Crypto Recovery Scams: How to Spot Fake "Wallet Recovery" Services
By Merunas Grincalaitis, founder of MEV DAO and a developer who builds MEV, sniping and trading bots on Ethereum. Last updated: October 2026.
TL;DR: A crypto recovery scam targets people who already lost money, promising to trace, "hack back" or legally recover their crypto for an upfront fee, then disappearing or asking for more. The FBI's 2025 Internet Crime Report logged 10,516 recovery scam complaints with $1.4 billion in reported losses. The tells are consistent: they contact you first, want money or your seed phrase upfront, guarantee results, or claim ties to the FBI, FTC or a law firm. Real help doesn't work that way. Law enforcement doesn't charge victims, and stolen crypto can't be reversed by anyone with a "special tool."
I build rescue and MEV tooling on Ethereum, so I talk to a lot of people right after they've lost funds. The second loss is the one that frustrates me most. Someone gets drained, posts about it, and within an hour they're talking to a "blockchain investigator" who wants 0.5 ETH to start. This guide is about recognising that pattern before you pay.
What is a crypto recovery scam?
It's a follow-up scam aimed at people who have already been scammed or hacked. The scammer offers to get your money back and charges you for it, then delivers nothing. The FTC calls refund and recovery scams "the worst of the worst" for that reason.
The numbers are large. In the FBI's 2025 Internet Crime Report, recovery scams with a cryptocurrency link produced 10,516 complaints and $1.4 billion in reported losses, with victims over 60 reporting about $540 million of that. The FBI notes that those losses can include money lost in the earlier scam that led to the recovery contact, and it flagged an increase in complaints about people impersonating government officials and recovery firms.
How do recovery scammers find you?
Mostly, you find them, or your earlier loss leads them to you. There are three common ways:
- Public posts. Write "my wallet got drained" on X, Reddit or Discord and the replies fill up with accounts pointing you to a "recovery expert." Many are bots, and the accounts vouching for them are often the same operation.
- Victim lists. The FTC explains that scammers buy and trade "sucker lists" of people who have paid scammers before, with details of how much they lost.
- The original scammer. If you lost money to a fake investment platform, the same group may come back under a new name offering to recover it. The FBI's 2025 report says victims of crypto investment fraud are also targeted in recovery scams.
On-chain, your loss is public too. Anyone can see that your address sent its balance to a drainer, which makes "we noticed the theft on your wallet" a believable opening line.
What do fake recovery services look like in 2026?
They change their branding often, but the playbook is stable. These are the versions I see most, with the primary sources that describe them:
| Disguise | What they claim | What gives them away |
|---|---|---|
| "Blockchain forensics" firm | They've traced your funds and need a fee to "release" them | A tracing report you can't verify, then new fees at each step (FBI) |
| Fictitious law firm | They work with the FBI, CFPB or a court on your case | Requests for bank details and upfront fees; the FBI says victims lost over $9.9 million to these between February 2023 and February 2024 (FBI) |
| Government impersonator | They're from the FTC, FBI or IC3 | Contact by text or messaging app, sometimes with a photo of a fake ID (FTC) |
| "Ethical hacker" | They can hack the scammer's wallet or "reverse" the transaction | Neither is possible on Ethereum; payment in crypto only |
| Fake whitehat or rescue helper | They'll rescue your remaining tokens if you send your seed phrase | They contact you first, and want your key instead of giving you a tool you run |
That last one is the most dangerous for drain victims, because it borrows from something real. Legitimate rescues of tokens left in a compromised wallet do exist (I cover how they work below). The difference is who reaches out to whom, and whether a stranger ends up holding your key.
What can actually be recovered, and by whom?
Less than recovery scammers promise, but more than nothing. It depends on where the funds are now.
| Where the funds are | Can they be recovered? | Who can realistically help |
|---|---|---|
| Still in your compromised wallet | Often yes | You, with a Flashbots bundle; the Flashbots Whitehat Hotline; a rescue tool you run yourself |
| Sent to a centralised exchange | Sometimes, if frozen quickly | The exchange, through its own process or legal process, triggered by your report |
| Sitting in the attacker's wallet | Rarely | Law enforcement, if they act on a report; your own lawyer through civil action |
| Bridged, mixed or swapped away | Practically no | Nobody can reverse it |
The FBI is direct about the limits in its 2023 warning on recovery scams: private recovery companies can't issue seizure orders, exchanges only freeze accounts through their internal processes or legal process, and law enforcement doesn't charge victims for investigating. If a company says it can make an exchange release your funds once you pay a fee, that claim alone tells you what it is.
