The second scam

Within days of losing money, somebody offers to trace it. They know what happened to you because lists of victims are a product, and the offer is theft number two.

Everything on this site aims at prevention. This page is different: it is about what happens after, when the worst has already occurred and the person who has just lost money becomes the most valuable target on the internet.

The offer arrives quickly — sometimes within hours. It is warm, competent and specific. It is also, without any exception worth qualifying, a second theft.

How they know

Because being a victim is public information. Complaints posted in a forum, a reply under a warning video, a comment on a news article, a message to a support account that was never a support account. Contact details are compiled, traded and worked through methodically. Some lists come directly from the first operation, which sells its own victims onward at a markup — the same person, twice.

This is why the message seems to know your situation. It does.

The four costumes

The blockchain investigator. Talks about tracing, clustering and exchange attribution, sometimes accurately, because the vocabulary is public. Sends a professional-looking preliminary report showing your funds "located" at an exchange, then asks for a fee to proceed.

The lawyer or law firm. Uses the name and registration number of a real firm, occasionally with a cloned website. Asks for a retainer. Real firms exist and do take cases — they do not find you in a comment section.

The regulator, police unit or "asset recovery agency". An official-looking letter, a case number, a seized-funds narrative: your money has been recovered and requires a fee, a tax, or a deposit to release. No authority anywhere charges a victim to return their own property.

The platform itself. "Compensation programme", "insurance fund", "we are refunding affected users" — from an address one character away from the real one, or from the very operation that took the money.

Why the fee always exists

Because the fee is the entire business. There is no tracing, no seizure, no negotiation and no case. The report is generated, the case number is invented, the letterhead is downloaded. What is real is the payment request, and it will be followed by another with a different justification for as long as payments arrive.

The amounts are calibrated to the loss: a small fraction of what you lost, framed as trivial next to what you would get back. That framing is the manipulation, and it is the same one that produced the original loss.

What tracing can and cannot do

Following coins across a public ledger is genuinely possible; anyone can do it in a block explorer, and firms do it professionally. What tracing cannot do is get anything back. Recovery requires a custodian to freeze an account and a legal order to release it — meaning the funds must have reached a regulated platform, that platform must be reachable by a court in some jurisdiction, and a case must exist.

Which is why real professional work in this field is commissioned by exchanges, insurers and law enforcement rather than sold door to door, and why the honest answer to "can I get it back" is usually no. If your funds are gone sets out what is actually worth doing in the first hour.

What is worth doing instead

1. Report to the police in your own countryFree. It creates the record that any later action needs, and aggregated reports are how patterns get investigated at all.
2. Report to the exchange the funds reachedFree, and the only party who can actually freeze anything. Give the transaction hash and the timestamp.
3. Report to your financial regulatorFree. It is how fake platforms end up on public warning lists, which is how the next person avoids them.
4. Keep everything, publish nothingScreenshots, addresses, hashes, messages, dates. Posting the story publicly is what puts you on the list.

Every step that helps is free. That symmetry is the simplest way to remember the whole page.