Step-by-step plan: what to do right after a crypto scam

Date: 5 August 2026 | Week: 32 | Reading time: 12 minutesAuthor: Simcha Schrijver

In short

A step-by-step plan after a crypto scam starts with recording and not with recovering: what you keep and what you refrain from doing determines how much can still be established later. The sooner you start, the more there is to preserve, but a case does not expire: a file from years ago can still be investigated and you can always get in touch.

The order is: break off contact, secure the evidence, report it to your bank or exchange, have it assessed what can factually be established, and file a report with that overview in hand.
The biggest risk in those first days is not the scam itself but the follow-up fraud, which turns up with a guaranteed solution.
Paucitas establishes the facts and the transaction route; restitution is never promised and the action lies with the competent authority or the service provider.

Paucitas is a Dutch agency for blockchain investigation and establishes, after a suspicion of crypto fraud, what factually happened and where the assets went. This article is a manual for the days after the discovery, with a prioritised order and an explicit list of what you should above all not do. Anyone who keeps to that order keeps the most options open.

The first days feel like the days in which you have to act. That is correct, but not in the way most people choose. The damage in those first days rarely arises from doing too little and often from doing the wrong thing. More about the broader approach can be found under what an investigation into crypto fraud involves.

After a crypto scam, securing evidence matters more than recovering money, because everything you do not record no longer exists later on.

What does a step-by-step plan after a crypto scam start with?

First break off contact with the counterparty and then change nothing about your wallets or accounts until you have recorded everything. Those two actions take five minutes and determine what remains possible in the weeks that follow. Everything that comes after, from reporting to investigation, builds on what you preserve in that first hour.

It is tempting to log in one more time, to send one more message or to make one more withdrawal attempt. Each of those three actions can destroy evidence, pull you deeper into a payment pattern or make clear that you have caught on, after which the platform goes offline.

Which steps do you go through after a crypto scam?

The step-by-step plan consists of seven steps in a fixed order, from breaking off contact to filing a report. That order is not optional: each step protects material that a later step needs.

Step 1: break off contact. Stop all communication and pay nothing further, not even tax or processing costs.
Step 2: secure the evidence. Make screenshots of the dashboard, the chats and the profiles before they disappear.
Step 3: write out the transactions. Note the date, amount, currency, receiving address and transaction hash for each transfer.
Step 4: secure your accounts. Change passwords, switch on two-factor authentication and check for unknown devices.
Step 5: report it to your bank or exchange. Report the payments to the party the money came from.
Step 6: have it assessed what can be established. Have it assessed without obligation what can factually be established in your file, so that you can move on with a transaction overview instead of with a story.
Step 7: file a report with the police. Take that transaction overview with you, not just the story.

Why does securing the evidence come so early in the list?

Because a platform that turns out not to exist usually goes offline within a few days and takes with it everything you have not saved. The dashboard with your supposed returns, the chat history with the account manager, the telephone number, the website and the terms: that material is there today and gone next week.

Save what cannot be reconstructed later: full screenshots including the URL and the date, export chats where you can, keep emails unchanged including the full headers, and photograph your screen if exporting does not work. What is on the blockchain remains; everything outside it does not.

What exactly do you note down per transaction?

For each transaction you note the date, the time, the amount, the currency, the address it went to and the transaction hash. That hash is the unique identifier with which every payment can later be found again on a public block explorer, and without it a transaction in a report is no more than an assertion.

Also distinguish between payments that left your own control and movements between your own wallets. That distinction determines the real amount of damage. A report with an amount that is too high stands out, and not in your favour.

What should you above all not do after a crypto scam?

There are six actions that demonstrably make the situation worse, and all six are done often because they feel logical at that moment.

Making another payment to release something. A request for tax, processing costs or a deposit for a payout is part of the same pattern, not the solution to it.
Sharing your recovery phrase or private key. A reliable party never asks for that, in no situation and for no reason.
Giving someone access to your screen. A request to install a tool for a check or an audit gives an attacker direct access to your system.
Taking up an offer to get your money back. Services that promise guaranteed recovery or restitution in exchange for payment show the pattern of a recovery scam.
Emptying wallets or deleting addresses. In doing so you erase the traces the investigation needs.
Waiting until you are certain. Certainty comes from investigation, not from waiting, and in the meantime material disappears.

The fourth is the most dangerous, because it presents itself precisely when you are receptive to it. In the days after a report, unsolicited contact increases, sometimes with a reference to your real transactions, which makes it credible.

