ScamLensCrypto Scam Field Guide
Emergency Response

Scammed in Crypto? What to Do and Where to Report It

ScamLens Editorial
A hand opening the account security settings page on a phone, next to an hourglass
First work out which of three situations you are in: your account was taken over, you signed an approval, or you sent the coins yourself.

Work out which of the three situations below is yours, then follow the steps under it; if two apply, do both. Whichever it is, don't delete the chats, the transfer records or the other person's account details. The platform and the police will ask for exactly those.

Which one are you in?

Exchange account hijacked: change passwords, clear devices, ask for a freeze

If you typed your password and a verification code into a lookalike site, or read a code out to someone claiming to be support, the other side may already be logged in to your account. Close the ways in, one by one, in this order:

Get into the real account from your own bookmark and change the passwords

Use a bookmark you saved yourself or type the official domain by hand; don't click a link from anyone. Change the login password and any separate withdrawal password or PIN, and change the password of the email address the account is registered to as well: that inbox can reset the exchange password, so while someone else can open it, nothing you changed holds. If you used the same password on other platforms, change it there too.

Sign out every device and session you don't recognize

The account's security settings list logged-in devices and active sessions. Remove everything that isn't yours; if there is a "log out of all devices" option, use it.

Delete API keys you didn't create

An API key can place orders without going through the login page, and one with withdrawal permission can withdraw. Open the API management page and delete every key you did not create yourself.

Check the withdrawal address book, 2FA and linked contact details

Look for unfamiliar addresses in the withdrawal address book or whitelist, and check whether two-factor authentication (2FA), the linked email or the linked phone number has been changed. Delete what was added and change back what was swapped.

Ask the platform's support for a freeze, with everything in one message

Use the live chat or ticket form inside the app or on the official site, never contact details given to you by someone who got in touch first. State three things: the account UID or registered email; when you noticed something was wrong; and the logins and withdrawals that were not yours. For each withdrawal, give the time, the coin and amount, the withdrawal address and the transaction hash (TxID, shown in the details of the withdrawal record). Ask for two things: freeze the account, and stop any withdrawal that has not gone out yet.

If someone later contacts you in the platform's name, check the phone number or account on the platform's own verification page first. OKX has a Channel verification page, and Binance has Binance Verify, which checks website addresses, emails, phone numbers, Telegram and social media accounts.

Signed a wallet approval or exposed your seed phrase: move assets, revoke approvals

This section is about wallets where you hold the keys yourself, such as MetaMask. Start by being clear about what got out. If you only signed an approval, revoke it and the wallet is still usable. If the seed phrase or private key was ever typed into a web page or sent to anyone, the wallet cannot be used again.

Move what is left to a new wallet first

Create a new wallet (a new seed phrase that has never been typed into any web page) and move anything of value to it. Approvals have to be revoked one at a time; moving the assets is quicker.

Revoke the approvals: the four steps in the ethereum.org guide

ethereum.org's guide to revoking token access lists tools for viewing and revoking approvals: Etherscan's Token Approval Checker and Blockscout for Ethereum mainnet, and multi-chain tools such as Revoke.cash. Follow the links from that guide rather than searching for a "revoke approval" site. Fake versions of these tools exist to collect one more approval, as covered in fake airdrops that get you to sign an approval.

  1. Open one of the tools listed in the guide.
  2. Connect your wallet.
  3. In the list of approvals, pick out the contracts you don't recognize.
  4. Click Revoke and confirm the transaction in your wallet.

The guide states that a revocation only takes effect once you pay a network fee, and that processing takes from one minute to several minutes depending on the network. Revoking protects what is still there: coins already taken do not come back. Before you confirm in the wallet pop-up, check that the transaction is a revoke and not another approval.

Seed phrase or private key exposed: retire the whole wallet

With the private key, the other side can send transactions directly, and revoking approvals does nothing about that. Once you have moved out what you can, stop using this wallet and this seed phrase.

Write down the contract address and the transaction hashes

The address of the contract you approved, the hash of the approval transaction you signed, and the hash of the transaction that later moved your coins all go into the police report.

You sent crypto to a scammer: stop paying, then contact the platform you sent from

You sent the coins yourself to a "mentor" or a "support agent", or deposited them on a platform the other person named. That on-chain transfer cannot be reversed. What you can do is stop adding to it and get the transaction details to the places that might be able to stop the funds.

From now on, pay nothing more

"Pay one more tax, deposit or unfreezing fee and you can withdraw" is a way to keep you paying. Whatever reason they give, send nothing.

The coins left from an exchange: contact that exchange

Through the support entry in the app or on the official site, say that this withdrawal was made under fraud and give them: the transaction hash (TxID) from the withdrawal record, the recipient address, the chain (network) used, the coin and amount, and the time of the withdrawal. Ask two questions. If the withdrawal is still under review and has not gone out, can it be cancelled? If the recipient address belongs to an account on the same platform, can that account be frozen?

You paid from a bank account, card or payment app: contact the bank or payment provider too

For example, you sent money to the other person so they could "buy the coins for you". Call the bank's or payment provider's customer line, say the payment was made under fraud, and ask whether it can be stopped or recalled. Report to the police at the same time; don't wait until the evidence is complete.

You deposited on a platform they named: don't deposit again in order to "withdraw"

The balance that platform shows on screen is not money you can take out. Write down the platform's full domain, where the app was downloaded from, the deposit address and the transaction hash of every deposit, and keep them with the rest of your material for the report.

