Fake overseas blockchain legal firms hire 'hackers' to break into platforms for fund recovery: Hong Kong woman scammed twice, losing 1.5 million

Who Gets Targeted

Victims are mostly ordinary investors who lost tens of thousands to millions in fake cryptocurrency exchanges, 'pig-butchering' scams, or stock recommendation groups. They are typically aged between 25 and 55, have limited knowledge of blockchain and legal procedures, but have heard of concepts like 'on-chain traceability' and 'hacker intrusion.' After being scammed the first time, they are often afraid to tell their families or reluctant to go through formal police reporting procedures, feeling an urgent need to prove they can get their money back. Scammers exploit this shame and anxiety, using promises of 'no recovery, no fee' and fabricated lawyer identities to exert repeated pressure, causing victims to pay more on top of their existing losses, and even borrow money to pay for so-called 'security deposits' and 'hacker commissions.'

骗局怎么运作

• Step 1: Run 'hacker recovery' ads to filter targets. Scam syndicates place ads on search engines, social media, and short-video platforms claiming 'Recover stolen cryptocurrency' or 'Professional hackers help you break into scam platforms to retrieve funds,' leaving WhatsApp or Telegram contact details. The pitch usually emphasizes 'targeting only scam platforms, not illegal' and 'thousands of successful cases,' waiting for victims who have just been scammed and are searching for 'recovery methods' to take the bait.
• Step 2: Impersonate overseas legal firms and lawyers. After the victim makes contact, someone claiming to be an 'overseas blockchain legal consultant' or a 'UK/Hong Kong lawyer' appears, sending electronic business cards with international law firm logos, scans of overseas practicing certificates, and forged screenshots of 'successful recovery cases.' Some versions even send a professional-looking 'Fund Tracking Assessment Report,' claiming that analysis of on-chain addresses has locked the funds, creating a basis for the next round of fees.
• Step 3: Collect the first fee for 'initiating hacker programs.' After gaining basic trust, the scammers demand an initial payment under the guise of 'hiring technicians to attack the platform backend' or 'international legal letter initiation fees,' typically ranging from several thousand to tens of thousands of Hong Kong dollars. They emphasize that 'this is for third-party technical services and will be deducted from the recovered funds upon success,' urging victims to pay within 24 hours before the 'attack window closes.'
• Step 4: Fabricate 'platform breach' progress and engage in serial fee collection. Within days of payment, victims receive forged chat screenshots, platform backend interfaces, or encrypted files claiming 'hacker location successful,' showing the stolen funds have been locked. Scammers then demand further transfers for 'unfreezing deposits,' 'platform firewall dismantling fees,' or 'cross-border judicial coordination fees,' with amounts increasing each time. Different roles—lawyers, hackers, and customer service—may be played by different people to create the illusion that the case is progressing.
• Step 5: Disappear or move to the next round of harvesting. When victims state they have no more money or threaten to call the police, the scam group immediately blocks them, deletes the Telegram account, and takes down the fake website. Some victims, due to their personal information being resold, are soon contacted by another group claiming to be 'professional recovery rights defenders,' falling into the same cycle of exploitation. The victim in the Hong Kong case was first scammed out of her funds in an investment fraud, and then lost a huge additional sum by contacting a fake lawyer to find a 'hacker'.

红旗信号（看到这些快跑）

• 🚩 Claiming 'no recovery, no fee' while demanding an upfront 'hacker service fee,' 'lawyer initiation fee,' or 'investigation fee'—a logical contradiction.
• 🚩 Contacting only via WhatsApp, Telegram, or WeChat, without providing a real office address, company registration number, or a verifiable landline, and refusing video confirmation.
• 🚩 Demanding payment via virtual currency, overseas bank accounts, or private accounts instead of official corporate accounts and compliant invoices.
• 🚩 Sending screenshots or files claiming 'hackers have breached the platform' or 'funds are frozen' without any official channel for verification; URLs and file timestamps are provided unilaterally by the scammers.
• 🚩 Repeatedly demanding 'secrecy,' forbidding victims from consulting police, family, or legitimate lawyers under the pretext of 'avoiding platform detection' or 'lawyer professional risks.'
• 🚩 Creating a sense of urgency, frequently using phrases like 'if you don't pay today, the funds will be transferred by the platform' or 'only a few hours left in the attack window' to force transfers.

