Crypto scam recovery: what can be traced, frozen, seized and actually returned

What crypto scam recovery actually means

Direct answer: Crypto recovery is not a single technical reversal; it is a chain of distinct outcomes—trace, freeze, seize, forfeit and return—and a case may stop at any one of them.

A trace maps transactions and may identify a service touched by the funds. A freeze restricts movement but does not decide ownership. A seizure places property under lawful control, usually through legal process. Forfeiture resolves the government's right to retain or distribute the property. Return is the final transfer of value to an accepted claimant. Calling all five steps “recovered” makes weak cases look complete and hides the part that matters to a victim: whether money was actually paid.

The public record contains examples at different levels. In Chicago, DOJ confirmed the court-authorized seizure of about $1.4 million in USDT and said the funds would be returned; that release did not confirm completed victim payments. In Virginia, title had been cleared to 420,740.422314 USDT and 1,249,996.15 BUSD, and the government said it was in the process of returning the property. In Ohio, DOJ went further: $105,615 had been paid, while another $319,385 had been approved for remission and was described as due to be paid.

The distinction also protects legitimate claims. If a wallet is frozen, the next task is not to celebrate a return but to identify the authority, case reference, claimant procedure and deadline. If an analyst has only produced a graph, the next task is to find a lawful recipient for that information. A useful recovery plan names the current stage, the evidence supporting it and the next decision-maker.

Classify the incident before choosing a recovery route

Direct answer: The first decision is whether the event was wallet theft, a scam-induced transfer, a malicious approval or a fake platform balance, because each creates different evidence and containment steps.

Wallet theft usually means an attacker obtained a seed phrase, private key, signing access or exchange credentials and made a transfer the owner did not intend. A scam-induced transfer is different: the owner deliberately signed or submitted a transaction because a fraudster lied about its purpose. Malicious approval gives a contract or spender permission to move tokens later; the first dangerous transaction may be the approval rather than the drain. A fake balance may involve no on-chain investment account at all—the website simply displays invented profits while real deposits go to criminal wallets.

Misclassification wastes the short containment window. Changing an exchange password may help an account takeover, but it does not revoke an on-chain token allowance. Revoking an allowance may stop a future drain, but it does not retrieve tokens already transferred. Reporting a fake dashboard as a “frozen investment account” may send attention toward a balance that never existed. The claim should describe what the victim controlled, what action occurred and what value actually left.

FBI guidance on investment fraud describes the fake-platform pattern: a victim may open a legitimate exchange account, fund it from a bank, buy Bitcoin, Ether or Tether, and then send the asset to a platform selected by the scammer. Operation Atlantic describes approval phishing separately: victims are tricked into authorizing wallet access, after which criminals can transfer cryptoassets. Similar financial harm does not mean the same technical event.

The first hour: contain loss before building the case

Direct answer: During the first hour, stop contact and new transactions, secure uncompromised access, record live identifiers, notify the services that moved the value and make an initial official report even if the tracing is incomplete.

Do not pay a tax, gas charge, insurance deposit, liquidity verification or AML release fee demanded by the same contact. Do not let a caller “help” by screen sharing. If a seed phrase or private key has been exposed, treat the wallet as compromised and obtain trusted technical help to move assets that remain; never paste the secret into a recovery website. If the incident is a suspicious token approval, review and revoke unnecessary allowances before reconnecting to other applications.

Capture volatile information before it disappears: the full destination address, network, token contract, TXID, timestamp, amount, exchange withdrawal record, website URL, user IDs, phone numbers and current chat. Screenshots help, but exports and native records are stronger because they preserve text, dates and metadata. Record what the fraudster claimed without adopting the claim as fact—for example, “the site displayed $80,000” rather than “my $80,000 account was frozen.”

Contact the bank or card issuer if fiat funded the purchase, and contact the exchange or on-ramp through a channel opened independently from its official site. Ask for a fraud case number and preservation of account, KYC, login and transaction records. Report to the appropriate national channel. The initial report can be supplemented when a better transaction map is available; waiting for a polished private report may allow funds to move again.

