- Thread starter
- #1
You may have spent months or years building your cryptocurrency portfolio.
Then one incident changed everything.
Maybe someone gained your trust and convinced you to move a large portion of your holdings.
Maybe you were directed to a fake investment platform.
Maybe you followed instructions from someone pretending to be a financial professional, exchange employee, or another trusted person.
Or perhaps several transactions occurred before you realized that the portfolio was no longer under your control.
Now you’re looking at a portfolio that has lost a substantial amount of cryptocurrency and you’re trying to understand what actually happened.
Don’t make another transfer simply because someone promises that another payment will restore your portfolio.
The FBI advises cryptocurrency-fraud victims to stop sending money and preserve transaction information, including wallet addresses, cryptocurrency amounts and types, dates, times, and transaction hashes.
Jim Recovery Team can review the information you have, identify relevant blockchain transactions, trace known fund movements, and help reconstruct what happened to the cryptocurrency.
If you’re ready, contact [email protected] or +1 (929) 399-9264 on WhatsApp.
If you need time first, preserve the evidence before doing anything else.
STOP MAKING ADDITIONAL PAYMENTS
If the person or platform is still communicating with you, you may hear:
“Your portfolio can still be restored.”
“You need to deposit more collateral.”
“One final payment will unlock the account.”
“You need to pay the outstanding balance.”
“Your funds are frozen until verification is completed.”
“Send more crypto so we can recover the first transfer.”
Don’t treat another payment as part of the solution without independently verifying the situation.
The FBI specifically warns victims not to pay additional fees or taxes to withdraw supposed cryptocurrency investment funds.
Your first task is to establish exactly how the portfolio loss occurred.
CALCULATE THE ACTUAL LOSS
Don’t start with the portfolio balance shown by a website or app.
Start with your own records.
Separate:
Portfolio value before the incident
Cryptocurrency actually transferred
Cryptocurrency actually withdrawn
Cryptocurrency remaining
Additional unauthorized transactions
For example:
Before, 50,000 USDT
Transferred, 20,000 USDT
Transferred, 10,000 USDT
Unauthorized movement, 5,000 USDT
Remaining, 15,000 USDT
The exact numbers will depend on your case.
The point is to distinguish an actual blockchain movement from a number displayed on a platform.
The FTC notes that blockchain records can contain transaction amounts and sender and recipient wallet addresses.
Once you’ve calculated the real movement of funds, identify every transaction connected to the loss.
FIND EVERY TRANSACTION
Open the wallet or cryptocurrency service associated with the portfolio.
Record:
Asset
Amount
Network
Sending address
Receiving address
Transaction hash
Date
Time
Do this for every significant transfer.
Don’t record only the largest transaction.
A portfolio loss can involve several separate payments.
The FBI identifies wallet addresses, cryptocurrency type and amount, transaction dates and times, and transaction IDs as important evidence when reporting cryptocurrency fraud.
Once you’ve collected the transactions, separate the ones you authorized from those you didn’t.
SEPARATE AUTHORIZED AND UNAUTHORIZED MOVEMENTS
You may have:
Personally sent cryptocurrency because someone instructed you to
Approved a smart-contract transaction
Connected your wallet to a website
Shared wallet credentials
Had someone access the wallet without permission
Had additional transfers occur after the original payment
These are different circumstances.
For each transaction, write:
Did I authorize this?
What did I believe I was doing?
Who instructed me?
What actually happened?
That distinction can make the transaction history much easier to understand.
Once you’ve separated the transactions, investigate the event that caused the largest portfolio reduction.
IDENTIFY THE MAIN LOSS EVENT
Maybe the largest loss came from:
A fake investment deposit
A manipulated payment
A wallet-draining transaction
A fake exchange
A malicious smart contract
A romance-related investment
A fake trading platform
A phishing website
A fraudulent business transaction
An impersonation scam
Don’t combine different events simply because they happened around the same time.
Identify what happened immediately before each major loss.
Once you’ve identified the main event, preserve the communications surrounding it.
SAVE THE CONVERSATIONS
Keep:
Emails
Text messages
WhatsApp messages
Telegram messages
Discord messages
Social-media messages
Phone numbers
Usernames
Profiles
Voice messages
Screenshots
Payment instructions
Wallet addresses
The FBI recommends providing information about how the scammer initially contacted the victim, how they identified themselves, and the communications associated with the fraud.
