Realizing you have been scammed out of cryptocurrency triggers a very specific kind of panic. The transaction is already confirmed on the blockchain, the person or platform you trusted has usually gone quiet or vanished, and every guide you find online seems to either promise an easy fix or offer none at all. Neither extreme is accurate. There is a right order of operations, and following it matters, both for the small chance of recovering funds and for protecting what you have left.
This guide walks through what to do after a crypto scam in the order it should actually happen, starting within the first hour and continuing through the following weeks. It is written for the moment right after discovery, when clear thinking is hardest and mistakes are most costly. None of the steps below require special technical skill. What they require is discipline about the order in which you do them, since acting out of sequence, for example reporting before securing remaining funds, or confronting a scammer before documenting the conversation, can make an already bad situation measurably worse.
Step One: Stop the Bleeding Before You Do Anything Else
Before reporting anything or contacting anyone, address whatever access the scammer may still have. If you shared a seed phrase, private key, or granted a wallet connection or token approval, assume that wallet is fully compromised and treat any remaining funds in it as being at risk right now, not later.
- Move any remaining funds in the affected wallet to a new wallet with a freshly generated seed phrase, using a different device if you suspect malware
- Revoke any token approvals or contract permissions the scammer's platform or dApp may have obtained, using a reputable revocation tool
- Change the password on your email, exchange accounts, and any password manager if you entered credentials on a fake site
- Enable or reset two factor authentication on every financial account, and check for authenticator app entries you do not recognize
- If a work device was involved, notify your IT or security team immediately, since the exposure may extend beyond your personal accounts
If any part of a wallet's seed phrase or private key was ever entered anywhere other than the original wallet software, that wallet should be treated as permanently compromised, not just the specific funds that were taken.
A common misconception worth correcting here
Many victims assume that because a scam transaction is already confirmed on the blockchain, there is nothing left to protect and no urgency to act quickly. That assumption is wrong and it is one of the more costly mistakes people make in the first hour. The original theft is only one event. If the scammer obtained a seed phrase, a private key, or an active token approval, they typically retain the ability to drain any funds you add to that same wallet later, intercept future deposits, or exploit the same access against a connected account. Treating the compromise as ongoing, rather than as a single completed event, is the difference between losing one transaction and losing everything that ever touches that wallet again.
Step Two: Document Everything While It Is Fresh
Evidence in crypto fraud cases has a habit of disappearing. Fake platforms go offline, Telegram accounts get deleted, and phishing domains get taken down within days. Capture what you can immediately, even before you have decided who to report to.
- The transaction hash or ID for every transfer connected to the scam, along with the sending and receiving wallet addresses
- Screenshots of every conversation, including usernames, profile links, and timestamps, not just the final messages
- The URL of any website or app involved, along with screenshots of the site itself, since it may not stay online
- Any promotional material, contracts, or documents the scammer sent you
- A simple written timeline in your own words: how you were first contacted, what was promised, and when funds were sent
This documentation forms the basis of both your official reports and any investigative work that follows. For a more detailed breakdown of what to preserve and why, see our guide on the first 24 hours after a crypto theft.
Organize it before you need it
It helps to put all of this into a single folder or document rather than leaving it scattered across screenshots, emails, and app notifications, because you will likely be asked to repeat the same information to more than one agency, exchange, or investigator. A simple table with the date, the transaction hash, the amount, the sending and receiving addresses, and a short note on what happened at each step is enough. This also makes it far easier to hand the case to a lawyer or investigator later without having to reconstruct the timeline from memory, which gets less reliable the more time passes.
