Cryptoblackbird CRYPTOBLACKBIRD Recover your crypto

Cryptoblackbird

Category: Case Studies

Illustrative, dramatized composite case files of crypto-fraud recoveries traced and recovered by Cryptoblackbird.

  • The Mentor in the Group Chat

    BLACK BOX // CBB-2026-055 // VECTOR: WHATSAPP-CLUB → BROKER

    The Mentor in the Group Chat

    Same scam as the others, far better ending — and the only thing that changed was speed. A WhatsApp “investment circle” steered this client onto Tangent Capital ↗. When the withdrawal froze, she did not pay the fee. She called us inside forty-eight hours, and the trail was still warm enough to chase across two legs.

    Vector
    WhatsApp club → fake broker portal
    Instrument
    USDT + ETH
    Reported Loss
    AUD $128,000
    Detection Window
    7 weeks · acted within 48h of freeze
    Recovered
    88% · AUD $112,600

    Last Known Position

    Maya is forty-one, an ICU nurse in Brisbane, added to a WhatsApp group by someone posing as a former colleague. “Tangent Capital Circle” looked like a supportive community: a mentor sharing signals, dozens of members posting daily gains and withdrawal screenshots, constant encouragement. No one ever asked her for money directly. They simply demonstrated, relentlessly, that everyone else was winning.

    She started small on the group’s portal, Tangent Capital. The dashboard rose, and a withdrawal of her early test profit actually paid — the anchor. Over seven weeks she committed more, eventually a redraw on her mortgage, because the mentor’s “high-conviction window” was closing and the group cheered her on.

    Point of No Return

    When Maya tried to withdraw the bulk of her balance, Tangent Capital demanded a “capital gains release fee” of twenty percent, upfront. The mentor turned warm but firm; the group chimed in that they had all paid it. That contradiction — pay more to access your own money — is the moment she stopped and searched instead of paying. She reached us two days later.

    The whole group had paid the release fee, they said. That was the sentence that finally sounded wrong instead of normal.

    Recovery Track

    1. Move at the speed of the freeze

      Because Maya reached us within two days, the funds had not finished laundering. We triaged immediately — every deposit, every chain, every counterparty catalogued in hours, not weeks.

    2. Split the fiat leg from the crypto leg

      Part of her loss left as a bank transfer to an on-ramp before becoming crypto. We opened a bank recall on that leg in parallel with the on-chain trace — two engines, one window.

    3. Trace USDT and ETH to live deposits

      Tangent Capital’s collector wallets were still consolidating. We followed her USDT and ETH to exchange deposit addresses that had not yet cashed out.

    4. Freeze while funds were sitting

      We filed freeze requests with full provenance at two exchanges plus a law-enforcement referral. Speed meant the funds were frozen in place, not chased after the fact.

    5. Recover across both legs

      The bank recalled the fiat on-ramp transfer and one exchange released the frozen crypto tranche after verification. Together the two legs returned the large majority of Maya’s loss.

    Wheels Down
    88%

    AUD $112,600 of $128,000 returned. Identical playbook to our worst outcomes — the difference was forty-eight hours instead of forty-eight days.

    Warning Lights

    • Being added to a group by a “former colleague” you cannot place is a classic seeding tactic.
    • A room full of profit screenshots is theatre; the “members” are operators or paid actors.
    • A small early withdrawal that pays is the anchor that justifies every large deposit afterward.
    • “Pay a release fee to withdraw your own balance” is never legitimate — it is the final extraction.
    • “Everyone here has already paid it” is social proof weaponised; let it be the alarm, not the reassurance.

    Withdrawal frozen behind a “release fee”?

    Do not pay it — report it. The faster you reach us, the more of the trail is still warm.

    Open a Case

  • The Second Theft

    BLACK BOX // CBB-2026-058 // VECTOR: RECOVERY-SCAM / DOUBLE-FRAUD

    The Second Theft

    This client was robbed twice. First by Winstom Trading ↗, a fake platform that froze his withdrawal. Then, weeks later, by a “recovery agent” who found him at his lowest, guaranteed to get it all back, and asked for an upfront fee. We take this archetype personally — the second theft is the one we exist to stop.