Don’t save only the final payment request.
The earlier conversation may explain how the person gained your confidence or why the transaction appeared legitimate.
Once you’ve preserved the conversation, document who you were dealing with.
DOCUMENT THE PERSON OR COMPANY INVOLVED
Record:
Name used
Company name
Job title claimed
Email
Phone number
Username
Website
Social account
Wallet addresses
Profile URL
Any identification they provided
If they claimed to represent a legitimate company, record that claim exactly.
Don’t automatically conclude that the legitimate company itself was responsible.
Once you’ve documented the identity they claimed, preserve what they used to make the opportunity look legitimate.
SAVE THE MATERIAL THAT BUILT TRUST
You may have received:
Investment statements
Portfolio screenshots
Trading results
Account dashboards
Invoices
Contracts
Company documents
Professional profiles
Fake licenses
Testimonials
Links
Videos
Screenshots of supposed profits
Keep everything.
A polished website or professional-looking dashboard does not establish that the underlying cryptocurrency transactions were legitimate.
The FBI warns that fraudulent investment platforms can use professional-looking websites and spoof legitimate businesses.
Once you’ve preserved the material, compare the platform’s displayed portfolio with the blockchain activity.
COMPARE THE DISPLAYED PORTFOLIO WITH THE BLOCKCHAIN
Suppose a platform showed:
Portfolio balance, 80,000 USDT
Available withdrawal, 80,000 USDT
But your blockchain records show:
Actual deposits, 25,000 USDT
Actual withdrawals, 0 USDT
The displayed balance should not automatically be treated as cryptocurrency you actually possessed.
Similarly, if your real wallet contained 25,000 USDT and 20,000 USDT later moved to an unfamiliar address, that blockchain movement is separate evidence.
Once you’ve made the comparison, identify every wallet address involved.
CREATE A WALLET ADDRESS MAP
Record:
Your original wallet
Deposit address
Investment platform address
Receiving address
Contract address
Subsequent destination
Exchange-related address, if identifiable
A simple map might look like:
Your wallet
↓
Address A
↓
Address B
↓
Address C
Don’t assume that the first receiving address is the final destination.
Once you’ve created the address map, trace the cryptocurrency movement.
TRACE WHERE THE CRYPTOCURRENCY WENT
Follow each major transaction separately.
For example:
20,000 USDT
→ Address A
→ Address B
→ Address C
Another transaction might follow an entirely different path.
Record:
Amount
Asset
From
To
Transaction hash
Timestamp
The purpose is to document movement, not to guess the identity of whoever controls an address.
The FTC notes that transaction and wallet information can sometimes help identify parties involved in a cryptocurrency transaction.
Once you’ve traced the movements, reconstruct the timeline.
BUILD THE COMPLETE TIMELINE
For example:
June 4 → first contact
June 5 → investment opportunity presented
June 6 → cryptocurrency account opened
June 7 → 5,000 USDT transferred
June 10 → platform displayed increased portfolio balance
June 12 → withdrawal requested
June 12 → withdrawal blocked
June 13 → additional payment demanded
June 13 → 10,000 USDT transferred
June 14 → account remained inaccessible
The exact sequence will depend on your case.
The goal is to connect:
contact → trust → opportunity → deposit → displayed portfolio → withdrawal problem → additional demand → further loss
Once the timeline is complete, document the withdrawal problem itself.
RECORD YOUR FIRST FAILED WITHDRAWAL
Write down:
Date
Time
Amount requested
Withdrawal method
Error message
Platform response
Additional requirement
For example:
Withdrawal requested, 15,000 USDT
→ withdrawal rejected
→ “pay verification fee”
→ 2,000 USDT requested
→ payment made
→ withdrawal still unavailable
This sequence is much more useful than simply writing:
“They wouldn’t let me withdraw.”
Once you’ve documented the withdrawal failure, preserve every subsequent demand.
