Losing cryptocurrency to a scam can be overwhelming. Whether you were deceived by a fake investment platform, sent funds to an impersonator, connected your wallet to a malicious website, or transferred cryptocurrency to the wrong person after being manipulated, the first few hours and days can be extremely important.
The most important thing to remember is this: do not panic, and do not send more money simply because someone promises to recover what you lost.
A cryptocurrency transaction may be recorded permanently on a blockchain, but understanding where the funds went, documenting what happened, identifying relevant addresses, and determining what practical steps may be available requires careful investigation.
This guide explains what you should do after a cryptocurrency scam and how to preserve the information that may be useful for an investigation.
1. Stop Sending Additional Funds
If you believe you have been scammed, stop communicating with the person or organization requesting additional payments until you understand what is happening.
Scammers may tell victims that they need to pay:
- A withdrawal fee
- A tax
- A verification fee
- An account activation fee
- A blockchain release fee
- A compliance fee
- A security deposit
- A wallet recovery fee
These requests can appear convincing, particularly when the scammer already knows details about your previous transaction.
In some cases, victims are contacted again by individuals claiming to be recovery specialists who say they can retrieve the original funds if another payment is made.
Do not assume that a person who claims to have recovered your funds actually has access to them.
Before making another payment, independently verify who you are dealing with and what authority or capability they actually have.
2. Preserve All Evidence
One of the most important things you can do is preserve evidence before deleting messages, closing accounts, changing devices, or losing access to websites and communication platforms.
Save copies of anything connected to the incident.
This may include:
- Transaction hashes or transaction IDs
- Cryptocurrency wallet addresses
- Screenshots of transactions
- Screenshots of investment dashboards
- Emails
- WhatsApp conversations
- Telegram conversations
- Social media messages
- Phone numbers
- Usernames
- Website addresses
- Domain names
- Payment receipts
- Bank or mobile-money records
- Exchange records
- Deposit confirmations
- Withdrawal requests
- Invoices
- Contracts
- Advertisements
- Profiles used by the suspected scammer
- Voice messages
- Relevant photographs or documents
Do not rely exclusively on screenshots.
Where possible, keep the original information and record the exact website address, username, email address, wallet address, transaction hash, and date associated with each piece of evidence.
3. Find Your Transaction Hash
If cryptocurrency was transferred from your wallet or exchange account, look for the transaction hash.
A transaction hash, sometimes called a TXID, is a unique identifier associated with a blockchain transaction.
It can be extremely useful because it allows a transaction to be located on the relevant blockchain.
Depending on the cryptocurrency, you may be able to enter the transaction hash into a public blockchain explorer and view information such as:
- Sending address
- Receiving address
- Transaction status
- Amount transferred
- Block information
- Confirmation information
- Other transactions associated with the address
Keep a copy of every relevant transaction hash.
If there were several transfers, record each one separately.
4. Record the Wallet Addresses
Wallet addresses are another important part of cryptocurrency investigations.
If you sent funds to another wallet, preserve the exact receiving address.
Do not manually retype an address if you can avoid it. Copy the original address directly from your transaction history or another reliable source.
You should also record:
Your wallet address:
The address from which the funds originated.
Receiving wallet address:
The address to which the cryptocurrency was initially transferred.
Additional addresses:
Any addresses involved in subsequent transactions that you identify during your review.
A single incident can involve multiple wallet addresses, so keeping an organized record can make the investigation much easier to follow.
5. Build a Timeline of What Happened
Write down what happened in chronological order while the information is still fresh.
For example:
1 January 2026
You discovered an investment advertisement.
2 January 2026
You communicated with an individual claiming to represent an investment company.
5 January 2026
You created an account on a website.
6 January 2026
You deposited cryptocurrency.
10 January 2026
The website displayed profits.
12 January 2026
You attempted to withdraw your funds.
12 January 2026
The platform requested an additional fee.
14 January 2026
You made another payment.
15 January 2026
The platform stopped responding.
This timeline can help investigators understand the sequence of events.
Include exact dates and approximate times whenever possible.
6. Secure Your Accounts and Wallets
If you provided passwords, private information, authentication codes, or other credentials to someone you do not trust, take security precautions immediately.
Change passwords associated with:
- Cryptocurrency exchanges
- Email accounts
- Social-media accounts
- Financial accounts
- Cloud storage
- Other services connected to the incident
Use strong, unique passwords.