1. 01
   Stop

   End the call or chat and send no further payment, signature or approval.

2. 02
   Secure

   Use a clean device to protect email, exchange, bank and wallet access; revoke malicious allowances where applicable.

3. 03
   Capture

   Save addresses, TXIDs, networks, token contracts, timestamps, chats and platform records.

4. 04
   Notify

   Open fraud cases with the bank, on-ramp, exchange, wallet provider or issuer that can preserve relevant data.

5. 05
   Report

   Use the official reporting channel for the victim's jurisdiction and retain the reference number.

Build a one-page evidence card before a long narrative

Direct answer: A usable evidence card links the victim's real-world payment to the on-chain event in a compact chronology, while the full files remain attached as supporting evidence.

Start with one sentence that identifies the incident: who initiated contact, the false reason given, the asset and network, the amount actually sent, and when the victim discovered the fraud. Then list every transaction in chronological order. Each row should contain the fiat source, legitimate purchase or exchange account, token, network, full address, TXID and value at the time. Keep displayed platform profits in a separate field marked unverified.

The evidence card should also name the current custodian or service if the public trail reaches one, but it must distinguish observation from attribution. “The address sent 50,000 USDT to a deposit address attributed by a public service to Exchange X” is not the same as “Exchange X owns the fraud.” A label can be wrong or shared. The platform may still be the right recipient for a preservation request, but identity requires its records or other evidence.

The Ohio public case illustrates the value of exact linkage. The victim lost $425,000, yet investigators traced $105,615 to the address that held 947,883 USDT. The entire wallet balance was not treated as that person's property. The traceable amount was paid; the remaining personal loss followed a separate remission route. Your evidence card should make the same separation between personal loss, observed wallet balance and legally claimed property.

Trace: what blockchain analysis can and cannot establish

Direct answer: A trace can reproduce public movements and identify probable service touchpoints, but it does not by itself identify the controller, freeze the asset or prove that every downstream token belongs to one victim.

A sound trace begins with a verified origin: a withdrawal record, victim-controlled address or TXID. It follows token transfers, native-asset movements, swaps and bridges while recording the rule used at each step. Simple hops are visible directly. Service deposit attribution, clustering and cross-chain continuity rely on additional data and should be labelled with the confidence and source. A graph without transaction tables is difficult for an investigator or exchange to reproduce.

In a November 2023 case, DOJ said Secret Service agents traced victim deposits that were quickly laundered through dozens of addresses and exchanged among several cryptocurrencies, a technique described as chain hopping. Nearly $9 million in Tether was seized and linked to reports from more than 70 victims. The case shows that complicated movement can still be investigated; it does not mean every hop is automatically reversible or that a private graph caused the seizure.

The June 2025 DOJ action against more than $225.3 million involved hundreds of thousands of transactions and more than 400 suspected victims. Law enforcement used blockchain analysis and other investigative techniques, then filed a civil forfeiture complaint. The release described a seizure and pending property action, not completed victim distribution. Scale makes the distinction more important, not less.

• Reproduce every asserted hop with a transaction hash and network.
• Record swaps and bridge exits without assuming the same owner controls every destination.
• Label third-party address attribution and preserve the source and lookup date.
• Separate the victim's traceable value from unrelated value later consolidated in the same wallet.
• Deliver a machine-readable transaction table alongside any visual graph.

Freeze: stopping movement without deciding ownership

Direct answer: A freeze restricts an account, address or token balance through a platform's controls, an issuer's controls or legal process, but the frozen asset has not yet been awarded to a victim.

Centralized exchanges can restrict internal accounts under their compliance procedures or in response to legal process. Some centrally issued tokens have administrative controls that may prevent movement from specified addresses. Those capabilities are asset-specific. There is no universal issuer switch for native Bitcoin, and a label in a blockchain explorer does not itself freeze anything.

Operation Atlantic provides a useful public comparison. On 9 April 2026, the UK National Crime Agency reported that more than $12 million in suspected criminal proceeds had been secured and frozen, while more than $45 million stolen in cryptocurrency fraud schemes had been identified. The two numbers are not interchangeable: identified value was larger than value actually frozen. The operation focused on approval phishing and identified more than 20,000 victims across the UK, Canada and the United States.