SAVE EVERY ADDITIONAL PAYMENT DEMAND
The platform or person may have requested:
Tax
Withdrawal fee
Verification fee
Security deposit
Account upgrade
Liquidity payment
Negative-balance payment
Release fee
Blockchain fee
The FBI specifically warns cryptocurrency-fraud victims not to pay additional fees or taxes to withdraw supposed investment funds.
If you paid one of these amounts, record the transaction separately.
If you refused, preserve the request.
Once you’ve documented those demands, check whether your remaining portfolio is still exposed.
CHECK YOUR REMAINING WALLET
Review your remaining assets.
Look for:
Unknown transfers
Token approvals
Unexpected swaps
NFT transfers
Smart-contract interactions
Unfamiliar destinations
If you find activity you didn’t authorize, document it separately.
If you still control the wallet and believe its credentials may have been exposed, take appropriate wallet-security measures before additional assets are lost.
Never give your seed phrase or private key to someone claiming they need it to recover your portfolio.
Once you’ve checked your remaining assets, preserve the evidence before making unnecessary changes.
DON’T DELETE THE PLATFORM OR ACCOUNT YET
If you can still access the platform, save:
Dashboard
Portfolio
Deposit history
Withdrawal history
Transaction history
Messages
Account information
Balance history
Error messages
Take screenshots before the website disappears.
If the platform becomes inaccessible later, your saved evidence may be the only record of what was displayed.
Once you’ve preserved the account, save the original website information.
RECORD THE WEBSITE AND DOMAIN
Write down:
Website URL
Domain
App name
Download source
Login page
Support page
Deposit page
Withdrawal page
Terms page
Be particularly careful with domains that resemble legitimate companies.
The FBI warns that fraudulent cryptocurrency investment platforms may use domains that closely mimic legitimate sites.
Once you’ve preserved the domain, document how you first found the opportunity.
RECORD HOW YOU FOUND THE OPPORTUNITY
Maybe it came through:
A social-media advertisement
A WhatsApp message
A Telegram group
A dating or social platform
A referral
A website
A phone call
An email
A supposed financial adviser
A business contact
Save the original source.
The way you were introduced can help establish the full chronology.
Once you’ve documented the origin, compare the promised opportunity with what actually happened.
COMPARE THE PROMISE WITH THE REALITY
For example:
Promised, professional portfolio management
Actual, repeated cryptocurrency deposits
Promised, easy withdrawals
Actual, withdrawal blocked
Promised, profits
Actual, additional payments demanded
Promised, final payment
Actual, another requirement
This comparison should remain factual.
You’re documenting what was represented versus what occurred.
Once you’ve made that comparison, calculate the total cryptocurrency sent.
CALCULATE THE TOTAL SENT
Create a separate record:
Payment 1, 3,000 USDT
Payment 2, 7,000 USDT
Payment 3, 10,000 USDT
Payment 4, 5,000 USDT
Total, 25,000 USDT
Then separately record:
Actual withdrawals
Remaining assets
Unauthorized transfers
Displayed platform balance
Don’t combine displayed profits with cryptocurrency actually received.
Once you’ve calculated the total, preserve the exchange records.
SAVE YOUR EXCHANGE RECORDS
If you purchased or converted the cryptocurrency through an exchange, preserve:
Purchase history
Withdrawal history
Deposit history
Wallet addresses
Transaction hashes
Account statements
Support tickets
Fraud reports
The FBI recommends including information about cryptocurrency exchanges used to send or receive funds when documenting cryptocurrency investment fraud.
Once you’ve preserved those records, contact the service you used to send the cryptocurrency.
CONTACT THE CRYPTOCURRENCY SERVICE
If you sent the cryptocurrency through an exchange, ATM operator, or other cryptocurrency service, contact that provider through its legitimate support channel.
Provide:
Transaction hash
Asset
Amount
Receiving address
Date
Time
Explanation of the fraud
The FTC advises people who paid a scammer with cryptocurrency to contact the cryptocurrency exchange or ATM operator immediately, report the transaction as fraudulent, and ask whether the transaction can be reversed or the money refunded.
Don’t assume a reversal will be possible.
Ask what options the provider has and preserve the response.
Once you’ve contacted the provider, save the case number and correspondence.
PRESERVE THE SUPPORT RESPONSE
Keep:
Case number
Email
Chat transcript
Fraud report
Transaction review
Instructions
Date contacted
If the provider says it cannot reverse the transaction, preserve that response too.
