How to verify a crypto recovery company is legitimate

The same Google queries that find real investigators also find professional-looking fraud. Use this framework before you send money or keys. See also our FAQ and romance scam dynamics—because “recovery” can be round two of the same playbook.

Start with identity, not vibes

Confirm you are on the firm’s real domain—type it manually or use a bookmark—not a link from a DM. Search the company name plus “scam” and read both organic results and forum threads with skepticism (competitors smear each other; victims sometimes mislabel). Where available, verify corporate registration and how long the domain has been registered. New domains plus aggressive ads are a higher-risk signal, though not dispositive alone.

Written scope beats verbal promises

Ask for a plain-language statement of work: what artifacts you receive (for example a labeled flow diagram, address list, narrative report), how many analyst hours are included, what chains are in scope, and what happens if tracing hits a dead end. Be wary of unlimited “we’ll keep trying” retainers with no milestones. Honest operators explain that recovery depends on third parties—exchanges, courts, law enforcement—not on charisma.

Seed phrases and remote access

Standard blockchain tracing for theft from a hot wallet does not require your mnemonic. If a vendor insists on a full seed up front, or AnyDesk-style remote control of your PC, pause. Wallet-access consulting is a different service line with different procedures; it should still avoid clownish security practices. Our wallet access guide outlines safer patterns.

Payment structure and refunds

Understand whether fees are hourly, fixed per phase, or contingent on recovery (contingency is rare in tracing because outcomes are uncertain). Get invoices and contracts in writing. Anyone who demands additional crypto to “unlock” a previous loss is almost always fraudulent—see first 24 hours for context.

Technical smell tests

Ask how they handle mixer exposure, bridge hops, and privacy pools. Superficial answers or guarantees of “full recovery” across any chain are red flags. Credible teams describe limitations and cite how their reports have been used with counsel or exchanges before. When you are ready, request an intake with VaultTrace Recovery and compare our answers to this checklist.