Fake crypto recovery: how the second scam works

The hack is the first loss. The stranger who offers to get your money back is the second.

How does the recovery scam work?

It follows the first scam, and it feeds on the same people. The FTC describes it plainly: the scammer calls, emails, texts or messages you on social media and says they can get your money back. If you did not know you had been scammed, they use bought data to tell you a believable story (CONFIRMED: FTC consumer advice, "Refund and Recovery Scams").

The FBI says almost all victims of crypto investment fraud are later contacted by recovery scammers. Its red flag: excuses such as a tax or fee before you can "access" your funds. Do not pay (CONFIRMED: FBI).

MINTGRAPHSECOND SCAM · CONFIRMED BY FBI AND FTC

1. They find youright after a hack or a loss
2. They look officiallawyer, investigator, support
3. They askfee, tax, gas or your documents
4. They repeata new fee appears, or they vanish

Law enforcement does not charge victims a fee to investigate. Never pay to get coins back.

Source · FBI IC3 PSA240624, FTC refund and recovery scams

1. They find you. Often right after a public hack or a loss you mentioned.
2. They look official. A "blockchain investigator", a "recovery lawyer", "exchange support", or a site that copies a real claim page.
3. They ask for something. An up-front fee, a "tax", "gas", ID documents or your bank details.
4. They take it and ask again. A new fee appears, or they vanish.

What do the authorities say?

On 24 June 2024 the FBI's Internet Crime Complaint Center warned about fake law firms that contact crypto scam victims. Some claim to work with the FBI or another agency. They may ask for your identity details, an up-front part of their fee, or "back taxes". Victims reported more than $9.9 million in losses to these fake firms between February 2023 and February 2024 (CONFIRMED: IC3 alert PSA240624). That figure is more than two years old and covers reports only in the US.

The same alert gives the rule that settles most cases: law enforcement does not charge victims a fee for investigating a crime.

Is it happening after the Bitget hack?

Both Bitget and Drift felt the need to say so publicly.

Bitget's incident page, updated 13 October 2026, has a warning. Bitget will never ask you to transfer funds. It will never ask for passwords, private keys, seed phrases or codes to "assist with asset recovery" or "restore withdrawals" (CONFIRMED that Bitget says this). Our write-up of the Bitget hack has the details.

Research noteWhere stolen crypto goes: the $388M Bitget hack, step by step→

Drift Foundation made the same point in its recovery update on 30 September 2026:

Show moreShow less

Posted by @DriftFDN on 30 September 2026. Public when we checked on 15 October. The warning is at the end: it "will never message you directly about recovered funds, ask you to connect a wallet, or ask for a fee."

We found no public report of a specific scam run against Bitget or Drift victims. The warnings read as a precaution. Whether a campaign exists is not known.

What does real recovery look like?

Slow, partial and announced by the project itself. Drift is a live example. It says about $295.4 million was taken from its users on 1 April 2026 and about $9.2 million has been frozen so far (REPORTED: Drift Foundation, 30 September). On 1 October it opened claims for a recovery token, DFX, on its own website. At launch, each DFX redeems for about 0.0104 USDT, roughly one cent per dollar lost (CONFIRMED: Drift's own update, 1 October 2026).

One more sign from the FBI: be wary of recovery services that use vague language, have little online presence, and promise results.

I already paid. What now?

You are not the first, and it is not your fault.

These steps are safety guidance, not legal advice.

!If you already paid a recovery agent: stop sending money, keep every record, report it officially, treat any wallet whose seed phrase you shared as compromised, tell your exchange. Source: FBI IC3, FTC, Report Fraud UK, EFCC.

1. Stop paying. A "final fee" is never final.
2. Keep every record. Chat logs, usernames, wallet addresses, transaction IDs, dates and amounts. Agencies ask for exactly this.
3. Report it. Pick your country below.
4. If you shared a seed phrase, treat that wallet as compromised. Do not use it again.
5. Tell your exchange if the money moved through one. Ask what it can trace or flag. It may not be able to do anything, and nobody can promise a result.

Where to report

• United States. The FBI's Internet Crime Complaint Center takes crypto fraud reports at ic3.gov (complaints are filed at complaint.ic3.gov). The FTC takes fraud and recovery-scam reports at ReportFraud.ftc.gov.
• United Kingdom (England, Wales and Northern Ireland). Report Fraud replaced Action Fraud. Report online at any time, or call 0300 123 2040, Monday to Friday, 8am to 8pm (from abroad, +44 300 123 2040). We did not verify the route for Scotland.
• Nigeria. The Economic and Financial Crimes Commission (EFCC) takes petitions online at efcc.gov.ng/SubmitPetition and in person at its directorates. Its page asks for details such as your name, contact details and the time of the offence. Its hotline is +234 809 332 2644. A cyber-crime rapid response centre is listed there as "coming soon". Petitions may come from people outside Nigeria too.

Reporting does not guarantee money back. The FBI says rapid reporting can help support recovery of lost funds.

MintGraph check

• What we checked on 15 October 2026: FBI alert PSA240624 and its crypto fraud page, FTC advice, Bitget's incident page, Drift's update, the Drift Foundation post, and the report pages above.
• What we could not check: current scam volumes for 2026, and any scam aimed at Bitget or Drift victims.

One next step

If a message offers to recover your coins, do not reply. Block it, save it, and report it. You can also warn others in the MintGraph Forge group at t.me/mintgraphforge. For the earlier link in this chain, see Telegram airdrop scams: 7 signs.

GuideTelegram airdrop scams: 7 signs and what to do→

Research and safety guidance, not financial or legal advice. MintGraph is not affiliated with Bitget or Drift.