It becomes part of your evidence file.
Once you’ve preserved the provider response, consider reporting the fraud through the appropriate channel for your jurisdiction.
REPORT THE FRAUD WITH COMPLETE TRANSACTION DATA
For U.S.-related cases, the FBI’s IC3 accepts cryptocurrency-fraud reports and asks for transaction information such as wallet addresses, cryptocurrency amounts and types, dates and times, and transaction hashes. It also asks for information about how the victim encountered the scammer, communications, websites, applications, exchanges used, and the timeline.
If you are outside the U.S., use the appropriate fraud-reporting or law-enforcement channel in your jurisdiction as well as the legitimate cryptocurrency service involved.
The important part is to submit accurate information rather than an incomplete description of the loss.
WATCH FOR A SECOND RECOVERY SCAM
A large portfolio loss can attract people claiming they can recover it.
You may receive:
“We traced your funds.”
“We found the receiving wallet.”
“Your crypto is ready to be recovered.”
“Pay a blockchain fee.”
“Send cryptocurrency to activate recovery.”
“We guarantee your money back.”
Be cautious.
The FBI warns that cryptocurrency victims may be targeted by fraudulent recovery services that claim they can recover lost funds.
Don’t send another payment simply because someone promises recovery.
Your original transaction evidence should come first.
DON’T LET THE PORTFOLIO BALANCE DISTRACT FROM THE TRANSACTIONS
A website might show:
$100,000 portfolio
$250,000 portfolio
$500,000 portfolio
But the relevant question is:
How much cryptocurrency actually entered the wallet or platform?
How much actually left?
Which addresses received it?
What transactions followed?
Displayed numbers can be part of the fraud itself.
Blockchain transactions provide a separate record that can be examined independently.
Once you’ve separated displayed values from actual transactions, organize the entire case into one evidence file.
CREATE ONE COMPLETE EVIDENCE FILE
Include:
Original contact
Person or company information
Website
App
Portfolio screenshots
Investment promises
Messages
Payment requests
Wallet addresses
Transaction hashes
Exchange records
Withdrawal attempts
Additional payment demands
Blockchain movements
Timeline
Support correspondence
This gives you one chronological record rather than scattered screenshots.
Once the evidence is organized, don’t continue negotiating with the people involved.
DON’T TRY TO BUY YOUR WAY OUT OF THE LOSS
If the person says:
“You already invested this much.”
“You’re almost finished.”
“One last payment.”
“Don’t lose everything now.”
“You need to pay to protect the rest.”
Don’t let the amount already lost become a reason to send even more.
The FBI recommends stopping further payments when cryptocurrency investment fraud is suspected.
Your next step should be evidence preservation and reporting, not another transfer.
YOU DON’T NEED TO HAVE EVERYTHING FIGURED OUT
You may only have:
A wallet
A few transaction hashes
A fake investment dashboard
Several screenshots
A phone number
A website
A conversation
That’s enough to begin reconstructing what happened.
Jim Recovery Team can review the information you have, identify relevant blockchain transactions, trace known fund movements, and help reconstruct the movement of the cryptocurrency.
If you’re ready for professional assistance, contact [email protected] or +1 (929) 399-9264 on WhatsApp with whatever information you currently have.
If you’re not ready, preserve the evidence first.
WHAT YOUR EVIDENCE SHOULD SHOW
Ideally, your records should establish:
What your portfolio contained before the incident
↓
How the fraud began
↓
Who or what directed the transactions
↓
What you were told
↓
Which cryptocurrency you actually sent
↓
Which addresses received it
↓
What happened when you attempted to withdraw
↓
Whether additional payments were demanded
↓
What other transactions occurred
↓
Where the cryptocurrency moved afterward
You don’t need to determine everything immediately.
Start with the blockchain transactions and work backward through the communications that caused them.
The most useful question isn’t simply “How do I recover my portfolio?”
It’s:
“Which transactions caused the loss, why did I authorize them, where did the cryptocurrency go, and what evidence connects those transfers to the fraud?”
Start there, preserve the evidence, contact the cryptocurrency service involved as soon as possible, and don’t let anyone convince you that another payment is required to recover what has already been lost.