A freeze can be temporary, contested or broader than one claimant's loss. The person requesting help should ask who imposed it, under what reference, on which asset and address, and what claimant procedure follows. A screenshot that says “frozen wallet” is not enough. Verify the notice directly with the platform, issuer or authority using contact information you found independently.

Seize: moving an asset into lawful control

Direct answer: Seizure means an authority has taken lawful control of identified property; it is a stronger status than a freeze, but it still does not guarantee final forfeiture or payment to a claimant.

The technical method depends on where and what the property is. A custodial exchange may transfer assets after receiving valid process. An issuer may assist with a centrally controlled token. Authorities may seize a device or obtain keys. The legal instrument and custody record matter because the public blockchain shows movement but does not, by itself, explain why the transfer was lawful.

The Chicago case is unusually clear about this stage. DOJ announced that approximately $1.4 million in USDT had been seized through a court-authorized seizure warrant from an unhosted virtual currency wallet. Tether assisted in effectuating the transfer. DOJ called it one of the first U.S. recoveries of USDT from an unhosted wallet and said the funds would be returned to victims, but the release did not confirm a completed distribution.

The larger June 2025 action is another seizure example. DOJ filed a civil forfeiture complaint against more than $225.3 million in cryptocurrency associated with an alleged laundering network. The Secret Service described it as the largest cryptocurrency seizure in its history. Because the complaint still had to proceed, the safe status is “seized; forfeiture sought,” not “$225.3 million returned.”

1. 01
   Locate

   Identify specific property and document its link to reported victim transactions.

2. 02
   Preserve

   Prevent movement where a service, issuer or authority has a lawful mechanism.

3. 03
   Obtain authority

   Secure the warrant, order or other process required by the relevant jurisdiction.

4. 04
   Transfer custody

   Move or secure the property under an accountable authority-controlled arrangement.

5. 05
   Continue the property case

   Resolve forfeiture, third-party claims and victim distribution separately.

Forfeit and return: the property case is not finished at seizure

Direct answer: Forfeiture resolves the legal status of seized property, while return requires a valid victim claim and an actual distribution; public announcements must say which of those events has occurred.

A seized wallet may contain funds from several victims, unrelated deposits or proceeds the government alleges came from other frauds. Potential owners must have a process to assert rights, and the authority must decide whether the property can be forfeited. Distribution may then occur through restitution, remission, restoration or another local procedure. These terms are not interchangeable, and the route varies by jurisdiction.

The Ohio matter is the clearest public status chain in this source set. A victim lost $425,000. Tether froze an address holding 947,883 USDT; a federal seizure warrant moved the tokens to law-enforcement control. A final order paid the directly traceable $105,615 to the victim and forfeited approximately $842,268 to the United States. The victim petitioned for remission of the remaining $319,385. DOJ reported that the petition was approved and that the remaining loss would be paid, producing a full $425,000 recovery when completed. The correct labels are still separate: $105,615 paid, $319,385 approved for payment.

Maine shows a partial distribution. Two victims transferred more than $800,000 in 2022. FBI seized 470,773 USDT, a federal court ordered forfeiture, and on 13 March 2026 DOJ said approximately $470,735 was being provided to the two victims. Virginia was at a different stage: title had been cleared to nearly $1.7 million in USDT and BUSD, and return was in process. Neither release supports changing “being provided” or “in process” to “already paid.”

When the trail reaches a centralized exchange

Direct answer: A centralized exchange touchpoint can create a practical preservation and identification opportunity, but only the exchange and competent authorities can decide whether to restrict, disclose or transfer account property.

Prepare a concise notice containing the victim's case reference, exact TXIDs, network, token contract, destination or deposit address, timestamps and a short explanation of the fraud. Use the exchange's official reporting channel rather than a support contact supplied by the scammer. Ask the exchange to preserve account, KYC, device, login and transaction records for lawful process. Do not demand personal data that the platform is not permitted to disclose to you.

