence

Save:

Scam website
Domain
App
Account pages
Chat history
Emails
Phone numbers
Usernames
Bank accounts
Wallet addresses
Transaction hashes
Screenshots
Deposit instructions
Withdrawal demands
Claimed licences
Identity documents shared

Do not rely only on cropped screenshots.

Preserve original files where possible.

3. Secure accounts

Check:

Email
Exchange accounts
Bank accounts
Wallets
Cloud storage
Password manager
Phone number

Revoke unknown sessions and reset reused passwords.

4. Review wallet approvals

If you connected a wallet to a suspicious site, inspect token approvals and signed permissions.

Move unaffected assets only after confirming the destination wallet and device are secure.

5. Contact the funding institution

If the transaction involved:

Bank
Card
Payment service
Legitimate crypto exchange

report the fraud promptly.

Ask what:

Recall
Fraud
Account-security
Record-preservation

options exist.

The FTC recommends reporting fraudulent transactions to the financial or payment company involved and asking whether reversal options are available.

Reporting a crypto recovery scam

For US victims, reports can be submitted to the FBI's Internet Crime Complaint Center.

Include:

Transaction hashes
Wallet addresses
Amounts
Dates
Domain names
Emails
Phone numbers
Social-media profiles
Bank details
Recovery-provider information
Original scam details

FBI Internet Crime Complaint Center

Fraud can also be reported through:

FTC ReportFraud

Reporting does not guarantee recovery.

It creates a record that can support investigations and connect related complaints.

Protect yourself from the second approach

After reporting a loss publicly, assume that anyone contacting you may have read the same information.

Do not publish unnecessarily:

Full name
Phone number
Email
Full loss amount
Wallet seed information
Identity documents
Bank statements

A wallet address may need to be shared with legitimate investigators or authorities.

Publishing it openly can also attract automated recovery solicitations.

Where professional help is needed, choose the provider yourself through:

Established law-firm directories
Bar associations
Known forensic firms
Regulator or law-enforcement guidance
Independent professional referrals

Do not select the person who happened to reply first under a complaint post.

Cexvia's recovery-scam decision tree

Recovery offer received
        │
        ├── Did you initiate contact?
        │      │
        │      ├── No
        │      │      → Treat as high-risk until verified
        │      │
        │      └── Yes
        │
        ├── Can legal identity / credentials be verified independently?
        │      │
        │      ├── No
        │      │      → Stop
        │      │
        │      └── Yes
        │
        ├── Is the tracing claim supported by real transaction evidence?
        │      │
        │      ├── No
        │      │      → Stop
        │      │
        │      └── Yes
        │
        ├── Does the provider claim funds are frozen?
        │      │
        │      ├── Yes
        │      │      → Verify with controlling exchange / authority
        │      │
        │      └── No
        │
        ├── Is recovery guaranteed?
        │      │
        │      ├── Yes
        │      │      → Major red flag
        │      │
        │      └── No
        │
        ├── Is an advance release / tax / bond payment required?
        │      │
        │      ├── Yes
        │      │      → Verify independently before any payment
        │      │
        │      └── No
        │
        └── Wallet access requested?
               │
               ├── Seed / private key / remote access
               │      → Stop
               │
               └── No
                      → Review written engagement and legal route

How this connects to fake exchanges and withdrawal traps

Recovery scams often begin after another crypto fraud pattern.

The sequence can be:

Fake exchange
      ↓
Withdrawal blocked
      ↓
Victim realizes platform may be fraudulent
      ↓
Victim posts complaint
      ↓
Recovery scammer makes contact
      ↓
Second advance-fee fraud

For that reason, Cexvia treats these topics as connected but distinct.

Fake exchange verification

Use:

How to Spot a Fake Crypto Exchange: 12 Red Flags and Verification Checks

Withdrawal problems

Use:

Crypto Exchange Withdrawal Problems: How to Diagnose Delays, Holds and Missing Transfers

Account restrictions

Use:

Crypto Exchange Account Frozen: Security Holds, Compliance Reviews and What to Do

The goal is to identify whether the problem is:

A legitimate exchange process
An exchange-wide operational issue
A fake trading platform
A secondary recovery scam

Those require different actions.

Frequently asked questions

Are crypto recovery companies legitimate?

Some forensic, legal and investigative businesses provide legitimate services related to tracing and recovery.

The existence of legitimate providers does not make an unsolicited recovery offer trustworthy.

Verify the company's identity, credentials, evidence, legal mechanism and fee structure independently.

Can stolen crypto actually be recovered?

Sometimes.

Recovery can be possible when assets reach a cooperative centralized service, when law enforcement or a court can restrain assets, or when funds are recovered through legal proceedings.

Many cases remain unrecovered, and no private company can guarantee the result.

Can a blockchain investigator freeze crypto?

A private blockchain analyst can trace transactions and provide evidence.

Tracing alone normally does not create legal control over another person's wallet or exchange account.

An exchange, custodian or authority with the necessary legal power would need to take the relevant restriction or recovery action.

Why does the recovery company know exactly how much I lost?

The information may come from:

Public complaint posts
Public blockchain data
The original scam operation
Shared or sold victim information

Knowledge of your loss is not proof that the recovery company is legitimate.