    Vector
    Fake broker + recovery-scam (double fraud)
    Instrument
    USDT (TRC-20 + ERC-20)
    Reported Loss
    $28,200 (incl. $4,500 second hit)
    Detection Window
    3 weeks after the second loss
    Recovered
    64% · $18,000

    Last Known Position

    Tane is thirty-nine, a logistics coordinator in Auckland. He put $23,700 into Winstom Trading after a slick online pitch, watched the dashboard grow, and hit the usual wall when he tried to withdraw — a “release fee” he sensibly refused to pay. He wrote the money off. That should have been the end of it.

    It was not. Weeks later, a “fund recovery specialist” contacted him directly, claiming to already know about Winstom Trading and to have recovered for “other victims.” They knew details. They were convincing. They asked for a $4,500 upfront “court bond” to begin.

    Point of No Return

    He paid it. Recovery scammers harvest victim lists from the first fraud, which is how they knew his story — and a guaranteed result plus an upfront fee is the entire tell. When they asked for a second “disbursement fee,” he stopped and found us. We do not charge upfront fees to trace, and we said so first.

    They knew exactly what happened to me. I thought that meant they were real. It just meant they had the list.

    Recovery Track

    1. Treat it as two cases

      We separated the Winstom Trading loss from the recovery-scam fee — different operators, different rails, different windows — and worked each on its own merits.

    2. Chase the fresher trail

      The $4,500 recovery-scam fee was only weeks old. We traced that USDT first, while it was still consolidating, to an exchange deposit address.

    3. Reopen the original

      Winstom Trading’s collector wallets had pooled victim funds. A portion of Tane’s original deposit was still identifiable in a cluster that had not fully cashed out.

    4. File on both

      We submitted two documented traces and victim reports — one for the recovery-scam exchange deposit, one for the Winstom cluster — with a referral covering the double fraud.

    5. Recover across both hits

      The recovery-scam fee was largely frozen and returned; a partial slice of the original Winstom loss came back from the cluster. Combined, it reached the majority of his total.

    Wheels Down
    64%

    $18,000 of $28,200 returned. The fresher recovery-scam leg recovered well; the older Winstom leg, partially. Reporting the second fraud quickly is what lifted the overall result.

    Warning Lights

    • No legitimate recovery service guarantees results or asks for an upfront fee to begin.
    • A “recovery agent” who already knows your scam details got them from a victim list, not from credibility.
    • Being a known victim makes you a target for the second fraud — expect the follow-up contact.
    • Real tracing earns its place by showing you the chain, not by promising miracles.
    • Verify any recovery firm independently before sending a cent — the second theft is preventable.

    Approached by a “recovery agent” after a scam?

    Do not pay an upfront fee. Bring us both stories — the original loss and the recovery approach — and we will trace what is real.

    Open a Case

  • Tap to Earn, Pay to Withdraw

    BLACK BOX // CBB-2026-054 // VECTOR: TASK-JOB-COMMISSION

    Tap to Earn, Pay to Withdraw

    A recruiter DM, a friendly “product optimization” job, a first payout that actually landed. By the time the client came to us, the only money that still existed was the money he had already deposited to 7solutions ↗. This is the case where I have to be honest about the ceiling.

    Vector
    Task/job commission scam
    Instrument
    USDT (Tron / TRC-20)
    Reported Loss
    $9,800
    Detection Window
    9 days
    Recovered
    24% · $2,350

    Last Known Position

    Devon is twenty-four, a recent graduate in Austin with an empty calendar. The recruiter message offered flexible remote work — “product optimization” paid daily in USDT through 7solutions. The onboarding was friendly and the first day genuinely paid: complete a set of tasks, a small commission lands, withdraw it. It worked.

    That first clean withdrawal is the whole scam. It turns a stranger’s promise into personal proof.

    Point of No Return

    Then came the “combination tasks.” Higher-value sets, 7solutions explained, required a matching USDT deposit to “unlock” before the larger commission released. Skip one and the set locked, forfeiting the earnings already on the balance. Devon deposited to unlock. The next combo was larger. A “manager” coached him, congratulated him, nudged him to borrow to clear the final, most profitable set. The five-figure balance never released — it was a number guarding the next deposit.

    The first payout was real. After that I was not earning anymore. I was just feeding it, one unlock at a time.

    Recovery Track

    1. Stop the next deposit

      First we confirmed no remaining “unlock” would ever release funds and made sure Devon sent nothing further. With task scams, the only money that exists is what already left.

    2. Reconstruct the chain

      We documented each TRC-20 deposit from Devon’s wallet to the 7solutions addresses, separating his small genuine withdrawal from the deposits that followed.

