What to do in the first 24 hours after a crypto scam
The transfer went through, the person who promised to help has gone quiet, and you have spent the last few hours refreshing a screen that will not change. If you only have energy for one thing right now, spend it on the next 24 hours. That window is where most of what can still be done actually gets done.
First, something you probably need to hear. You were targeted by people who do this for a living, working from scripts refined on thousands of victims before you. Falling for it is not a character flaw. The sooner the shame loosens its grip, the sooner you can act, and acting fast is the one part of this you still control.
Stop paying, including the “fee to get it back”
Whatever the platform or the person is asking for next, do not pay it. The withdrawal tax, the account-unlock fee, the small deposit to “verify” your wallet, they are all the same scam wearing a new label. No payment releases the rest. Cut contact, but do not delete anything yet. Stepping away quietly keeps the scammer from rushing the money somewhere harder to follow.
Save the evidence before it vanishes
Fake sites and chat accounts tend to disappear once a victim pushes back, so capture everything now. Screenshot the dashboard, the platform URL, and the whole conversation wherever it happened. The pieces that matter most to anyone tracing this later are the wallet addresses and the transaction hashes for each transfer you made. Keep copies in two places, like your phone and a cloud drive, because forensic work needs the original unedited files. Our guide to preserving evidence in the first 24 hours walks through how to do it cleanly.
Report it in the right places, today
File with IC3.gov and ReportFraud.ftc.gov, then ask your local police for a report and a case number. That number matters more than it looks. Exchanges usually want an official police or federal case reference before they will act on a freeze request. Include your wallet addresses, the transaction IDs, the platform name, and your screenshots. The FBI is upfront that reporting does not by itself bring money back, but it is what gives an investigator or an exchange something concrete to act on.
Call the exchange while the money may still be reachable
Crypto payments cannot be reversed the way a card charge can. What sometimes works is different. Funds that land at a compliant exchange can occasionally be frozen, but only if that exchange hears about it before the money is cashed out or run through a mixer. So call the platform your money left from, and the receiving exchange if you can identify it, and ask them to flag the destination address. This is the step where hours genuinely change the outcome.
Expect the second scam, and ignore it
Within a day or two, messages will start arriving that promise to recover your crypto for an upfront fee. They found you on the same victim lists the first crew sold. Real tracing is paid for as investigative work, not sold as a guaranteed refund, and nobody legitimate asks to be paid in crypto or gift cards. If you want the longer version before someone talks you into round two, we wrote about whether crypto recovery services are legit.
When to bring in an investigator
For larger losses, a documented on-chain trace can turn your report into something law enforcement or a court can actually use. Our Investigation Help page covers the smaller cases we sometimes take on, and for five and six figure losses that need court-grade attribution we point people to Rexxfield. If you are weighing whether it is even worth it, our honest take on the real chances of getting money back may help.
None of this guarantees the money comes home. What the first 24 hours decide is how much of a trail is left to follow, and that is worth protecting while you still can.
— Gus