Then one incident changed everything.
Maybe someone gained your trust and convinced you to move a large portion of your holdings.
Maybe you were directed to a fake investment platform.
Maybe you followed instructions from someone pretending to be a financial professional, exchange employee, or another trusted person.
Or perhaps several transactions occurred before you realized that the portfolio was no longer under your control.
Now you’re looking at a portfolio that has lost a substantial amount of cryptocurrency and you’re trying to understand what actually happened.
Don’t make another transfer simply because someone promises that another payment will restore your portfolio.
The FBI advises cryptocurrency-fraud victims to stop sending money and preserve transaction information, including wallet addresses, cryptocurrency amounts and types, dates, times, and transaction hashes.
Jim Recovery Team can review the information you have, identify relevant blockchain transactions, trace known fund movements, and help reconstruct what happened to the cryptocurrency.
If you’re ready, contact [email protected] or +1 (929) 399-9264 on WhatsApp.
If you need time first, preserve the evidence before doing anything else.
STOP MAKING ADDITIONAL PAYMENTS
If the person or platform is still communicating with you, you may hear:
“Your portfolio can still be restored.”
“You need to deposit more collateral.”
“One final payment will unlock the account.”
“You need to pay the outstanding balance.”
“Your funds are frozen until verification is completed.”
“Send more crypto so we can recover the first transfer.”
Don’t treat another payment as part of the solution without independently verifying the situation.
The FBI specifically warns victims not to pay additional fees or taxes to withdraw supposed cryptocurrency investment funds.
Your first task is to establish exactly how the portfolio loss occurred.
CALCULATE THE ACTUAL LOSS
Don’t start with the portfolio balance shown by a website or app.
Start with your own records.
Separate:
Portfolio value before the incident
Cryptocurrency actually transferred
Cryptocurrency actually withdrawn
Cryptocurrency remaining
Additional unauthorized transactions
For example:
Before, 50,000 USDT
Transferred, 20,000 USDT
Transferred, 10,000 USDT
Unauthorized movement, 5,000 USDT
Remaining, 15,000 USDT
The exact numbers will depend on your case.
The point is to distinguish an actual blockchain movement from a number displayed on a platform.
The FTC notes that blockchain records can contain transaction amounts and sender and recipient wallet addresses.
Once you’ve calculated the real movement of funds, identify every transaction connected to the loss.
FIND EVERY TRANSACTION
Open the wallet or cryptocurrency service associated with the portfolio.
Record:
Asset
Amount
Network
Sending address
Receiving address
Transaction hash
Date
Time
Do this for every significant transfer.
Don’t record only the largest transaction.
A portfolio loss can involve several separate payments.
The FBI identifies wallet addresses, cryptocurrency type and amount, transaction dates and times, and transaction IDs as important evidence when reporting cryptocurrency fraud.
Once you’ve collected the transactions, separate the ones you authorized from those you didn’t.
SEPARATE AUTHORIZED AND UNAUTHORIZED MOVEMENTS
You may have:
Personally sent cryptocurrency because someone instructed you to
Approved a smart-contract transaction
Connected your wallet to a website
Shared wallet credentials
Had someone access the wallet without permission
Had additional transfers occur after the original payment
These are different circumstances.
For each transaction, write:
Did I authorize this?
What did I believe I was doing?
Who instructed me?
What actually happened?
That distinction can make the transaction history much easier to understand.
Once you’ve separated the transactions, investigate the event that caused the largest portfolio reduction.
IDENTIFY THE MAIN LOSS EVENT
Maybe the largest loss came from:
A fake investment deposit
A manipulated payment
A wallet-draining transaction
A fake exchange
A malicious smart contract
A romance-related investment
A fake trading platform
A phishing website
A fraudulent business transaction
An impersonation scam
Don’t combine different events simply because they happened around the same time.
Identify what happened immediately before each major loss.
Once you’ve identified the main event, preserve the communications surrounding it.
SAVE THE CONVERSATIONS
Keep:
Emails
Text messages
WhatsApp messages
Telegram messages
Discord messages
Social-media messages
Phone numbers
Usernames
Profiles
Voice messages
Screenshots
Payment instructions
Wallet addresses
The FBI recommends providing information about how the scammer initially contacted the victim, how they identified themselves, and the communications associated with the fraud.