- A single running document with dates, amounts, wallet addresses, and transaction hashes in chronological order
- Copies of identification documents, if any were shared with the scammer, since this may affect identity theft exposure separately from the financial loss
- Bank or card statements showing any fiat transfers used to purchase the cryptocurrency that was later sent to the scammer
- Names, usernames, phone numbers, and any wallet addresses associated with the scammer, even ones that seem irrelevant at the time
Step Three: Report It, and Report It Correctly
Reporting a crypto scam will not usually reverse the transaction on its own, but it accomplishes several things that matter: it creates an official record, it can trigger action against exchange accounts still holding your funds if you move quickly, and it feeds into broader law enforcement pattern recognition that occasionally does lead to arrests and asset seizures.
Who to contact
- The FBI Internet Crime Complaint Center at ic3.gov, which is the primary federal intake point for cryptocurrency fraud in the United States
- The Federal Trade Commission at reportfraud.ftc.gov, particularly relevant if an investment platform or advertisement was involved
- Any exchange whose wallet addresses appear in the fund flow, since exchanges can sometimes flag or freeze an account tied to a reported theft if contacted quickly and with a case or report number
- Your local police department, which may seem unhelpful for a crypto case but is sometimes necessary for insurance claims or as a prerequisite for other reports
- If you are outside the United States, your national cybercrime reporting body, such as Action Fraud in the UK or your equivalent national police cybercrime unit
Type these addresses directly into your browser rather than clicking a link from a search ad or a message, since scammers have built convincing fake versions of both IC3 and FTC reporting pages to harvest information from people trying to report fraud.
Step Four: Understand What Happens Next, Realistically
A single report to a government agency does not trigger an individual investigation into your case in most instances. These agencies aggregate reports to identify large scale patterns and to support broader enforcement actions, and your report becomes part of that dataset. Individual case investigation, meaning the work of actually tracing where your specific funds went and identifying a viable path forward, is a separate track.
That is where blockchain tracing comes in. Investigators can follow the path stolen funds took across wallets and, where they eventually settled on a service that can be legally compelled to respond, such as a centralized exchange. Our guide on how blockchain investigators actually trace stolen funds explains that process in detail. Coin Trace performs this kind of tracing and prepares findings that can support law enforcement referrals or legal action, though it is important to be direct that tracing where funds went is not the same as recovering them, and outcomes vary by case.
When Legal Counsel Typically Gets Involved
Not every case needs a lawyer, but several situations tend to call for one specifically. If the loss is large enough to justify the cost of civil litigation, if tracing has identified a specific exchange or custodial wallet holding the funds, or if the scam involved a business account, employer funds, or a fiduciary relationship, legal counsel usually becomes part of the picture at some point. A lawyer experienced in crypto asset recovery can issue a formal preservation letter to an exchange asking it to freeze an account while a subpoena is prepared, file what is sometimes called a John Doe lawsuit against an unidentified defendant identified only by wallet address, and pursue civil discovery that can compel an exchange to disclose account holder information faster than a criminal referral alone might move.
Coordination matters here. Tracing findings are most useful to a lawyer when they are documented clearly enough to be attached to a legal filing, which is part of why working with an investigator before engaging counsel, or in parallel with them, tends to produce a stronger case than either step taken alone.
A Worked Example of How This Typically Plays Out
Consider a common pattern: a victim is contacted through social media by someone posing as an investment advisor, builds a relationship over several weeks, and eventually sends funds to what appears to be a legitimate trading platform. The platform shows a growing balance, then blocks withdrawals and demands a tax or release fee. The victim realizes it is a scam only after that fee is refused and the platform stops responding entirely.
In this scenario, Step One means checking whether any wallet credentials were shared with the platform, which is common since many fake platforms ask users to connect a wallet or import a key for supposed verification purposes. Step Two means preserving every message from the advisor, the platform's URL and screenshots, and every transaction hash tied to each deposit. Step Three means filing with IC3 and the FTC, and separately contacting any exchange that appears in the fund flow, since the initial deposits often pass through a real exchange before reaching the fake platform's wallet. From there, tracing work picks up where the funds went after leaving the fake platform's control, which is frequently the point where a viable exchange chokepoint, if one exists at all, becomes visible.
