What is Global Ledger?

Global Ledger is a Swiss blockchain analytics company delivering fast, end-to-end AML compliance and investigation tools. Founded in 2019, we support over 2,000 digital assets and manage a database of over 700 million attributed addresses, updated daily. We perform 250,000 AML checks and monitor 30 million wallets every day. With an average response time of just 500ms and private server deployment options, Global Ledger combines speed, scale, and security.

Which blockchains does Global Ledger analyse?

Currently, the following blockchains are supported: Bitcoin (BTC) Bitcoin Satoshi Vision (BSV) Litecoin (LTC) Ethereum (ETH), including top tokens Tron (TRX), including top tokens Binance Coin (BNB) Polygon (MATIC) Arbitrum (ARB) Base (ETH) Avalanche (AVAX) Moonbeam (GLMR) Polkadot (DOT) Solana (SOL) TON.

How is the GL Score calculated?

The GL Score is a number from 0 to 100 that shows the degree of risk: low, medium, and high. Each score is represented by a corresponding color: green indicates low risk, yellow indicates medium risk, and red — high risk. The risk score is derived from the assessment of the riskiness of sources contributing to a requested address or transaction. To calculate the score, the algorithm analyzes incoming transactions, assesses the risk of identified sources, and calculates a score on a scale from 0 to 100. This score provides an indication of the potential level of risk associated with the address or transaction based on the evaluated sources and their associated activities. Learn more about risk score calculation from our blog article.

What are your data sources?

The Global Ledger team regularly collects and constantly analyses publicly available information, open data from the top blockchains, replenishes the internal information base by conducting its own investigations, as well as data purchased from reliable vendors.

What if I need help ASAP?

Our support team stays in touch 24/7 to provide clients with the most comfortable service and experience in case of unexpected hacks or cyberattacks. Please send your request with a brief description of your case to contact@globalledger.io, and our manager will reach you shortly.

Crypto Recovery Scams: How They Work & How to Stay Safe

Impersonation Scam Warning

We are aware of scammers impersonating Global Ledger via fake domains, spoofed emails, and even phone calls.

Please note: Global Ledger operates only through the official domain https://globalledger.io and does not contact users via call or emails with requests to take action involving wallets or funds.

If you encounter a suspicious website or communication claiming to represent Global Ledger, please contact our Investigation & Research specialist vladyslav.t@globalledger.io.

The scale of crypto-related losses has shifted dramatically in just one year. In 2024, attackers stole $1.94 billion across 265 incidents. By the end of 2025, that figure more than doubled — reaching $4.04 billion across 255 incidents, according to Global Ledger research.

As the amount of stolen funds grows, new schemes are forming around these incidents. One of them is crypto recovery scams — services that claim to help recover lost assets but instead create additional risk.

This article explains what crypto recovery scams are, how they work, how to recognize warning signs, and how to identify legitimate crypto recovery companies without adding further risk.

Key Takeaways

A crypto recovery scam is a second-layer fraud: scammers target people who have already lost funds and charge an upfront fee to "recover" them — then disappear.
The FBI has issued multiple warnings regarding fictitious law firms and recovery companies targeting cryptocurrency users.
$4.04 billion was stolen across 255 crypto incidents in 2025 — more than double the $1.94 billion recorded across 265 incidents in 2024.
Only approximately 7% of stolen funds were returned across 255 incidents last year.
Known blockchain analytics firms have had fraudulent copycat domains registered in their name to deceive users searching for professional help.

What Is a Crypto Recovery Scam?

Crypto recovery scams — also called fund recovery scams or impersonation scams — are schemes where criminals pretend to be someone who can help you get your money back. They might pose as lawyers, blockchain analytics firms, or even government representatives. They charge an upfront fee, promise results, and then disappear.

The key mechanism that makes this scam effective is brand impersonation. Scammers don't present themselves as unknowns. They copy the logos, domains, and documentation of real blockchain analytics companies to appear credible.

      What separates crypto recovery scams from ordinary phishing is the targeting. Phishing casts a wide net across random users. Recovery scammers go specifically after people who have already lost funds and are actively searching for help. The victim pays willingly, because the scam is designed to look like the solution to their problem. 
    

A recent case involving Global Ledger shows how these scams work in practice. A fraudulent website impersonated the company and promoted fake crypto asset recovery services, including a form designed to target people searching for help.

The issue was quickly identified and taken down, but it reflects a broader trend of scammers imitating trusted blockchain analytics providers.

The Scale of the Problem

According to the Global Ledger research, nearly $2 billion of stolen funds remained unspent, meaning they had not yet been moved or cashed out. This creates a large pool of assets that users and companies still hope to recover.

But the actual recovery rates remain low. Only around 7% (or $263.23 million) of stolen funds were returned across those cases. This gap between expected and realistic recovery outcomes is where recovery scams operate.