A deposit address is useful but not conclusive identity evidence. Exchanges may rotate or share address infrastructure, credit funds internally and send withdrawals from different omnibus wallets. Public attribution can therefore identify a likely service without identifying the customer. The platform's records, and the lawful process used to obtain them, are what may connect an on-chain deposit to an account controller.

Be alert to exchange impersonation during the response. FBI warned in August 2024 that scammers contact victims while posing as exchange employees, create urgency, and seek credentials, links or identifying information. End the unsolicited call and navigate to the official exchange site independently. A real support investigation does not require your seed phrase, private key or a transfer to a “verification wallet.”

• Use the platform's independently verified fraud or law-enforcement portal.
• Reference the existing police report instead of inventing legal authority.
• Provide full addresses and TXIDs; never provide private keys.
• Ask for data preservation and a case number, not an informal promise of reimbursement.
• Record the exact status: received, under review, restricted, frozen or released.

Cross-chain movement, swaps and laundering do not erase the starting evidence

Direct answer: Cross-chain movement complicates continuity because the asset and ledger change, but the original TXID, service records and bridge or swap events still provide a structured starting point for investigators.

Do not describe a bridge as though one token literally travelled between chains. Typically, an asset is locked, burned, swapped or deposited on one system and a corresponding asset is released or minted elsewhere. A defensible report records both sides, the bridge or service, the relevant transaction identifiers and the rule used to link them. When the link depends on timing, amount or vendor attribution rather than a direct protocol record, say so.

Rapid swaps create valuation and ownership questions. A victim may send ETH, the fraud network may convert it to USDT, and the recoverable property may later be another token. The claim should preserve the amount and value of the victim's actual transfer while describing downstream assets separately. Do not use a later wallet balance as proof of the victim's entitlement to all property there.

The nearly $9 million DOJ seizure announced in November 2023 involved proceeds moved through dozens of addresses and exchanged among several cryptocurrencies. Investigators called the technique chain hopping and connected the seized Tether to reports from more than 70 victims. The June 2025 $225.3 million action involved a still larger laundering network with hundreds of thousands of transactions. Both matters show why structured transaction data and service cooperation matter; neither supports a promise that complexity can always be unwound.

The fiat on-ramp is part of the evidence and response

Direct answer: When a bank, card or legitimate exchange funded the crypto purchase, notify that institution immediately and preserve its records even though the final blockchain transfer cannot simply be recalled.

Many investment scams deliberately use a legitimate on-ramp. FBI's investment-fraud guide describes victims moving money from a traditional bank to a reputable exchange, buying the token selected by the scammer and then sending it to a private wallet or fake platform. The legitimate first step does not validate the destination. It does, however, create records connecting the victim's fiat loss to the on-chain transaction.

Tell the bank the true mechanism: impersonation, false investment claims, remote access or another form of deception. Ask whether any fiat transfer is still pending, whether a recall or fraud review is available, and what written documentation is required. Do not describe a deliberately submitted bank transfer as an unknown card charge if that is not what happened. Accuracy preserves credibility and allows the institution to apply the correct rules.

The Chicago public case shows the on-ramp pattern in a tech-support scam. Fraudsters used a computer pop-up, impersonated technical support and a bank fraud department, then convinced mostly older victims to convert money from traditional accounts into cryptocurrency and send it to unhosted wallets. DOJ later seized about $1.4 million in USDT. The seizure did not reverse the original bank transfers; investigators followed the resulting property.

1. 01
   Notify the fiat provider

   Report the deception and ask whether any transfer, card purchase or funding leg can still be stopped or reviewed.

2. 02
   Preserve the on-ramp record

   Download statements, order confirmations, exchange deposits, purchases and withdrawals.

3. 03
   Match fiat to crypto

   Connect each funding event to the token purchase and withdrawal TXID without combining separate losses.

4. 04
   Keep remedies separate

   A bank dispute, exchange investigation and asset-tracing case can run in parallel but have different standards.

Report locally first, then support the cross-border process

Direct answer: Victims should report through their local or national official channel; cross-border cooperation is handled by competent authorities, not by sending a private request directly to Europol or another international body.

