Recovering from a Scam: Tools, Tactics, and Realistic Outcomes

What you'll learn

• The Honest Numbers on Crypto Recovery
• Notable Exceptions and Why They Happened
• What to Do Immediately If You Have Been Scammed
• The Recovery-Scam Industry
• Legitimate Recovery Channels (and Their Limits)
• Tax, Insurance, and Other Loose Ends
• How On-Chain Forensics Catches Attackers
• Mental Health and Talking to Loved Ones
• For Deeper Reading

Key terms

Recovery rate

The estimated share of stolen crypto that is eventually returned to victims. Chainalysis data implies the industry-wide rate sits below 15 percent in any given year, and dramatically lower for individual retail victims of pig-butchering, rug pulls, and drainer attacks.

Recovery scam

A second-stage fraud targeting previous fraud victims with offers of paid recovery services. The defining red flag is any upfront fee. Surveys suggest more than 50 percent of fraud victims are re-targeted within 12 months.

Bitfinex 2016 hack recovery

In February 2022 the DOJ arrested Ilya Lichtenstein and Heather Morgan ("Razzlekhan") for laundering approximately 4.5 billion dollars from the August 2016 Bitfinex hack. Lichtenstein sentenced to five years in March 2024; Morgan to 18 months in November 2024.

Silk Road forfeitures

The October 2013 seizure of approximately 144,336 BTC from Ross Ulbricht and the November 2020 separate seizure of more than 69,370 BTC from "Individual X" (worth about 1 billion dollars at the time). Funds were auctioned by the U.S. Marshals Service.

Ronin Bridge recovery

After Lazarus Group drained 624 million dollars in March 2022, Sky Mavis raised a 150 million dollar round led by Binance in April 2022; combined with company funds, all user balances were reimbursed by late June 2022.

May 2024 wBTC return

After a 1,155 wBTC (about 68 million dollars) address-poisoning loss, on-chain pressure and negotiation through Match Systems and Cryptex resulted in approximately 22,960 ETH being returned by the attacker on May 10, 2024.

Mt. Gox civil rehabilitation

The bankruptcy proceeding for the 2014 Mt. Gox collapse, administered by trustee Nobuaki Kobayashi. Repayments to creditors began July 5, 2024; the deadline for distributions has been extended to October 31, 2026.

FTX bankruptcy distributions

The FTX estate began distributing to creditors in early 2025 under John J. Ray III. Most retail account holders received their dollar-denominated November 2022 balance plus interest, often recovering 100 percent or more in dollar terms.

Rev Proc 2009-20 safe harbor

An IRS revenue procedure that lets qualifying Ponzi-scheme victims deduct 95 percent of their qualified investment in the year the lead figure is criminally charged, reduced by expected recoveries. Application requires technical coordination with a CPA.

TCJA theft-loss suspension

The 2017 Tax Cuts and Jobs Act suspended personal theft-loss deductions for tax years 2018 through 2025, with narrow exceptions for federally declared disasters and Rev Proc 2009-20 Ponzi cases. Most retail crypto-fraud losses are not deductible.

Lazarus Group

A state-sponsored North Korean hacking unit attributed by the FBI and OFAC to more than 3 billion dollars in crypto theft since 2017, including Ronin (March 2022) and Bybit (February 2025, approximately 1.5 billion dollars).

On-chain forensics

Attribution and asset-tracing work performed across blockchain transaction data by firms like Chainalysis, TRM Labs, Elliptic, and Crystal Intelligence. The basis of most successful recoveries; primarily serves law enforcement and large institutions.