The "blockchain forensics firm" that doubled the loss

March 2025. A holder in Brooklyn lost $84,000 to a phishing site three weeks earlier. He searches "crypto recovery service" on Google and contacts a firm called "ChainGuard Forensics" — polished website, claims partnerships with the FBI, lists $300M in "recovered funds" on its landing page. The firm asks for a $2,400 "case-opening fee" plus 15% of recovered funds. He pays. Two weeks later, they ask for an additional $4,500 for "international cooperation fees." He pays again. Then they go dark.

The structure of secondary scams

Victims of crypto fraud are a target list. Many of them leave a public trail — posts on Reddit or X about the loss, comments under news stories, membership in online victim support groups that scammers join too. The secondary scammer offers exactly what the victim wants to hear: an authority figure who can reverse the loss. The fees are calibrated to be "worth it" given the original loss but small enough to pay without scrutiny.

The hard truth about crypto recovery

Truly recoverable cases are rare. Recovery happens when: (1) the funds were routed through a US-licensed exchange that froze them on suspicion of fraud, (2) law enforcement (FBI, IRS-CI) has built a case against the operator and obtained a seizure warrant, or (3) the operator made a mistake — KYC'd at an exchange, reused an address linked to their identity, or held funds long enough for legal process to catch up.

None of these scenarios involve a private "recovery service" charging fees upfront. Established blockchain analytics firms such as TRM Labs, Chainalysis and Elliptic sell their tools to law enforcement, exchanges and other institutions; they are not in the business of taking a private victim's case for an upfront fee.

The four signs of a fake recovery service

  • Asks for money. When recovery happens at all, it comes through law enforcement or an exchange freezing funds, and neither sends you an invoice. Anyone asking for a fee first is the secondary scam — and "we only take a cut of what we recover" is often just the opening line before the fees start.
  • Claims "FBI partnerships" or "blockchain forensics certifications." The FBI does not partner with retail-facing recovery firms. There is no industry "blockchain forensics certification" with regulatory weight.
  • Found via Google Ads or Reddit DMs. Real services do not need to advertise to grieving victims.
  • Promises specific recovery amounts or timelines. Real cases take months to years, with no certainty of outcome.

What to actually do after a loss

File IC3 (ic3.gov). File with your state attorney general's consumer protection office. Contact the exchange the funds were last seen on — if it is US-licensed, they may freeze. Then accept the loss and rebuild defensively, not chase a recovery that almost certainly is not coming.