The amount of stolen crypto funds that remained unspent. Source: Global Ledger

This scale is already prompting government action. The FBI's Internet Crime Complaint Center (IC3) received 181,565 cryptocurrency fraud complaints totaling more than $11 billion in losses in 2025 — a 22% increase from 2024. The FBI has now issued three successive public service announcements specifically warning about fake crypto recovery services: in August 2023, updated in June 2024, and updated again in August 2025. The repeated updates reflect a problem that is growing, not stabilizing.

The North American Securities Administrators Association (NASAA) — the primary regulator for state-level securities enforcement in the US — has also published a dedicated advisory on "Crypto Recovery Room Scams", identifying the pattern as a distinct and documented threat to retail investors.

The 2026 Crypto Laundering Roadmap: 5 Trends Redefining Global Financial Crime

For a broader look at how crypto-related financial crime is evolving in 2026, see 5 trends redefining global financial crime.

See More Details

Why It’s Really the Problem

Fund recovery scams cause two distinct types of harm — one to individual users, one to the companies whose names are being copied. Both matter, and both are worth understanding.

1) Individuals are targeted at their most vulnerable moment

      A person who already lost money to crypto fraud is exactly who recovery scammers look for. 
    

They are stressed, searching for help, and more likely to trust anyone who sounds official. Scammers use that window deliberately — arriving with professional-looking websites and names borrowed from real companies. The result is a second financial loss on top of the first.

2) Legitimate companies lose trust they didn't damage

      When scammers copy a real firm's brand, every user they deceive reflects badly on the real company.
    

A person who encounters a fake site (unless it looks like “official”) and gets defrauded is unlikely to distinguish the impersonator from the real firm afterward. The reputational damage is real, even though the legitimate company did nothing wrong. This forces real firms to spend resources monitoring and removing fraudulent domains they never created.

3) The scam targets exactly the people trying to fix the problem

The firms best positioned to help users are the ones most often impersonated.

Blockchain analytics companies are credible, technical, and exactly what a user would search for after financial losses. That's precisely why scammers copy them. It creates a trap where seeking expert help can lead directly into another fraud — unless the user knows how to verify who they're actually talking to.

Top 5 Biggest Crypto Hacks Happen in 2025 & What Comes Next in 2026

This type of brand impersonation is just one of many tactics illicit actors use. Check out our article on the top 5 ways crypto scams and hacks happen to better understand how attackers operate.

See More Details

How Crypto Recovery Scams Work: Step-by-Step

Fund recovery scams follow a consistent operational pattern. Understanding each stage helps identify the scheme before money “changes hands”.

Step 1. Finding victims

Scammers do not wait for victims to find them. They actively source contact lists of people who have already reported crypto losses — through forums, social media posts, complaint boards, and data obtained from darknet marketplaces.

Someone who has posted publicly about losing money to a fake exchange or pig butchering scheme is a “qualified lead” for a recovery scammer.

      If you're a company: Monitor public channels where your brand is mentioned. Scammers read the same forums your potential clients do.

If you're an individual: Avoid posting details of your loss publicly. If you need to share information, do it directly with law enforcement or a verified professional — not on open forums.

Step 2. Impersonating a credible brand

Case 1. Website

Once scammers make contact, they present a fabricated identity: a law firm specializing in crypto-related cases, a blockchain analytics company, or a government-affiliated recovery unit. They support this identity with copied logos and fake domain names that closely resemble real companies. An example of a fraudulent website impersonating Global Ledger is shown below.

Example of a fraudulent website impersonating Global Ledger

      Important: At first glance, it looks legitimate — but the real Global Ledger website uses the domain .io, not .com. That single character difference is easy to miss, and that's exactly what scammers count on. 
    

This brand impersonation specifically targets well-known names in the blockchain analytics space. These are the exact companies a fraud victim would search for, which makes their names the most valuable ones to copy.

Case 2. Emails

Brand impersonation doesn't always mean a fake website. In April 2026, a user contacted Global Ledger after receiving an email that appeared to come from contact@globalledger.io — complete with the company's logo and branding. The email instructed the recipient to set up a crypto wallet and add a custom token contract. It was a spoofed address: the email was never sent by Global Ledger.

Important: If you receive an unexpected email from any blockchain analytics company asking you to take action with your wallet, do not follow the instructions. Contact the company directly through their official website to verify.

If you're a company: Set up monitoring for domain variations of your brand name. The sooner a fake domain is identified, the sooner it can be reported and taken down.

If you're an individual: Always navigate to a company's website directly by typing the address yourself. Never click a link sent to you by someone offering recovery services.

Step 3. Establishing false authority

The scammer claims to have access to government records or case files showing that the user’s funds are recoverable. Some also claim the person was included on a government-affiliated list and that funds can be recovered through "legal channels."

      If you're an individual: If someone claims to represent a government agency, hang up and contact that agency directly using the official number from their website.
    

