“Stolen cryptocurrency can be recovered when it is traced to a regulated business, frozen there, and pursued through legal process, but recovery is never guaranteed and the odds fall with every day of delay.”
By Brandon Orewyler | July 2026
Americans reported $9.3 billion in cryptocurrency fraud losses to the FBI in 2024, across 149,686 complaints, part of a record $16.6 billion in total reported fraud losses.1 Behind those numbers is a question I hear regularly, because I represent investors recovering assets lost to crypto fraud: the money is gone, the platform has stopped processing withdrawals, and can you actually recover stolen cryptocurrency?
The honest answer is sometimes, and whether you can turns far more on speed and on where the funds move than on any legal theory. Stolen crypto is functionally unreachable while it hops wallet to wallet; it becomes recoverable at the moments it touches a business that answers to courts, and those moments pass quickly.
This guide covers the recovery problem end to end: why speed decides these cases, how tracing converts a wallet address into a defendant and a frozen account, which California claims add real value (one can triple your damages), how the three recovery lanes compare, and how to avoid the scams that target victims twice.
Key Takeaways
- Speed decides more than legal theory. Stolen crypto is freezable while it sits at a regulated off-ramp, and thieves move it through in hours or days.2
- The freeze reaches the account, not the coin. Every freeze remedy targets the custodial balance at the regulated business where the thief cashed out; self-custodied funds stay out of reach until they move.
- California law adds real teeth. Penal Code section 496(c) allows treble damages and attorney’s fees where property was “obtained in any manner constituting theft.”34
- The FBI lane and the civil lane are complements, not substitutes. File the IC3 complaint immediately and pursue the civil case you control; each reaches things the other cannot.2
- Guaranteed recovery is the second scam. Anyone promising your crypto back, asking for keys, or charging an upfront percentage is a fraud; California’s DFPI tracks the category by name.5
Can You Recover Stolen Cryptocurrency?
Sometimes. Stolen cryptocurrency can be recovered when it is traced to a regulated business, frozen there, and pursued through legal process, but recovery is never guaranteed and the odds fall with every day of delay.
Blockchains are public ledgers, so stolen funds can usually be followed through intermediate hops. But following is not recovering: on chain, no court order stops the next transfer. The recovery window opens where the thief needs the regulated world to cash out, because at that point there is an account, a balance, and a business with a legal department. Understand precisely what a freeze reaches: not the coins in the thief’s wallet, but the balance (often already converted to fiat) at the off-ramp where the thief landed. If the thief cashed out and dispersed first, the freeze arrives at an empty account, and the case becomes a slower fight against whatever people and assets can still be identified.
If your funds moved to an identifiable exchange account, you may have a live recovery window; it is measured in days, not months.
Why Does Speed Decide Crypto Recovery?
Because stolen crypto is only freezable while it sits at a regulated off-ramp, and thieves move it through in hours or days, every recovery tool works dramatically better in the first week than in the first quarter.
The FBI’s Recovery Asset Team, working through what the Bureau calls the Financial Fraud Kill Chain, moves to freeze fraudulent transfers when victims report quickly: in 2024 it handled 3,020 complaints involving $848.4 million in attempted theft and reported a 66% overall success rate across the kill chain, freezing $469.1 million domestically.2 Read the figure carefully: it measures freezes on rapidly reported, traceable transfers (mostly business email compromise wires), not recovery of all fraud losses, and a freeze is the beginning of getting money back, not the end. What it proves is that the system rewards immediate reporting.
“The victims who recover something are almost always the ones who moved within days.”—Brandon Orewyler, Principal, Astraea Counsel
The same clock governs the civil side: an exchange compliance desk can place an administrative hold in days when tracing shows stolen funds on its platform, and a court can freeze traced assets on an emergency application, but both require knowing where the funds are while they are still there. (If your loss came from a protocol hack rather than a fraud on you personally, the firm’s incident-response playbook for crypto hacks walks that lane; this guide is for the defrauded investor.)
Report to IC3 and start tracing the day you discover the theft; every recovery path below weakens by the week.
How Do You Trace Stolen Crypto and Identify Who Took It?
Tracing follows your funds across the public ledger to a deposit address at a custodial business, and legal process then converts that address into an identity and an account snapshot.
The sequence is standard. Forensic tracing carries your transfers through intermediate wallets to an exchange deposit address. You then file suit, naming the thief as a Doe defendant by wallet address if necessary, and subpoena the exchange for the know-your-customer file behind that address; courts commonly authorize this expedited discovery for unidentified online defendants, and the identification half (naming, serving, jurisdiction) is covered in the firm’s guide to suing offshore and anonymous defendants. What that guide leaves for this one is the recovery function of the same subpoena: the exchange’s response is not just a name but the account’s history and balance, showing whether your funds are still there to freeze and where the rest went. Treat the KYC subpoena as an asset-location tool that happens to also name the defendant.
