Crypto Recovery Scams and Fake Exchange Support: Retail Hygiene After a Loss in 2026

By CoinX Editorial (gspteck) · Published 2026-10-05 · Last verified 2026-10-05

The hours after a crypto loss are when retail traders are most exposed to a second loss. Whether the first one came from an investment scam, an account takeover, or a mistyped withdrawal, people tend to post about it in public: a reply to an exchange’s social account, a forum thread, an app-store review. Within minutes, “recovery experts,” “blockchain tracers,” fake law firms, and fake exchange support agents can show up in your DMs. The FBI’s Internet Crime Complaint Center has warned specifically about fraudulent cryptocurrency recovery schemes, and the FTC says that anyone asking for upfront fees to get your money back is a scammer. This guide is educational account-security hygiene: how these schemes work, how to tell real venue support from impostors, and what to do after a loss. It is not financial or legal advice, and no one, including us, can promise that funds will come back. For the login side of phishing, see anti-phishing codes and bookmark-only login.

How recovery scams work, according to official sources

These are primary sources worth reading in full:

FBI IC3, August 2023. In PSA I-081123-PSA, the FBI warns of an increase in cryptocurrency recovery schemes that target people who already lost crypto to fraud, scams, or theft. The fraudsters may contact victims directly on social media or messaging platforms, or advertise in comment sections and search results. They charge an upfront fee, then either disappear or produce an incomplete tracing report and ask for more money. They may claim ties to law enforcement or legal services. The FBI also notes that private-sector recovery companies cannot issue seizure orders, that exchanges freeze accounts only through internal processes or legal process, and that law enforcement does not charge victims a fee to investigate.
FBI IC3 victim guidance. PSA I-082423-PSA tells victims to report to IC3 right away with transaction details (addresses, amount and asset, date and time, transaction hash) and to “be wary of anyone claiming they can recover your funds as this may be another scam.”
FTC. The FTC’s page on refund and recovery scams describes upfront charges labeled as a “retainer fee,” “processing fee,” “administrative charge,” or “tax,” and says plainly that anyone who asks for personal or financial information or an upfront fee to recover money is a scammer. Its cryptocurrency and scams guidance adds that only scammers demand payment in crypto or guarantee profits.

The pattern is consistent: the scammer contacts you first, claims authority, guarantees results, and asks for a fee or access. The fee is usually requested in crypto, which is hard to reverse.

Recovery scam sequence: first loss, public post, unsolicited recovery DM, upfront fee causing a second loss — The typical sequence: a first loss, a public post about it, an unsolicited “recovery” contact, and an upfront fee that becomes a second loss.

Real exchange support vs. impersonators

Fake support is the same scam wearing the venue’s logo. Exchanges document what their staff will never do. Read your own venue’s list on its official help center, reached through your bookmark: The same impersonation happens with apps; our seven checks to verify an official crypto app on Google Play show how to confirm a listing before you install.

Coinbase. Coinbase’s technical support and impersonation scams article says its customer service agents will never ask you to secure, move, or access your funds, never provide or ask for a seed phrase, never ask for your password or 2-step verification code, never ask you to install software, and never remotely access your device. Its Telegram and WhatsApp scams page says Coinbase has no official presence on those platforms, with one named exception for a regional Telegram channel, so a “Coinbase agent” DMing you there is a red flag.
Kraken. Kraken’s Protect yourself from scams page lists what Kraken will never ask for, including your password, 2FA or device approval codes, seed words, Master Key, remote access to your computer, or changes to your security settings. It also says crypto transactions are irreversible and that Kraken cannot reverse or recover funds once they leave your account. It warns against using search engines to find support phone numbers.

Put together, the rule is short. Real support works through a ticket you opened from inside your account. It does not reach you first through a DM, it does not give you a “safe wallet” address, and it never needs your codes. If a message asks you to move funds to “protect” them, treat it as theft in progress. If you are setting up a fresh wallet after an incident, follow our self-custody wallet setup steps, including how to store a recovery phrase, before moving anything.

Comparison of genuine exchange support reached via bookmark or app ticket versus impersonators who DM first and ask for codes or fund transfers — Genuine support starts from a ticket you open in the official app or bookmarked site. Impersonators contact you first and ask for codes, remote access, or transfers.