    3. Trace fast Tron flows

      USDT on Tron consolidates quickly. We followed the deposits as they merged into collector wallets and moved toward cash-out within days.

    4. Find the one slow exit

      Most of the funds were gone before we engaged, but one collector routed a portion through a centralized exchange. That slice was still tagged to Devon’s deposits.

    5. File for the recoverable slice

      We submitted the trace and a victim report. The exchange held and, after verification, returned the small recoverable portion — the realistic ceiling once Tron rails had done their work.

    Wheels Down
    24%

    $2,350 of $9,800 returned. Task-scam funds move fastest of all. A partial recovery here is an honest outcome, not a failure — and far better than paying one more “unlock.”

    Warning Lights

    • A real job pays you; it never asks you to deposit your own money to “unlock” earnings.
    • The small genuine first payout is bait to manufacture trust before the deposits begin.
    • “Combination tasks” that lock and forfeit a displayed balance are built to escalate deposits.
    • Unsolicited recruiter DMs offering daily crypto pay for trivial tapping are a known pattern.
    • A “manager” who tells you to borrow to finish a task set is closing a sale, not coaching a career.

    Caught in a deposit-to-earn job?

    Send nothing more. Bring us your deposit transactions and we will trace the rails before they go cold.

    Open a Case

  • Minted to Empty

    BLACK BOX // CBB-2026-052 // VECTOR: WEB3-MINT-DRAINER

    Minted to Empty

    This one was over before the client finished her coffee. A “free companion mint” hosted on Pelliron Universal ↗ asked her to sign a single approval. Ninety seconds later the drainer had swept two chains. When she reached us, the wallet was bare — but the cash-out had not finished, and that gap is where we work.

    Vector
    Counterfeit mint + wallet drainer
    Instrument
    ETH + Polygon
    Reported Loss
    CAD $71,200
    Detection Window
    90 seconds (one signature)
    Recovered
    47% · CAD $33,500

    Last Known Position

    Priya is thirty-four, a motion designer in Toronto who had been minting art for two years. She knew her way around a wallet. The trap was not technical naivety — it was a compromised Discord. A moderator account she trusted posted a surprise “holder companion drop,” linking to Pelliron Universal, a platform dressed to look like the marketplace she used daily, on a domain one character off the real one.

    Pelliron asked her to connect and claim. The popup did not ask her to buy anything. It asked her to sign.

    Point of No Return

    Buried in the request was a setApprovalForAll — a blanket permission letting an unknown contract move every token in her wallet. She approved it the way most people approve a cookie banner. The drainer fired at once, sweeping her ETH-chain assets and then bridging to clear her Polygon holdings on the same authorization.

    It never charged me anything. That is what fooled me. Free things do not feel like theft until the wallet is empty.

    Recovery Track

    1. Revoke before chasing

      The moment Priya reached us we walked her through revoking the malicious approval and moving the two assets the drainer had missed into a clean wallet. Stop the bleed before tracing what is gone.

    2. Identify the kit

      The contract signature matched a drainer-as-a-service template we had catalogued from other Pelliron Universal victims. A known kit means known cash-out behaviour.

    3. Track both chains to the bridge

      We followed the ETH-chain sweep and the Polygon sweep separately to the bridge that consolidated them, then on to the laundering wallets the operators favour.

    4. Tag the centralized exit

      A meaningful slice was sent to a centralized exchange to cash out. We mapped that deposit address to Priya’s stolen tokens and built a freeze request with full chain provenance.

    5. Freeze, verify, return

      The exchange froze the deposit pending verification. After proof of ownership, the seized portion came back — partial, because the rest dispersed through self-hosted wallets we could trace but not seize.

    Wheels Down
    47%

    CAD $33,500 of $71,200 returned. One approval did the damage; disciplined revocation and a fast freeze recovered everything that reached an exchange.

    Warning Lights

    • A “free” mint that asks you to sign setApprovalForAll is a drainer — claiming never needs blanket token access.
    • Links posted by a Discord moderator are not safe; server takeovers are routine.
    • Read the signature request, not the dollar amount — the danger is the permission, not the gas.
    • A domain one character off the real marketplace is a clone, lock icon and all.
    • Surprise “holder-only” drops manufacture the urgency that stops you checking the contract.

    Signed something you should not have?

    Revoke first, then send us the wallet and the transaction. We will trace where the drainer took it.