The KYC subpoena is your asset map: it tells you who took the funds and whether anything is left to freeze.
What Legal Claims Recover Stolen Crypto in California?
California plaintiffs pursuing stolen crypto typically combine conversion, fraud, and unjust enrichment with two higher-leverage tools: a treble-damages claim under Penal Code section 496(c) and a constructive trust over the traced funds.
Start with the claim most victims have never heard of. Penal Code section 496, the receiving-stolen-property statute, carries a civil remedy: an injured person may sue for “three times the amount of actual damages, if any, sustained by the plaintiff, costs of suit, and reasonable attorney’s fees.”3 In Siry Investment, L.P. v. Farkhondehpour (2022), the California Supreme Court held the remedy is not limited to trafficking in stolen goods: “A plaintiff may recover treble damages and attorney’s fees under section 496(c) when property has been obtained in any manner constituting theft,” including fraudulent diversion of funds.4 Where a crypto fraud fits that description and the statute’s elements (including the defendant’s knowledge) can be proven, section 496(c) turns a compensatory case into a treble-damages case with fee-shifting.
The constructive trust is the tracing remedy. A constructive trust is an equitable remedy that treats the wrongdoer as holding your property for your benefit, and it follows the property into whatever form it took. California codifies it: one “who gains a thing by fraud … or other wrongful act” is “an involuntary trustee of the thing gained, for the benefit of the person who would otherwise have had it.”6 In crypto cases it supports freezing specifically traced assets rather than chasing a bare money judgment, and it aims your claim at your funds and their proceeds rather than a general creditor’s place in line. Conversion, fraud, and unjust enrichment round out the standard complaint.
Two federal notes. Where the theft involved unauthorized access to your computer, wallet, or account (wallet-drainer attacks, SIM swaps), the Computer Fraud and Abuse Act adds a civil action with a short fuse: suit must be brought “within 2 years of the date of the act complained of or the date of the discovery of the damage.”7 And where the fraud was an investment scheme built on a token sale, securities claims may sit alongside everything above; the firm’s guide to private crypto litigation when the SEC won’t act maps that menu.
If your loss traces to conduct a prosecutor would call theft, have counsel assess section 496(c) before you settle for compensatory framing.
Should You Sue, Go to Law Enforcement, or File a Bankruptcy Claim?
File the free IC3 report immediately in every case; add a civil action when the amount justifies it and tracing gives it a target; and when the platform holding your assets has failed, the fight becomes a bankruptcy claim on its own clock.
| Path | Typical speed | Cost to you | What it can reach | Honest limits |
|---|---|---|---|---|
| Civil action + freeze (exchange holds, TRO, KYC subpoenas) | Days to weeks for freezes; years to judgment | Highest (section 496(c) can shift fees)3 | Traced custodial balances; defendants’ assets; treble damages; discovery you control | Needs a trace to an off-ramp or an identified defendant; self-custodied funds stay out of reach |
| Law enforcement (IC3 / FBI, state regulators) | Freezes in days when reported fast; seizure and return often years | Free | Kill-chain freezes; criminal seizure and forfeiture; restitution | One complaint among 859,532 filed in 2024;1 no control and no guarantee your case is worked |
| Bankruptcy claim (failed exchange or platform) | Years | Low to moderate | A pro-rata distribution from the estate | Often a fraction of the crypto’s current value: claims are typically converted to dollars at the petition date, so even a full-payout plan can badly lag the appreciated coin; timing set by the court |
Read the table as a sequence, not a menu. The IC3 complaint costs nothing and can trigger the kill-chain freeze while your civil papers are being drafted, so it goes first. The civil action is the only lane you control and the only one that can produce treble damages, but it is real litigation, and it makes economic sense in proportion to the amount stolen and the quality of the trace. The bankruptcy lane is not a choice; it is what happens when the platform holding your assets fails, and its strategy is covered in the firm’s analysis of what FTX taught crypto creditors.
File the free IC3 complaint immediately; sue when the trace and the amount justify it; the bankruptcy lane is inherited, not chosen.
Can You Reach an Offshore Crypto Scammer From California?
