Crypto fraud: what to do now, and why your data comes first

Something is gone. Coins that are no longer in the wallet. A platform that no longer responds. Or someone you trusted can no longer be reached.

You are not alone in this. In the practice of Robert and Johannes, more than 600 cases since 2021, a link to fraud shows up in roughly two to three out of ten data sets. Above all in old histories.

This article tells you what to do now, what to secure and what your data can show. It does not tell you whether you will get your money back. Nobody can honestly tell you that in advance.

01 What you should do right now

1. Stop paying. No “fee”, no “tax”, no “unlock” so that a payout supposedly comes through. The police explicitly advise against making any further payments.
2. Revoke open approvals. If you connected your wallet to a website and confirmed something: check your approvals with revoke.cash or Etherscan’s Token Approval Checker and revoke anything you do not recognize. This prevents further outflows through that approval. It does not bring back what is already gone.
3. Gave away your seed phrase? Abandon the wallet. Then revoking does not help. Whatever is still there goes to a new wallet, and you stop using the affected addresses.
4. Inform your bank if money was sent by bank transfer or card.
5. Secure everything while you still have access. Screenshots of the platform, chats and emails, transaction hashes, wallet addresses. Plus the CSV exports of every exchange you have used, covering the entire period, not just the current year.
6. File a police report at any police station or online via the internet police station (Internetwache) of your federal state. In Austria you file a report at any police station (Polizeiinspektion) and can additionally report fraudulent websites to Watchlist Internet.
7. No “recovery” offers with upfront payment. They get in touch unsolicited, call themselves a law firm, an agency or an authority and want a fee before the payout. Watchlist Internet calls such an upfront fee an unmistakable sign of criminal intent, and the Verbraucherzentrale (German consumer advice center) knows of no case in which money came back that way. Anyone who wants money upfront for the recovery is not legitimate, even if they pose as an authority, for example as BaFin.

The police report does not wait for the data preparation. Securing and reporting come first, putting things in order comes after.

02 Why your data is the foundation for everything that follows

Police, lawyers, forensic specialists and tax advisors all end up asking you the same basic question: What went from which of your addresses, when, in what amount, and where to?

Sounds simple. Rarely is. Crypto data is typically scattered and incomplete across many platforms. Often forgotten: the first exchange, a hardware wallet, a chain. Clients often say “that was only on my Ledger”. But the hardware wallet belongs in the data just as much as the exchange.

This leads to the sentence this article revolves around:

As long as one of your own sources is missing, any unexplained outgoing transaction may also be a transfer to yourself. The tax tool then shows it as an unpaired entry, and the cause is usually simple: the other side has not been imported. Only once everything is in and the outgoing transaction still stands alone does it become a reliable statement: here, something went to a third-party address.

03 Three patterns we see in crypto data

1. The project that later turned out to be a scam

You bought a token, put money into a protocol, took part in a pool. Later the project is dead, the token worthless, the people behind it gone.

In the data, this is not an outgoing transaction to a stranger. These are real transactions: you swapped, deposited, paid. And that is exactly why they belong in the documentation.

The common trap: the token gets marked as spam in the tool because you no longer want to see it. As a result, all transactions involving this token drop out of the calculation, including the swap you used to buy it. The balance then deviates in places that seemingly have nothing to do with the token.

These need to be kept apart from scam tokens that were sent to you unsolicited. They often carry the ticker of a real asset, such as “USDC”. A tool that identifies assets by their ticker then values them at the real market price, and absurd values appear. Whether real or fake is decided by the contract in the block explorer. The fix: mark the contract as scam or rename the ticker, for example to “USDC-SCAM”.

The rule of thumb: What you paid for stays in. What was sent to you unsolicited goes out.

2. Phishing: the confirmation that allows more than you thought

An email, a link, a website that looks like the real one. You connect your wallet and confirm something.