Where available, enable multi-factor authentication.
If you believe an account has been compromised, contact the relevant service provider through its official website or support channel.
Be especially careful with your wallet
If you believe your private key or seed phrase has been exposed, treat the wallet as potentially compromised.
Do not give your seed phrase or private key to someone claiming to be a recovery specialist.
A legitimate investigation does not require you to casually disclose your private keys or seed phrase to an unknown person.
7. Do Not Delete the Scam Website or Messages
Your first instinct may be to delete everything associated with the scam.
Avoid doing this.
The website, domain name, messages, advertisements, profiles, email addresses, and other information may contain valuable evidence.
Instead of deleting information, preserve it.
Take screenshots and record URLs, usernames, contact information, and relevant dates.
If a website is still accessible, document what it shows.
If it disappears later, the information you preserved may still be useful.
8. Check the Website Carefully
If the incident involved an investment platform or cryptocurrency website, record its domain name.
Look for information such as:
- Company name
- Claimed registration details
- Contact information
- Terms and conditions
- Privacy policy
- Withdrawal instructions
- Customer-support details
- Social-media accounts
- Wallet addresses
- Payment instructions
Be cautious about assuming that professional-looking websites are legitimate.
Scammers can create websites that look remarkably similar to genuine financial or cryptocurrency services.
A professional logo, impressive dashboard, customer-service chat, or displayed account balance does not by itself prove that funds actually exist or are available for withdrawal.
9. Understand What Blockchain Tracing Can and Cannot Do
One of the biggest misconceptions about cryptocurrency is that blockchain transactions are automatically anonymous.
Many public blockchains provide transparent transaction records.
Depending on the blockchain and available information, investigators may be able to examine the movement of cryptocurrency between addresses and identify transaction patterns.
This process is commonly referred to as blockchain tracing or blockchain analysis.
However, tracing does not automatically mean that cryptocurrency can be recovered.
Blockchain analysis may help establish:
- Where funds were sent
- Which addresses received them
- How funds moved afterward
- Whether funds were transferred through additional addresses
- Whether funds reached a known exchange or service
- Relevant transaction relationships
Identifying a transaction path is different from obtaining the funds.
Actual recovery can depend on many factors, including where the assets are located, whether they remain accessible, whether an exchange or service can identify an account, applicable legal processes, and cooperation from relevant parties.
For this reason, no responsible investigator should promise guaranteed recovery simply because a transaction can be traced.
10. Be Careful With “Recovery Experts”
After losing cryptocurrency, you may receive messages from people claiming that they can recover your funds.
Some may contact you through:
- Telegram
- X
- Cryptocurrency forums
- Other online platforms
They may claim to be hackers, blockchain investigators, government agents, lawyers, exchange employees, or recovery specialists.
Some may even know details about your original loss.
That information does not automatically prove that they can recover your cryptocurrency.
Be particularly cautious if someone:
- Guarantees recovery
- Demands cryptocurrency upfront
- Requests your wallet seed phrase
- Requests your private key
- Claims to have already located your funds without providing verifiable evidence
- Threatens you with legal consequences
- Claims to have connections inside an exchange
- Says you must pay immediately
- Requests payment through another cryptocurrency wallet
- Claims that your funds are already recovered but requires another fee before release
A second scam can sometimes begin immediately after the first.
11. Report the Incident
Depending on the circumstances and jurisdiction, consider reporting the incident to the relevant authorities, financial institutions, cryptocurrency exchanges, and platforms involved.
When making a report, provide organized information rather than simply saying that you lost cryptocurrency.
Include:
- Your name and contact details
- Date of the incident
- Type of cryptocurrency
- Amount involved
- Wallet addresses
- Transaction hashes
- Suspected scammer’s contact information
- Website addresses
- Social-media profiles
- Email addresses
- Screenshots
- Communication records
- Payment records
- A clear description of what happened
The more organized the information is, the easier it may be for the receiving organization to understand the incident.
12. Do Not Alter the Evidence
Avoid editing screenshots in a way that removes important information.
If you need to highlight something, keep the original copy and create a separate annotated copy.
Preserve original emails where possible.
Keep original transaction records.
Do not manipulate documents to make the incident appear different from what actually happened.
Accurate documentation is important.
13. What a Cryptocurrency Investigation May Involve
Every incident is different.
