The FBI's Internet Crime Complaint Center counted 859,532 complaints in 2024 and $16.6 billion in reported losses, a third more than the year before.
Cryptocurrency was involved in $9.32 billion of it. Investment fraud was the largest category at $6.57 billion, and $5.8 billion of that was cryptocurrency investment fraud across 41,557 complaints, up 47 percent in a year. People over sixty reported $4.885 billion, and about 7,500 of them lost more than $100,000 each.
Every one of those numbers is a complaint filed after the money was gone, which is where you are.
The report does not carry a recovery column for cryptocurrency fraud, because there is not one worth printing. The money that leaves a wallet in a theft is, in the large majority of cases, gone, and the actions that remain are worth taking for reasons other than getting it back.
This lesson says what those actions are, what each one can and cannot do, and how to set an expectation you can live with.
Yesterday was the first hour. This is the honest version of the question everyone asks next, and the honesty is the point: the people who will contact you about your loss, per O101-04, are selling the other answer.
Tracing is not recovery
A theft on a public chain is completely visible. You can watch the funds move from your address to the thief's, then onward, hop by hop, on any block explorer, and so can everyone else. Firms exist that do this professionally, with better tooling, and they will show you a diagram.
None of that moves the funds back. Visibility is the chain's normal state. A thief's address is as public as yours and exactly as reachable, which is to say not at all, unless someone with power over a chokepoint acts.
This matters because tracing looks like progress. It produces a document, it names addresses, it feels like a case being built. It is the first thing a recovery firm sells because it is the only thing they can actually deliver.
The three chokepoints
Stolen funds can be stopped in three places, and only three.
A regulated exchange. If the funds land at an exchange that checks identity, the exchange can freeze the account. For that to happen the funds must actually arrive there, someone the exchange will act for must ask in time, which in practice means law enforcement rather than you, and the attacker must not have withdrawn already. Attackers know this chokepoint better than victims do. Stolen funds are moved, split and mixed before they go near one, and the ones that do arrive at an exchange usually arrive under an account the exchange will not connect to you.
A freezable token. Some stablecoins are issued by a company that can freeze balances at an address. If your stolen funds are in one of those, and you report to the issuer and to law enforcement with the transaction hashes before the funds move, a freeze is possible. It is rare. It is also free to try, and it is the one case where a report filed within hours has changed an outcome.
Seizure. Law enforcement can seize funds from an identified party, after an investigation, through a court. This is how the large recoveries you read about happen. It takes months to years, it requires the case to be large or connected enough to be worked, and the funds returned, when they are, go to victims through a process that starts with the report in O101-03. Your individual loss will not be worked on its own. It may be counted inside a case that is.
That is the whole list. A wallet vendor cannot help. A validator cannot help. The network cannot reverse anything, and per F101 that is what makes it a network worth using.
The report gives $9.32 billion involving cryptocurrency across the year's complaints. It gives no recovery figure for that category.
Suppose, generously, that one percent of it was frozen or seized and returned. That is about $93 million, spread across some fraction of the roughly 150,000 crypto-related complaints, which is a few hundred dollars per complaint if it were spread evenly, and it is not spread evenly: it concentrates in a small number of large cases.
Now suppose the report's figures are a minority of real losses, which every study of fraud reporting finds, so the denominator is larger still.
The honest reading is that the probability of your funds coming back is low enough that the report does not print it. Not zero. Low enough that the correct amount of your life to spend pursuing it is the free actions and one evening, and then the rest of this course, which is about the second theft.
What is worth doing
Given the base rate, the actions that are still worth taking are the ones that cost nothing and occasionally work, plus the ones that matter for reasons other than recovery.
- Report, per O101-03. It is free, it is the input to every chokepoint above, and it is the only action that can turn your loss into part of a case that is worked.
- Notify the issuer, if the stolen asset is a freezable stablecoin, with the hashes, today.
- Notify the exchange, if you can see the funds arriving at one, and give the report number when you have it. Expect the exchange to act on law enforcement's request rather than yours.
- Keep the evidence from O101-01 intact and dated.
Then stop. The time after that is better spent on why it happened, which is what Year One teaches, than on a recovery the numbers do not support.
Somebody who can find the funds can get them back, for a fee.
Finding is free; a block explorer does it. Getting back requires one of the three chokepoints, and a private firm controls none of them. What a firm can do is write the report you could write yourself, send it to the exchange you could contact yourself, and charge you for the diagram.
There is one legitimate version: a real lawyer, whose bar registration you have verified, pursuing a real legal action against an identified party, for a fee you agree in writing. That is rare, slow, and worth it only when the party is identified and the amount is large.
Everything else, and in particular anyone who contacts you rather than the other way round, anyone who has already "located" your funds, and anyone who needs a fee before release, is O101-04's subject. The offer is the tell.
Setting the expectation
Write one sentence in the evidence document from O101-01: "I am treating this as gone." Then do the free actions, file the report, and close the document.
That sentence is not resignation. It is the thing that protects you from the second wave, because every recovery scam depends on you not having written it.
A theft on a public chain is completely visible and, in the large majority of cases, gone: tracing shows where funds went and recovers nothing. Funds can be stopped in only three places, a regulated exchange they land on, an issuer that can freeze its stablecoin, or a law enforcement seizure, and each needs conditions that attackers know how to avoid. The 2024 FBI report counts $9.32 billion in crypto-involved losses and prints no recovery figure for it, which is the base rate. Do the free actions that occasionally work, report, notify an issuer or exchange with the hashes, then write "I am treating this as gone" and stop, because the people who will contact you next are selling the other answer.