TL;DR - Yes - an unsolicited offer to recover stolen crypto for an upfront fee is almost always a second scam, and the FBI's IC3 already linked one version of it to $9.9 million in fresh victim losses.
On June 24, 2024, the FBI's Internet Crime Complaint Center published a warning built around one specific number: victims of crypto scams who were then contacted by a fictitious "recovery" law firm reported $9.9 million in new losses in just twelve months. A follow-up alert from August 13, 2025 described the same con with more moving parts - fake attorneys, an invented regulator, a WhatsApp group staffed with pretend bank officers. Most advice about crypto scams stops at the original theft. The second scam, aimed at people who already lost money once, gets far less attention.
How does the crypto recovery scam actually work?
The pattern is consistent enough that the FBI gave it a name in IC3 PSA240624: fictitious law firms targeting cryptocurrency scam victims. Someone who already lost money to a scam - often a pig-butchering scheme - gets a new message, usually on social media or a messaging app, from a person claiming to be an attorney or a "fund recovery specialist." They reference the victim's actual case details, sometimes claiming a referral from the FBI or the Consumer Financial Protection Bureau. Then comes the ask: a percentage of the amount to be recovered, paid up front, before any funds move.
None of this requires the scammer to touch a single wallet. The believable part is the case details, the agency name-drop, the sense that someone official is finally paying attention. That's what makes the second scam work almost as well as the first one did.
Two dated FBI IC3 warnings, over a year apart, describe the same con with more moving parts each time. The pattern has not stopped.
Fake recovery agents and real investigators open the same way
This is the part that trips people up. A genuine forensic investigator, a real class-action attorney, and a scam artist all start the conversation the same way - they know about your loss, and they offer to help. IC3 PSA250813 lists the tells that separate the fake from the real: referencing a made-up body like the "International Financial Trading Commission," refusing a video call, and moving the conversation into a group chat with a supposed "foreign bank processor" who confirms the funds are ready to release. Real investigators do not need a group chat to prove anything.
One line does most of the work here. No legitimate recovery service asks for payment before it recovers a cent. The IC3 says it plainly: it will not ask for payment to recover lost funds, and it will not refer victims to a company that does.
What are the red flags of a fake fund-recovery offer?
A handful of signals show up in nearly every version of this scam:
The contact was unsolicited - you didn't hire anyone, and they found you.
They ask for a fee, a "tax," or a "verification deposit" before any money moves.
They cite an agency, court, or commission you can't independently verify.
They push the conversation onto WhatsApp, Telegram, or a private group chat.
They refuse a video call or won't put anything in writing under their real name.
Any single item on that list is a reason to stop. Two or more, and you're very likely looking at the exact pattern described in PSA240624 and PSA250813.
Both paths start from the same message. Paying the fee almost always ends in a second, permanent loss; screening the destination wallet first costs nothing and takes minutes.
Legitimate recovery paths look nothing like this
Real recovery is slow, mostly free, and rarely successful. Law enforcement - the FBI, the Secret Service, or a state investor-protection unit - can sometimes trace and freeze funds still sitting on a centralized exchange, but that happens through official channels you contact yourself, not through someone who messages you first. Our explainer on whether police can actually trace and recover pig-butchering funds covers what a real investigation looks like. A civil forfeiture case can run a year or more and still return nothing, because the money already moved through a mixer or a chain of throwaway wallets.
If a recovery claim sounds fast, guaranteed, or fee-based, that alone rules it out.
Should you screen the "recovery agent's" wallet before paying?
Before you send anything - a fee, a "tax," a "verification deposit" - look at the wallet address they gave you, not just their story. A public block explorer like Etherscan shows the raw transaction history, but spotting scam and fraud clusters by eye, across multiple chains, is slow and easy to get wrong. Screen the address with Plastron first and you get a direct read on whether it matches known scam, fraud, or stolen-funds patterns - Plastron's own dataset currently tags 3,354 of its 3,901 labeled addresses as scam-linked, alongside a daily-refreshed OFAC list of 780 sanctioned addresses.
A wallet with no history and no exposure is not proof of legitimacy. But a wallet that already shows up against scam clusters is proof you should stop now, before the fee leaves your account. And if the address checks out clean, that still isn't permission to pay - it just means the wallet itself isn't the reason to say no. You can also report the address publicly so the next targeted victim finds a warning instead of a blank page.
FAQ
Will the FBI or IC3 ever contact me first to recover my funds?
No. Federal agencies don't solicit victims through social media or messaging apps, and the IC3 states directly that it will not ask for payment to recover lost funds or refer you to a company that does.
I already paid a recovery fee. What now?
Stop sending anything further, save every message and payment record, and report the contact to the FBI's Internet Crime Complaint Center at ic3.gov. A refund from the scammer is rarely realistic, but the report can help investigators link your case to a larger pattern.
How is a recovery scam different from the original scam?
The first scam takes your funds through a fake investment, romance, or job pretext. The recovery scam is a second, separate fraud that targets people who already reported a loss, using the real details of that loss to sound credible.
Can a legitimate company actually recover stolen crypto?
Sometimes, but only where the funds still sit on a centralized exchange that can freeze them under a legal order - a process that runs through law enforcement, not an unsolicited message. Once funds pass through a mixer or several hops of wallets, recovery becomes unlikely no matter who claims to handle it.
What should I check before sending money to anyone claiming to help?
Verify their identity through the agency's official site directly, never through a link or number they gave you, and check the destination wallet address for scam or sanctions exposure before you send anything. A legitimate process never depends on you paying first.
Disclaimer: This article is for educational and informational purposes only and is not legal, financial, tax, or compliance advice. Crypto carries risk; you act on this information at your own risk. Always do your own research and consult a qualified professional before making decisions. Views are the author's own and do not constitute financial, legal, or investment advice.
About Plastron
Plastron is a free, non-custodial wallet screening tool. It checks Ethereum and six EVM chains for AML and KYT risk — sanctions exposure, mixer contact, and stolen-funds proximity — and returns a risk report in seconds. It reads public on-chain data only: it never takes custody of funds and never asks for private keys.