Eight Scams, One Desk: What Actually Brings Stolen Crypto Back
I’ve laid eight of my recent investigations open on this site — real operators, real traces, outcomes from 31% to 84%. Read one at a time they’re cautionary tales. Read together, they answer the question every client asks me first: can I actually get it back?
The honest answer is “sometimes, partly, and it depends on a few things you can still influence.” After years of this work, the cases that recover well and the cases that don’t separate along surprisingly consistent lines. Here is what I’ve learned, drawn straight from the files in my case studies.
The one factor that beats every other: time
If you take nothing else from this, take this. The single biggest predictor of how much I recover is how quickly the case reaches me. Eleanor came to me in six days and we recovered 84%. Colin came after seven weeks of paying fees and 31% was the honest ceiling. Same diligence, very different windows.
Stolen crypto doesn’t sit still. It’s swept, split and routed toward off-ramps within hours. Every day that passes lets the operators add another layer between you and the exchange where recovery actually happens.
How the money leaves decides what’s possible
The payment rail you used shapes the whole investigation. Card payments often have chargeback rights, which is how I clawed back the bulk of Lori’s boiler-room losses. Bank transfers to a cloned firm can fall under reimbursement frameworks — the route that carried most of Eleanor’s recovery. Pure crypto is the hardest, recoverable only where it touches a platform with a real compliance desk.
That’s why two scams of similar size can end so differently. Trade Zone X and Myforexp2p both moved funds on-chain — but where those funds landed, and how fast we got there, set the outcomes at 47% and 38%.
Why a “fee to withdraw” is always the scam
Five of these eight cases share one mechanism: at the moment you try to take money out, a fee appears. A “liquidity unlock,” a “verification tax,” an “AML deposit.” It is the same trick wearing different clothes — from the Soteriavaults staking vault to Canada Crypto Bank’s phantom loan. No legitimate platform on earth asks you to pay in to get your own balance out. The day that fee appears is the day to stop and seek help.
And the cruellest one: the refund that isn’t
If you’ve already lost money, expect a second call. Patricia’s case is the pattern in miniature: a fake “government refund unit,” armed with details from the first scam, asking for fees to release a reimbursement that doesn’t exist. I’ll say it as plainly as I can — a real investigator never asks you to pay a fee up front to recover your money. I don’t.
The eight cases, at a glance
Read the full investigations
Each case above opens into the complete file — how the trap was built, what I did, and exactly what came back. Start at the Case Studies hub.
If it just happened to you: the first 48 hours
- Stop paying. No genuine withdrawal, “tax” or “unlock” ever requires you to send money in to get money out.
- Write down every transaction — dates, amounts, wallet addresses and transaction hashes. This is the spine of any trace.
- Delete nothing. Chats, emails and screenshots are evidence, even the embarrassing parts.
- If you paid by card or bank transfer, contact your bank today — those rails carry deadlines that crypto does not.
- Ignore anyone who contacts you offering a “refund” or “recovery” for an up-front fee. That is the second scam.
- Bring it to someone who follows the money on-chain. The wallets remember even after the platform deletes your account.
Tell me what happened
I’ll look at your case honestly — what can be traced, what can be recovered, and what can’t — and I never charge a fee up front. You can get in touch here or submit the details directly.