Watch as Web Story: Scammed Out of Crypto? First 24 Hours
Short answer: If you have been scammed out of crypto, the first 24 hours are for stopping further loss, not for getting money back. Confirmed crypto transfers cannot be reversed by any bank, exchange, or government agency. What you can still control is whether the scammer drains more, whether your remaining funds are safe, and whether your report is detailed enough for an exchange or investigator to act on. Do these in order: stop sending anything, secure the wallet, save every piece of evidence, then report to the right place in your country. Anyone who contacts you offering to recover your funds for a fee is running a second scam.
Last updated: 26 October 2026. Reporting routes and tools below were checked against the FBI Internet Crime Complaint Center (IC3), the US Federal Trade Commission, Action Fraud in the UK, and the revocation tools named in Sources. Scam sites and app names change fast — type official addresses yourself instead of clicking links from messages.
Hour 0: stop, do not send more, do not click more
The most expensive mistake after a scam is the second payment. Scammers routinely follow a first theft with a "tax", "fee", "verification deposit", or "account unlock" charge that supposedly releases the original funds. No real exchange, police force, or tax authority works that way. If anyone says you must pay to unlock crypto, that demand is itself the scam.
Stop all contact with the scammer. Do not tell them you have reported them — the FBI's guidance for crypto investment fraud victims says exactly that, because a warning can tip them off to move funds faster or delete accounts. Do not delete chats, emails, or transaction records, even if they are embarrassing. Those records are the evidence.
Do not install any "recovery" software, remote-access tool, or wallet app the scammer — or a stranger who appears afterwards — recommends. Remote-access software on a phone or computer that holds a wallet is a direct route to a second theft.
Scammed out of crypto: first figure out which kind of loss this is
Recovery steps depend on what the scammer actually got. There are three different cases, and mixing them up wastes the hours that matter.
| What happened | What the scammer controls | Your first move |
|---|---|---|
| You signed a bad token approval (a fake site, a "claim" button, a drained DeFi page) | Permission to move specific tokens, not your whole wallet | Revoke that approval, then move remaining tokens |
| You typed your seed phrase or private key into a site, app, or message | The entire wallet, on every network | Make a brand-new wallet and move everything that is left, fast |
| You sent crypto or bank money to a fake investment platform, fake exchange, or impersonator | The funds you already sent (usually gone) | Report to the exchange and the police route below, with transaction details |
If you are unsure which case applies, treat it as the worst one — seed phrase exposed — until you can rule it out. Revoking an approval does nothing if the attacker already has your seed phrase, because they can simply approve new transfers themselves.
Step 1 (first hour): if it was an approval, revoke it
Disconnecting your wallet from a website does not stop a drain. Disconnecting only stops the site from seeing your address. An approval you already signed lives on the blockchain and keeps working whether you stay connected or not. You have to revoke it.
For Ethereum and other EVM networks (BNB Chain, Base, Arbitrum, Polygon and others), open Revoke.cash or Etherscan's Token Approval Checker. You can paste your wallet address in read-only mode first — no connection needed to see the list. Look for unlimited approvals, apps you no longer use, and spenders you cannot identify. Revoking is an on-chain transaction, so it costs a small amount of gas on that network. If you hold USDT on both Ethereum and TRON, check both: TRON is not an EVM network, so use Tronscan's token approvals section for TRON addresses.
Use the real site only. Fake revoke tools are a known trap: a copycat page can trick you into signing a new approval instead of removing one. Type revoke.cash yourself or use a bookmark. Never follow a revoke link from a direct message, a reply, or a search advert.
Revoke first, then move what is left. If a valuable token is still sitting in the wallet and you cannot revoke fast enough, moving it to a fresh wallet can reduce exposure — but that move does not fix the old wallet. Never deposit more into the old address afterwards.
Step 2 (first hour): if your seed phrase leaked, abandon the wallet
This is the hardest step to accept, and the most important one. If your 12 or 24 words were typed into a fake site, pasted into a chat, photographed, or entered into an app you now distrust, that wallet is compromised for good. Changing a password does not help. Revoking approvals does not help. The attacker has the keys.
On a clean device — not the phone or computer you used on the scam site, if you can avoid it — create a brand-new wallet with a fresh seed phrase. Write the words down on paper, offline, and never photograph them. Move every remaining asset to the new wallet, starting with the largest holdings. Then stop using the old wallet entirely. Our guide to keeping your 12 words safe covers storage in detail, and our beginner's wallet guide covers moving funds to a wallet you control.
If you cannot move funds because the network fee is higher than a small remaining balance, leave it. Do not send fresh funds into the old wallet to "cover the fee" — that money goes straight to whoever holds the keys.
