Ilia Zavialov explains why a second payment never brings the first one back

01Why the offer arrives so soon after the loss

The message usually lands while the loss is still fresh. It can come as a reply under a post about the scheme, a private note in a support chat, a comment beneath a video about crypto fraud, or an advert above the search results for a phrase like «recover stolen bitcoin». To the person reading it the timing looks like coincidence. Anyone who has just paid a scheme has demonstrated that they hold crypto, that they answer strangers, and that they are under pressure to act.

Those three facts have market value. The traces left by a first scheme, wallet addresses, screen names, e-mail addresses and amounts, get sorted, traded and worked again. A person who published a transaction hash in a public forum while asking for help has effectively printed an invitation. The second approach can then open with details that only a witness would appear to know, which is exactly why it reads as credible.

The emotional state matters as much as the data. A sudden loss produces a need to do something, and inaction feels unbearable while the money is still theoretically traceable. A recovery pitch answers that need with a task list: send the hashes, sign the agreement, pay the retainer, wait for the report. The structure itself is soothing, because it converts helplessness into a process with visible steps.

02The vocabulary that makes a pitch sound technical

A recovery pitch is rarely crude. It speaks of on-chain forensics, address clustering, mixer de-anonymisation, cross-border asset tracing, freezing orders and compliance liaison. Some versions attach a job title such as «certified blockchain recovery specialist». The vocabulary is borrowed from work that genuinely exists, which is the reason a quick search fails to disprove it.

Blockchain analysis is a mature discipline. Firms sell software that maps addresses into clusters and labels known services, and exchange compliance teams use it to decide whether an incoming deposit is tainted. The output of that work is a graph and a written report describing where value moved. Its authors have no ability to move value back.

The pitch collapses two separate things into a single word. Tracing ends at an address. Recovery would require control of the keys behind that address, or a legal instrument compelling a custodian who holds the funds. An offer that promises a result within days has quietly skipped the courts, the jurisdictions and the exchange legal departments that sit between those two points.

03What a public ledger actually permits

A confirmed transaction on a public chain is final by design. There is no card network behind it, no chargeback window, no settlement bank able to reverse an entry after review. Irreversibility is the property people pay for when they choose these networks, and it applies with identical force when the payment was a mistake. Every recovery promise has to work around that fact or pretend it is absent.

The only key that can move coins from an address is the key controlling it. That leaves one realistic lever, and the lever sits off the chain. When stolen funds reach a service that verifies identity, that service can freeze the balance if it is asked in time and in the correct form. Such a request comes from law enforcement or from a court.

A private agent has no standing anywhere in that chain of requests. They cannot compel a custodian, obtain a freezing order or serve process abroad. Their access to the underlying data is the same public explorer available to everyone with a browser. What they sell is the impression of access, packaged as a service.

Speed settles the rest. Funds taken by a scheme are usually split, swapped across chains and pushed through services within hours. By the time a person has found a recovery advert, the value has often been converted and withdrawn through an identity nobody can summon on request. A report can still describe that path, and a description changes nothing about who holds the money.

04The ladder of fees

The first payment is designed to feel proportionate. Set against a loss of tens of thousands, a retainer of a few hundred reads as a rational bet with an obvious upside. Some pitches make the first step easier still by calling it a network fee, a gas cost, or a deposit returned out of the recovered amount. The purpose of that step is agreement, and its size is chosen to obtain agreement quickly.

After that the requests arrive in sequence. An unlock fee to release the traced balance. A tax clearance so the transfer counts as lawful. An escrow deposit demanded by a partner exchange. An anti-money-laundering charge before anything can reach a personal wallet. Every item is presented as the final obstacle, and every one appears only once the previous item has been paid.

The ladder works because of what has already been spent. Refusing at the fourth step means writing off the first three, and the mind resists that far more strongly than it resists one further transfer. The people running the sequence understand this better than their targets do. They keep adding rungs while payments continue and vanish on the day the payments stop.

This is why the total extracted often exceeds the original loss. The first scheme took an amount the person had decided to risk. The second takes whatever can be found under pressure, which means savings, borrowing from relatives, and sometimes a credit line opened for the purpose.

05Dashboards, case numbers and paper

Most operations of any size run a portal. The person logs in and sees a case reference, a progress bar, a list of traced transactions and a recovered balance that climbs over the following days. None of it touches a chain. A number on a page costs nothing to write, and the balance displayed there has never existed anywhere else.

The portal performs one job: it justifies the next fee. An attempt to withdraw returns an error naming a fresh requirement, and the requirement carries a price. Because the person can see the money on screen, walking away feels like abandoning something real. The interface converts an abstract promise into an apparent asset, which is exactly what it was built to do.

Paperwork follows the same logic. A service agreement in a familiar format, a company number copied from a real registry, a letterhead and sometimes a scanned certificate cost almost nothing to assemble. One detail resists the staging: regulated firms bill through channels that leave an audit trail, while demands for stablecoins sent to a fresh address, for gift cards or for a cash courier exist because those routes cannot be undone. The chosen payment method describes intent more honestly than any document attached to it.

