How to spot a "recovery agent" that's just a second scam

Here's a pattern we see constantly: within days of a victim's loss, a new message appears. "We're blockchain recovery specialists. We found your funds at this wallet. Send us $800 processing fee and we'll extract them." The victim, already desperate and already burned, hands over more money to the second scammer.

The second-wave scam works because it's designed to pass every check a victim is taught to perform. So how do you tell the real thing from the fake? Here are the five tells we use — and the inverse of what a legitimate firm looks like.

The five tells

• They found you cold, fast. A legitimate firm doesn't cold-DM victims within hours of a loss. If they have your wallet address and your story before you've published it anywhere, they're monitoring victim forums and feeds — the classic second-wave pattern.
• They guarantee 100%. Real forensics firms say "the funds are at this address; the question is whether they've been withdrawn." A guarantee is a sales script. If they promise the exact amount "will be returned," walk away.
• The fee is in crypto, upfront, and "non-negotiable." "Gas fee," "license fee," "extraction fee," "KYC activation fee" — the name changes, the pattern doesn't. A legitimate firm's first payment is either free (an assessment) or card/PayPal to a named, verifiable account. Never "send $2,000 to this wallet to unlock your funds."
• They ask for your seed phrase or wallet password. Tracing a public blockchain requires zero access to your keys. Anyone asking for the seed phrase wants to drain your wallet too — a second theft in your own name.
• No verifiable footprint. Check the domain age (WHOIS), the team page, the company registration. Second-wave scammers run 3-month-old domains with stock-photo "team" pages, a PO box, and a free "virtual office" address. The footer links to nothing real.

What a legitimate firm looks like instead

• Named, findable humans. Real names, real photos, credentials you can look up. A "recovery agent" who can't survive a Google search is doing it on purpose.
• Honest odds, not promises. "60–80% recoverable if we act this week" is a forensic assessment. "100% guaranteed" is a scam.
• Live contact before payment. A video call, a phone number, a written report before any fee. You should be able to see the on-chain trail in writing before you pay.
• Traceable payment. Card or PayPal to a named entity — reversible if things go wrong. The scammer's whole model depends on the payment being irreversible, which is why it's always crypto or a wire to a stranger.