Have I Been Scammed – Twice? How to Spot Fake Crypto Recovery Scams
If someone contacted you claiming they found your stolen crypto and need a fee to release it, that is a recovery scam – a second scam aimed at people who were already scammed once. A legitimate firm never guarantees recovery, never asks for your seed phrase, and never demands payment to unlock funds it claims to have found.
Being deceived a second time cuts deeper than the first loss. Victims write to us saying "I have been double scammed", and almost every message carries shame. Please set that down: this was not your fault, either time. Recovery scammers buy lists of previous victims and script every word to exploit hope. This page shows you their playbook – and how to verify a real firm.
How do I know if a crypto recovery service is a scam?
Treat any recovery service that contacts you first, guarantees your money back, or demands an upfront fee to release funds it "found" as a scam. Real investigators assess your case before anything else and tell you plainly that recovery is never guaranteed. Invented jargon such as "gray status" or "CFX mirroring" settles it – both come from scam scripts.
Why they sound convincing
- They found you. Scammers trade lists of previous victims and cold-contact people who have already lost money.
- They know your case. The message often references real details of your loss, bought along with your contact data.
- The jargon is invented. "Gray status", "CFX mirroring" and "main-net p-keys" exist only in scam scripts.
What to do now
- Stop paying and stop replying.
- Save every message, "statement", wallet address and payment transaction ID.
- Report to the police or the FBI's IC3 and verify any firm independently before sharing your case.
Signs you've been scammed
If you're searching "have I been scammed" or "was I scammed", check your situation against these signs. Any one of them is a strong indicator. Several together are near certainty.
- You can't withdraw, or a withdrawal was "canceled" and your balance shown as frozen – covered on our can't withdraw page.
- You're asked to pay a fee, tax or commission before you can withdraw.
- An unsolicited "mentor" or "account manager" guided your investing – the core of an investment scam.
- You were promised guaranteed or unusually high returns.
- Your wallet emptied right after you signed something or entered your seed phrase on a website – see hacked wallet.
- The person who introduced you to "investing" was someone you met online – the pattern behind every romance scam.
If any of this matches, stop all payments now and preserve your records. Then prepare for what usually comes next: an unsolicited offer of "help".
Why most "recovery" offers are a second scam
"If someone contacted YOU claiming they've already found your funds and just need an 'activation fee' or payment for 'computer power' – that is the second scam. A real investigation assesses your case first and never guarantees a result."
After a crypto theft, victims' details circulate on lists that criminals buy and sell. Then the messages start: a "recovery agency", a "blockchain analyst", a "solicitor" – sometimes claiming links to law enforcement – announcing that your funds have been located and can be released. Most crypto recovery scams follow this exact structure, and they are why so many people ask whether crypto recovery is legit at all.
One client described the method precisely: "Tricking my trust and saying that he found out how I have been hit by precedent scammers... then going with me through the recovery process." Another summed up the aftermath: "All wanted paying in advance and nothing happened."
The mechanics are advance-fee fraud. You pay a "retainer", then a "processing fee", then a "tax", then a payment for "computer power" – and then another. Some operators ask for your seed phrase or remote access to your computer, which hands them whatever you have left. Fake reviews and invented "A+ ratings" complete the picture. In Recoveris case files, entities reported for exactly this pattern include the website coin-refunds.com and an "agency" calling itself Swap Trackbackcoin.
Decoding the jargon: "gray status", "CFX mirroring", "computer power", "testnet keys", "main-net p-keys"
Fake recovery scripts lean on technical-sounding language. Every phrase below comes from real messages sent to our clients. None of them describe anything real.
"Gray status" / "green status"
Victims are told "the amount is in gray status" and must "pay 5% to the miners to increase the computer power" to turn it green. No blockchain, wallet or exchange anywhere has a gray or green status. The words exist to make one more payment sound technical.
"Computer power" / "mining fees"
You never pay for computer power or mining to access your own funds. Real network fees cost cents to a few dollars and are paid inside your own wallet, never to a stranger's address.
"CFX mirroring process"
One client was told the "CFX mirroring process has been successfully finalized" and that funds were "seeded into your wallet, which will function as the secondary wallet". Meaningless jargon. No "mirroring" moves real funds; the phrase dresses up an unlock fee.
"Testnet keys" and "activate main-net p-keys"
The scammer hands over worthless "testnet keys" as proof of recovery, then demands a deposit – one victim was told "I need to deposit 6,850 USDT to activate the main-net p-keys". Testnet coins have zero value, and private keys are never "activated" by a deposit. Pure advance-fee fraud.
"Need gas fee with USDT or USDC!!!"
A demand to prepay "gas" in stablecoins to a stranger's address is theft, every time.
"Mining Pool Account Statement"
An official-looking PDF claiming your funds sit in a mining pool awaiting release. The document is a prop, built to justify fees and delays.
"Bitcoin Volatility Index (2.63%)"
An invented metric printed on those fake statements, supposedly governing when funds can be released. No such index controls anyone's funds.