What evidence to keep for the platform and the police

A fake platform and the other person's accounts can be shut down at any time, so save everything as soon as the steps above are done. The cryptocurrency page of the FBI's Internet Crime Complaint Center (IC3) lists what a complaint should contain: cryptocurrency addresses, the type and amount of cryptocurrency, transaction hashes, and the dates and times of the transactions, plus how you met the other person, which platforms you used to communicate, any website domains involved, phone numbers and other identifiers. To match that list, collect the following:

  • Every transfer: transaction hash, recipient address, chain, coin and amount, date and time. Open the transaction in a block explorer and screenshot the whole page, so the hash, addresses and amount are all in one image.
  • The other person's accounts: profile picture, display name, username or ID, bio, group name, and which platform you first met on and how the conversation started.
  • The full chat history: from the first message on. Export the original record if you can, and don't screenshot only the key lines. Each screenshot should show who said it, in which conversation, and when.
  • Sites and apps: the fake site's full domain, the app's name and where it was downloaded from, and whether the link came by text message, direct message or an ad.
  • Bank, card or payment-app receipts: amount, time, the recipient's name and account number, and the order or reference number.
  • A one-page timeline: date, who, what happened, how much was sent, from start to finish. This is the page you hand over when you contact the platform and when you report.

Where to report a crypto scam: US, UK, Australia, Canada, Hong Kong, Taiwan, mainland China

Take the material from the previous section and use the channel for where you live. If someone you trust can go with you, don't go alone.

  • United States: file a complaint with the FBI's Internet Crime Complaint Center (IC3) and report to the Federal Trade Commission at ReportFraud.ftc.gov. IC3's site says you can file even if you are unsure whether your situation qualifies. Complaints are combined with other data so the FBI can investigate cases and track trends, and in some instances freeze stolen funds, but IC3 does not guarantee a response to every complaint.
  • United Kingdom: report to Report Fraud, the police reporting service previously called Action Fraud, online or on 0300 123 2040. In Scotland, report to Police Scotland on 101. Both numbers are as given on the Financial Conduct Authority's report a scam page.
  • Australia: report through the Australian Cyber Security Centre's ReportCyber, and report the scam to Scamwatch, which is run by the Australian Competition and Consumer Commission. The Australian Federal Police's cybercrime page points victims to ReportCyber and notes that Scamwatch collects and analyses scam data but does not respond to individual reports.
  • Canada: report to the Canadian Anti-Fraud Centre, online at reportcyberandfraud.canada.ca or toll free on 1-888-495-8501.
  • Hong Kong: the Hong Kong Police Force's Anti-Deception Coordination Centre (ADCC) runs the Anti-Scam Helpline 18222 around the clock. The official page says the helpline only provides consultation: if you suspect you have been scammed, report at the nearest police station, and dial 999 in an emergency. You can first run the other party's phone number, web address or payment account through the police's Scameter.
  • Taiwan: call the 165 anti-fraud hotline, or report on the National Police Agency's 165 anti-fraud website (in Chinese).
  • Mainland China: dial 110 or report at the nearest police station. The National Anti-Fraud Center app, published by the Criminal Investigation Bureau of the Ministry of Public Security, accepts tip-offs.
  • Elsewhere: report to the police where you live.

After reporting, also report the exchange accounts and social media accounts the other person used, through each platform's own reporting form.

After the coins have left: when can they still be stopped?

The on-chain transfer itself cannot be reversed. The FTC's page on cryptocurrency and scams says cryptocurrency payments typically are not reversible: once you pay, you can usually only get the money back if the person you paid sends it back. IC3's cryptocurrency page uses the word "irrevocable". So whether anything can still be stopped depends on who is holding the coins now.

Where the coins are nowWho can act on themWhat you can do
Still in your own exchange account, or in a withdrawal that has not gone outThat exchangeAsk the platform at once to freeze the account and cancel the withdrawal, as in the hijacked account section above
In the other party's account at an exchangeThat exchange, which holds the coins in the account in custodyGive the transaction hash and the recipient address to the platform you sent from, and report it. Whether the account is frozen is up to that exchange and law enforcement
USDT, sitting at the other party's own wallet addressThe issuer. Tether's terms of service state that it reserves the right to freeze tokens and blacklist addresses, including at the request of governmentsReport it and give the address and hash to the police. If someone approaches you privately asking for an "unfreezing fee", see the next section
A native coin such as bitcoin or ether, sitting at the other party's own wallet addressOnly whoever holds the private key for that addressReport it and keep the address and hash
Already moved abroadThe platforms and law enforcement thereReport it. IC3 states that once cryptocurrency has moved to another jurisdiction, US law enforcement may face significant difficulties in following it

Someone says they can recover your money for an upfront fee

Treat it as a scam. This is what two agencies say:

  • The FTC's page on refund and recovery scams: government agencies and legitimate organizations will not charge you to help get your money back, and will not guarantee that you will get it back. If someone contacts you first and wants a fee up front, that is a scammer. The same page says scammers buy, sell and trade lists of people who have already lost money.
  • IC3: it does not work with non-law-enforcement entities such as law firms or cryptocurrency services to recover funds or investigate cases, and it will not contact you to ask for information or money. It tells victims to be cautious of cryptocurrency recovery services, especially those that charge an upfront fee.

If the caller can recite how much you lost and how it happened, that only shows your details are in their hands. A lawyer you found yourself and whose credentials you checked, charging for their work, is a different matter, though nobody can guarantee the result. For how the "unfreezing fee", "deposit" and "channel fee" requests each work, see crypto recovery scams: "we can get your USDT back".

Next, for the case that matches yours