📊 Crypto Clarity Weekly
Wednesday, September 30, 2026 · Security Update · Free for Everyone
| Threat Level HIGH The Second Hit | Attack Class Recovery Scam Revictimization | The Damage $1.4B 2025 Losses | Best Defense Never Pay First No Fee to Recover |
🚨 Recovery Scams: The Second Theft
Week 40 · Security Update · Special Free Edition
The market kept drifting lower. Bitcoin slipped to about $83,272, down roughly 4% on the week, with Ethereum near $2,671 and Solana about flat at $119. Fear & Greed eased to 67, still in Greed but cooling from last week's highs. A softer, sideways market matters for today's threat, because recovery scams do not chase euphoria. They feed on the aftermath: the people who already lost money in a downturn, a hack, or a scam, and who are desperate to get it back. That desperation is the vulnerability, and an entire industry is built to exploit it.
🔍 Following On From Monday
Monday we covered airdrops and the drainer that empties a wallet in a single signature. Today is the cruelest sequel: the scam that targets people who have already been drained. If Monday was about avoiding the first theft, this is about recognizing the second one, the con that arrives dressed up as your rescue.
⚠ Threat Brief
You lost crypto to a scam, a hack, or a collapsed platform. Weeks later, someone reaches out: a firm that "specializes in recovering stolen crypto," an investigator who says they "traced your funds," sometimes a person claiming to be from the FBI or IC3. They know real details about your loss, because in many cases the victim list was resold, or because they are the very people who took your money the first time. They promise to get it back. All they need is an upfront fee, a "tax," or your wallet details. Pay it and they vanish, or they invent a new fee, and then another. There is no recovery. There was never going to be.
🚨 When the Rescue Is the Robbery
How Recovery Scams Work, and the One Rule That Ends Them
Recovery fraud is one of the fastest-growing corners of crypto crime, and one of the most heartless, because every target is already a victim. In 2025 alone, the FBI's Internet Crime Complaint Center logged more than 10,500 recovery-scam complaints and roughly $1.4 billion in reported losses. The reason it works is simple: it does not need to find fresh, trusting people. It goes back to the ones who have already been hurt and are willing to try anything.
Who They Pretend to Be
The costume is always authority. They pose as blockchain investigators or "asset recovery" firms with official-looking websites. They pose as law firms taking a class action. Most brazenly, they impersonate the very agencies you would turn to for help, the FBI or the IC3, complete with badge numbers and case files. Some even build fake versions of the real IC3 site. The whole point of the disguise is to borrow the trust you place in law enforcement and turn it against you.
How They Find You
Victim lists are a commodity. After a scam, contact details and loss amounts get bought and sold among criminal groups, so a fresh victim is a warm lead worth money. Sometimes it is even simpler: the original scammers keep your information and circle back themselves, now playing the hero instead of the thief. And they trawl the obvious places, the comment sections of scam-warning videos, crypto-loss forums, and social media, looking for anyone publicly describing a loss. If you have posted "I got scammed, can anyone help," you have raised your hand.
The One Rule That Ends It
Here is the line that cuts through all of it: no legitimate law enforcement agency ever charges you a fee to recover stolen money. The IC3 has no social media accounts, does not contact victims through messaging apps, and never asks for payment. Real investigators do not take a cut, do not need a "release tax," and do not ask you to move funds to a "secure wallet" they control. So the moment anyone asks for money upfront to get your crypto back, you already have your answer. The request for a fee is not a step in the process. It is the entire scam.
🛡 If You Have Been Hit, or Are Being Targeted
Five steps that keep a first loss from becoming a second one.
