Victims of a cryptocurrency theft or scam are unusually easy to target a second time, and the people running upfront fee recovery scams know this. The victim is already anxious, already searching for help, and already primed to trust anyone who claims to understand blockchain tracing.
How the approach usually starts
Contact often comes unprompted, through a comment on a public post about the original theft, a direct message, or a cold email referencing details that make the sender sound informed. The pitch is a fast, near guaranteed recovery, contingent on a payment made before any actual work begins.
Why the fee structure itself is the tell
Legitimate investigative work is billed for the analysis actually performed, not offered as a guaranteed percentage of funds that have not yet been recovered. No investigator, regardless of skill, can promise a specific recovery outcome, because blockchain transactions cannot be reversed by anyone, including the platforms the funds passed through.
A request for payment before any documented analysis has taken place, from someone who contacted you rather than the reverse, is close to a guaranteed sign of this scam, regardless of how credible the outreach sounds.
What to do if you are contacted this way
Verify the identity of anyone offering recovery services independently, through channels you find yourself rather than ones they provide. Do not send any additional cryptocurrency, and treat urgency, a claimed narrow window to act, as a pressure tactic rather than a genuine constraint.