Don’t save only the final payment request.
The earlier conversation may explain how the person gained your confidence or why the transaction appeared legitimate.
Once you’ve preserved the conversation, document who you were dealing with.
DOCUMENT THE PERSON OR COMPANY INVOLVED
Record:
Name used
Company name
Job title claimed
Phone number
Username
Website
Social account
Wallet addresses
Profile URL
Any identification they provided
If they claimed to represent a legitimate company, record that claim exactly.
Don’t automatically conclude that the legitimate company itself was responsible.
Once you’ve documented the identity they claimed, preserve what they used to make the opportunity look legitimate.
SAVE THE MATERIAL THAT BUILT TRUST
You may have received:
Investment statements
Portfolio screenshots
Trading results
Account dashboards
Invoices
Contracts
Company documents
Professional profiles
Fake licenses
Testimonials
Links
Videos
Screenshots of supposed profits
Keep everything.
A polished website or professional-looking dashboard does not establish that the underlying cryptocurrency transactions were legitimate.
The FBI warns that fraudulent investment platforms can use professional-looking websites and spoof legitimate businesses.
Once you’ve preserved the material, compare the platform’s displayed portfolio with the blockchain activity.
COMPARE THE DISPLAYED PORTFOLIO WITH THE BLOCKCHAIN
Suppose a platform showed:
Portfolio balance, 80,000 USDT
Available withdrawal, 80,000 USDT
But your blockchain records show:
Actual deposits, 25,000 USDT
Actual withdrawals, 0 USDT
The displayed balance should not automatically be treated as cryptocurrency you actually possessed.
Similarly, if your real wallet contained 25,000 USDT and 20,000 USDT later moved to an unfamiliar address, that blockchain movement is separate evidence.
Once you’ve made the comparison, identify every wallet address involved.
CREATE A WALLET ADDRESS MAP
Record:
Your original wallet
Deposit address
Investment platform address
Receiving address
Contract address
Subsequent destination
Exchange-related address, if identifiable
A simple map might look like:
Your wallet
↓
Address A
↓
Address B
↓
Address C
Don’t assume that the first receiving address is the final destination.
Once you’ve created the address map, trace the cryptocurrency movement.
TRACE WHERE THE CRYPTOCURRENCY WENT
Follow each major transaction separately.
For example:
20,000 USDT
→ Address A
→ Address B
→ Address C
Another transaction might follow an entirely different path.
Record:
Amount
Asset
From
To
Transaction hash
Timestamp
The purpose is to document movement, not to guess the identity of whoever controls an address.
The FTC notes that transaction and wallet information can sometimes help identify parties involved in a cryptocurrency transaction.
Once you’ve traced the movements, reconstruct the timeline.
BUILD THE COMPLETE TIMELINE
For example:
June 4 → first contact
June 5 → investment opportunity presented
June 6 → cryptocurrency account opened
June 7 → 5,000 USDT transferred
June 10 → platform displayed increased portfolio balance
June 12 → withdrawal requested
June 12 → withdrawal blocked
June 13 → additional payment demanded
June 13 → 10,000 USDT transferred
June 14 → account remained inaccessible
The exact sequence will depend on your case.
The goal is to connect:
contact → trust → opportunity → deposit → displayed portfolio → withdrawal problem → additional demand → further loss
Once the timeline is complete, document the withdrawal problem itself.
RECORD YOUR FIRST FAILED WITHDRAWAL
Write down:
Date
Time
Amount requested
Withdrawal method
Error message
Platform response
Additional requirement
For example:
Withdrawal requested, 15,000 USDT
→ withdrawal rejected
→ “pay verification fee”
→ 2,000 USDT requested
→ payment made
→ withdrawal still unavailable
This sequence is much more useful than simply writing:
“They wouldn’t let me withdraw.”
Once you’ve documented the withdrawal failure, preserve every subsequent demand.
SAVE EVERY ADDITIONAL PAYMENT DEMAND
The platform or person may have requested:
Tax
Withdrawal fee
Verification fee
Security deposit
Account upgrade
Liquidity payment
Negative-balance payment
Release fee
Blockchain fee
The FBI specifically warns cryptocurrency-fraud victims not to pay additional fees or taxes to withdraw supposed investment funds.