真实案例

• A Hong Kong woman, having previously fallen for an online investment scam, saw an ad online claiming she could hire a 'hacker' to attack the scam website and recover her losses. After contacting a fake lawyer, she was repeatedly asked to pay 'service fees,' 'deposits,' and 'administrative fees,' eventually falling for two scams in a row and losing over 1.5 million HKD in total. This case was reported by HKET, warning that recovery-related ads are often serial scams.
• A cross-border telecom fraud group in mainland China disguised themselves as professional 'rights-defending lawyers' to conduct a second round of harvesting on 399 victims who had already been scammed in a separate cryptocurrency fraud. The Beijing Daily app reported this case on March 27, 2026, warning the public that 'rights-defending lawyers' can also be roles played by scam syndicates. (Source: https://news.bjd.com.cn/2026/03/27/11654727.shtml)
• A man who lost millions on an investment platform contacted a so-called rights-defending organization online that called itself a 'recovery master.' The group promised to help recover the funds and demanded a processing fee, resulting in the man being scammed again. The forex rights-protection platform FX110 reported this under the headline 'Precision Strike! Man loses millions, then 'recovery master' comes with a knife,' with personal names anonymized.
• In March 2026, the forex rights-protection platform FX110 reported an attempted secondary cryptocurrency recovery scam: a Taiwanese investor who had lost 1.234 million TWD in crypto due to poor investment decisions sought help from a so-called 'international recovery organization,' nearly getting fleeced again. (Source: https://www.fx110.com/special/14697)

Official Stance

• On March 27, 2026, the Beijing Daily app reported that a cross-border telecom fraud group disguised as professional 'rights-defending lawyers' conducted a second round of harvesting on 399 cryptocurrency victims, calling on the public to be wary of the fraud risks hidden behind 'recovery services.'
• In 2026, the Shanghai Public Security Bureau announced the cracking of a massive cross-border virtual currency underground banking case involving over 20 billion RMB, noting that virtual currency-related crimes are often intertwined with cross-border fund transfers and telecom fraud, making ordinary investors vulnerable to secondary scams. NetEase News reprinted the report.
• In 2026, CCTV Finance exposed a massive cross-border stock recommendation scam, with Gansu police conducting a full-chain crackdown. The report pointed out that scam groups often target the same victim repeatedly, first using stock recommendation scams to induce investment, then conducting secondary harvesting under the guise of 'rights protection' or 'recovery.' Sina News reprinted the CCTV report.
• The National Police of Ukraine recently announced the dismantling of a fake cryptocurrency investment platform scam group, with 62 victims and 46 suspects involved; the fake platform made about 1 million USD in illegal profits per month. BlockTempo reports show that cross-border crypto fraud has become a key focus for law enforcement agencies worldwide, and seeking 'illegal recovery' channels after being victimized carries extremely high risks.

How to Protect Yourself

• ✅ Report the crime immediately via 110 or the National Anti-Fraud Center app; do not contact any third party claiming to offer 'technical recovery.' Formal police reporting and case filing procedures do not charge victims 'hacker service fees' or 'recovery deposits.'
• ✅ Preserve all evidence of the first scam, including platform names, deposit records, chat logs, wallet addresses, and transaction hashes. These materials should be submitted directly to the police or local anti-fraud centers, not to 'lawyers' met online.
• ✅ If someone claims to be a lawyer, ask for their practicing license number from the domestic or target jurisdiction's bar association and verify it independently via the association's official website or phone number. Genuine cross-border legal services will not promise to 'attack scam platforms,' nor will they demand payment in virtual currency.
• ✅ No matter how professional the person sounds, never provide your wallet private keys, mnemonic phrases, or remote computer access. Any request for private keys under the pretext of 'on-chain verification' or 'technical assistance' is essentially an attempt to steal your remaining assets.