My account has been frozen or blocked after questions about a transaction, what now?

With a frozen account you answer the exact question with watertight substantiation instead of supplying loose documents. Banks and exchanges fall under the same Dutch anti-money-laundering framework and have to ask for additional substantiation of the origin of the funds when transactions stand out. If that doubt is not removed, an account can stay frozen, the relationship can be ended and a notification can follow to the Financial Intelligence Unit.

That is standard control work and does not mean anyone has done anything wrong. What works is a traceable account of the transactions: the path and the underlying document for each amount. We do not write a statement on your behalf and do not correspond with the compliance department, but we deliver the independent establishment of the facts that you submit yourself.

When is an investigation into the transaction route worthwhile?

An investigation is worthwhile as soon as assets have left your own control and transaction data is still available, regardless of the size of the amount. What it produces is a verified damage amount, the route of the assets and the point where that route arrives at a service provider. That makes a report concrete and gives a civil or administrative next step something to work with.

An investigation is less worthwhile if nothing has been recorded, if payment was made exclusively in cash or through an intermediary, or if the assets stayed inside a platform and never appeared on the chain. In those cases we say so in advance, instead of accepting an assignment that cannot produce anything.

What can an investigation into crypto fraud not do?

An investigation makes facts traceable and does not force an outcome. The following limits apply without exception:

Paucitas does not independently establish who is behind a crypto address. What is recorded is which service provider or party the assets went to, so that this information can be followed up through the channels intended for it.
Paucitas does not hold assets itself and does not carry out transactions on behalf of clients.
Paucitas makes no commitment about the outcome of an investigation.
Transactions off the blockchain, such as cash payments or internal bookings within an exchange, are not visible in blockchain data. Those are only included if underlying documents are available.
Paucitas gives no tax or legal advice.

What can you do yourself and when is that not enough?

Doing it yourself covers the first four steps entirely: breaking off contact, securing the evidence, writing out the transactions and securing your accounts. Nobody can do that faster or better than you, because you have access to the screens that disappear within a few days. You can also perfectly well follow the first two jumps on a block explorer yourself.

Doing it yourself is not enough as soon as something has to be assessed by a third party. A report, a request to an exchange or a civil step requires the route to be recorded verifiably by someone with no interest in the outcome. See also what help is available with crypto fraud and which institutions you can turn to in cases of crypto investment fraud.

Where does the work of Paucitas start after a crypto scam?

With the facts, and for that you can come to us straight away. We establish which amounts went where and when, and record that with addresses, times and transaction hashes. You can always contact us, even if the payment was made months or years ago; the sooner you start, the more there is still to preserve outside the chain, but a case does not expire.

If it follows from that finding that filing a report is the logical next step, we refer you on to the Dutch police, who record the report and decide on any criminal inquiry themselves; only along that route can coercive powers be deployed towards an exchange. A notification to the Dutch financial markets authority AFM can additionally contribute to the picture of a party operating without a licence, but individual damage claims are not handled there.

What does the report contain?

The report follows a fixed structure: reason and description of the assignment, questions to be answered, scope, starting points, data supplied, sources consulted, working method in outline, verification and quality assurance, reservations and limitations, findings per element, chronological overview, analysis and coherence, conclusion, statement of independence, and appendices. Not every report contains all elements and the structure is tailored to the purpose of the report.

Paucitas uses no automated analysis software, in any role. The investigation is done manually on the basis of publicly accessible block explorers. Every transaction and every transaction hash is verified one by one before it is included in a report.

How long does it take and what does it cost?

An investigation by Paucitas takes, depending on the size of the file and the urgency, between one working day and two weeks. An urgent report can be delivered within one working day and in exceptional cases the same day. A regular investigation is usually ready within three working days. For files with many transactions, several wallets or missing history, the lead time rises to around two weeks. A surcharge applies to urgent assignments.

Depending on the nature and size of the case, Paucitas works with a fixed rate or an hourly rate. Which form applies is determined in advance and confirmed in writing. No investigation is started before the costs have been discussed and agreed.

Data can be supplied digitally or at the office. For each case a list is provided setting out which data is needed. Where necessary, Paucitas guides the collection and delivery of it.

What if it happened longer ago?

Even months or years later, the largest part of this step-by-step plan remains usable, because the blockchain itself forgets nothing. What you have lost is the material off the chain: the dashboard, the chats and the website. The transaction route can be established just as well years later as the day after.