If you paid one of these amounts, record the transaction separately.
If you refused, preserve the request.
Once you’ve documented those demands, check whether your remaining portfolio is still exposed.
CHECK YOUR REMAINING WALLET
Review your remaining assets.
Look for:
Unknown transfers
Token approvals
Unexpected swaps
NFT transfers
Smart-contract interactions
Unfamiliar destinations
If you find activity you didn’t authorize, document it separately.
If you still control the wallet and believe its credentials may have been exposed, take appropriate wallet-security measures before additional assets are lost.
Never give your seed phrase or private key to someone claiming they need it to recover your portfolio.
Once you’ve checked your remaining assets, preserve the evidence before making unnecessary changes.
DON’T DELETE THE PLATFORM OR ACCOUNT YET
If you can still access the platform, save:
Dashboard
Portfolio
Deposit history
Withdrawal history
Transaction history
Messages
Account information
Balance history
Error messages
Take screenshots before the website disappears.
If the platform becomes inaccessible later, your saved evidence may be the only record of what was displayed.
Once you’ve preserved the account, save the original website information.
RECORD THE WEBSITE AND DOMAIN
Write down:
Website URL
Domain
App name
Download source
Login page
Support page
Deposit page
Withdrawal page
Terms page
Be particularly careful with domains that resemble legitimate companies.
The FBI warns that fraudulent cryptocurrency investment platforms may use domains that closely mimic legitimate sites.
Once you’ve preserved the domain, document how you first found the opportunity.
RECORD HOW YOU FOUND THE OPPORTUNITY
Maybe it came through:
A social-media advertisement
A WhatsApp message
A Telegram group
A dating or social platform
A referral
A website
A phone call
An email
A supposed financial adviser
A business contact
Save the original source.
The way you were introduced can help establish the full chronology.
Once you’ve documented the origin, compare the promised opportunity with what actually happened.
COMPARE THE PROMISE WITH THE REALITY
For example:
Promised, professional portfolio management
Actual, repeated cryptocurrency deposits
Promised, easy withdrawals
Actual, withdrawal blocked
Promised, profits
Actual, additional payments demanded
Promised, final payment
Actual, another requirement
This comparison should remain factual.
You’re documenting what was represented versus what occurred.
Once you’ve made that comparison, calculate the total cryptocurrency sent.
CALCULATE THE TOTAL SENT
Create a separate record:
Payment 1, 3,000 USDT
Payment 2, 7,000 USDT
Payment 3, 10,000 USDT
Payment 4, 5,000 USDT
Total, 25,000 USDT
Then separately record:
Actual withdrawals
Remaining assets
Unauthorized transfers
Displayed platform balance
Don’t combine displayed profits with cryptocurrency actually received.
Once you’ve calculated the total, preserve the exchange records.
SAVE YOUR EXCHANGE RECORDS
If you purchased or converted the cryptocurrency through an exchange, preserve:
Purchase history
Withdrawal history
Deposit history
Wallet addresses
Transaction hashes
Account statements
Support tickets
Fraud reports
The FBI recommends including information about cryptocurrency exchanges used to send or receive funds when documenting cryptocurrency investment fraud.
Once you’ve preserved those records, contact the service you used to send the cryptocurrency.
CONTACT THE CRYPTOCURRENCY SERVICE
If you sent the cryptocurrency through an exchange, ATM operator, or other cryptocurrency service, contact that provider through its legitimate support channel.
Provide:
Transaction hash
Asset
Amount
Receiving address
Date
Time
Explanation of the fraud
The FTC advises people who paid a scammer with cryptocurrency to contact the cryptocurrency exchange or ATM operator immediately, report the transaction as fraudulent, and ask whether the transaction can be reversed or the money refunded.
Don’t assume a reversal will be possible.
Ask what options the provider has and preserve the response.
Once you’ve contacted the provider, save the case number and correspondence.
PRESERVE THE SUPPORT RESPONSE
Keep:
Case number
Chat transcript
Fraud report
Transaction review
Instructions
Date contacted
If the provider says it cannot reverse the transaction, preserve that response too.