| 1 | Treat every unsolicited recovery offer as a scam. If someone reaches out promising to get your funds back, that is the tell. Do not engage, do not share wallet details, do not click their links. |
| 2 | Never pay an upfront fee. No fee, no tax, no deposit, no "gas to release the funds." Real recovery never starts with you sending money. This single rule stops almost every version of the scam. |
| 3 | Go to the real agencies yourself. Report at ic3.gov by typing the address in yourself, and to local police. These channels are free. Anyone charging to do this for you is the second scam. |
| 4 | Document everything. Dates, amounts, wallet addresses, transaction hashes, and every message. A clear record is what actually helps investigators, and it costs nothing to keep. |
| 5 | Assume they will come back. If you were scammed once, your details are circulating. Expect a "recovery" pitch, and be ready to recognize it for what it is before it lands. |
⚠ Yield Trap of the Week · Red Flag: A Stablecoin That Isn't Stable
msUSD / USDC on Aerodrome: 188% in rewards
On the surface this is the safest thing in DeFi: a pool of two dollar-stablecoins, paying about 188% in rewards on top of roughly 22% in swap fees, with around $1.6 million sitting in it. Two dollars, a triple-digit yield. What could go wrong.
This: msUSD is supposed to be worth $1.00. As of Tuesday night it was trading at about $0.885, down more than 11%. A dollar-pegged coin sitting at 88 cents is not stable, it is slipping, and the pool has to dangle a 188% reward, paid in AERO, just to convince anyone to provide liquidity against it. That yield is not a gift, it is hazard pay. The reward is the market telling you, out loud, that the risk is real.
I pulled every pool on Base and Arbitrum paying over 40% with at least $1 million in it. This week there were 51.
Before I look at any yield, I ask three questions. Is every coin in the pool actually holding its value? How much of the pool is really earning the headline rate? And what am I being paid in? If I cannot answer all three, the APY does not matter.
vfat is an affiliate partner. If you use my link I may earn a commission at no cost to you. I only partner with tools I actually use, and this is not a recommendation to enter any specific pool.
📗 The Real Next Step Is Free
If you have lost crypto, the constructive move is not a recovery service, it is a well-documented police report and an IC3 filing, both free. Our guide walks through exactly what to include so your report actually gives investigators something to work with.
Read: What to Put in a Crypto Scam Police Report →Starting next Wednesday: a new format
This week's Security Update is free for everyone. Starting October 7, every Wednesday issue opens with the week's biggest threat and one yield trap, free for all subscribers. The full breakdown, the step-by-step checklist, and the pools that pass my checks are for Premium members.
Premium also includes unlimited DeFi Scanner and Satoshi Shield scans, Friday's DeFi Deep Dive with my real portfolio, Monthly AMA's, and the 12 Red Flags course.
$4.95 your first month, then $9/month, cancel anytime.
📋 From David's Desk
Recovery scams make me angrier than almost anything else I cover, because they are engineered to hit people at their lowest. Someone has already lost money, they feel ashamed, they are desperate, and right on cue a voice appears promising to make it right. So let me say this as plainly as I can: nobody who charges you a fee upfront is going to recover your crypto. Not a firm, not an investigator, not anyone flashing a badge. The real agencies do not work that way and do not charge. The rescue that asks for money first is just the robbery, running a second time.
On the market: a softer week, Bitcoin back around $83K and Fear & Greed easing to 67. HYPE took the hardest knock of my positions, down about 12% on the week to roughly $86, but it is still comfortably above where I entered, so it stays exactly where it is: untouched, trim levels written, and firmly in the do-not-add zone. And the new Yield Trap segment above is the scanner logic I run every week, now pointed at live pools so you get the verdict without touching a tool.
One more thing. This issue is free for everyone on purpose. Wednesday changes next week, and I wanted you to hold a full one in your hands first, so the new format feels like an invitation, not a wall.
📅 What's Coming Friday
Friday (Premium, DeFi Deep Dive): EtherFi and liquid restaking, one of the biggest corners of DeFi, and exactly what you are trusting when you stake through it. Plus the weekly portfolio scorecard.
Has someone offered to recover crypto you lost? Forward the message before you reply to anyone. I will tell you what I see, and I will never charge you a cent for it. It reaches [email protected], and I read every one.
📗 Safe DeFi: Your First 90 Days · Website · Blog · 📺 YouTube · 📷 Instagram · [email protected]
Crypto Clarity Weekly is educational content only and does not constitute financial or investment advice. Always do your own research before investing.
You're receiving this special edition free. Want every Wednesday and Friday? Go Premium here. · Unsubscribe