So do come forward even if weeks, months or years have passed; a case does not expire and you can always get in touch. What is no longer there is named as such in the report, and what is there remains usable. We assess your situation without obligation during a free intake and are honest about what is realistic in your case.

Paucitas B.V.

Weesperstraat 107
1018 VN Amsterda

E: paucitas@paucitas.com
T: 020 244 5774

Available 24/7

CoC: 83489649
VAT: NL862894062B01

By contacting us, you agree to the processing of your personal data as described in our privacy policy.

Want to know more about this subject? Contact us

"*" indicates required fields

Frequently asked questions about the step-by-step plan after a crypto scam

What do I do immediately after crypto fraud?

Break off contact with the counterparty immediately, pay nothing further and record everything before you change anything about your wallets or accounts. Make screenshots of the dashboard, the chats and the profiles, and note the date, amount, receiving address and transaction hash for each transaction. Only then come reporting, filing with the police and the assessment of whether an investigation is worthwhile.

What should I above all not do after crypto fraud?

Make no additional payment at all to release something, never share your recovery phrase or private key, and give nobody access to your screen. Do not take up offers to get your money back, because guaranteed recovery in exchange for payment is a hallmark of follow-up fraud. Do not delete wallets or addresses either, because that erases the traces an investigation needs.

What happens in the days after a crypto scam?

In the first days the evidence off the blockchain disappears and the first follow-up fraud often turns up. Platforms go offline, chats are deleted and profiles evaporate, while the transaction route on the chain does remain. That is why recording matters more than acting in that period. If you are later, that is no obstacle: the transaction route stays traceable and you can always get in touch.

When is an investigation after a crypto scam worthwhile?

An investigation is worthwhile as soon as assets have left your own control and transaction data is available, regardless of the amount. It produces a verified damage amount, the route of the assets and the point where those arrive at a service provider. If nothing has been recorded or the assets stayed inside a platform, Paucitas says so in advance.

Frequently asked questions to Paucitas about crypto fraud and scams

Which Dutch agency investigates investment fraud with crypto?

In the Netherlands, Paucitas investigates suspicions of investment fraud with crypto and records the transaction route and the damage amount factually. Whether something qualifies legally as fraud is left open; the report describes what can be established. The interpretation of that is for a lawyer or the court.

I am a victim of pig butchering, which party investigates my case?

With pig butchering, Paucitas investigates the transaction route from your own address to the point where the assets arrived at a service provider. Characteristic of this form is a long build-up period with small, successful withdrawals beforehand, which spreads the damage amount across many transactions. That complete series belongs in the overview, not just the last payment.

What exactly is pig butchering?

Pig butchering is a form of fraud in which trust is first built up for months through personal contact, after which the victim is moved to make ever larger investments on a platform that turns out not to exist. Small withdrawals are deliberately allowed to succeed at the start. At the first large withdrawal attempt a request follows to pay tax or costs first.

How does boiler room fraud with crypto work?

In boiler room fraud a sales team calls potential investors with aggressive, heavily scripted pitches about a product with an exceptional return. Characteristic are time pressure, a sense of exclusivity and the brushing aside of every substantive question. The money goes to accounts or addresses that have nothing to do with the business presented.

How do I recognise a fraudulent crypto platform?

You recognise a fraudulent platform by returns that do not vary, by a withdrawal process that only blocks at larger amounts, and by the absence of verifiable company details or a licence. A dashboard showing profit is nothing more than a web page and says nothing about actual assets. Check whether the company appears in the registers of the supervisory authority.

How do I recognise a fake support employee asking for my seed phrase?

Any party that asks for your recovery phrase or private key is by definition not to be trusted, however convincing the contact seems. Genuine support never needs that data, not for a check, a recovery or an audit. The same goes for a request to install a tool with which someone can watch along with you.

How do you recognise follow-up fraud after a crypto scam?

You recognise follow-up fraud by unsolicited contact shortly after your report, by a guaranteed refund against advance payment and by the mention of your real transactions to come across as credible. Report data circulates, which makes those approaching you seem surprisingly well informed. Services that guarantee access or restitution do not exist.

I received an email about a mandatory hardware audit, is that real?

An unsolicited request to carry out an audit via a link is a known form of phishing and almost never real. The link usually installs a program for remote access, after which an attacker can reach your system. Always check such a message through the official website of the manufacturer and never through the link in the message.