    Open a Case

  • The Livestream That Doubled Nothing

    BLACK BOX // CBB-2026-051 // VECTOR: CELEBRITY-GIVEAWAY → PLATFORM

    The Livestream That Doubled Nothing

    By the time this case reached our desk, the wallet had been empty for two days and the client still half-believed the coins were “processing.” They were not. They were three hops gone, funnelled through a platform we already had on our Watchlist — Max Vault Investment ↗. We had a thirty-six-hour window of warm trail, and we used all of it.

    Vector
    Deepfake giveaway → deposit platform
    Instrument
    Bitcoin (BTC)
    Reported Loss
    $38,400 (0.61 BTC)
    Detection Window
    36 hours
    Recovered
    31% · $11,900

    Last Known Position

    Raymond is sixty-three, a retired aircraft mechanic in Sarasota, Florida. He spent thirty years reading warning lights for a living, so he is not the person you would expect to fall for a giveaway. But the stream that surfaced in his feed was built from real keynote footage of a founder he admired, with a synthetic voice laid over the top and a countdown promising to double any Bitcoin sent for “wallet verification.”

    What turned a scam into a loss was the second step. To “claim and withdraw” the doubled balance, viewers were told to register on a partner platform — Max Vault Investment — and deposit a verification amount. Raymond did, and the dashboard there dutifully showed his “doubled” balance climbing. It was a number on a screen, guarding a deposit address that only ever received.

    Point of No Return

    He sent a small test first — 0.01 BTC — and the platform chat told him test amounts under the minimum were not eligible. So he sent the rest, 0.6 BTC, to hit the “guaranteed tier.” When he tried to withdraw, Max Vault Investment asked for a “network reconciliation fee” to release the funds. That was the engine quitting. He came to us instead of paying it.

    I read the name on that stream three times. It was him. I did not know a face could be borrowed like that.

    Recovery Track

    1. Capture before it moves

      We logged the stream, the Max Vault deposit address, the chat handles and every transaction hash from Raymond’s wallet. Giveaway funds die on-chain in hours; the record has to be taken first.

    2. Separate his coins from the pool

      The deposit address fanned out immediately. We traced the funds across three hops into two consolidation wallets and isolated Raymond’s tranche from the dozens of other victims feeding the same address.

    3. Catch the off-ramp

      One consolidation wallet pushed a slice to a deposit address at a mid-tier exchange with a working compliance desk. That slice still carried recoverable BTC.

    4. File inside the window

      We packaged an exchange-ready trace and a law-enforcement referral and filed both inside the thirty-six hours, before the remaining balance reached a mixer.

    5. Hold the frozen tranche

      The exchange froze the flagged deposit. After identity and victim verification, the recoverable portion came back — partial, because the bulk was laundered before we ever saw the stream.

    Wheels Down
    31%

    $11,900 of $38,400 returned. Giveaway funds move in minutes; the speed of Raymond’s decision to stop and report — not the size of the loss — set the ceiling on what survived.

    Warning Lights

    • “Send crypto, get double back” is a scam every time — no celebrity and no platform does this.
    • A real face does not verify a real promise; deepfake video and cloned voices are cheap and routine.
    • Being routed to a “partner platform” to withdraw your winnings is the deposit trap, not a withdrawal.
    • A “test transaction” that “does not qualify” exists only to build trust before the large send.
    • “One more fee to release your funds” is the universal second hook.

    Routed to a platform to “withdraw” a giveaway?

    The first hours decide the recovery. Bring us the deposit address and your transaction hashes and we will plot the trail.

    Open a Case

  • The Broker With a Borrowed Licence

    BLACK BOX // CBB-2026-056 // VECTOR: CLONE-OF-REGULATED-FIRM

    The Broker With a Borrowed Licence

    The client did her homework. She checked a registration number, found it on a regulator’s register, and wired her money believing she was dealing with an authorised firm. The number was real; the firm using it was not. CAPIXTRADE ↗ had borrowed another company’s credentials — and because the loss left as a bank transfer, we had a banking lever most crypto cases never get.

    Vector
    Clone firm (cloned licence / APP)
    Instrument
    Bank transfer → EUR / USDT
    Reported Loss
    €86,500
    Detection Window
    5 weeks · reported within days
    Recovered
    92% · €79,600

    Last Known Position

    Aoife is fifty-two, a pharmacist in Cork who had never traded before and did everything the careful way. CAPIXTRADE presented as an established brokerage, complete with a firm registration number she could look up on a public register. The number resolved to a genuine, authorised company — just not the people emailing her. Clone-firm fraud works precisely because the credential is real and the impersonation is invisible from the outside.

