Evidence first
Before you continue
Stop paying new fees, save evidence first and verify exact domains or wallet addresses through official tools.
No recovery guarantees
Evidence checklist
Official report routes
Start here
Before sending more funds
- Open the exact domain from the address bar. Do not trust a logo, ad, DM or search-result title.
- Check whether the service is using a private support route, Telegram contact, unlock tax or recovery fee.
- Search official warning lists for the domain, company name, app name and support contact.
- If a wallet seed phrase, private key, remote-access app or token-approval request appears, stop and document it.
- Use the evidence kit before confronting a suspected scammer.
Evidence by scam type
| Scenario | Most useful evidence | Likely next route |
|---|---|---|
| Fake exchange / withdrawal tax | Dashboard URL, withdrawal error, tax/unlock message, support chat, deposit tx hash, destination wallet, account screenshots. | Warning checker, exchange report, IC3/FTC or local regulator. |
| Recovery scam | Original loss summary, recovery promise, fee request, claimed agency/company, wallet address, proof of contact, payment demand. | FTC/CFTC guidance, IC3, warning checker and evidence kit. |
| Wallet drainer | Suspicious URL, signed transaction/approval hash, token contract, spender address, wallet popup screenshots and approval review result. | Transaction lookup, Revoke.cash profile, wallet provider report. |
| Clone domain / fake support | Exact domain, copied brand page, chat widget, Telegram/WhatsApp/email handle, requested action and screenshots. | Binance Verify when relevant, service profile, Chainabuse and warning checker. |
| Romance or investment pitch | First contact profile, investment promise, scripts, payment sequence, pressure language and all wallet addresses. | IC3/FTC, local cybercrime report, warning checker. |
| Fake token / airdrop | Contract address, token page, claim URL, wallet prompt, social post/ad and explorer links. | Transaction lookup, wallet-drainer wiki, Chainabuse. |
Where to report
| Goal | Where to report | Attach |
|---|---|---|
| Cybercrime report | FBI IC3 or the relevant national cybercrime portal | Transaction hashes, wallet addresses, website URLs, communication records. |
| Consumer/regulator warning | FTC, CFTC, FCA, SEC/Investor.gov or local financial regulator | Offer language, company claims, warning-list matches and payment demands. |
| Exchange report | The exchange used to send funds | Withdrawal receipt, transaction hash, destination address and scam narrative. |
| Wallet or abuse platform | Wallet provider support, Chainabuse or chain-specific abuse channels | Wallet addresses, chain, transaction hash and screenshots. |
| Public review or CryptoRescue tip | Only after saving evidence and avoiding doxxing/private data | Sanitized domain, pattern, dates and source links. |
What CryptoRescue can and cannot do
| Area | Meaning |
|---|---|
| CryptoRescue can help with | Organizing evidence, explaining scam patterns, linking official reporting routes and building public educational pages when sources are strong enough. |
| CryptoRescue cannot do | Guarantee fund recovery, unlock exchange accounts, act as police, impersonate regulators or contact scammers on your behalf. |
| Never send us publicly | Seed phrases, private keys, passwords, one-time codes, full ID scans, home addresses or private account credentials. |
| Useful public tip | A sanitized domain, wallet address, transaction hash, support handle, timeline and screenshots with private data hidden. |
Private intake
Send a private report for review
This creates a private moderation item. It is not published automatically, and you should not include seed phrases, private keys, passwords or full identity documents.
Update log
- 10 May 2026Published with source tracking and reader-safety context.
- CorrectionsIf a source changes or a claim needs clarification, this page can be updated from the editorial desk.