Can you recover scammed USDT or crypto? What to do first

The honest truth: can it be recovered

No going in circles: once crypto is sent, recovery is very hard, because transactions are irreversible and often cross borders, and in many cases it can't be recovered at all. Putting that reality up front is so you aren't harvested a second time by "guaranteed recovery" patter (more on that later).

But "hard" isn't the same as "nothing to do". The cases where money does come back are specific, and all three start with a police report:

• The stolen funds are USDT and the receiving address still holds them. Tether's terms of service reserve the right to freeze USDT held at an address and to blacklist the address. Its Law Enforcement Requests policy says investigators may ask for an address to be frozen, and that "requests to freeze Tether addresses should be accompanied by appropriate legal process" (tether.to, checked October 2026). A victim writing in directly has no legal process to attach, so the request has to come from the police.
• The funds are still sitting in an account at a regulated exchange. Binance, for example, says it "is unable to unilaterally freeze any user's assets without an appropriate official freezing order from law enforcement or a court of competent jurisdiction", and tells victims to "promptly take action to obtain an official freezing order, e.g. by reporting the matter to your local police" (How to Report Stolen Funds Transferred to Binance, checked October 2026). The police impersonation scam entry quotes that page at length.
• You move before the money is swapped or scattered. Neither company names a deadline, but a freeze only catches what is still at that address or in that account. Once it has been swapped into another coin, split across many addresses or sent off the platform, there is nothing left to freeze. Count in hours, not days.

If none of the three applies (say, bitcoin sent straight to a private wallet and already split up), what is left is on-chain tracing plus a court process, and the odds are low. Either way, work through the steps below: keep the evidence, and close the doors that are still open.

One page often gets mixed up with this. Tether's knowledge-base page Tether tokens Recovery is about USDT mistakenly deposited to an address that does not support it, and it tells you to contact the receiving party first. It is not a way to get back USDT you sent to a scammer; for that, a freeze goes through the police report and Tether's law-enforcement process described above.

Step 1 · Preserve evidence

Evidence disappears over time — the other side may delete the account, take down the page, block you. So the moment you realise, the first thing isn't to confront them, it's to save everything you can screenshot or store. Reporting, notifying, and every step after rely on it. We'd suggest gathering:

• The full conversation as screenshots: from how contact started, to how they steered you, to how it ended — captured complete and in order, not just fragments.
• The other side's account details: Telegram / Line / social account, display name, avatar, profile URL.
• The recipient address: the wallet address you sent the coins to, copied in full.
• The transaction hash (TxID): every transfer has a unique identifier — the on-chain, checkable hard proof.
• Amount, token, chain, time: what coin you sent, over which chain, how much, and when.
• Relevant URLs: the fake event page, fake exchange, or links given by fake support.
• Payment records: if a bank transfer or card purchase was in the chain, keep those records.

With the transaction hash and recipient address you can check the flow of funds yourself on a block explorer: for Ethereum-family chains use Etherscan, and for TRON (common for USDT-TRC20) use Tronscan — paste in the hash or address and you'll see the record of the transfer. Screenshot those pages and keep them with the rest.

Step 2 · Stop the bleeding and close the back door

Once evidence is preserved, the next thing is to stop the loss from growing. The form the scam took decides the damage-control move, so pick the one that fits your case:

If you connected a wallet or signed something

If this scam involved connecting your wallet to a page of unknown origin, or signing an approval, your wallet may still have a malicious approval hanging on it, with assets at ongoing risk of being moved out. Go check and revoke suspicious approvals immediately and close the door that's still open. How to check and how to revoke, step by step, is in the wallet approval review and revoke guide. If it's serious and you suspect your private key or seed phrase has leaked, move the assets not yet touched to a brand-new, clean wallet whose private key only you control.

If an exchange account or password is involved

If you ever entered an exchange password or code on a suspicious page, treat the account as compromised: go to the real official site from your bookmark, change the password, reset two-factor authentication, and check whether your login devices and withdrawal whitelist have been quietly altered.

If a bank was in the chain

If you first sent money somewhere to buy coins, or the other side lured you into a bank transfer, contact your bank as soon as possible to explain the fraud and ask whether it can take emergency action or place a hold. For this kind of money-flow interception, time is everything — the faster, the better.

Step 3 · Report and notify

Whatever the amount, and however much you feel "it probably can't be recovered", we'd recommend reporting it. Beyond your own case, a report builds up the police's intelligence on the method and the recipient address, giving a chance to block things at a larger scale.