For funds still in a drained wallet, the real route is technical, not legal. A sweeper bot takes any ETH you send for gas, so the transfers have to go in a private bundle with a funding transaction, all in one block. The Flashbots Whitehat Hotline does this for free when remaining assets exceed $1,000, accepts requests only through whitehat.flashbots.net, and says it can't get back funds that have already left. You can also do it yourself, as in my Flashbots guide to rescuing tokens, or compare the options in sweeper bot rescue: your options.
How do you check a recovery offer before you pay anything?
Run it through these questions. One "yes" is enough to walk away.
- Did they contact you first? A reply to your post counts. Legitimate firms and agencies don't cold-message victims on X or WhatsApp.
- Do they want money upfront? The FTC lists the labels scammers use: "retainer fee," "processing fee," "administrative charge," "tax". Calling it something else doesn't change it.
- Do they want payment in crypto, gift cards or wire transfer? The FTC says only scammers insist on these.
- Do they guarantee results? Nobody can guarantee that stolen crypto comes back.
- Do they claim to work with the FBI, FTC or a court? Look up the agency's contact details yourself and call them. Don't use the number they gave you.
- Do they want your seed phrase or private key? Never give it to anyone. A legitimate rescue tool runs on your machine, and the Flashbots hotline uses its own submission process.
- Can they explain, in plain technical terms, how they'll get the funds back? "Proprietary tracing software" and "hacking the scammer's wallet" are not explanations.
What should you do instead?
Do the things that cost nothing and actually help:
- Save what's still in the wallet before anything else. If you were drained in the last hour, my first-hour checklist for a drained wallet covers the order.
- Report it. In the US, file at ic3.gov with the transaction hashes, addresses, amounts and dates the FBI asks for, and at ReportFraud.ftc.gov. Elsewhere, go to your local police. Reporting the scam addresses on Chainabuse helps warn others.
- Contact the exchange if your funds went to one, with your report number.
- Talk to a lawyer you found yourself if the amount justifies civil action. A firm that found you is the red flag in the table above.
If you've already paid a recovery scammer, stop paying, even if they say one more fee will release everything. Report the second scam the same way, and contact the platform or exchange you paid through about reversing it, as the FTC suggests for anyone who paid a scammer.
Frequently asked questions
Are crypto recovery services legit?
Almost every service that contacts you after a loss and asks for an upfront fee is a scam. Legitimate help exists, but it comes from law enforcement, exchanges, your own lawyer, or rescue tools you run yourself, and none of it starts with a cold message.
Can someone hack a scammer's wallet to get my crypto back?
No. Without the scammer's private key nobody can move funds out of their wallet, and Ethereum transactions can't be reversed. Anyone offering to "hack back" is running a scam.
Does the FBI charge a fee to recover stolen crypto?
No. The FBI says law enforcement doesn't charge victims to investigate, and the FTC says its real employees won't text you or message you on apps like WhatsApp to prove who they are.
How do recovery scammers know I lost money?
From your public posts asking for help, from lists of past victims that scammers buy and trade, or because they ran the original scam. Your on-chain losses are also visible to anyone.
I already paid a recovery service. What now?
Stop sending money, save every message and payment detail, and report it at ic3.gov and ReportFraud.ftc.gov. Contact the exchange or payment provider you used right away and ask whether the payment can be stopped.
Related guides
- Wallet Drained? What to Do in the First Hour (Ethereum Checklist)
- Rescue Tokens From a Compromised Wallet: Sweeper Bot Rescue Service
- The YouTube MEV Bot Scam: How the Remix Contract Drains Your ETH
- MEV Bot for Sale: What's Real, What's a Scam, and What It Should Cost
If you still have tokens stuck in a compromised wallet, MEVDAO's Token Rescue Bot moves them out with a Flashbots bundle while your key stays on your own machine. It's included in the MEVDAO subscription, and you can start a 3-day free trial. If you're unsure whether an offer you got is real, message me on Telegram before you pay anyone.