Does IC3 contact crypto scam victims to recover money?

The FBI has warned that scammers impersonate IC3.

IC3 states that it does not ask people to pay to recover funds and does not refer victims to companies that charge for recovery.

Verify any claimed FBI or IC3 contact independently.

Is a crypto recovery lawyer safer than a recovery company?

A genuine lawyer can provide legitimate legal services.

The word “lawyer” alone is not verification.

Check the lawyer's professional registration, law firm, office contact details and any claimed court case independently.

Should I pay an upfront recovery fee?

An upfront professional retainer can exist in legitimate legal or forensic work, but it should be documented in a verifiable engagement with an identifiable provider.

That is materially different from repeated crypto payments described as release fees, taxes, court bonds or blockchain validation charges.

Unexpected recovery offers demanding advance payment are a major scam warning.

Should I pay tax before recovered crypto is released?

Do not send a tax payment to a private wallet based only on a recovery message.

Verify any tax obligation independently with the relevant tax authority or qualified professional.

Can a recovery site ask me to connect my wallet?

Treat unexpected wallet-connection requests as high risk.

Do not connect a valuable wallet or sign unexplained transactions merely to “verify ownership” or receive supposed recovered funds.

Does a blockchain tracing report prove the crypto belongs to me?

No.

A tracing report can provide transaction evidence.

Legal ownership and entitlement to recovery can require additional documentation and legal analysis.

What should I do if I already paid a recovery scammer?

Stop further payments.

Preserve both the original scam and recovery-scam evidence, secure relevant accounts and wallets, contact the institutions used to send funds, and report the new transactions to the appropriate authorities.

Conclusion

Crypto recovery scams work because the victim has already experienced a real loss.

That makes the second promise unusually persuasive.

The recovery scammer may have genuine transaction data, know the exact amount lost and use the identity of a real law firm, exchange or government agency.

None of those facts proves that the person contacting the victim has authority to recover anything.

Use this verification chain:

identity → credentials → transaction evidence → tracing conclusion → legal authority → controlling institution → fees → wallet access

A legitimate professional should be able to explain the limits of what they can do.

A scammer usually sells certainty:

“Your funds are recovered.”

“Pay this fee.”

“One final payment.”

Recovery is possible in some cases, but it is conditional, evidence-dependent and rarely guaranteed.

After an initial crypto loss, the priority should be to preserve evidence, secure remaining assets, report through genuine channels and independently select any professional assistance.

Do not let the first loss create the conditions for a second one.

Primary sources and Cexvia resources

*Cexvia evaluates centralized exchanges and related risk events using publicly verifiable evidence. Scam and identity verification are separate from exchange risk scoring. Recovery outcomes depend on the facts, jurisdiction, destination services and legal process; Cexvia does not guarantee asset recovery or recommend a specific recovery provider.*

The short answer

Why crypto scam victims are targeted again

Public complaint posts

Data from the original scam

Public blockchain data

Cexvia's recovery-offer verification model

1. Unsolicited recovery contact is a major warning sign

2. Fake IC3, police and regulator impersonation

FBI warning about IC3 impersonation

Verification rule

3. Fake law firms can look extremely convincing

How to verify a law firm

4. A blockchain tracing report does not prove funds are recoverable

What tracing can establish

What tracing alone does not establish

5. “Your funds are already frozen” requires independent confirmation

Ask who controls the funds

6. Advance-fee recovery is the core scam pattern

7. A “tax before recovery” claim requires independent verification

8. Wallet connection can replace the obvious advance fee

Recovery rule

9. Seed phrase or private-key requests are disqualifying

10. Fake exchange employees can create a second fake platform

Verify through the real exchange

11. “We work with the FBI / regulator” requires direct verification

12. Real recovery does exist—but it is conditional

Recovery is evidence-dependent

What legitimate professionals can actually do

Blockchain forensic provider

Lawyer

Exchange

Law enforcement

Recovery-provider verification checklist

Identity

Credentials

Case claim

Authority

Fees

Wallet security

Questions to ask a recovery firm before paying anything

Red flags by recovery persona

What to do immediately after an initial crypto loss

1. Stop additional payments

2. Preserve the original evidence

3. Secure accounts

4. Review wallet approvals

5. Contact the funding institution

Reporting a crypto recovery scam

Protect yourself from the second approach

Cexvia's recovery-scam decision tree

How this connects to fake exchanges and withdrawal traps

Fake exchange verification

Withdrawal problems

Account restrictions

Frequently asked questions

Are crypto recovery companies legitimate?

Can stolen crypto actually be recovered?

Can a blockchain investigator freeze crypto?

Why does the recovery company know exactly how much I lost?

Does IC3 contact crypto scam victims to recover money?

Is a crypto recovery lawyer safer than a recovery company?

Should I pay an upfront recovery fee?

Should I pay tax before recovered crypto is released?

Can a recovery site ask me to connect my wallet?

Does a blockchain tracing report prove the crypto belongs to me?

What should I do if I already paid a recovery scammer?

Conclusion

Primary sources and Cexvia resources

Related research

How to Spot a Fake Crypto Exchange: 12 Red Flags and Verification Checks