It becomes part of your evidence file.
Once you’ve preserved the provider response, consider reporting the fraud through the appropriate channel for your jurisdiction.
REPORT THE FRAUD WITH COMPLETE TRANSACTION DATA
For U.S.-related cases, the FBI’s IC3 accepts cryptocurrency-fraud reports and asks for transaction information such as wallet addresses, cryptocurrency amounts and types, dates and times, and transaction hashes. It also asks for information about how the victim encountered the scammer, communications, websites, applications, exchanges used, and the timeline.
If you are outside the U.S., use the appropriate fraud-reporting or law-enforcement channel in your jurisdiction as well as the legitimate cryptocurrency service involved.
The important part is to submit accurate information rather than an incomplete description of the loss.
WATCH FOR A SECOND RECOVERY SCAM
A large portfolio loss can attract people claiming they can recover it.
You may receive:
“We traced your funds.”
“We found the receiving wallet.”
“Your crypto is ready to be recovered.”
“Pay a blockchain fee.”
“Send cryptocurrency to activate recovery.”
“We guarantee your money back.”
Be cautious.
The FBI warns that cryptocurrency victims may be targeted by fraudulent recovery services that claim they can recover lost funds.
Don’t send another payment simply because someone promises recovery.
Your original transaction evidence should come first.
DON’T LET THE PORTFOLIO BALANCE DISTRACT FROM THE TRANSACTIONS
A website might show:
$100,000 portfolio
$250,000 portfolio
$500,000 portfolio
But the relevant question is:
How much cryptocurrency actually entered the wallet or platform?
How much actually left?
Which addresses received it?
What transactions followed?
Displayed numbers can be part of the fraud itself.
Blockchain transactions provide a separate record that can be examined independently.
Once you’ve separated displayed values from actual transactions, organize the entire case into one evidence file.
CREATE ONE COMPLETE EVIDENCE FILE
Include:
Original contact
Person or company information
Website
App
Portfolio screenshots
Investment promises
Messages
Payment requests
Wallet addresses
Transaction hashes
Exchange records
Withdrawal attempts
Additional payment demands
Blockchain movements
Timeline
Support correspondence
This gives you one chronological record rather than scattered screenshots.
Once the evidence is organized, don’t continue negotiating with the people involved.
DON’T TRY TO BUY YOUR WAY OUT OF THE LOSS
If the person says:
“You already invested this much.”
“You’re almost finished.”
“One last payment.”
“Don’t lose everything now.”
“You need to pay to protect the rest.”
Don’t let the amount already lost become a reason to send even more.
The FBI recommends stopping further payments when cryptocurrency investment fraud is suspected.
Your next step should be evidence preservation and reporting, not another transfer.
YOU DON’T NEED TO HAVE EVERYTHING FIGURED OUT
You may only have:
A wallet
A few transaction hashes
A fake investment dashboard
Several screenshots
A phone number
A website
A conversation
That’s enough to begin reconstructing what happened.
Jim Recovery Team can review the information you have, identify relevant blockchain transactions, trace known fund movements, and help reconstruct the movement of the cryptocurrency.
If you’re ready for professional assistance, contact [email protected] or +1 (929) 399-9264 on WhatsApp with whatever information you currently have.
If you’re not ready, preserve the evidence first.
WHAT YOUR EVIDENCE SHOULD SHOW
Ideally, your records should establish:
What your portfolio contained before the incident
↓
How the fraud began
↓
Who or what directed the transactions
↓
What you were told
↓
Which cryptocurrency you actually sent
↓
Which addresses received it
↓
What happened when you attempted to withdraw
↓
Whether additional payments were demanded
↓
What other transactions occurred
↓
Where the cryptocurrency moved afterward
You don’t need to determine everything immediately.
Start with the blockchain transactions and work backward through the communications that caused them.
The most useful question isn’t simply “How do I recover my portfolio?”
It’s:
“Which transactions caused the loss, why did I authorize them, where did the cryptocurrency go, and what evidence connects those transfers to the fraud?”
Start there, preserve the evidence, contact the cryptocurrency service involved as soon as possible, and don’t let anyone convince you that another payment is required to recover what has already been lost.