    An “account manager” walked her through a first deposit by bank transfer, then a second. The platform showed steady, believable growth — nothing flashy, which is what made it convincing.

    Point of No Return

    When Aoife requested a withdrawal, CAPIXTRADE introduced a “regulatory clearance levy” payable before release, then asked her to move funds into USDT “to speed settlement.” That switch — from a believable brokerage to a crypto release fee — was the tell. She stopped, contacted the real firm whose licence had been cloned, and then came to us.

    I checked the register myself. The licence was real. It never occurred to me the people behind it might not be.

    Recovery Track

    1. Work the banking clock first

      Most of the loss had gone bank-to-bank. We helped Aoife file an authorised-push-payment fraud claim with her bank immediately and supplied the evidence pack the recall process needs.

    2. Document the clone

      We recorded how CAPIXTRADE had borrowed the registration number, capturing the impersonation for both the bank and the genuine firm’s fraud team — which strengthens a reimbursement claim materially.

    3. Trace the converted leg

      The portion she had moved into USDT we followed on-chain to a consolidation wallet and onward to an exchange deposit address.

    4. Recall and freeze in parallel

      The bank actioned recalls on the still-traceable transfers while we filed a freeze request for the crypto leg with full provenance.

    5. Reimburse and return

      The banking recall reclaimed the bulk; the exchange released the smaller frozen crypto slice after verification. Together they returned almost all of it.

    Wheels Down
    92%

    €79,600 of €86,500 returned. The strong outcome was not luck — bank-transfer fraud reported quickly has recall and reimbursement routes that pure-crypto cases simply do not.

    Warning Lights

    • A real licence number on the register does not prove the people contacting you hold it — call the firm on its official number to confirm.
    • A “regulated brokerage” that suddenly needs you to pay a fee or switch to USDT to withdraw is a clone.
    • Clone firms favour believable, modest “growth” over flashy returns — restraint is part of the disguise.
    • Report bank-transfer fraud to your bank within hours; recall windows close fast.
    • Verify a firm through the regulator’s own contact details, never the links the “broker” sends you.

    Wired money to a “regulated” broker that won’t pay out?

    Move fast — banking recalls are time-critical. Bring us the transfers and the platform details and we will act on both rails.

    Open a Case

  • The Hashrate That Never Spun

    BLACK BOX // CBB-2026-053 // VECTOR: CLOUD-MINING-CONTRACT

    The Hashrate That Never Spun

    For four months a dashboard told this client his Bitcoin was compounding daily. The graph was real to look at and connected to nothing. The platform behind it — Dailywealthfinancing ↗ — was a template we had seen before, and that familiarity is part of why we got more than half of it back.

    Vector
    Cloud-mining contract (fee wall)
    Instrument
    Bitcoin (BTC)
    Reported Loss
    £54,900 (5 top-ups)
    Detection Window
    4 months (slow bleed)
    Recovered
    58% · £31,800

    Last Known Position

    Gary is forty-seven and runs a two-van plumbing firm in Manchester. He wanted his savings working while he did. Dailywealthfinancing sold exactly that story: rent hashrate, skip the hardware, collect daily BTC. Slick dashboard, referral program, support that answered in minutes. He started with a modest contract.

    The dashboard performed on cue — a clean upward line, daily payouts crediting an in-platform balance, projected returns that made the next tier look obvious. So he upgraded. Twice. Then a third time, after support explained a higher tier “unlocked instant withdrawals.”

    Point of No Return

    When Gary finally tried to withdraw, the balance would not move. First a “node-sync fee” of a few hundred pounds. He paid it. Then a “tax clearance” set as a percentage of his displayed balance — thousands. Then a refundable “anti-money-laundering deposit.” Each fee was smaller than the balance it claimed to unlock, which is exactly why people keep paying. The displayed earnings never existed; only his five real top-ups did.

    The graph went up every single day. I kept paying the next fee because the next fee was always less than what they owed me.

    Recovery Track

    1. Strip out the theatre

      We set the phantom dashboard balance aside and reconstructed only the five genuine BTC top-ups and the fee payments — the actual money that left Gary’s control.

    2. Cluster the deposits

      The top-ups and fees resolved into a small cluster of operator wallets. Dailywealthfinancing reused infrastructure across a template of near-identical “mining” sites we recognised.

