Fake crypto recovery services: how not to lose twice

What it looks like

You described the theft in comments, a group or a forum. A few hours later a message arrives:

• “I am an ethical hacker, I will recover your USDT in 24 hours”;
• “Crypto law firm, we work with the police”;
• “Your funds have been located and frozen; pay the fee to withdraw them”;
• a “review” from someone who “already got everything back”, linking to the same specialist.

Sometimes they write in the name of an exchange, the USDT issuer, the police or an “international agency”. Logos and stamps on documents are easy to fake.

Signs of fraud

• They found you. Real services do not hunt for victims in comments.
• Upfront payment. Any fee before a recovery: “withdrawal tax”, “insurance”, “unfreeze fee”, “smart-contract payment”.
• A guarantee. “100% back”, “guaranteed result”. Only whoever holds the money can return it: an exchange or the issuer, by decision of law enforcement. No one may promise the result on their behalf.
• They ask for access. Your seed phrase, remote access to your computer, installing an app, signing a transaction “for verification”.
• They rush you. “The window closes today”, “tomorrow will be too late”.
• Messenger only. No company, address or contract; payment only in crypto.

What honest tracing can do

Anyone can follow money on a blockchain: the data is public. Honest tracing:

• shows where the funds went and which of them reached exchanges;
• prepares letters to the exchanges and a summary for the police;
• explains that the exchange, the issuer and the police decide what happens next;
• does not promise a result and does not ask for money for a promise.

GuardPay /stolen starts for free. If you choose full case support, the fee is 20% and only from funds actually recovered; there is no upfront payment. You read and accept the terms before work starts. Recovery is not guaranteed.

If you already paid a “recovery service”

• Do not send anything more, even if they promise a “final payment”.
• Keep the chat, addresses and TXIDs of the payments to the “service”: this is another theft, report it to the police too.
• If you gave access to your computer or phone, change passwords from another device and check your email and wallets.
• If you entered your seed phrase, move what is left to a new wallet, see what to do after a theft.