Report it to the authorities

Crypto fraud is reportable, and the right channel depends on where you are. Use the one that fits — and report even if the amount feels small, because it feeds intelligence on the method and the receiving address:

• United States — report to the FTC at reportfraud.ftc.gov, and file crypto-related crime with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov.
• United Kingdom — report fraud and cybercrime to Action Fraud at actionfraud.police.uk (or call 0300 123 2040).
• Australia — report to Scamwatch at scamwatch.gov.au, and cybercrime via ReportCyber at cyber.gov.au/report-and-recover/report.
• Canada — report to the Canadian Anti-Fraud Centre at antifraudcentre-centreantifraude.ca.
• Anywhere else — contact your local police (use the emergency number only for an emergency) and search for your country's official anti-fraud or cybercrime reporting portal. Ask for a reference number; later steps will use it.

Whichever channel you use, bring the evidence you organised in step one — the transaction hash, the counterparty address and your screenshots — and explain the events in order. The clearer it is, the more it helps with acceptance and the investigation that follows.

Step 4 · Notify the exchange involved

If the stolen funds ended up flowing to an exchange address (a block explorer may give you a hint of this), or the other side used an exchange account to receive payment, notify that exchange's official support and provide the transaction hash, recipient address and your report details. On receiving a report, or when cooperating with law enforcement, a regulated platform may take action against the account involved.

Binance's page, for example, lists what to send: how and when it happened, screenshots or video of you logging in to show the compromised wallet is yours, the transaction details (which wallet was compromised, which account received the funds), every on-chain transaction involved as a clickable TxID link, and a copy of the police report. The same page says Binance deals with law enforcement directly, its support team will not share that information with you, and updates come from the police (checked October 2026).

Two things to stress. First, you must go through the official support entry — in from the exchange's official-site bookmark or the support entry inside the official app. Don't search the web for "XX exchange support"; that's a phishing hotspot for fake support, and right now you're exactly the target they love. How to confirm the other side is official is in how to confirm Binance is official. Second, what an exchange can do has limits — whether and how far it acts is decided by the platform and legal process, so don't treat it as a guaranteed route to recovery.

Beware the recovery-service second scam

Please read this section to the end, because it targets people who've just been scammed — anxious and helpless — on purpose. Many haven't recovered from the first loss before they're caught here, hurt worse.

After you've been scammed, someone may appear quickly, calling themselves a "fund recovery expert", "blockchain investigator", "white-hat hacker" or "rights-protection team", claiming a special technique or inside channel to recover your money. They'll usually: first ask you to pay a "service fee", "unfreezing fee" or "deposit", or ask for your wallet access, private key or seed phrase "so they can operate". These are almost all second scams. Genuine, lawful recovery goes through reporting and the justice system; nobody guarantees recovery, and certainly nobody asks for your private key.

• Anyone who "guarantees recovery" or quotes "a high success rate" — treat as a scam: nobody can promise crypto recovery.
• Anyone who wants payment up front before they'll start — treat as a scam: it's the same logic as a fake event's "pay first to claim".
• Anyone who wants your private key, seed phrase or wallet approval — treat as a scam: handing it over is being robbed a second time.
• Anyone who DMs you, or comments "I can help" under your scam post — highly suspect: they wait where the prey gathers.

Remember: after a scam, what you should seek is the police and proper legal help — not a "recovery service" of unknown origin that opens by asking for money or access. Why they can already quote your amount and your dates, the four openings a prosecutors' office catalogued, and what the only two legitimate routes actually are, are taken apart in “we can recover your stolen crypto”: the second scam is the easier one.

FAQ

They say paying an "unfreezing fee" will release my money. Is that real?

No. An "unfreezing fee", "deposit" or "tax" — anything that asks you to pay before you can get your money back — is textbook second-scam patter. After a scam, no legitimate channel works this way.

The amount is small. Do I still need to report it?

Yes, we'd recommend it. Reporting isn't only for your own case; it gives the police intelligence on the method and the address, which helps block the wider scam chain. And if more victims of the same case emerge later, your record is useful when cases are combined.

The recipient address is visible on the blockchain — doesn't that let you find the person?

On-chain you can see the address and the flow of funds, but an address by itself doesn't equal a real identity. Tracing the money to a regulated platform and then obtaining records through legal process is what gives a chance of reaching the people behind it — and that needs police and platform cooperation, not something an individual can do by looking it up.