If money has just left your wallet or your exchange account, the next few hours matter more than anything you do later. Evidence disappears, accounts get closed, and the people who took the funds move them on quickly. This guide sets out what to do first, in the order that actually helps.
Stop sending money
This sounds obvious, and it is the step people skip. Most crypto fraud does not end with one payment. It ends after a chain of them, each one presented as the last obstacle between you and a withdrawal: a tax, a compliance fee, a wallet activation charge, an insurance deposit, a fine for an account flagged by a regulator. None of these are real. No legitimate exchange or regulator ever asks a customer to send more funds in order to release existing funds.
If you are mid-conversation with someone pressing you to pay one more time, stop there. Do not tell them you have worked it out and do not threaten them. Simply stop paying, and start recording.
Secure what is left
- Move any remaining balance to a wallet that has never touched the platform in question, using a seed phrase that has never been typed into any website.
- Revoke token approvals you granted to the platform’s smart contracts. An approval you signed months ago can still drain a wallet today.
- Change the password and reset two-factor authentication on your real exchange accounts and on the email address attached to them.
- Remove any remote-access software you were asked to install, such as AnyDesk or TeamViewer. Being talked through installing one of these is a common part of the pattern.
Preserve the evidence before it vanishes
Fraudulent platforms go offline, chat accounts get deleted, and the website that showed your balance is often gone within weeks. What you capture now is what you will still have in six months.
- Every transaction hash, wallet address and exchange reference for money you sent.
- Full-page screenshots of the platform showing your account, your balance and any withdrawal requests you made.
- The whole conversation, not the highlights — WhatsApp, Telegram, email, the lot. Export it rather than screenshotting selectively.
- The domain name, any company name or registration number the platform claimed, and the names your contacts used.
- Bank statements showing the outgoing payments, if fiat was involved at any stage.
Report it properly
Reporting rarely produces a fast refund, and it is still worth doing. It creates the paper trail that any later action depends on, and it feeds pattern data that regulators use to publish warnings.
Report to your national police or fraud reporting body, to the financial regulator in the country the platform claimed to operate from, and to any exchange that processed your payment — exchanges can sometimes freeze funds that have not yet been moved on, but only if they hear quickly. If a card or bank transfer was involved, tell your bank the same day and ask specifically about a chargeback or recall.
Watch for the second approach
Victim lists get resold. Within weeks of a loss, many people are contacted by someone offering to recover the money — a “blockchain forensics” firm, a lawyer, an agency claiming to work with a regulator. Asking for a fee up front is the tell. So is contacting you first, when you never approached them.
Before you engage anyone, search the firm’s name yourself rather than following a link you were sent, check it against the register of the regulator it claims to be authorised by, and treat a guaranteed outcome as disqualifying. Nobody can guarantee the return of funds already moved across a blockchain.
What a realistic outcome looks like
Some money is recovered, usually where it was paid by card or bank transfer, or where it is still sitting at an exchange that can be reached in time. Funds converted to crypto and moved through several wallets are far harder, and often impossible, to get back. Anyone telling you otherwise before seeing your case is selling something.
Act quickly, document everything, and be as sceptical of the second offer of help as you wish you had been of the first.