Increasingly, yes. Foreign incorporation no longer defeats California jurisdiction by itself; after the Ninth Circuit’s 2025 en banc decision in Briskin v. Shopify, a platform’s deliberate dealings with users it knows are in California count toward jurisdiction.8
The Ninth Circuit has already applied that rule to a foreign crypto platform. In Freeman v. 3Commas Technologies OÜ (March 2026), a panel reversed the personal-jurisdiction dismissal of California claims against an Estonian crypto-trading software company that, on the record, “knows about its California consumer base, conducts its regular business in California, contacts California residents, [and] interacts with them as an intermediary” for crypto trades.9 Read it for what it is: an unpublished memorandum disposition, non-precedential under Ninth Circuit Rule 36-3, decided in a data-breach posture rather than a fraud case, over a dissent by Judge Miller. It illustrates where Briskin points for offshore crypto platforms; it is not controlling authority. The doctrine is mapped in the firm’s post-Briskin jurisdiction analysis.
I litigate this question. In Gelasio v. Zafar, an appeal I briefed and argued, the Ninth Circuit unanimously reversed the dismissal of a California investor’s claims (allegations the defendants dispute and that remain to be proven) against a UK-resident founder and a Hong Kong entity for lack of personal jurisdiction; the case is now back before the district court on remand, with an amended complaint in progress.10 A jurisdictional win is the door, not the recovery, but it converts an “unreachable” offshore counterparty into a defendant.
One more cross-border tool belongs in the kit: 28 U.S.C. section 1782, under which a U.S. district court may order a person who “resides or is found” in its district to produce documents or testimony “for use in a proceeding in a foreign or international tribunal.”11 Where recovery litigation runs abroad, section 1782 reaches the U.S.-held records (exchange files, analytics, service-provider data) that close the gap between where the fraud happened and where the evidence sits.
If your counterparty knew it was dealing with a Californian, have the jurisdictional theory assessed before writing the claim off.
What Is California Doing About Crypto Scams?
California runs a two-agency enforcement effort: the Department of Financial Protection and Innovation (DFPI) operates a public Crypto Scam Tracker built from consumer complaints, and the Department of Justice shuts down fraudulent crypto websites.
The numbers, attributed to the agency that reported each: DFPI announced in March 2025 that its tracker and a new DOJ partnership had shut down more than 26 crypto scam websites and uncovered $4.6 million in consumer losses, drawn from more than 2,668 complaints submitted in 2024, alongside seven newly identified scam types.12 The California DOJ’s same-day release reported its own broader 2024 total: 42 fraudulent cryptocurrency websites shut down, at least $6.5 million in victim losses, and an average loss of $146,306 per victim.13 The tracker itself listed 604 complaint entries as of June 2026, searchable by company name and scam type, with a glossary that is a working taxonomy of current fraud patterns, from pig-butchering schemes (relationship-based investment fraud run through fake trading platforms) to imposter sites mimicking legitimate exchanges.5
Use the state apparatus for what it does well: check the tracker, and report to DFPI (dfpi.ca.gov/submit-a-complaint) and the California DOJ (oag.ca.gov/report) as well as IC3, because complaint data drives the takedowns. But a takedown ends the scam’s forward operation; it does not return your money. Recovery remains a private project run through the tools in this guide.
Report to the DFPI, the California DOJ, and IC3 to fuel takedowns, but expect recovery to come from your own civil case.
How Do You Spot a Crypto Recovery Scam?
Anyone who guarantees recovery of stolen cryptocurrency, asks for your private keys or seed phrase, or demands an upfront fee or a percentage of the amount to be “recovered” is running a second scam aimed at people already victimized once.
The category is common enough that California’s DFPI defines it in its scam glossary: an asset recovery scam is a “[s]cam by a third party requiring a fee to ‘recover’ funds lost in a prior fraudulent transaction,” and the DFPI Commissioner’s public warning urges consumers to “stay wary of crypto recovery scam sites.”512 In the matters that reach my desk, the recovery pitch often arrives within days of the original theft, because scammers mine victim lists for people who are desperate and primed to believe.
The tells are consistent. Legitimate counsel will tell you recovery is uncertain; the scam guarantees it. Legitimate recovery never requires your private keys or seed phrase; the scam always finds a reason to ask. Legitimate professionals bill for work performed or take a documented contingency; the scam wants an upfront “processing” fee, often payable in crypto. And a real lawyer is verifiable in thirty seconds on the California State Bar’s license lookup. Nothing in this guide promises recovery, and that is the point; be suspicious of anyone whose pitch does.
If a “recovery service” guarantees results, wants your keys, or charges a percentage upfront, walk away and report it to DFPI.
When to Bring in Counsel
The highest-leverage window is the first days after discovery: the tracing, the freeze targets, the IC3 referral, and the claim strategy all work better run together, and all of them decay with time. If you have lost substantial assets to a crypto fraud, the questions in this guide (where the funds went, what is freezable, whether the counterparty is reachable) are answerable on your facts, usually quickly, and the assessment costs far less than a month of waiting.