Step 3 (first few hours): save the evidence before it disappears
Scam sites, profiles, and chat accounts get deleted quickly. Screenshot everything now, with dates visible where possible:
— Every wallet address involved: yours and the scammer's, on each network.
— Every transaction hash (the long ID shown on a block explorer), the coin, the amount, and the date and time.
— The website address, app name, social media handles, phone numbers, and email addresses used.
— The full chat history: how they first contacted you, what they promised, and what they told you to do, in order.
— Bank or card records, if you paid by bank transfer or card before converting to crypto.
— Any case or reference number an exchange gives you later.
Save the originals, not just screenshots, where you can: export chat history, download email headers, and copy transaction hashes into a plain text file. Investigators and exchange compliance teams ask for transaction hashes and addresses first. A report that says "I lost some Bitcoin" with no hash or address is very hard to act on.
Worked example (labeled as an example, not a real case): suppose you sent 0.5 ETH to an address after clicking a fake "claim" page, then signed an unlimited USDT approval on the same page. Your evidence file should list: the 0.5 ETH transaction hash, the scammer's receiving address, the approval transaction hash, the fake site's address, and the time of each step. That file is what you attach, in summary form, to every report below. It also tells you the order of your own fixes: revoke the USDT approval first (it is still live), then decide whether the wallet itself is compromised.
Step 4: report it — US and UK routes compared
| United States | United Kingdom | |
|---|---|---|
| Main police / crime report | FBI Internet Crime Complaint Center (IC3) at ic3.gov | Action Fraud online or on 0300 123 2040 (Scotland: Police Scotland on 101) |
| Consumer fraud report | FTC at ReportFraud.ftc.gov | Report to Action Fraud; check FCA warnings for the firm or site |
| Extra route if relevant | SEC for securities-style schemes; CFTC for derivatives or commodity-style fraud | Your bank immediately, on a number from your card or statement — call 159 can connect you to most UK banks |
| What you get back | An IC3 complaint reference; FTC confirmation page | A crime reference number — keep it for your bank and any later claim |
In the US, start with IC3. The FBI's crypto guidance asks for how the scammer first contacted you and how they identified themselves, plus transaction details: dates, amounts, wallet addresses, transaction hashes, and the receiving institution where known. File even if no money was lost — the FBI encourages reports from targets as well as victims, because the pattern is what links cases. File a separate FTC report too: the FTC does not investigate individual complaints, but it feeds reports into a database used by law enforcement agencies, and it helps build cases against repeat schemes. If you are 60 or older and need help filing, the Justice Department's Elder Justice Hotline is 1-833-FRAUD-11 (833-372-8311).
In the UK, start with Action Fraud and your bank. Call your bank first if any bank payment was involved — banks can sometimes stop a payment that has not cleared, and they need the crime reference number Action Fraud gives you. Action Fraud reports go to the National Fraud Intelligence Bureau, which links reports about the same addresses, sites, and phone numbers. If a bank transfer is involved, speed matters more than completeness: report to the bank with what you have, then add detail to the Action Fraud report afterwards.
Report to the exchange as well, in both countries. If funds went to or through a named exchange, contact that exchange's support or compliance team directly, through its official site — not through a link anyone sent you. Include the scammer's wallet address, the transaction hash, the date and time, and your IC3 or Action Fraud reference if you already have one. Exchanges can freeze an account faster than law enforcement can, but only while funds are still sitting there. Scammers move funds through several wallets quickly, so this report is also time-sensitive. Our guide to locking down your exchange account covers the account settings to check on your own account at the same time.
Report the address and the site, too. Flag the scammer's address on the relevant block explorer, report the site to the platform hosting it, and submit the case to Chainabuse, the industry reporting portal, so other users see the warning. These steps do not recover funds, but they are how the next victim gets warned before sending anything.
What honest recovery looks like — and what it does not
Be blunt about odds. A confirmed blockchain transfer is irreversible by design. There is no central authority that can reverse it, and no legitimate company can "hack it back". Recovery is possible in narrow cases only: funds frozen on an exchange before withdrawal, funds seized in a law-enforcement case, or a bank payment reversed before it clears. Most individual scam losses are not recovered. Any article or service that promises otherwise is selling something.
That honesty matters because the second scam is built on hope. After a loss, victims get messages from fake "recovery firms", fake IC3 or FBI impersonators, and fake lawyers, all asking for an upfront fee, a tax payment, or remote access. The FBI warns that the real IC3 never contacts victims by phone, email, social media, or messaging apps to offer recovery, never asks for payment to recover funds, and never refers victims to a company that charges for recovery. If a "recovery agent" found you first, that is the warning sign, not the credential.
