The first few hours after you realise you've been scammed — a few right moves can change a lot
Take a breath first. When you realise you've been scammed your mind usually goes blank, anxious and self-blaming — that's normal. But the time that follows is critical: preserve evidence early, report it early, stop the bleeding early. This page walks you through it in "do this first, then this" order, and warns you off the second trap that targets victims specifically.
The honest truth: can it be recovered
No going in circles: once crypto is sent, recovery is very hard, because transactions are irreversible and often cross borders, and in many cases it can't be recovered at all. Putting that reality up front is so you aren't harvested a second time by "guaranteed recovery" patter (more on that later).
But "hard" isn't the same as "nothing to do". In some situations a timely move really does limit the loss or save part of it: if the asset is still at a point you control, if the stolen funds are still sitting on a regulated platform, if an early report gives the money flow a chance of being intercepted. The sooner you act, the better the odds. So don't let discouragement freeze you into doing nothing — work through the steps below, and at least preserve the evidence worth keeping and close the back door that needs closing.
Step 1 · Preserve evidence
Evidence disappears over time — the other side may delete the account, take down the page, block you. So the moment you realise, the first thing isn't to confront them, it's to save everything you can screenshot or store. Reporting, notifying, and every step after rely on it. We'd suggest gathering:
- The full conversation as screenshots: from how contact started, to how they steered you, to how it ended — captured complete and in order, not just fragments.
- The other side's account details: Telegram / Line / social account, display name, avatar, profile URL.
- The recipient address: the wallet address you sent the coins to, copied in full.
- The transaction hash (TxID): every transfer has a unique identifier — the on-chain, checkable hard proof.
- Amount, token, chain, time: what coin you sent, over which chain, how much, and when.
- Relevant URLs: the fake event page, fake exchange, or links given by fake support.
- Payment records: if a bank transfer or card purchase was in the chain, keep those records.
With the transaction hash and recipient address you can check the flow of funds yourself on a block explorer: for Ethereum-family chains use Etherscan, and for TRON (common for USDT-TRC20) use Tronscan — paste in the hash or address and you'll see the record of the transfer. Screenshot those pages and keep them with the rest.
Step 2 · Stop the bleeding and close the back door
Once evidence is preserved, the next thing is to stop the loss from growing. The form the scam took decides the damage-control move, so pick the one that fits your case:
If you connected a wallet or signed something
If this scam involved connecting your wallet to a page of unknown origin, or signing an approval, your wallet may still have a malicious approval hanging on it, with assets at ongoing risk of being moved out. Go check and revoke suspicious approvals immediately and close the door that's still open. How to check and how to revoke, step by step, is in the wallet approval review and revoke guide. If it's serious and you suspect your private key or seed phrase has leaked, move the assets not yet touched to a brand-new, clean wallet whose private key only you control.
If an exchange account or password is involved
If you ever entered an exchange password or code on a suspicious page, treat the account as compromised: go to the real official site from your bookmark, change the password, reset two-factor authentication, and check whether your login devices and withdrawal whitelist have been quietly altered.
If a bank was in the chain
If you first sent money somewhere to buy coins, or the other side lured you into a bank transfer, contact your bank as soon as possible to explain the fraud and ask whether it can take emergency action or place a hold. For this kind of money-flow interception, time is everything — the faster, the better.
Step 3 · Report and notify
Whatever the amount, and however much you feel "it probably can't be recovered", we'd recommend reporting it. Beyond your own case, a report builds up the police's intelligence on the method and the recipient address, giving a chance to block things at a larger scale.
Report it to the authorities
Crypto fraud is reportable, and the right channel depends on where you are. Use the one that fits — and report even if the amount feels small, because it feeds intelligence on the method and the receiving address:
- United States — report to the FTC at reportfraud.ftc.gov, and file crypto-related crime with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov.
- United Kingdom — report fraud and cybercrime to Action Fraud at actionfraud.police.uk (or call 0300 123 2040).
- Australia — report to Scamwatch at scamwatch.gov.au, and cybercrime via ReportCyber at cyber.gov.au/report.
- Canada — report to the Canadian Anti-Fraud Centre at antifraudcentre-centreantifraude.ca.
