It is unfortunately common for victims of a cryptocurrency theft or scam to be targeted a second time, by someone claiming they can recover the stolen funds in exchange for an upfront fee. The pitch is usually a fast, near guaranteed recovery, contingent on a payment made before any real work begins.
How the approach usually starts
Contact often comes unprompted, through a comment on a public post about the original theft, a direct message, or a cold email referencing details that make the sender sound informed. That apparent familiarity with your case is designed to build instant credibility, not evidence that the person actually has any ability to help.
Why the fee structure itself is the tell
Legitimate investigative work is billed for the analysis performed, not as a percentage of funds promised to be recovered, and no legitimate firm can promise a specific recovery outcome. Blockchain transactions cannot be reversed by anyone, including the platforms the funds passed through, which is exactly why no one can honestly guarantee a result before any work has started.
A request for payment before any documented analysis has taken place, from someone who contacted you rather than the reverse, is close to a guaranteed sign of this scam, regardless of how credible the outreach sounds.
What to do if you are contacted this way
Verify the identity of anyone offering recovery services independently, through channels you find yourself rather than ones they provide. Do not send any additional cryptocurrency, and treat urgency, a claimed narrow window to act, as a pressure tactic rather than a genuine constraint. A legitimate investigator will still be available tomorrow.
If you are unsure whether an offer is genuine, it is reasonable to ask for a written explanation of how fees are billed before sharing any case details. A firm that cannot answer that plainly, or that becomes evasive when pressed, has told you what you need to know.