Step 4. Collecting the upfront fee

The scammer requests payment — typically in cryptocurrency or prepaid gift cards — to initiate the recovery process. They may ask users to pay a portion of the fee upfront, with the balance due after recovery. They may also request payments for “taxes” or other fabricated charges. The promised recovery never occurs.

      If you're an individual: Any request for upfront payment before any work is performed is a reliable sign of fraud. A legitimate firm will provide a written agreement specifying what you're paying for before any significant fee is collected. 
    

Step 5. Escalation or disappearance

Some operations disappear immediately after the first payment. Others continue, inventing new fees — administrative charges, tax clearances, international transfer requirements — to extract additional money from people before eventually cutting contact.

If you're an individual: If a recovery service keeps asking for more payments under new pretexts, stop all contact immediately. Each additional payment is a separate loss. Report the incident to the FBI's IC3 and document everything you have — messages, wallet addresses, payment records.

Are Crypto Recovery Services Scams? Red Flags to Check

Not every company offering crypto recovery assistance is fraudulent. But the following indicators can be associated with scam operations, not legitimate firms.

🔴 Red Flag	What It Looks Like in Practice	🟢 Green Flag
Upfront fee required before any work	Payment demanded before any analysis, reporting, or engagement contract	Explains what they'll do first, then invoices
Guaranteed recovery	Any promise of full or certain fund return — legitimate recovery is probabilistic	Is honest that recovery depends on case specifics and cannot be guaranteed
Unsolicited contact	You were contacted first, not the other way around	You found them through independent research or a verified referral
Pressure and urgency	Time-limited offers, countdown language, "act now or lose the chance"	Gives you time to verify, ask questions, and review an engagement agreement
Domain mismatch	URL differs slightly from the real firm	Has a consistent, verifiable domain that matches all official communications
Pressure to keep engagement secret	Telling you not to discuss the case with family, lawyers, or banks	Encourages you to consult your own legal counsel and involve relevant authorities

Legitimate Crypto Recovery Companies: What They Actually Do

Legitimate blockchain analytics and asset recovery firms operate transparently and verifiably. Here is what distinguishes a real crypto asset recovery company from a fraudulent one.

Legitimate companies always conduct a preliminary assessment

A real firm starts with a brief consultation or scoping call to evaluate whether recovery is technically feasible — before asking for significant payment. This involves reviewing available transaction data to determine where funds moved and whether any recovery path exists.

Legitimate companies use proprietary blockchain analytics tools

Real companies use professional tools to trace fund flows across chains, through mixers, and into exchanges. This work results in clear, evidence-based reports that can be used by law enforcement or in legal proceedings. You can usually verify this by checking what tools and methods a company describes on its website.

Legitimate firms are transparent about limitations and timelines

Crypto asset recovery is not guaranteed. It depends on how quickly the engagement starts after the incident and whether exchanges or law enforcement can cooperate to freeze or return assets.

Global Ledger's asset recovery service works exactly this way: starting with an honest assessment of your case, tracing stolen assets using AML risk-scoring and blockchain visualization, producing documented evidence-backed reports, and collaborating with law enforcement agencies and authorities to facilitate further steps in the asset recovery process.

Conclusion

Crypto recovery scams work because they look exactly like the help you need. The domain looks right, the branding looks familiar, the promises sound reasonable. The only reliable way to tell the difference is to verify independently and never pay before you have something in writing.

If you've lost funds to crypto fraud, the most important step is to start the tracing process as early as possible — the longer stolen assets stay on-chain without intervention, the harder recovery becomes.

We're here to help you start your crypto recovery. Our investigation team provides an immediate assessment, offers expert consultation, maintains transparent communication, and connects you with reliable partners for further legal recovery when needed.

Start Recovery Process

FAQ

What is crypto recovery?

Crypto recovery is the process of tracing and reclaiming stolen or lost digital assets using blockchain analytics, forensic evidence, and coordination with exchanges or law enforcement.

How do asset recovery companies work?

They trace stolen funds on-chain, identify where assets moved, build forensic evidence reports, and work with exchanges or authorities to freeze or return funds.

Are asset recovery services legit?

Some are, some aren't. Legitimate firms assess your case before charging significant fees and are transparent about what recovery is realistically possible. Services that contact you first and demand upfront payment are typically fraudulent.

How much does asset recovery cost?

It depends on case complexity. Legitimate firms charge for documented work — a detailed report, legal coordination, or exchange outreach. No reputable firm charges a large upfront fee with no deliverable attached.

How long does asset recovery take?

The full recovery process can take anywhere from a few days to several months or even years. If engagement starts quickly and funds haven't reached, for example, a mixer, coordinated freezes can happen fast. Once funds move through privacy tools or multiple hops, the process extends significantly.

Are crypto recovery services scams?

Many are. The clearest indicators: they contacted you first, they guarantee results, and they ask for payment before doing any work. Legitimate services do none of these things.