The First 72 Hours After a Crypto Scam: What to Do

Why the first 72 hours matter

Crypto moves fast. Once stolen funds hit a mixer, a privacy chain, or a non-cooperative exchange, the realistic odds of tracing — let alone recovery — drop sharply. The work you do in the first three days largely determines what is possible later.

A practical checklist

1. Stop sending money. If you are still in contact with the scammer, do not send "recovery fees" or "tax payments". These are the same scam, twice.
2. Preserve evidence. Screenshot every chat, every transaction, every wallet address, every URL. Export the originals where you can — chat exports, email headers, transaction CSVs.
3. Record the transaction hashes. Each outgoing transfer has a unique hash. These are the anchor points for any forensic trace.
4. Report to the exchange you withdrew from. Most major exchanges have a fraud desk. A timely report can, in some cases, freeze funds before they move on.
5. File a police report. A case number is required by most banks, exchanges, and counsel before they will act on your behalf.
6. Talk to an investigator. A free case review tells you whether tracing is feasible before you spend anything on it.

What we look for

When we open a case, the first pass is a feasibility check: where did the funds go, are the receiving addresses connected to known clusters (exchanges, mixers, OFAC-listed entities), and is there an actionable next step. We tell you honestly within 24 hours whether a deeper investigation is worth your money.

If you are in the window, open a confidential case. If you are past it, it is still worth talking — sometimes the evidence trail is colder than it looks, and sometimes it is warmer.