Most crypto fraud doesn’t announce itself. It arrives as a friendly message to the wrong number, a “free” trading signal, a patient new relationship, or a platform that works perfectly right up until you try to take your money out. After hundreds of investigations from our Brooklyn desk, the same handful of signals keep repeating — and once you can read them, they’re hard to un-see.
Below are five of the patterns we trace most often. Each links to a full, case file showing how the scam drew its target in, where the signal broke, and exactly what we were able to recover. The outcomes are mixed on purpose — recovery is real, but it is never guaranteed, and the honest cases teach the most.
1. The “wrong number” that becomes a wealth circle
It starts as a misdirected text and warms into a private group chat full of strangers posting profit screenshots and thanking a “mentor.” Nobody asks you for money — at first. The pressure is social, and the platform only exists at the end of a link shared in the chat. We walked one of these end to end in the Halcyon “Capital Circle” case, where a $74,200 loss met a 20% “clearance fee” at the withdrawal screen.
2. Free signals and the ninety-second dump
A channel gives away accurate-looking “signals,” builds a track record on small safe calls, then steers everyone to buy one thin-liquidity token “all at once.” The insiders sell into your buy order. There’s no withdrawal to block — the loss is a market event they engineered. See the Telegram pump-and-dump case, an honest 22% recovery and the hardest archetype we work.
3. Romance first, “gold-backed forex” second
The relationship comes before the investment by weeks. Then a conservative-sounding product — “allocated gold,” “gold-backed forex” — appears, with small early withdrawals honored to build trust. The fees only arrive when you try to cash out in full. This four-month case blended bank reimbursement and on-chain tracing into a 41% recovery on $128,900.
4. The exchange that won’t let you withdraw
The platform looks real for weeks — order books, an app, instant deposits. The illusion holds until you withdraw in size and a “capital gains tax” or “verification deposit” appears, payable to the platform. Every fee paid reveals another. In the CoinHarbor case, acting within days of the freeze made a 64% recovery possible.
5. The “refund unit” that targets you twice
Months after a loss, a caller who somehow knows the details of your original scam offers to “release” your recovered funds — for a fee. It’s the same network circling back. Real regulators never charge victims to return money. This double-fraud case shows how fast action turned an $18,600 second hit into a 79% recovery.
The signals, in one place
Across every archetype, the same warning lights repeat:
- A new contact who pivots to an investment within days of meeting you.
- Small early withdrawals that “work” — built to manufacture trust before the larger asks.
- A platform you only reach via a shared link, not an app store or established reputation.
- Any fee, tax, or “verification deposit” demanded before your balance can be released.
- Anyone — a partner, a “mentor,” or an “official” body — who knows just enough to feel credible.
▶ The pointThe scam is the easy part to see in hindsight. The trail it leaves on the chain is what we follow forward — and it’s why even partial recovery is often possible.
If you want the detail behind each of these, the full set of investigations lives on our Case Studies page — eight files, eight outcomes, one method.
The eight case files, on record
