What to do if you were caught

The first hour

Stop sending money. That is the whole instruction and it is more important than everything below it, because almost all additional loss after this point comes from a follow-up rather than from the original event.

Specifically: do not send anything else to any address connected to this, do not pay a fee that has been described as necessary to release, unlock, verify or withdraw anything, and do not connect a wallet to any page somebody sends you in the next few days. The moment after a loss is the moment you are most likely to accept a plan that promises to undo it, and the people who offer such plans know that.

Then stop trying to trade your way out. Attempting to recover a position by taking a larger one is how a contained loss becomes an uncontained one. Whatever you decide about the position you are holding, decide it after you have done the steps below rather than in the hour when the decision feels most urgent.

If you have not yet lost anything and are reading this while something is still in progress, the same instruction applies and you can stop here. Nothing further is required of you.

Build the record while it is fresh

Everything you write down in the next day is worth several times what you could reconstruct in a month. Memory for sequences degrades quickly, and sequence is exactly what any report will ask about.

Capture the messages rather than describing them. Screenshots showing usernames, timestamps and the full thread are far more useful than copied text, because copied text loses context that turns out to matter. If a group or channel might be deleted, capture it now; this happens routinely and it happens fast.

Write down the sequence in plain order: when you first heard about it, from whom, what you were told, what you did, when you did it, and what changed afterwards. Use dates and times. Where you are unsure, write that you are unsure rather than guessing, because a report containing a confident wrong detail is worse than one containing an honest gap.

Collect the identifiers. Transaction signatures, wallet addresses, the token address, exchange account references, any payment reference from a card or bank leg. Addresses are the only durable identifiers in this environment; names, handles and project titles change and are not unique.

Note what you were promised, in the exact wording used. This is the detail people most often lose and most often need, because the difference between an expectation you formed and a claim somebody made is central to how any report is read.

Where reports go, in general terms

This desk cannot tell you which body has jurisdiction over your situation, what any of them will do, or what any of it means for your legal position. Those are questions for a qualified professional where you live. What can be described usefully is the general shape of the reporting landscape, which is broadly similar across countries.

Find the official versions of these for your own country rather than following a link somebody sends you. Search for the regulator by name, check that the address is the official government or authority domain, and go directly. Impersonation of reporting bodies is common and is aimed at exactly the person reading this page.

For orientation on what these organisations actually publish, the internet crime complaint intake operated at ic3.gov is a clear example of the cybercrime-reporting category, and the investor alert material published by the US Securities and Exchange Commission and the customer advisories from the Commodity Futures Trading Commission show what the financial-regulator category produces. Those three are American; if you are elsewhere, your country has its own equivalents and those are the ones to use.

File the report even if you expect nothing from it. Reports are how the people who look at aggregate patterns see aggregate patterns, and yours is one row of that.

The venue you used

If any part of what happened touched a service with accounts and customers, that service is the only participant in the whole sequence with the technical ability to stop anything, and its ability to do so decays by the hour.

Contact them through their official support channel, found from inside your own account rather than from a search result or a message. Give them the transaction identifiers, the timing and a short factual description. Ask them directly what they need from you and whether a case reference exists. Keep the correspondence.

Be realistic about what this achieves. Funds that have moved to self-custodied addresses are gone from the perspective of any single service, and no exchange can reverse a transaction on a public chain. What a venue can sometimes do is act on an account inside its own system, which is a narrow window and only occasionally the relevant one.

Contact them anyway, promptly, and then stop refreshing. Having done the fast thing quickly is worth a great deal, and continuing to chase it hourly afterwards costs you sleep without changing anything.

An honest word about getting money back

Recovery is frequently impossible. Not difficult, not slow, not dependent on trying hard enough: frequently impossible, and it is more respectful to say that plainly than to leave you hoping.

The reasons are structural. Transfers on a public chain are final and cannot be reversed by anybody, including the people who built the network. Funds move quickly, often across services and jurisdictions, and addresses do not carry identities. Enforcement bodies are working with limited resources against a large volume of reports, and the cases that get individual attention tend to be large or connected to something else. None of this reflects on the seriousness of what happened to you.

So the right expectation is that reporting is worth doing for reasons other than recovery, and that any plan built around getting the money back is a plan that will probably not pay out. Two things follow from that. The first is that you should not spend more money pursuing it. The second is that you are now, for a period, an attractive target for anybody selling hope, which is the subject of the next section and the most important thing on this page after the instruction to stop.

The second approach, aimed at you now

People who have just lost money are contacted by people offering to recover it. This is not an occasional risk; it is a routine follow-up, and it succeeds because it arrives precisely when the target most wants it to be real.