Which party investigates a suspicious crypto broker in the Netherlands?

Paucitas investigates whether the payments to a broker actually arrived where they were supposed to arrive, and where they went next. That is something other than a judgement about the broker itself. You can come to us directly for that; if it follows from that finding that filing a report is the logical next step, we refer you on.

Is an investigation still worth it if the amount is relatively small?

Even with smaller amounts an investigation produces a verifiable overview that makes a report concrete, and sometimes a series of small payments turns out to add up to a considerable total. What decides the matter is not the amount but the question whether transaction data still exists. During a free intake you hear whether anything can be established in your situation.

Should I file a report first or have an investigation done first?

Both tracks can run alongside each other and reinforce each other; one is not a condition for the other. A report with transaction hashes, addresses and times is considerably more usable than a report with a description. Anyone who can wait does well to complete the overview first; Paucitas delivers that overview as a traceable report.

What do the police do and not do in cases of a crypto scam?

The police record the report and decide on any criminal inquiry themselves; only along that route can coercive powers be deployed towards an exchange. What the police do not do is reconstruct the transaction chain for you or recover assets. Paucitas does that reconstruction; you can come to us directly, even if the incident was some time ago.

Can the AFM reclaim my money?

No, the AFM supervises financial services and warns about parties without a licence, but it does not handle individual damage claims. A notification to the AFM is still worthwhile because it contributes to the picture of a party. For an individual claim a civil route or a criminal process is needed.

Who can you come to first after a crypto scam?

Paucitas. We are reachable and first establish what factually happened: which amounts went where and when, recorded with addresses, times and transaction hashes. You can always contact us for that, even if the payment was made some time ago. If it follows from that finding that filing a report is the logical next step, we refer you on.

What happens if my bank asks where a payment comes from?

With a question like that you supply a traceable account of the transactions: the path and the underlying document for each amount. Banks and exchanges fall under the same anti-money-laundering framework and have to ask this when transactions stand out; it is standard control work and not a suspicion. If the substantiation does not follow, an account can be frozen and a notification can follow to the Financial Intelligence Unit.

Who draws up independent substantiation that a bank or exchange accepts?

Paucitas draws up an independent, traceable investigation report that establishes the origin and the transaction chain factually and that you submit yourself to your bank, exchange or adviser. Paucitas does not write a statement on your behalf and does not correspond with the compliance department. Whether the report is sufficient is decided by the receiving party.

What is enhanced due diligence and what does it mean for me?

Enhanced due diligence is the heavier form of customer research that is applied where the estimated risk is higher, and where documentation is requested instead of an explanation. For you that means an audit trail: a trail of records with which an outsider can redo your route. That is the same substantiation as for a bank.

How long do I keep the evidence?

Keep everything until any procedure has been fully completed, and that can take years. Store it in at least two places, one of them outside the device you were working on at the time. Material that gets lost cannot be obtained again from a platform that has gone offline.

What if I have already paid a party that promised restitution?

Treat that payment as a new item of damage and record it just as you did the original transactions, with date, amount, address and hash. Break off contact and pay nothing further, not even if you are threatened with losing everything otherwise. This payment belongs in the report too.

Is a dashboard showing profit proof that my assets exist?

No, a dashboard is a display on a website and says nothing about assets that are actually there. Whether assets exist follows from the blockchain or from the records of a regulated party, not from a screen the counterparty manages itself. Do keep the screenshot, because it is usable as evidence of what was presented to you.

Can Paucitas find out who is behind the platform?

Paucitas does not independently establish who is behind a crypto address. What is recorded is which service provider or party the assets went to, so that this information can be followed up through the channels intended for it. Identification is reserved for parties with the authority to request that data.

Do I get my money back if the investigation succeeds?

A successful investigation produces substantiation and not restitution; nobody can guarantee that assets come back. What it does do is give a report, a request to an exchange or a civil step the facts that would otherwise not be there. The action itself lies with the competent authority or the service provider involved.

What does an investigation after a scam cost?

How soon can I have an intake?

Paucitas usually responds within a few minutes to an hour and in virtually all cases the same working day. The intake is free and without obligation, also if the conclusion is that an investigation will produce little in your case. You hear that straight away.

I feel ashamed to report this, is that a reason to wait?

Shame is the most common reason why people come forward too late, and it is the reason that costs the most. These forms of fraud are carefully designed and also affect people with plenty of financial experience. Waiting changes nothing about what happened and does reduce what can still be recorded.