The people targeted here had already lost money once. Fake law firms, fake recovery services and people impersonating federal agents reached out offering to trace and return the funds, for a fee paid upfront or for access to a wallet.
More than 10,500 complaints in a single year.
The decision point was answering. The victim was contacted about a loss in a channel where they had not disclosed it, at the moment they were least able to think clearly, and the offer was the proof.
Five lessons of prevention, and this one assumes prevention failed. That is deliberate. Everybody eventually signs something they should not have, and what happens in the following ten minutes decides whether it was expensive or catastrophic.
Read this before you need it. Nobody learns a procedure while their hands are shaking.
The first ten minutes, in order
Order matters more than speed, and the intuitive order is wrong.
1. Get to a clean device. If there is any chance the machine is compromised, everything you do on it makes things worse, including the revocation you are about to attempt. Use a different device. If you do not have one, a phone you have not used for the compromised session is better than the machine in front of you.
2. Revoke first, move second. This is the step people get backwards.
An approval is a standing permission attached to the address, not to the balance. If you move your tokens out and leave the approval live, the permission still applies to that address, including to anything that arrives there later: a refund, an airdrop, a payment from someone using your old address, or the token you forgot. Attackers run automated sweepers on drained addresses for exactly this. Kill the permission, then move what is left.
The exception is when the theft is already in progress and there is a race. If funds are actively leaving, move the largest remaining balance first, then revoke. You will usually lose that race, which is a reason to have architecture rather than reflexes.
3. Move what remains, in value order. Largest first. Send to an address that has never touched the compromised session and never signed anything. If you have the F104 vault tier, that is what it is for.
4. Assume the seed is exposed if there is any doubt. If the compromise came from a seed phrase, a fake wallet app, or malware rather than a single approval, every address from that seed is gone, including ones you have never used. Do not move funds to a different address from the same seed. That is a very common and total mistake.
5. Write down what happened, now. Timestamps, the site, the request, transaction hashes, the attacker's addresses. Your memory of this will be worse in an hour than you expect, and every reporting channel wants specifics.
What is actually recoverable
The honest answer is: almost never, and you should hear it from us rather than from someone charging you.
Settlement is final. There is no chargeback, no reversal, no administrator with a rollback. Immunefi recorded roughly 0.4 percent of stolen funds recovered in the first quarter of 2025, against 21.2 percent a year earlier.
The narrow exceptions, none of which you control:
- Centralised choke points. If the funds route to an exchange with real compliance, a fast report can occasionally freeze them. This works sometimes, on a scale of hours, and only if the funds actually pass there.
- Stablecoin issuer freezes. Some issuers can freeze addresses. They act on legal process, not on requests from victims.
- Attackers who negotiate. Occasionally, for very large thefts, funds come back. The 1,155 WBTC victim in F105-04 recovered more than 96 percent after publicly offering a 10 percent bounty. That is a real outcome and it is not a plan: it happened because the attacker chose it, on a theft large enough to be worth their attention, and the overwhelming majority of losses end nowhere near there.
Report anyway, because reports are how the choke points learn, and how patterns get attributed even when your specific loss does not come back. In the US that is IC3. Chainabuse is a cross-jurisdiction reporting surface. Report to the exchange if any leg touched one, with hashes.
The second attack
Now the part that costs people more than the original theft.
Within hours of a public loss you will be contacted. The messages are competent. They cite your transaction hashes, which are public. They use the vocabulary. They may reference a real agency, or a law firm with a real-looking website, or a "blockchain forensics" service with a plausible team page.
Anyone who contacts you offering to recover your funds is stealing from you. Not "probably". Treat it as a definition. No legitimate agency initiates contact offering recovery for a fee. No legitimate service needs your seed phrase, your private key, or a signature to "verify ownership".
The tell is structural rather than stylistic, which is why it survives the attacker being good at their job. Real investigative bodies do not solicit. Real firms do not require crypto payment upfront to begin. And nothing legitimate requires you to sign a transaction to prove you owned an asset you are reporting stolen: your report already contains the addresses.
The mechanism here is the same one from F111: urgency plus authority plus a person who very much wants a specific outcome to be possible. You are the perfect target immediately after a loss because you want it to be true.
I will just have a conversation and see if they are legitimate.
The conversation is the product. These operations are patient, and their skill is at conversation. Every minute you spend evaluating them is a minute they spend evaluating you. The correct volume of engagement is zero.
The runbook
Print it. Keep it offline. F106 builds the full version covering device theft, exchange compromise and seed exposure; this is the signature-specific one.
- Clean device.
- Revoke the hostile approval.
- Move remaining assets, largest first, to an address that has never signed anything.
- If the seed may be exposed, treat every address from it as lost and never send to another address derived from it.
- Record hashes, addresses, times, and the site.
- Report to IC3 and Chainabuse, and to any exchange involved.
- Audit every other address you control for approvals from the same source.
- Ignore, and do not reply to, every inbound offer of help.
Revoke before you move, because the permission is attached to the address and not to the balance. Get onto a clean device first, treat a possibly exposed seed as total loss across every address it derives, and write everything down while it is fresh. Recovery is rare and you do not control the exceptions. The one thing fully in your control after a loss is refusing the second attack, and the rule there is simple: anyone who contacts you offering to recover your funds is stealing from you.