Step Five: Watch for the Second Scam
This is arguably the most important step in this entire guide, because it is the one most victims are not prepared for. Within days of a public report, a social media post, or even just an online forum comment about a crypto loss, victims are frequently contacted by someone offering to recover the stolen funds, often for an upfront fee.
These recovery scams work because they arrive when a victim is emotionally desperate and financially motivated to believe a fix exists. See our guide on how cryptocurrency recovery scams work for a full breakdown, but the short version is this: no legitimate recovery process requires you to pay a fee upfront, send additional cryptocurrency to unlock funds, or hand over a seed phrase or private key to anyone, under any circumstances.
Legitimate investigators and legitimate law enforcement do not cold contact scam victims offering recovery services. If someone reaches out to you first, that is itself a red flag, regardless of how credible they sound.
Step Six: Take Care of Yourself, Not Just the Case
Victims of crypto scams often carry significant shame, on top of the financial loss, which keeps many people from reporting at all or from talking to family about what happened. That shame is misplaced. Cryptocurrency scams, especially the relationship based and impersonation varieties, are engineered by organized groups with scripts, trained handlers, and psychological tactics refined across thousands of victims. Being targeted is not a reflection of carelessness or gullibility.
Practically, that means telling at least one trusted person what happened, since isolation is exactly what a follow up recovery scam depends on, and being patient with yourself about the timeline. Tracing, reporting, and any legal process that follows can take weeks or months, not days.
It is also worth acknowledging the financial stress that follows a significant loss separately from the case itself. If the funds involved were needed for near term expenses, contacting creditors proactively, reviewing whether any tax loss can be claimed, and being cautious about taking on new debt to make up the shortfall are all reasonable steps that have nothing to do with the scam investigation but matter just as much to getting through the aftermath.
A Realistic Summary of the Path Forward
Recovery is never guaranteed, and anyone who tells you otherwise is not being straight with you. What is realistic is this: securing what remains, documenting the incident thoroughly, reporting it through the correct official channels, and pursuing tracing and legal avenues where a viable path exists. See our guide on whether stolen cryptocurrency can be recovered for a full, honest look at how that process works and what outcomes actually look like.
Frequently asked questions
No. Do not confront the scammer, ask for your money back, or send any further payment they request, including fees framed as taxes, release charges, or verification deposits. Continued contact rarely produces useful evidence and often leads directly into a second extortion attempt.
Local police can file an official report, which may be required for insurance or tax purposes, but most do not have the specialized tools to trace blockchain transactions themselves. Federal reporting through IC3 and, where relevant, dedicated blockchain tracing work tend to be more directly useful for the investigative side.
As quickly as possible. If funds are still sitting in an identifiable wallet or have recently moved to a centralized exchange, speed matters, since exchanges can sometimes freeze an account when contacted promptly with a report number and transaction details, before the funds are withdrawn or converted further.
Yes. Individual reports feed into pattern recognition that agencies and investigators use to identify larger criminal operations, and a wallet address involved in your smaller loss may reappear in a much larger case. It also creates a documented record if the same actor targets you again.
Not immediately in most cases. The first priority is securing remaining funds, documenting the incident, and filing official reports. Legal counsel tends to become relevant once tracing has identified a specific exchange or entity holding the funds, or when the loss is large enough to justify civil litigation, at which point a lawyer can pursue subpoenas, preservation letters, or a civil suit.
Yes, it is worth notifying your bank or card issuer, particularly if you are concerned about further unauthorized activity or if you plan to explore any dispute options for the original purchase of the cryptocurrency, even though the bank generally cannot reverse the later crypto transaction itself.
Sources and further reading
- Internet Crime Complaint Center (IC3), Cryptocurrency Crime Information · Federal Bureau of Investigation
- Refund and Recovery Scams · Federal Trade Commission
- Cryptocurrency Investment Fraud · Federal Bureau of Investigation