What to Do in the First 24 Hours After a Cryptocurrency Scam

The first priority is to stop the loss

The first 24 hours after discovering a cryptocurrency fraud are rarely about finding a single legal remedy. They are about preventing additional damage, preserving evidence, and determining whether there is still an actionable point in the movement of the assets.

The first instruction is usually the simplest: stop sending money.

Cryptocurrency investment fraud frequently continues after the victim begins to suspect something is wrong. A fraudulent platform may claim that a withdrawal requires a tax payment, security deposit, liquidity fee, account-verification payment, or additional investment. A supposed recovery agent may then appear and demand another payment to retrieve the first loss. The FBI specifically advises victims of cryptocurrency investment fraud to stop sending money and report the matter through IC3.¹

Do not assume that an additional payment will unlock an account simply because a dashboard shows a substantial balance. In many confidence-based investment schemes, the displayed balance is not a custody statement at all. It is part of the fraud.

The same caution applies to people who contact a victim after the loss and claim to be investigators, law firms, government agents, hackers, or asset-recovery companies. A legitimate recovery assessment should begin with evidence, traceability, legal authority, and identifiable counterparties. It should not begin with a promise that a payment will “release” cryptocurrency from the blockchain.

Preserve the evidence before trying to solve the case

Victims often focus first on screenshots of a fraudulent investment balance. Those screenshots may matter, but the more important evidence is usually broader.

Preserve the complete communications history with the suspected fraudsters. That can include text messages, WhatsApp or Telegram conversations, emails, social-media accounts, telephone numbers, usernames, profile links, websites, application names, QR codes, payment instructions, bank instructions, wallet addresses, and any documents the fraudsters provided.

Preserve the transaction evidence as well. For each transfer, record the date, time, cryptocurrency, amount, originating account or wallet, destination address, transaction hash, and the platform through which the transfer was made. The FBI asks victims reporting cryptocurrency fraud to provide precisely this type of transaction information because it can make a complaint materially more useful to investigators.²

Do not rely entirely on screenshots when exports are available. Download account statements, CSV files, transaction histories, emails, and platform records. Retain original files rather than editing or annotating the only copy.

A useful rule is: preserve first, organize second.

Secure accounts and wallets that may still be exposed

A scam and an account compromise are not always the same event.

In a conventional investment scam, the victim may have voluntarily authorized each transfer based on deception. In another matter, the fraudster may have obtained an exchange password, seed phrase, private key, API credential, remote access to a computer, or control of an email account. Those scenarios require different responses.

Where credentials may be compromised, secure the affected email, exchange, mobile, and financial accounts. Review active sessions, security settings, withdrawal addresses, API access, forwarding rules, and recovery information. Do not type a seed phrase or private key into an unfamiliar “recovery” website.

If a wallet’s private key or seed phrase has actually been exposed, simply changing a password on a wallet application may not solve the problem. The underlying cryptographic credential may remain compromised. Moving unaffected assets can be appropriate, but the timing and method should be considered carefully if there is an active compromise or if evidentiary preservation is important.

This is one reason technical incident response and legal evidence preservation should be coordinated rather than treated as separate projects.

Build a transaction chronology

Before asking whether assets can be recovered, establish what actually happened.

A useful chronology should identify each funding event and each known destination. That chronology begins to separate three categories of evidence: what the victim knows directly, what the blockchain records directly, and what requires analytical attribution.

The distinction matters. A transaction hash can demonstrate that a transaction occurred. It does not necessarily demonstrate the real-world identity of the person controlling the destination address. Attribution may require clustering, proprietary intelligence, exchange records, IP records, KYC information, or other off-chain evidence. Foundational Bitcoin research showed that pseudonymous addresses can often be grouped using transaction-based heuristics, but those methods are analytical tools rather than identity certificates.³

Make reports that investigators can actually use

Victims should generally report cryptocurrency investment fraud through the FBI’s Internet Crime Complaint Center and consider appropriate local or federal law-enforcement reporting based on the facts. The FBI specifically encourages prompt IC3 reporting and asks for detailed information regarding contacts, payment methods, destinations, and interactions.²

The quality of the report matters.

“Someone stole my crypto” gives an investigator very little to work with.

A report identifying the relevant wallet addresses, transaction hashes, dates, amounts, exchanges, domain names, telephone numbers, usernames, communications, and other identifiers gives investigators a substantially better starting point.

Reporting should not be confused with guaranteed asset recovery. Law enforcement must prioritize matters, establish jurisdiction and legal authority, and work within criminal and forfeiture procedures. But current federal cases show that blockchain analysis, private-sector information, issuer cooperation, and forfeiture can produce significant restraints and seizures when the evidence and circumstances permit. In the Department of Justice’s 2025 $225.3 million USDT case, investigators alleged a large laundering network and described a voluntary Tether freeze obtained during the investigation.⁴ Our firm serves as counsel in that forfeiture proceeding, United States v. Approximately 225,364,961 USDT, No. 1:25-cv-01907 (D.D.C.), where we represent more than one hundred of the alleged victims and have filed verified claims covering more than $70 million in combined client losses.

Begin tracing with a legal objective

The question should not merely be, “Where did my cryptocurrency go?”

A better investigation asks:

Where did the cryptocurrency go, what can be established about the recipient, what records are likely to exist, and what legal or institutional process could realistically matter at that point?

A trace may reveal that funds are still moving among self-hosted wallets. It may show that assets passed through a bridge. It may identify interaction with a decentralized exchange. It may identify a centralized exchange deposit. It may identify a stablecoin address that has since been frozen. Each finding creates a different legal problem.

Tracing is most useful when it is undertaken with a legal objective in mind. The significance of any destination depends on what can reliably be established and whether a lawful avenue exists to obtain additional evidence or pursue assets.

Be skeptical of anyone who guarantees recovery

There is no legitimate forensic technique that permits an analyst to reverse a final blockchain transaction merely because it was fraudulent.

Recovery usually requires something beyond the blockchain itself: access to a custodian, cooperation by an intermediary, a freeze or restraint, control over an issuer-administered asset, criminal seizure, civil process, settlement, or enforcement against an identifiable defendant.

The existence of a trace therefore does not establish the existence of a remedy.

That is the most important principle during the first 24 hours. Move quickly, but do not confuse speed with panic. Preserve the evidence. Stop further loss. Determine what the blockchain actually shows. Identify where off-chain evidence may exist. Then decide which legal path, if any, is proportionate to the facts.