Cryptocurrency fraud: what should you do when a platform will not release your money?

If a supposed investment platform blocks withdrawal and demands further transfers for tax, verification or unlocking a wallet, stop paying. Contact your bank, preserve transaction history and report a suspected crime. A promise to recover the full amount after one last payment is a warning sign.

Updated: 20 October 2026. In a warning of 29 September 2026, CERT Polska described fake investment advertisements using well-known people's images and AI-generated video. A recognisable face does not authenticate an offer. Source: CERT Polska.

A loss on a genuinely purchased asset may result from a price change. It does not by itself demonstrate a crime or a right to recover capital. A situation with no genuine investment, fictitious displayed profits and money sent to perpetrators is different.

KNF describes both cryptoasset price volatility and fake exchanges, apps and manipulation. It also warns against installing remote-access tools at an unknown consultant's request. Source: KNF, fraud and manipulation.

A suspended withdrawal also calls for checking the genuine provider's terms and official announcements. Not every account check is a scam. Make contact yourself through an official channel, not a link supplied by a telephone adviser.

1. Do not pay more money or provide further codes or documents.

2. If you shared remote access to your device, disconnect it. Contact the bank from a safe device and secure access to your accounts.

3. Record the platform address, consultant's profile, conversations and payment confirmations. Do not delete the account merely to remove an upsetting reminder.

4. Notify the police or prosecutor's office. Report a suspicious website to CERT Polska through incydent.cert.pl.

In January 2026, CERT described platforms where a supposed consultant encouraged investment, after which withdrawal proved impossible. A balance displayed on such a dashboard does not prove funds are available. Source: CERT Polska, January 2026 summary, p. 14.

Prepare transfer confirmations, account numbers and recipient details, conversation dates, emails, domains, the exchange's name and any blockchain transaction identifiers you have. For crypto, the network and destination wallet address also matter. KNF's warning on fake investments stresses preserving this information. Source: KNF, recommendations for victims.

Never give a person offering help your wallet recovery phrase, private key, password or login code. Assessment does not require taking over your banking.

A victim may receive another offer: “we found the money; you must pay to release it”. KNF describes further scams targeting victims under the pretext of recovery. Verify the provider's identity, contract scope and fees. A promise of guaranteed cryptocurrency recovery should prompt caution. Source: KNF, investment scam patterns.

A screenshot showing a high “profit” may document what the consultant displayed. It does not itself prove assets were bought or money is available to withdraw. Establishing where payment started, where it went and what happened next is much more important. Separate bank transfers from purchasing cryptocurrency and sending it to another address.

For each transaction, record the date, amount, currency or asset, platform used and available identifier. If you have transfer confirmation, also retain the network and recipient address. Leave unknown details as questions to clarify. Do not complete records on the strength of a telephone adviser's assurances.

You transferred money from your own account to a recognised exchange, bought cryptocurrency and then, influenced by a caller, sent it to a specified address. Confirmation of the initial payment describes only the start of the trail. Purchase and withdrawal history, correspondence and the consultant's instructions are also needed.

This does not automatically establish liability of the bank or exchange. It shows why “I lost money in crypto” is too general. A genuine purchase, an account takeover and a fictitious platform are different situations. Each requires fact-finding before a demand is directed to a particular entity.

• Kontakty: telephone numbers, emails, profile and messaging-service names, and advertisement links.

• Platforma: the full domain, app used, support correspondence, terms and withdrawal notices, if available.

• Payments: transfer confirmations, recipients, exchange transaction history and transfer identifiers.

• Instructions to act: messages about supposed tax, extra payments, remote access and successive withdrawal deadlines.

• Steps taken: reports to the bank, exchange, law enforcement and CERT, and the reference numbers received.

Keep original files. Add dates and descriptions to screenshots. If contact continues, do not make more payments merely to obtain more evidence. Limiting further losses comes first.

Describe the specific transactions and why you suspect fraud. State whether you lost account access, shared your device or followed the caller's instructions yourself. Ask what action is available in this particular situation and how to provide evidence. Do not describe a knowingly ordered transaction as one you did not carry out.

Use an official website or app you find independently. A “security department” recommended by the same consultant may be part of the same scheme. Record reference numbers, dates and replies so the next person assessing the case can see what was already checked.

Ask exactly who will contract with you, what work they will perform, on which documents, what fees apply and what they cannot promise. A report displaying a wallet address does not mean funds can be seized. Tracing funds and actually recovering money are different stages.

Be especially cautious about demands for another payment to “unlock” money, your recovery phrase or remote-desktop installation. Do not let a supposed withdrawal deadline rush you. Checking the provider and terms matters more than a promise of quick results.

Prepare a short summary: when contact began, how much you paid, how you paid, when withdrawal was blocked and where you have already reported the case. Do not send passwords or keys. PGW can help organise documents and establish possible assistance; assessment is not a recovery guarantee or a promise to reverse a transfer.

Does a transfer to a legitimate exchange rule out fraud?

It does not settle the issue. Subsequent transactions and who carried them out must also be established. Use of a well-known brand does not prove the telephone consultant worked for it.

Can a cryptocurrency transfer be reversed?

Do not treat it as an ordinary transfer that can be freely cancelled. The chance of securing or recovering funds depends on the particular flows, entities and authorities' actions. There is no honest universal guarantee of an outcome.

Can PGW guarantee recovery?

No. We can analyse the records and agree the possible scope of assistance. We do not offer investments or ask for wallet keys. Terms are agreed after assessment.

Telefon/WhatsApp: +48 720 13 14 15, kontakt@e-pgw.pl, www.e-pgw.pl. PGW office: Gwiaździsta 6/5, 53-413 Wrocław, by appointment; online service in Poland. PGW is not a law firm. Reserved activities are performed by authorised advocates and Polish legal advisers.

See also: complaining about an unauthorised transaction i first steps after online fraud.