Use the reporting route for the victim's residence and the location of the relevant financial account, then provide the same consistent transaction table to the bank and platforms involved. In the United States, IC3 accepts internet-crime complaints and may refer information to federal, state, local or international partners. In the United Kingdom, Operation Atlantic directs victims to Report Fraud. Europol publishes national cybercrime reporting links for participating countries.

Europol is explicit that a member of the public who is a victim must contact local or national police. The appropriate authorities contact Europol if needed; Europol deals with information supplied by law-enforcement agencies, not ordinary direct case submissions from the public. A private company that sells “direct Europol filing” or asks for an international case-release fee is misrepresenting that route.

A cross-border case often requires records from several jurisdictions: a domestic bank, an exchange incorporated elsewhere, an issuer in another country and a controller who may be unknown. The victim's role is to make the evidence portable and consistent. Use UTC timestamps alongside local time, retain original currency amounts, identify the network precisely, and update the original report rather than creating conflicting versions for each recipient.

Use a feasibility grid instead of a recovery percentage

Direct answer: A responsible assessment scores evidence, current asset location, available control point, legal reach and claimant linkage; it does not invent a universal chance of recovery.

Recovery feasibility improves when the origin is verified, the current asset remains identifiable, funds have reached a cooperative centralized service or controllable token, and the victim has an official case reference. It weakens when the starting transaction is uncertain, value has dispersed through cash-out routes, no service can be identified, records are missing or the claimant's value cannot be separated from unrelated funds.

The public cases show why a percentage would be misleading. In Ohio, a $425,000 loss ultimately had a documented payment and approved remission route, even though only $105,615 was directly traced to the frozen address. In Maine, more than $800,000 was lost and about $470,735 was being returned. In the JuicyFields investigation, Europol reported alleged damage of €645 million and 186,000 victims, while €1.515 million in cryptocurrency plus other categories of assets were seized or frozen. Europol did not say that the crypto had been distributed to victims.

A legitimate analyst can verify public transactions, prepare a reproducible table, identify likely service touchpoints, preserve sources and explain uncertainties. The analyst cannot compel KYC disclosure, issue a seizure order, guarantee an issuer freeze, decide ownership or promise payment. FBI's recovery-scheme warning states directly that private recovery companies cannot issue seizure orders and that exchanges freeze accounts through internal processes or legal process.

Recovery scams target people who already have a credible loss

Direct answer: Treat an unsolicited recovery offer as a new fraud risk, especially when it promises a guaranteed result, claims secret law-enforcement access or requires an advance crypto payment, seed phrase or remote access.

The FBI warned in August 2023 that fraudulent recovery businesses contact victims through social media, messaging platforms, search results and comments around cryptocurrency content. They may charge an upfront fee and disappear, or provide an incomplete or inaccurate tracing report before demanding more money. Some falsely claim affiliation with law enforcement or legal services. The prior loss makes the story persuasive because the caller may know the asset, amount or wallet address.

Verify every institution outside the conversation. Open the regulator, court, police, exchange or issuer website yourself. Call a published number and ask whether the named person and reference are real. Law enforcement does not charge victims a fee to investigate. A real public case does not authorize a stranger to sell access to seized funds, add a name to a claimant list for a wallet-deposit fee, or collect an “international tax” in USDT.

A paid service can still be legitimate when its scope is modest and testable: organize evidence, reproduce a transaction map, identify procedural options or provide licensed advice in a disclosed jurisdiction. The contract should name the deliverable, professional entity, fee and limitations. It should never say that payment purchases control over an authority, guarantees a freeze, or unlocks a fake platform balance.

• No guaranteed recovery percentage or fixed payout date before the assets are located and the process is known.
• No seed phrase, private key, exchange password, one-time code or remote desktop session.
• No payment to a personal wallet for tax, gas, AML clearance, insurance or court release.
• No unverifiable badge, invented regulator or case number that cannot be confirmed independently.
• No claim that a private report itself freezes, seizes or transfers cryptocurrency.