Recovery scams: the second hit

In the hours after a theft, the urge to get the money back is overwhelming — and that is exactly the state recovery scammers target. Often the trigger is your own disclosure: post 'my wallet was drained' on social media or a forum and DMs from 'recovery specialists' arrive within minutes. Because the blockchain is a public ledger, the theft is traceable by anyone, so you can be targeted without posting at all.

Their self-descriptions follow a pattern: white-hat hacker, blockchain forensics specialist, former exchange security lead, the investigations arm of a law firm. They offer proof in the form of grateful comments from other victims and screenshots of successful recoveries, all of which are trivially fabricated. Some use the names of real companies or public bodies without permission.

One test is enough: do they want money before doing the work? Investigation fee, retainer, gas costs, a fee to 'unlock the smart contract', prepaid tax on the recovered amount — the labels vary, the structure does not. Pay, and either the demands grow or the account goes quiet. And if they ask for your seed phrase, your private key or a wallet connection, the intent is to take whatever you have left.

The reality is that no third party can technically retrieve assets sent out of a self-custody wallet. A broadcast transaction cannot be reversed, and nobody holds the attacker's keys. The one real possibility is that the funds reach a regulated business such as an exchange, which freezes them at the request of law enforcement — a route that runs through the police and the exchange, not through a stranger in your DMs. So in the immediate aftermath, do not open a conversation with someone new. Assemble your records and take the case to the official channels instead.