06Borrowed authority

The strongest version of the pitch avoids the language of business entirely. It arrives as a regulator, a police cybercrime unit, an exchange compliance officer, a court clerk or a lawyer acting for a group of victims. Impersonation dominates the reported figures. The Federal Trade Commission logged more than a million impersonation reports for 2025 with 3.5 billion dollars in losses, close to one report in every three.

Authority changes the nature of the request. A commercial offer invites a decision, while an official instruction invites compliance. Once the frame is administrative, a demand for money becomes a procedural step with a bureaucratic name, a release fee, a bond, a clearance charge. People who would dismiss a salesman will follow a case officer through several transfers.

Call centres are built for this work. The FBI complaint centre counted more than eighty thousand reports of call centre fraud, covering fake technical support together with government impersonation, and losses above 2.9 billion dollars in a single year. Such an operation has scripts, shift patterns, escalation to a supervisor and a standard of politeness most real institutions struggle to match.

The same data holds a detail worth keeping in mind. In four impersonation reports out of five, no money changed hands at all. Attempts outnumber successes by a wide margin, which means an approach of this kind is routine background noise and carries no implication that somebody has been singled out.

07Voices that pass for familiar

The telephone stage has changed shape. A convincing voice clone can be produced from roughly three seconds of recorded speech and reaches around eighty five per cent accuracy. Source material is trivial to obtain from a voice note, a webinar recording, a podcast appearance or a short clip on a social account.

Human detection has not kept pace. In controlled testing, listeners separated a real voice from a synthetic one in 37.5 per cent of attempts, a result worse than guessing. That figure removes recognition from the list of usable security checks. A voice resembling a known lawyer, a bank officer or a relative now carries no information at all about who is actually speaking.

The response has to be procedural. Identity gets confirmed on a second channel chosen by the person receiving the call, using a number published by the institution itself and never a number supplied during the call. A question whose answer sits outside any public record works as a further filter. Pressure to stay on the line and act immediately is itself the clearest signal available.

08Why the same person is approached again

Contact details of people who have already paid circulate as a product. This trade is old and predates crypto by decades, and the format has simply moved to messaging apps and spreadsheets sold inside closed channels. A person who paid once is worth more than a random stranger, because the expensive part of the work has already been completed by somebody else.

The second wave often poses as the response to the first. Somebody writes as the investigator assigned to the original case, as a liquidator distributing seized assets, or as an administrator holding a settlement fund. Details of the original loss are quoted accurately, because they came from the operation that caused it. Accuracy about the past is used to buy credibility about the future.

Age shows clearly in the figures. Complainants aged sixty and above reported an average loss of 38,501 dollars against an overall average of 20,699 dollars, roughly 1.86 times higher. Repeated targeting is part of that gap, alongside larger holdings and a stronger sense of obligation towards anyone who sounds official.

A workable rule sits inside this pattern. Any unsolicited approach that already knows the specifics of a loss should be read as proof that the record is circulating. Knowledge of the case is evidence about the sources of the sender, and it says nothing whatever about their authority to act.

09What is worth doing, and where it stops

The first hours carry real practical value. Transaction hashes, wallet addresses, chat exports, screenshots, receipts and the exact chronology should be preserved before the other side deletes accounts. If the funds passed through an exchange, that exchange should be notified in writing with the hashes attached, since a freeze is only possible while the balance is still sitting there. Where a bank or card rail appeared in the chain, the bank receives the same notice on the same day.

Reporting to national channels matters beyond a single case. The FBI complaint centre logged 1,008,597 complaints for 2025 with nearly 21 billion dollars in reported losses, a rise of twenty six per cent on the previous year, and around half of all reported losses in the United States involve crypto. Individual reports allow a pattern to be assembled across many victims, which is the only route by which one address becomes a named target.

The honest limit belongs in the same paragraph as the advice. Reporting rarely returns money to the person who filed the report. Realistic outcomes are a durable record, occasionally a freeze when the timing happens to be right, and sometimes a distribution years later through a court appointed process. Anyone describing a faster or more certain result is describing something that does not exist.

Professional help can still be engaged, and it looks different from the moment of first contact. A regulated law firm works under a written engagement, invoices through a traceable channel, holds a licence that can be verified with the regulator directly, and states plainly that the outcome remains uncertain. Nobody with genuine standing asks for a payment in crypto to a personal address as the condition for releasing funds that are supposedly already recovered.

10Questions and answers

11Read next

• Ilia Zavialov Explains How a Crypto Transfer Actually Works, Step by Step How crypto works
• Ilia Zavialov Explains the Types of Crypto Scams and How Each One Is Built Scam types
• Ilia Zavialov on the Crypto Wallet Protections That Hold After a Breach Protection
• Ilia Zavialov on the First Hours After a Crypto Theft: What Actually Helps Incident
• Where Fraud Losses Actually Go: Ilia Zavialov Reads the 2025 Numbers In numbers
• Ilia Zavialov on the seed phrase and the fake wallet support desk Seed phrases
• Checking a wallet address before you send: the checks Ilia Zavialov runs first Wallet checks
• Ilia Zavialov Explains How an Approval Drainer Empties a Wallet Wallet drainers

Back to the blog