Stolen Crypto: How to Recover It, What Works and What Doesn’t

Your wallet is empty, the transaction is confirmed, and a search result promises crypto recovery for a retainer. Before you pay, understand what works. Based on Dilendorf Law Firm’s experience handling cybercrime and crypto-related disputes, this article explains viable recovery options, common pitfalls, and how to avoid being victimized twice.

The arithmetic nobody tells you

The FBI’s Internet Crime Complaint Center logged 181,565 cryptocurrency-related complaints in 2025, up 21 percent, with $11.366 billion in losses and 18,589 complainants who each lost more than $100,000 [1].

On its own victim-resources page, the FBI states that once scammers withdraw funds “into criminally controlled cryptocurrency wallets inaccessible to the victim,” there is “usually nothing the victim can do” [2].

Ask any current or retired agent from the FBI, the Justice Department or another federal agency and you will hear the same number: roughly a 1 percent chance of recovering stolen crypto through tracing alone. Anyone who quotes you better odds before reviewing your facts is selling something.

Why self-custody theft is different

If funds were drained from an account at a U.S. cryptocurrency exchange, there is a registered money services business with security obligations, account records, a complaint process and an arbitration clause you can invoke.

A self-custody wallet has none of that. FinCEN classifies unhosted wallets as software on the user’s own device, where the owner “has total independent control over the value” and the person transacting through it “is not a money transmitter” [3].

No license, no custodian, no counterparty. You cannot sue the wallet. Recovery therefore depends on two questions: where did the coins go, and did a regulated entity fail you on the way in or the way out?

The forensics trap

Victims of self-custody theft, finding no one to blame, turn to firms that market blockchain tracing. We have seen retainers of $50,000, $60,000 and more than $100,000 quoted to people who had just lost their savings.

The FBI’s warning is blunt: “Private sector recovery companies cannot issue seizure orders to recover cryptocurrency. Cryptocurrency exchanges only freeze accounts based on internal processes or in response to legal process” [4].

The same advisory describes firms that take an upfront fee and then “produce an incomplete or inaccurate tracing report and request additional fees” [4].

Between February 2023 and February 2024, victims re-targeted by fictitious law firms offering recovery reported a further $9.9 million in losses [5], and the FBI has seized the websites of recovery services that advertised “strong success in recovering victim funds but have no track record in doing so” [6].

Even legitimate tracing hits a wall at the border. A forensics firm’s letter to a foreign exchange will be ignored.

In our experience, U.S. court subpoenas and turnover orders directed at offshore exchanges have been ignored too, on the argument that the exchange has no U.S. presence and the court no jurisdiction.

A tracing report that ends offshore is a map to a door no private party can open.

What forensics is actually for

Tracing is not useless; it is a tool with one real customer, and that customer is law enforcement. Seizure power belongs to the government.

When agents seize and forfeit stolen assets, victims may petition for remission under 28 C.F.R. Part 9, and the Justice Department has returned more than $13 billion in forfeited assets to victims since 2000 [7].

Remission requires proof of a specific loss, that it resulted directly from the crime, and that the victim does “not have other recourse reasonably available” [8]. There is no fee to petition; as the Justice Department puts it, “If you are asked to pay a fee, it is fraud” [7].

The honest caveat: with 181,565 crypto complaints in a single year, no individual case is assured an investigation. Agents look for patterns that lead to arrests and large seizures, not for individual refunds. A well-built referral with a clean chronology, preserved evidence and tracing that connects to a known cluster raises the odds. A $100,000 report in a drawer does not.

What actually works: find the perpetrators, then the liable party

The first realistic goal is not the coins; it is the people. Many of the highest-profile crypto thefts were committed from inside the United States, where arrests, seizures and restitution orders are possible.

Federal prosecutors have charged a racketeering enterprise that stole more than $263 million in cryptocurrency, with several defendants arrested in California [11]; a Florida defendant in a $20 million SIM-swap theft was ordered to pay $20,379,007 in restitution to the victim [12]; and the Justice Department has pursued civil forfeiture of more than $5 million in bitcoin traced from five SIM-swap victims’ wallets [13].

None of those outcomes came from a private tracing report sitting with the victim. They came from an agency that decided to investigate. The best outcome you can engineer in the first weeks is a case referral, built by people who know how agents evaluate a file, to an enforcement agency that is interested in your facts.

The second path is civil: holding accountable the intermediary whose failure made the theft possible.

Phone carriers have a statutory duty under Section 222 of the Communications Act to protect customer information, and the FCC has said that a carrier’s failure to reasonably protect it, “including through fraudulent SIM swap schemes, can independently violate the law” [9].

Since 2024, wireless providers must use secure authentication before any SIM change or port-out and must notify customers immediately when one is requested [10].

Exchanges owe duties under their own terms and security representations and must freeze accounts in response to legal process [4].

Banks that moved the fiat legs have their own obligations. These claims are typically arbitrated before the AAA or JAMS under the intermediary’s own clause and turn on the record: authentication logs, account-change notices, support transcripts and internal controls.

That is where cybercrime arbitration experience earns the fee, and where the defendant has assets to pay an award.

A pattern to watch: the Lenovo ID and Dropbox breach

The liable party is not always one you have a contract with.

Between August 4 and August 21, 2026, roughly 5,000 Dropbox accounts were opened without a password being guessed.

According to Dropbox’s notice to affected users, an issue with Lenovo’s email verification process allowed an unauthorized party to register a Lenovo ID using the victim’s email address and then use that Lenovo ID, through a legacy login integration, to sign into the Dropbox account tied to that address.

Many of those account holders had never been Lenovo customers. For anyone who kept a seed phrase, wallet backup or exchange recovery code in cloud storage, that was a crypto theft event, not a privacy event.

Under New York law, a company owes no general tort duty to people it has no contract with, but the Court of Appeals recognizes an exception “where the contracting party unreasonably launches a force or instrument of harm,” which applies where a defendant’s conduct affirmatively creates or exacerbates a dangerous condition rather than merely failing to prevent one [14].

On the facts described in the notice, that is the argument: a defective authentication and login integration did not just fail to stop an existing threat, it built a new, open door that attackers walked through to bypass ordinary account protections.

That is the kind of fact pattern we look for in every crypto theft matter: a party, contractual or not, whose negligently designed safeguard or procedure created the pathway.

Expect more of these. On June 22, 2026, the heads of the Five Eyes cyber security agencies, including the NSA, warned that frontier AI models will fundamentally transform offensive cyber capabilities and that “The timeline is not years, it is months” [15].

Six weeks later a legacy identity integration was being used at scale. AI-driven attacks will find more doors like this one, and the companies that built them will be the recoverable parties.

The first 72 hours

File an IC3 complaint at ic3.gov with every receiving cryptocurrency address, transaction hash, date and amount; the FBI asks for exactly that data [5].

Send written notice to any exchange the funds touched, demanding a freeze and preservation of records.

If a phone number was hijacked, demand the carrier’s SIM-change and authentication records in writing.

Preserve the compromised device as is, and do not move remaining assets from it. Do not pay anyone who contacted you first; law enforcement “does not charge victims a fee for investigating crimes” [4]. Then get an independent assessment of whether a liable intermediary exists before you commit to anything else.

This article is for general informational purposes only and does not constitute legal advice. Recovery outcomes depend on the facts of each matter and no result is guaranteed. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Prior results do not guarantee a similar outcome. Attorney Advertising.