If you have heard any of these phrases, you are talking to a scammer. Stop paying, keep every message, and have the payments traced instead – to unfreeze crypto you were never required to pay for "computer power", because it was never frozen in "gray status" to begin with.
"A blockchain analyst found your funds" – it's fake
One client put it in their own words: "I was contacted by a Crypto Blockchain analyst... he works with people scammed to recover funds." The profile looked professional. The credentials were invented, and the claim that funds sat in a "mining pool" awaiting release fees followed the standard script.
Legitimate investigators do not cold-contact victims claiming to have already located their money. Finding stolen funds requires your transaction data first; anyone who "found" them before speaking to you is reading from a purchased victim list. Real recovery runs through exchanges, courts and law enforcement – never through a fee paid to a personal wallet.
The "safe account" bank scam
This variant usually arrives by phone, and it targets people before or after a crypto loss. A caller pretending to be your bank or the police reports "suspicious activity" and urges you to protect your money by moving it to a "safe account" – often by opening an account at a legitimate app-based service such as Revolut, or by converting the money to crypto. The "safe account" belongs to the scammer, and once the money becomes crypto it moves within minutes.
Banks and police never ask this
Banks and police never ask you to move money to a safe account, buy crypto to protect it, or keep a call secret. Hang up and call your bank back on the official number printed on your card.
How to verify a legitimate firm ("no upfront fee")
Check five things before trusting anyone with your case:
- A registered legal entity you can look up, with a real address.
- A named team with verifiable backgrounds – LinkedIn profiles, former employers, court appearances.
- Court-admissible reporting – work product that law enforcement and exchanges can act on.
- A transparent process and pricing, agreed before any work starts.
- Honest language about odds. Anyone guaranteeing recovery fails the test immediately.
A word about "no upfront fee crypto recovery", which many burned victims search for. Real forensic work has real fixed costs – investigator hours, analytics tooling, legal preparation – so legitimate firms typically use a transparent fixed-fee plus success-fee model, agreed in writing before work begins. The scam version inverts this: a guaranteed result and a large payment demanded today. Recoveris resolves the dilemma by making the first step free. The Strategic Assessment tells you where the funds went and whether recovery is realistic before you spend anything.
For the record you can verify: Recoveris AG is a Swiss company in Zug, staffed by former law-enforcement investigators and prosecutors, serving EY as a technical partner for distributed-ledger analysis, with direct channels to compliance teams at 190+ exchanges through the VerifyVASP partnership.
Former Guardia di Finanza investigator specialising in financial crime. Leads Recoveris investigations across tracing, exchange freezes and court-ready evidence. LinkedIn
Virtual assets expert for OSCE and Interpol; US court expert witness on the QuadrigaCX and DAO hack cases.
LinkedIn
Attorney; co-created the crypto-asset task force at the Buenos Aires prosecutor's office.
LinkedIn
Source of Funds specialist; thousands of cases traced for corporations and banks.
LinkedIn
Former Global Investigations Lead at MoonPay; 1,000+ complex crypto investigations.
LinkedIn
OSINT and digital forensics, 25+ years; former Guardia di Finanza investigator.
LinkedInScammers impersonate real firms too
One final warning from experience: scammers impersonate real firms too, including Recoveris – confirm you are on recoveris.io before sharing anything. Read our warning about scammers impersonating Recoveris.
First 24 hours: stop, preserve, report
Stop paying and stop replying
No activation fee, gas fee or "final" payment will release anything.
Never share your seed phrase or your screen
Anyone asking for either is after what you have left.
Preserve evidence from both scams
Messages, emails, "statements" and invoices, wallet addresses, and every payment transaction ID – from the original theft and from the fake recovery.
Report it
File with your local police and the FBI's IC3 (ic3.gov), and flag the addresses on Chainabuse. Name both scams in one report.
Get a free assessment
We treat the whole chain of losses as one case and trace every payment. The full method: recover stolen cryptocurrency.
Frequently asked questions
How do I know if I've been scammed?
Is that crypto recovery service legit or a scam?
Why do people say recovery services are scams?
How can I verify a legitimate recovery firm?
How do I report a crypto scam?
Someone said they found my stolen funds – is it real?
What is the 'CFX mirroring process' scammers mention?
They say I must pay for 'computer power' or 'mining' to release my funds – is that real?
They gave me 'testnet keys' and say I must 'activate main-net p-keys' – what is this?
I've already been scammed twice – can the recovery-scam money be recovered too?
A firm says 'no upfront fee' – is that safe?
Talk to a team you can verify – the first assessment is free
Every hour matters. The longer you wait, the harder recovery becomes. Scammers move fast to hide stolen funds. But as long as assets are moving, there is a trail our investigators can follow. Tell us what happened, and we'll give you an assessment of your options.
Recovery outcomes vary and are never guaranteed. This page is general information, not legal or financial advice.