- Anywhere else — contact your local police (use the emergency number only for an emergency) and search for your country's official anti-fraud or cybercrime reporting portal. Ask for a reference number; later steps will use it.
Whichever channel you use, bring the evidence you organised in step one — the transaction hash, the counterparty address and your screenshots — and explain the events in order. The clearer it is, the more it helps with acceptance and the investigation that follows.
Step 4 · Notify the exchange involved
If the stolen funds ended up flowing to an exchange address (a block explorer may give you a hint of this), or the other side used an exchange account to receive payment, notify that exchange's official support and provide the transaction hash, recipient address and your report details. On receiving a report, or when cooperating with law enforcement, a regulated platform may take action against the account involved.
Two things to stress. First, you must go through the official support entry — in from the exchange's official-site bookmark or the support entry inside the official app. Don't search the web for "XX exchange support"; that's a phishing hotspot for fake support, and right now you're exactly the target they love. How to confirm the other side is official is in how to confirm Binance is official. Second, what an exchange can do has limits — whether and how far it acts is decided by the platform and legal process, so don't treat it as a guaranteed route to recovery.
Beware the recovery-service second scam
Please read this section to the end, because it targets people who've just been scammed — anxious and helpless — on purpose. Many haven't recovered from the first loss before they're caught here, hurt worse.
After you've been scammed, someone may appear quickly, calling themselves a "fund recovery expert", "blockchain investigator", "white-hat hacker" or "rights-protection team", claiming a special technique or inside channel to recover your money. They'll usually: first ask you to pay a "service fee", "unfreezing fee" or "deposit", or ask for your wallet access, private key or seed phrase "so they can operate". These are almost all second scams. Genuine, lawful recovery goes through reporting and the justice system; nobody guarantees recovery, and certainly nobody asks for your private key.
- Anyone who "guarantees recovery" or quotes "a high success rate" — treat as a scam: nobody can promise crypto recovery.
- Anyone who wants payment up front before they'll start — treat as a scam: it's the same logic as a fake event's "pay first to claim".
- Anyone who wants your private key, seed phrase or wallet approval — treat as a scam: handing it over is being robbed a second time.
- Anyone who DMs you, or comments "I can help" under your scam post — highly suspect: they wait where the prey gathers.
Remember: after a scam, what you should seek is the police and proper legal help — not a "recovery service" of unknown origin that opens by asking for money or access.
We haven't been scammed, and we won't pretend we have — but we did walk through "what to actually do when it goes wrong", so you're not left without a starting point when you're panicking. A few key points can be settled in advance: a transaction hash and recipient address correspond to public on-chain records on a block explorer (like Etherscan or Tronscan), which makes them preservable, corroborating, objective evidence; and an exchange's official support is always initiated from inside the official site or app, never surfacing from an external search. Each platform's page locations and entry names change, so we don't hard-code a path here — go by the official interface you see at the time.
People skip steps most easily when panicked, so here are the three lines most worth holding. First, the evidence (conversation, recipient address, transaction hash) must be saved early and complete — it's the basis of everything afterwards. Second, the still-open back door (wallet approvals, leaked credentials) must be closed in time, before the loss grows. Third, anyone who comes to you offering to "recover your money" who opens by asking for a fee or a private key — treat as a second scam, every time. This is the step to be most wary of, because it bites exactly the people who've just been scammed and are most desperate.
FAQ
They say paying an "unfreezing fee" will release my money. Is that real?
No. An "unfreezing fee", "deposit" or "tax" — anything that asks you to pay before you can get your money back — is textbook second-scam patter. After a scam, no legitimate channel works this way.
The amount is small. Do I still need to report it?
Yes, we'd recommend it. Reporting isn't only for your own case; it gives the police intelligence on the method and the address, which helps block the wider scam chain. And if more victims of the same case emerge later, your record is useful when cases are combined.
The recipient address is visible on the blockchain — doesn't that let you find the person?
On-chain you can see the address and the flow of funds, but an address by itself doesn't equal a real identity. Tracing the money to a regulated platform and then obtaining records through legal process is what gives a chance of reaching the people behind it — and that needs police and platform cooperation, not something an individual can do by looking it up.