Tax note, not tax advice: in both the US and the UK, a theft loss may have tax implications, but the rules differ and have changed over time. Keep your evidence file and your crime reference number, and ask a qualified tax adviser before claiming anything. Do not let a "recovery" service use a promised tax refund as the reason to charge you a fee.
The 24-hour checklist, in order
1. Stop sending money. Do not pay any fee, tax, or deposit to unlock funds.
2. Do not warn the scammer. Do not delete chats, emails, or transaction records.
3. Revoke suspicious token approvals (Revoke.cash / Etherscan checker; Tronscan for TRON).
4. If your seed phrase leaked, make a new wallet on a clean device and move what is left.
5. Screenshot and save every address, hash, handle, site, and chat, with dates.
6. Call your bank if a bank payment was involved.
7. Report to IC3 (US) or Action Fraud (UK), plus the FTC (US).
8. Report to the exchange the funds passed through, with hashes and your case reference.
9. Flag the address and site so the next person sees a warning.
10. Ignore every recovery offer that arrives unsolicited or asks for a fee.What victims keep getting wrong (from recent reports)
A dead website does not mean a dead approval. If the site that tricked you into signing is gone, the smart contract behind it can still be live, especially if it is upgradeable — check and revoke the approval anyway. A gasless permit signature is a separate permission: revoking a token allowance does not always remove it, so check both.
An app-store listing is not proof a wallet app is genuine. A fake wallet app can reach an official store, and a seed phrase created inside a fake app stays compromised even if you later move that seed to a real desktop appperiod. The fix is a brand-new seed phrase on a clean device, not the same seed on new hardware.
Watch for invented fee pretexts. Scammers demand a "tax", "gas fee", or "withdrawal fee" to release supposed profits. Real exchanges do not collect your tax bill for you, and Bitcoin transfers do not carry a gas fee — either demand is a reason to stop paying, not to pay.
A frozen exchange account is not automatically a seized one. Preserve the exchange's exact message and screenshots, ask for the reason in writing, and keep escalating through the exchange's official support — outcomes can change after review. And when you copy an address from your transaction history, check the full address character by character: scammers plant lookalike addresses in your history (address poisoning) so a careless paste sends funds to them.
>FAQ
Can scammed crypto be recovered?
Sometimes, in narrow cases: funds frozen on an exchange before withdrawal, or funds seized in a law-enforcement case. A confirmed transfer to a wallet the scammer controls cannot be reversed by anyone. Reports still matter — they link cases, freeze accounts, and warn others — but no one can promise recovery.
I only disconnected my wallet from the scam site. Am I safe?
No. Disconnecting stops the site from seeing your address, but an approval you already signed stays live on the blockchain. Revoke the approval, then check whether your seed phrase was also exposed. If it was, the wallet itself must be abandoned.
Should I pay a crypto recovery service?
No. Legitimate investigators do not charge victims an upfront fee to recover crypto, and the FBI warns that recovery-service offers are frequently a second scam. Report through IC3, Action Fraud, and the exchange instead, and keep your evidence file.
What if the scammer is asking for more money to release my funds?
That demand is part of the scam. Real exchanges, police forces, and tax authorities do not ask victims to pay a fee to release seized or frozen crypto. Stop paying, save the messages, and report them with the rest of your evidence.
How long do I have to report?
Report within the first 24 hours if you can, because exchange freezes and bank recalls are time-sensitive. There is no hard deadline that makes a later report useless — older reports still link cases — but every hour reduces the chance funds are still where they can be frozen.
Sources
- FBI / IC3 guidance for cryptocurrency scam victims — IC3: Cryptocurrency
- FTC fraud reporting — ReportFraud.ftc.gov
- Action Fraud (UK) — Action Fraud, telephone 0300 123 2040
- CFTC digital-asset red flags, including reporting routes — CFTC: Curious About Crypto? Watch Out for Red Flags (PDF)
- Token approval revocation tools — Revoke.cash and Etherscan's Token Approval Checker (type the address yourself or use a bookmark; see the warning in Step 1)
- Related Bia Crypto guides linked in the article: seed-phrase safety, beginner wallet guide, exchange-account lockdown
Disclaimer: This article is for education only. It is not financial, legal, or tax advice. Crypto transfers are irreversible, reporting does not guarantee recovery, and exchange and police procedures change. Check the live official pages above before you act.
Related tool: Salary to Hourly Calculator (US) — Work Out What You Really Earn Per Hour (Free Tool)
0 Comments