Stop sending, including any 'release fee'
The most common second loss comes from a request for one more payment to unlock a withdrawal — a tax, a fee, a verification deposit. There is no legitimate mechanism by which sending more cryptocurrency releases funds already sent. Stop paying at this point, however plausible the explanation.
Preserve the record before it disappears
Accounts and websites are frequently taken offline within days. Anything you have not saved may not be recoverable later.
- Transaction IDs and receiving addresses for every payment, copied as text rather than only as screenshots.
- Full chat history from every channel used, exported where the app allows it.
- The website or app used, including URLs, and screenshots of your supposed balance.
- Phone numbers, email addresses, social profiles and any documents sent to you.
- Your own bank or exchange records showing where the money came from.
Secure the accounts around you
If you shared screen access, installed software at someone's request, or entered wallet details into a site, treat every connected account as exposed. Move remaining balances to a wallet the other party has never seen, revoke token approvals, change passwords and enable app-based two-factor authentication. Never re-enter a seed phrase into any site or support form — no legitimate party will ever ask for it.
Report it in the UK
Keep every reference number. A well-evidenced report with hashes attached is treated very differently from a general complaint.
- Action Fraud, or Police Scotland on 101 in Scotland, for the formal crime report and reference number.
- Your bank, if funds moved through a card or bank transfer, so the payment route can be reviewed.
- The exchange you sent from, and the receiving service if you can identify one, through their fraud or compliance channel.
- The platform hosting the profile or advert that reached you.
What comes next, realistically
Once the record is preserved and reported, an onchain investigation can establish where the funds moved and where they came to rest. Where a path ends at a regulated service, that is a point a bank, solicitor or law enforcement body can act on. Where it ends in a privacy tool or a dormant address, we say so — and we will tell you at the first review if the data does not support a case worth paying for.
If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.
Common questions
- Can a cryptocurrency payment be cancelled or reversed?
- No. A confirmed transfer is final. What can be done is establishing where the value went and evidencing it for the people who can act on it.
- Should I pay a fee to withdraw my balance?
- No. A request for payment before a withdrawal can be released is a standard feature of this type of fraud, whatever it is called.
- How quickly should I act?
- Preserve records the same day, and report within a few days. Onchain data is permanent, but chat histories, websites and profiles routinely disappear.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the onchain data supports a traceable case.
Key terms in this guide
Plain-English definitions from the Wallsec glossary.