Often this is an approval: it allows a smart contract to move tokens out of your wallet, without you confirming each individual movement again. If the limit is unlimited, the contract can empty the wallet. For this, the attacker needs neither your seed phrase nor your private key, only your confirmation. Tools that exploit exactly this in an automated way are called drainers.

Particularly insidious are permit signatures: the approval is signed outside the blockchain. It looks as if you were just logging in to a website, and the usual wallet warnings are missing.

What this means for your data: with a classic approval, the approval itself appears on-chain as a separate transaction in the block explorer. With a permit signature, it does not. It only appears on-chain when the attacker redeems it, often immediately before or together with the drain. In the tax tool, a drainer outflow looks unremarkable: a completely normal withdrawal to an address the tool does not know. Nothing in the tool tells you it was theft. You only recognize that once all of your own addresses are in the data and this one is left over.

And beware in the other direction: not every outgoing transaction in the tool is real. After genuine transfers, attackers send fake token transfers of the same amount to lookalike addresses that look like real ones at the beginning and the end, including your own. A wallet import can take them over as a real “USDC” or “ETH” withdrawal. Then it looks like more was lost than actually happened, with negative balances in the amount of the fake transfers. Here too, the contract decides.

3. The trusted person who “trades for you”

The following example is constructed. The pattern is not.

Let’s call him Max. An acquaintance recommended him, he supposedly trades successfully and does it for others too. Over ten months you send him coins in several tranches, partly directly from the exchange, partly from your hardware wallet. At first he sends screenshots showing profits. At some point he can no longer be reached.

In the data, it looks like this:

• Several withdrawals to the same address, which does not appear in any of your sources.
• Never a return flow. No profits arriving in any of your wallets or exchanges.
• For the exchange withdrawals, the export usually contains the transaction hash or the destination address. This generally makes it possible to match the tranche unambiguously.

The screenshots say “profit”. Your data says “outflows only”. This contradiction is not an assessment, it is a finding. And that is exactly what you need before anyone else takes it further.

04 What to collect for the documentation

Your side

• A list of all exchanges, wallets and DeFi protocols you have ever used. Including closed exchanges, including the hardware wallet.
• All wallet addresses, each with its chain.
• CSV exports covering the entire period. For closed exchanges, a data access request under Art. 15 GDPR.
• Bank and credit card statements of your euro deposits. Acquisitions can often be restored quite precisely from these.

For each suspicious outgoing transaction

• Date
• Coin and amount
• Euro value at the time of the transaction
• Destination address
• Transaction hash

The context

• Website address and email in the case of phishing, with screenshots
• Chats, promises and payment receipts in the case of a trusted person

And if something cannot be clarified: leave the gap open and note what you know. A commented gap is better than a plausible entry that nobody can prove.

05 And in the tax tool?

A stolen or lost outgoing transaction has to be booked in the tool somehow, and the label determines how it appears in the report. CoinTracking has its own transaction type “Lost” for lost or stolen coins. An outflow booked as tax-free removes the coins from the entire portfolio in all the tools we work with, technically like a withdrawal.

How the loss is to be treated for tax purposes is something you clarify with your tax advisor. TX-Partner is not a tax advisory firm. We provide the data basis on which this decision is made.

06 Where the documentation ends

Your data reaches as far as your last address of your own. Up to that point, it can be shown what went out and where to.

Who is behind the destination address and where the coins went afterwards is answered by forensic specialists, for example AQ Forensics.

Legal steps belong with a lawyer. The investigation with the police.

07 How we help you

We prepare your crypto data: every source that can be obtained goes into the tool, reconciled against the blockchain, every outgoing transaction with date, amount, euro value, destination address and hash. Whatever cannot be clarified stays open and commented. With that, you go to the police, a lawyer, forensic specialists or your tax advisor.

We look at your case before we make you an offer. The costs are fixed before you place the order.

More about the service: Crypto data preparation at a fixed price. How a history with gaps is technically restored: Reconstructing crypto history.