Related Resources
- Crypto Exchange Subpoenas: How to Get the Records, and How to Fight One
- Crypto Asset Forfeiture in California: How Owners Fight Back
- Your Protocol Just Got Hacked: The First 72 Hours
- How to Sue an Offshore, Foreign, or Anonymous Defendant in California
- The Borderless-Internet Defense Just Died in the Ninth Circuit
- Crypto Bankruptcy: Recovering Assets After FTX
- When the SEC Won’t Act: Private Crypto Litigation
- What Happens When a Stablecoin Payment Goes Wrong?
This article provides general information for educational purposes only and does not constitute legal advice. Asset-recovery outcomes depend on the facts of each case, and no result is guaranteed. Consult qualified legal counsel for advice on your specific situation. Attorney Advertising.
- Crypto litigation attorney—token, exchange, and digital-asset disputes
Footnotes
-
Federal Bureau of Investigation, Internet Crime Complaint Center, 2024 Internet Crime Report (2025) (859,532 complaints and $16.6 billion in reported losses overall; 149,686 complaints referencing cryptocurrency with $9,322,335,911 in losses), available at https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf. ↩ ↩2
-
Federal Bureau of Investigation, Internet Crime Complaint Center, 2024 Internet Crime Report at 13 (2025) (Recovery Asset Team / Financial Fraud Kill Chain 2024 results: 3,020 complaints, $848.4 million in attempted theft, $469.1 million frozen domestically across 2,651 domestic complaints, 66% success rate; most initiated incidents are business email compromise), available at https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf. ↩ ↩2 ↩3
-
Siry Investment, L.P. v. Farkhondehpour, 13 Cal. 5th 333, 361-62 (2022). ↩ ↩2
-
California Department of Financial Protection and Innovation, Crypto Scam Tracker (updated June 9, 2026) (604 complaint-based entries at capture; glossary definitions including “Asset Recovery Scam”), available at https://dfpi.ca.gov/consumers/crypto/crypto-scam-tracker/. ↩ ↩2 ↩3
-
Cal. Civ. Code §§ 2223-2224 (§ 2224: one “who gains a thing by fraud … or other wrongful act, is … an involuntary trustee of the thing gained, for the benefit of the person who would otherwise have had it”). ↩
-
18 U.S.C. § 1030(g) (Computer Fraud and Abuse Act civil action; suit must be brought “within 2 years of the date of the act complained of or the date of the discovery of the damage”; damages for certain violations limited to economic damages). ↩
-
Briskin v. Shopify, Inc., 135 F.4th 739 (9th Cir. 2025) (en banc). ↩
-
Freeman v. 3Commas Technologies OÜ, No. 24-6158 (9th Cir. Mar. 2, 2026) (mem.) (unpublished memorandum disposition, not precedent per 9th Cir. R. 36-3; reversing dismissal of data-breach claims against an Estonian crypto-trading software company for lack of personal jurisdiction; Miller, J., dissenting), available at https://cdn.ca9.uscourts.gov/datastore/memoranda/2026/03/02/24-6158.pdf. ↩
-
Gelasio v. Zafar, No. 24-7277 (9th Cir. Apr. 29, 2026) (mem.) (unpublished memorandum disposition, not precedent per 9th Cir. R. 36-3; reversing dismissal for lack of personal jurisdiction; on remand before the district court). The author briefed and argued the appeal for the plaintiff-appellant. ↩
-
28 U.S.C. § 1782(a). ↩
-
California Department of Financial Protection and Innovation, “DFPI Strengthens Partnership with CA Department of Justice to Stop Crypto Scams and Prevent Consumer Financial Loss” (Mar. 10, 2025) (more than 26 crypto scam websites shut down; $4.6 million in consumer losses uncovered; more than 2,668 complaints in 2024; seven new scam types), available at https://dfpi.ca.gov/press_release/dfpi-strengthens-partnership-with-ca-department-of-justice-to-stop-crypto-scams-and-prevent-consumer-financial-loss/. ↩ ↩2
-
California Department of Justice, Office of the Attorney General, “Attorney General Bonta Protects Californians by Shutting Down 42 Fake Cryptocurrency Websites in 2024” (Mar. 10, 2025) (42 fraudulent websites shut down in 2024; at least $6.5 million in victim losses; average loss per victim of $146,306), available at https://oag.ca.gov/news/press-releases/attorney-general-bonta-protects-californians-shutting-down-42-fake. ↩