A cryptocurrency investigation may involve reviewing the available evidence and establishing a factual picture of what happened.
Depending on the circumstances, this may include:
Transaction analysis
Reviewing blockchain transactions and identifying relevant wallet addresses and transaction relationships.
Evidence organization
Organizing screenshots, messages, transaction records, websites, contact details, and other evidence into a clear timeline.
Address analysis
Reviewing the activity associated with relevant blockchain addresses.
Incident documentation
Preparing a structured description of the incident that can be provided to relevant authorities, exchanges, legal professionals, or other appropriate parties.
Exchange or service identification
Where the available evidence permits, determining whether funds appear to have moved toward a known cryptocurrency service or exchange.
These activities should be presented accurately. Tracing is not the same as recovering assets, and an investigation cannot guarantee a particular outcome.
What You Should Never Give a Recovery Service
There are certain pieces of information you should treat as highly sensitive.
Never casually provide your:
- Seed phrase
- Private key
- Password
- Authentication codes
- Recovery codes
- Banking credentials
- Cryptocurrency exchange password
If someone says they need your seed phrase to recover your cryptocurrency, treat that request as a major warning sign.
What Information Should You Give an Investigator?
When contacting a professional investigation or documentation service, prepare as much relevant information as you safely can.
A useful initial case file may contain:
Personal contact information
Your name and a reliable email address.
Incident summary
A short explanation of what happened.
Cryptocurrency involved
For example, Bitcoin, Ethereum, USDT, USDC, or another asset.
Amount involved
The approximate amount and currency.
Transaction information
Transaction hashes and wallet addresses.
Suspected scammer information
Names, usernames, phone numbers, email addresses, websites, and social-media accounts.
Communication evidence
Relevant messages, emails, screenshots, and other records.
Timeline
The dates and sequence of important events.
Providing organized information at the beginning can make it easier to understand the case.
Can Cryptocurrency Always Be Recovered?
No.
This is one of the most important things victims should understand.
A blockchain may provide a permanent record of a transaction, but that does not mean that an individual or private recovery company can simply reverse the transaction.
Cryptocurrency transactions generally cannot be cancelled in the same way as a traditional card payment.
Recovery may depend on circumstances such as:
- Whether the funds can still be traced
- Whether the assets remain accessible
- Where the funds were transferred
- Whether they reached a centralized exchange or service
- Whether the relevant service can identify or restrict an account
- Whether law-enforcement or legal processes become involved
- The jurisdiction involved
- The quality of the available evidence
- How quickly the incident was documented and reported
Anyone promising a guaranteed recovery should therefore be approached with extreme caution.
The Importance of Acting Quickly
Time can matter.
The longer an incident goes undocumented, the more difficult it may become to reconstruct exactly what happened.
Scammers may delete social-media accounts, change websites, abandon wallets, change usernames, or disappear from communication platforms.
That is why preserving information as soon as possible is important.
Even if you believe the money is already gone, do not destroy the evidence.
A transaction hash, wallet address, message, email, website address, or screenshot may become important later.
Canva Recovery Team: Documentation, Investigation and Blockchain Analysis
At Canva Recovery Team, our approach is centered on understanding the available evidence and helping victims organize the information surrounding a cryptocurrency incident.
Our work may involve reviewing available transaction information, documenting the incident, examining blockchain activity, and helping clients understand what the available evidence shows.
We believe clients should receive clear information rather than unrealistic promises.
Blockchain tracing is not a guarantee of asset recovery.
Where appropriate, information identified during an investigation may help a victim understand the movement of funds and prepare documentation for relevant authorities, exchanges, legal professionals, or other appropriate channels.
Every case is different, and the available evidence determines what can reasonably be established.
Have You Lost Cryptocurrency?
If you believe you have been affected by a cryptocurrency scam, start by preserving the evidence.
Do not send additional funds to someone simply because they promise to recover your cryptocurrency.
Save your transaction hashes.
Save your wallet addresses.
Save your messages and emails.
Record the websites and contact details involved.
Secure your accounts.
Then seek appropriate professional or official assistance based on the circumstances of your case.
The first step toward understanding what happened is preserving the evidence.
Canva Recovery Team can help you organize the available information and assess the blockchain and incident data that you provide, while keeping expectations realistic and evidence-based.
Leave a Reply