The approach usually arrives unsolicited, shortly after you have said publicly that something happened. It may present as a recovery service, a blockchain forensics specialist, a legal firm, a group of other affected people organising together, a helpful individual who says they went through the same thing, or occasionally as an official body. It may show you a dashboard displaying your funds as located and awaiting release. It may know accurate details about what happened to you, which is unsurprising, because those details are often public.

• Any upfront payment. A fee, a retainer, a deposit, a gas payment, a tax, an unlock charge, a verification amount. The structure is always that a small payment releases a large one, and the large one does not exist.
• Any request for a seed phrase or private key. No recovery process requires this. There is no exception and no technical reason one could exist.
• Any request to connect your wallet to check eligibility. Connecting is an action with consequences, and a page built for this purpose is built to take advantage of it.
• Any unsolicited contact at all. This is the cleanest filter available. Real help does not arrive in your messages; you go out and find it through official channels you looked up yourself.
• Any promise of a specific outcome. Nobody can promise recovery. Confidence about an outcome that depends on foreign jurisdictions and pseudonymous addresses is not expertise.
• Pressure to act before a window closes. The same instrument as before, aimed at the same faculty, at a moment when you are less able to resist it.

If you take one thing from this page beyond stopping, take this: the second approach costs people more than the first one does with some regularity, because it targets someone who has already been softened and who now has a reason to want to believe. Nothing legitimate will be lost by ignoring every unsolicited offer of help for the next several months.

Securing what you still have

Once the record is captured, spend an hour on the accounts and keys you still hold. This is ordinary hygiene and it is worth doing regardless of how the loss occurred.

1. Assume any wallet that interacted with something unknown is compromised. If a wallet signed anything you cannot fully account for, move remaining assets to a wallet created fresh, from a device you trust, and stop using the old one.
2. Review approvals. Where a wallet has granted permissions to programs, review and revoke anything you do not recognise or no longer use, through the official interface for whatever chain you are on.
3. Change passwords on anything connected. Exchange accounts, the email address those accounts recover to, and anything sharing that password. The email account is the highest priority because everything else recovers through it.
4. Turn on app-based two-factor authentication wherever it is offered, in preference to text messages.
5. Leave the affected channels. Membership lists are a resource, and continued presence keeps you on one.
6. Tighten what is public. If a profile links a public handle to your loss, consider whether it needs to stay that way for the next few months.

Keeping the file

Put everything in one place and keep it. A folder with the screenshots, the identifiers, your written sequence of events, the reference numbers from any report and the correspondence with any venue.

Keep it even after you have concluded nothing will come of it. Cases occasionally reopen, class actions occasionally form, and authorities occasionally contact people years later. A file assembled now is a complete file; one assembled later from memory is not, and the difference is not recoverable.

There may also be tax or accounting consequences depending on where you live and what you did. This desk is not qualified to say anything about that and will not try. If the amount matters to you, the file is what a qualified professional will ask for, so having it costs you nothing and saves the conversation.

Telling somebody

Most people tell nobody, and the silence does real damage on its own.

The reasoning behind the silence is usually that admitting it means admitting something about yourself. It does not. These arrangements are designed by people who have refined them against many attempts, they work on ordinary judgement under time pressure, and the specific information that would have changed your decision was deliberately kept out of view. The mechanism does not require a mark to be careless; it requires only that the order of arrival stays invisible.

Tell one person you trust. If you passed the thing along to others, tell them now and plainly, without a long apology, because what they need from you is accurate information quickly rather than your feelings about it. Passing along something you believed is not the same as running it, and treating yourself as though it were helps nobody.

If the amount was significant enough to affect how you are functioning, that is a reason to talk to somebody about the effect and not only about the money. Financial loss produces a genuine stress response, and treating that as a real thing rather than as a weakness is the practical move.

Going forward

There is no closing instruction that makes this fair, so here are three things that are simply true.

The first is that the mechanism is old, it is well documented by regulators who have described it across many decades and many markets, and its current vocabulary is the newest thing about it. Recognising it once means recognising it in whatever it wears next.

The second is that the useful lesson is structural rather than emotional. Not "be more careful", which is unactionable, but a specific question: does this arrangement pay anybody without a later arrival. That question separates a product from a sequence, and it is the whole content of the tool-or-scheme checklist on this site.

The third is that the arithmetic was never in your favour and was never visible to you. Why late buyers lose works it through with round numbers, and it is worth reading once, after the fact, because seeing the outcome fall out of a formula is a different kind of understanding from being told it. How coordinated buying works covers the same ground from the participant point of view.

You are allowed to be finished with this. Report it, keep the file, secure what you have, ignore everyone who contacts you about it, and go and do something else.

Questions readers send about this page