What to do after a loss: report, secure, and don’t pay

This order keeps a bad day from getting worse. Adapt it to your situation, and get qualified legal advice if large sums are involved.

Stop sending. Do not pay any “unlock,” “tax,” “gas,” or “verification” fee to release funds, whether a fake platform asks for it or a recovery service does. The FTC and FBI both describe upfront fees as the scam itself.
Secure what you still control. From your bookmarked exchange site, change your password, revoke sessions and devices (see our sessions audit), move off SMS 2FA (see SIM-swap and SMS 2FA risks), delete API keys you didn’t create (API key scopes), and check your withdrawal allowlist for addresses you didn’t add (address-book poisoning). If remote-access software was installed, assume the device is compromised and follow the cleanup steps in our fake APK guide.
Gather evidence. IC3 lists what helps most: crypto addresses, amount and asset type, dates and times, transaction hashes, the domains or apps the scammer used, how you first encountered them, any messages, and which exchanges were used to send or receive.
Report through official channels. Open a ticket with your exchange from inside the app or bookmarked site. In the US, file at ic3.gov and ReportFraud.ftc.gov. Elsewhere, use your national police cybercrime unit or financial regulator. Reporting is free.
Expect follow-up scams. Once you report or post publicly, assume new “recovery” contacts are hostile. If someone claims to be with the FBI or another agency, IC3 advises contacting your local field office yourself to confirm.

After-loss playbook: stop sends, secure account, gather transaction evidence, report to venue and authorities — After a loss: stop sending money, lock down the accounts you still control, collect transaction evidence, and report through official channels for free.

Red flags in any “recovery” offer

Any one of these is enough to walk away:

Upfront fee under any name, such as retainer, tax, processing, or “wallet activation.”
They found you. An unsolicited DM, comment reply, or call after you posted about a loss.
Guarantees, like “100% recovery” or “we hacked the scammer’s wallet.” The FBI notes that private companies cannot issue seizure orders.
Borrowed authority, such as claims of working with the FBI, Interpol, a regulator, or a law firm, often with official-looking letterheads.
Access requests for your seed phrase, 2FA codes, remote desktop, or a “verification deposit.”
Pressure, like “funds will be lost forever in 24 hours.” Real legal processes don’t run on DM deadlines.

Legitimate blockchain-analytics firms and lawyers exist, but they work through formal engagements and, where it applies, alongside law enforcement or civil courts. They don’t cold-message victims in Telegram groups. If you’re considering paid help, find the provider yourself through independent sources, check their credentials with the relevant bar or regulator, and never pay in crypto.

Six red flags in crypto recovery offers: upfront fee, unsolicited contact, guarantees, fake authority, access requests, pressure — Six red flags. Any single one is enough reason to stop replying.

Prevention habits that also blunt recovery scams

Don’t post wallet addresses, transaction hashes, or loss amounts in public replies. Use the venue’s private ticket instead.
Lock down DMs on X, Telegram, and Discord so strangers can’t message you directly.
Keep a short note offline with your venue’s official support path and the list of things support will never ask for.
Choose venues with clear official support channels in the first place (see choosing a secure trading platform), and use withdrawal allowlists with change delays (see withdrawal allowlists and 2FA).

Practical checklist

Never pay upfront to “recover” crypto. Per the FTC and FBI, that fee is the scam.
Contact support only through a ticket opened from the bookmarked site or official app.
Never share your password, 2FA codes, or seed phrase, never install remote-access tools, and never move funds to a “safe” address.
Secure the account, collect transaction evidence, and report to the venue and to IC3, the FTC, or local authorities for free.
Treat every new “recovery” contact after a loss as hostile until you have verified it independently.

Key takeaways

Recovery scams go after people who have just lost crypto. The FBI documents upfront fees, fake law-enforcement ties, and outreach through social media and messaging apps.
Coinbase and Kraken both publish lists of things their support will never ask for. A request to move funds or share codes is the giveaway.
Crypto transfers are generally irreversible. Exchanges freeze funds only through their own processes or legal process, and no DM “agent” can change that.
Reporting is free. Paying a stranger to recover funds usually just adds a second loss.

Not financial or legal advice. This article summarizes public guidance from the FBI IC3, the FTC, and exchange help centers as of 2026-10-05. Procedures and official channels change, so confirm them on your exchange’s official help pages and with the relevant authorities where you live. No affiliate links. Last verified 2026-10-05.