    3. Follow the consolidation

      Funds from many victims pooled into a primary treasury wallet, then drained in batches toward a payment processor and an exchange used to convert to fiat.

    4. Engage the cooperative off-ramp

      One batch of Gary’s traced coins reached a processor with a real compliance function. We submitted a documented trace tying specific outputs back to his deposits.

    5. Recover and flag the template

      The processor held the flagged funds and, after verification, released the recoverable portion. We added the template fingerprint to our Watchlist so the next mirror site is faster to identify.

    Wheels Down
    58%

    £31,800 of £54,900 returned. The slow-bleed structure that hid the fraud for months also left a long, traceable paper trail — which worked in Gary’s favour.

    Warning Lights

    • A dashboard number is a graphic, not a balance — if you cannot withdraw it, it does not exist.
    • Legitimate platforms deduct fees from a withdrawal; they never demand new deposits to “unlock” your money.
    • “Tax,” “node-sync” and “AML” fees each smaller than the frozen balance are a designed trap.
    • Guaranteed daily mining returns ignore difficulty, hardware and electricity — real mining has none of that certainty.
    • Tiers that “unlock instant withdrawals” exist to extract larger principal, not to pay you out.

    Stuck behind a withdrawal fee wall?

    Do not pay the next fee. Send us your real deposit transactions and we will trace where they actually went.

    Open a Case

  • The Portfolio Manager I Never Met

    BLACK BOX // CBB-2026-057 // VECTOR: PIG-BUTCHERING ROMANCE

    The Portfolio Manager I Never Met

    Five months. That is how long the relationship ran before the first dollar moved, and it is why this is one of our hardest case files to write. By the time the client accepted what Omenyx Group ↗ really was, the money had been laundered methodically across months. We recovered what we could. It was not much, and I will not pretend otherwise.

    Vector
    Romance / “managed portfolio”
    Instrument
    USDT (multi-chain)
    Reported Loss
    $164,000
    Detection Window
    5 months (long con)
    Recovered
    19% · $31,200

    Last Known Position

    Wei Lin is forty-eight, an engineer in Singapore, widowed three years. The connection began on a language-exchange app and moved to daily messages — patient, warm, never rushed. Months in, the partner mentioned a relative who managed crypto portfolios through Omenyx Group and offered to “help him learn.” There was no hard sell. That is the signature of pig-butchering: the fattening is the relationship itself.

    The first small deposit on Omenyx grew and, crucially, a modest withdrawal paid out. After that the amounts climbed with his confidence in the person, not the platform.

    Point of No Return

    When Wei Lin eventually tried to take a large sum out, Omenyx Group required a “tax bond” to release it — and the partner, ever supportive, offered to “split” the cost. The contradiction finally landed. When he asked to meet, even by video, the excuses began. He came to us the week he accepted the answer.

    I was not chasing returns. I trusted a person. The platform was just where they told me to put it.

    Recovery Track

    1. Map five months of movement

      We reconstructed every deposit across the full timeline — multiple chains, dozens of transfers — to see how much had genuinely left and where it first pooled.

    2. Accept what was already gone

      A long con launders as it goes. The earliest deposits were untraceable months before he reached us; we focused on the most recent, still-warm transfers.

    3. Chase the recent tranches

      The final two deposits had not fully dispersed. We followed them to collector wallets and on toward two exchange deposit addresses.

    4. File on the warm slice

      We submitted a documented trace and victim report to the exchanges and a referral to the relevant fraud authorities, covering the recoverable tranches only.

    5. Recover the recoverable

      One exchange held and returned a portion after verification. The honest total is a fraction — the cost of a fraud built to run for months before anyone reports it.

    Wheels Down
    19%

    $31,200 of $164,000 returned. We publish the low numbers on purpose. The single biggest factor in a romance-investment case is how long it ran before it was reported — and five months is a long time for a trail to cool.

    Warning Lights

    • An online-only partner who introduces a crypto “opportunity” is the most common pig-butchering script.
    • The early small withdrawal that pays is the anchor; it exists to justify the large deposits later.
    • “Trusting a person” is not the same as vetting a platform — the person is the bait.
    • A “tax” or “bond” required to withdraw your own balance is never real.
    • Refusal to meet on a live video call, after months, is a red flag — not shyness.

    Was your “investment” introduced by someone you met online?

    The sooner the last transfers are traced, the more survives. Bring us the wallet history and we will tell you what the chain still shows.

    Open a Case