free excerpt · vol. 4 · it happened. now what?

the first steps after a crypto scam (and the second scam that follows)

margin note: the boxer’s rule: if the stranger is suspiciously generous with treats, check what he wants for them.

laws differ by country; check the rules where you live. if you are in danger or being threatened, contact the police.

first: stop the bleeding

  1. stop sending. no more payments, “fees”, “taxes” or “deposits to unlock”, to anyone, for any reason.
  2. don’t sign anything else from the affected wallet.
  3. figure out what was compromised.
    • seed phrase leaked: assume the whole wallet, on every chain, is compromised. create a new wallet with a new seed phrase on a clean device, and move whatever is left there, the most valuable assets first. attackers often run automated “sweeper” scripts that grab any funds the moment they arrive, so don’t send fee money into the compromised wallet without understanding that risk.
    • a bad approval or signature, seed safe: revoke the approvals in question, then consider moving remaining assets to a fresh wallet anyway.
    • a fake platform: the money sent there is with the scammer. focus on documentation and reporting.
  4. secure the rest. change passwords and 2fa on email and exchange accounts if there’s any chance they’re involved. check the computer for malware, or stop using it for crypto.

document everything

before anything is deleted: transaction hashes, addresses, dates and times (with the time zone), screenshots and payment receipts.

report it

the police where you live, your financial regulator if a firm or platform was involved, your bank immediately if money was sent by card or bank transfer, and any exchange the stolen funds went to, through its official site, with the transaction hashes. exchanges can sometimes freeze funds that arrive in an account they control. no promises.

reporting rarely brings money back quickly. it matters anyway: it builds the cases that freeze funds and shut down platforms later.

the second scam: recovery

within days, sometimes hours, someone will offer to get the money back: a “blockchain forensics firm”, a “lawyer”, someone claiming to work with the police or a regulator, or a “hacker” who can reverse transactions. they want a fee up front, or the seed phrase, or more personal details. law enforcement has issued repeated public warnings about exactly this.

the rule is short: anyone who contacts you offering to recover crypto is part of the problem. legitimate help is something you go and find through official channels, not something that finds you.

losing money to a scam is not a character flaw. if it feels heavy, talk to someone: many places have a free, confidential helpline.

nfa. education, not financial or legal advice. you can lose all the money you put into crypto. interests: see /disclosure.

what’s inside the full guide (pdf · 18 pages): five chapters (anatomy of a rug pull · phishing, fake support and drainer contracts · token approvals and how to revoke them · pig butchering and “friendly” strangers · it happened. now what?), plus a fill-in incident log, a one-page checklist, a glossary and official and technical sources. it can’t get money back; it covers what to write down and where to report it.

ad · our own product. the full guide, “the lazy guide to crypto scams” (vol. 4, pdf, 18 pages), is $3.99: rektnotrich.com/courses/scam-field-guide

source: the lazy guide to crypto scams, vol. 4, v1.1 (oct 2026). chapter 5 · intro note, 5.1 “first: stop the bleeding”, 5.2 “document everything” and 5.3 “report it” (page 11, 5.3 continues on page 12), 5.4 “the second scam: recovery” (page 12), 5.5 “look after the person” (page 12, condensed). time zone: the incident log, page 11. margin note: the one-page checklist, page 13. contents: page 3.