Crypto fraud involves the same elements as traditional gold scams: manufactured urgency, layered fees, and organized networks. However, blockchain transactions are public, permanent, and traceable. The transaction records provide a basis for identifying the recipients of stolen funds, and professional tracing can convert these records into evidence against specific defendants.
Recovery is possible in certain circumstances. The likelihood of recovery depends on the speed of response, the destination of the funds, and the effective use of the legal mechanisms available in Kenya under the VASP Act, 2025. This guide outlines the steps to take in the first 72 hours, the procedures for reporting and tracing, the civil recovery process, and the risks of secondary fraud targeting victims.
Know Your Enemy: The Scam Typologies
Recovery strategy follows scam type:
Pig-butchering the long con: a relationship built over weeks on a dating app or WhatsApp, migrating to a "great investment" on a platform that shows fake profits until the withdrawal request demands "taxes" and then silence. The largest losses, and the most traceable funds, typically run through identifiable exchange accounts.
Fake exchanges and platforms have professional-looking sites, sometimes spoofing real brands; deposits accepted, withdrawals never permitted. The platform itself is the defendant-shaped hole.
Telegram and WhatsApp investment groups signals, "doubling", mining pools; Ponzi mechanics paying early joiners with later joiners' money until collapse.
Phishing and wallet drainers seed phrases harvested, wallets swept, signatures abused. Theft of assets you already held; the trail runs on-chain.
Romance-adjacent and impersonation frauds fake support desks, fake escrow, fake brokers.
In each case, the victim is left with a transaction history rather than the original funds. This transaction history forms the foundation of any subsequent legal action.
The First 72 Hours: Speed Decides the File
1. Preserve everything: wallet addresses, transaction hashes, platform URLs, chats, emails, deposit instructions, receipts of every fiat leg (bank and M-Pesa statements showing transfers to on-ramps). Screenshots with dates; exported chat logs.
2. Do not alert the scam: no confrontation, no "I know" messages, no withdrawal-attempt drama that prompts the operators to move and mix funds.
3. Record the on-chain trail: the hashes let a tracer follow flows immediately; the window in which funds sit at an identifiable exchange account is often short.
4. Report: a criminal complaint to the DCI (cybercrime unit), and suspicious-transaction reporting channels through the Financial Reporting Centre where applicable. The complaint anchors everything else.
5. Instruct counsel with the assembled file to freeze applications and exchange requests, move on documents, and the documents are yours to make.
Reporting: Criminal Complaint and the Regulators
The criminal track runs through the Directorate of Criminal Investigations, whose cybercrime capabilities can engage platforms' law-enforcement channels directly; the DPP prosecutes; and under POCAMLA, proceeds can be restrained. The regulatory track runs through the Financial Reporting Centre for money-laundering analysis and, for platforms operating in Kenya, the CBK's VASP licensing regime under the Act of 2025 which imposes compliance obligations on lawful operators that victims' lawyers can invoke, and imposes a legal problem on unlawful operators distinct from yours. Neither track returns money on its own; their value lies in pressure, restraint, and information that feeds the civil claim.
Blockchain Tracing: The Ledger as Witness
Professional blockchain forensics can trace transactions across various addresses, mixers, and exchange accounts to the final destinations where the assets are ultimately withdrawn. Through the platform's law-enforcement process, the account can be identified using its KYC records. The tracing process must meet evidentiary standards and require a formal report from a reputable forensic provider rather than informal screenshots. Timeliness is critical, as funds that reach privacy tools or jurisdictions that do not cooperate may become unrecoverable. While not every tracing effort is successful, a successful trace can identify the individual behind the transaction. Route: Where Money Comes Back.
As with gold fraud, civil proceedings are where recovery actually happens, and the playbook translates directly:
- Freezing orders and injunctions against identified recipients and their assets, obtained urgently where the tracing identifies them in time.
- Third-party disclosure and production orders against exchanges, banks and M-Pesa reaching the off-ramp records.
- Fraud, unjust enrichment and conversion claims against the identified recipients including knowing assistants who hosted accounts for a cut.
- Garnishee and execution against frozen balances and traced assets.
- POCAMLA restraint running in parallel with the criminal complaint, preserving assets before judgment.
Kenyan courts apply the same substantive law to cryptocurrency-related losses as they do to other forms of property fraud. The primary difference lies in the nature of the evidence, as blockchain records often provide stronger proof than is typically available in other cases. In situations where assets are moved across jurisdictions, the strategy for freezing and disclosure must follow the assets and may require coordination with foreign legal counsel.
The Second Scam: Recovery Fraud
Every publicised crypto loss often attracts so-called 'recovery agents' who contact victims through emails, direct messages, and websites, offering to recover stolen funds in exchange for upfront fees or payments for 'unlock codes,' 'tax clearances,' or 'wallet reactivation.' These schemes replicate the fee structure of the original scam, targeting victims a second time. Common warning signs include guarantees of recovery (which no legitimate professional can provide), requests for upfront fees, unsolicited contact, unverifiable identities, and claims of working with law enforcement agencies. No legitimate recovery process requires payment to release funds. Victims should engage only registered advocates, verify their credentials, and treat all unsolicited offers as potentially fraudulent. The risk of secondary loss is significant. The Hygiene That Keeps You Out of This Article.
Recovery is costly, while prevention is comparatively inexpensive. Use hardware wallets for significant holdings; never enter seed phrases on websites; verify transactions before signing; avoid engaging with unsolicited support; and check investment platforms against regulatory registers. For estates and heirs, proper planning, as outlined in our crypto will and inheritance guides, can prevent loss due to death as well as fraud.
A Worked Example: The Platform That Couldn't Pay Out
Consider a composite example. An investor deposits a modest amount on a trading platform, encouraged by a mentor met through a professional networking group. The displayed balance increases to a substantial sum, but withdrawal requests result in demands for verification fees, then 'tax clearances,' followed by silence. On legal advice, the investor preserves all relevant evidence, including transaction hashes, chat records, platform URLs, and records of M-Pesa and bank transfers. A complaint is filed with the DCI, and a blockchain trace is commissioned immediately. The trace identifies her USDT at a major exchange, and the account remains active and KYC-verified. Counsel obtains a production order that reveals the account holder is a local nominee who hosts accounts for a fee. A freezing application is filed while funds remain, and a portion of the original deposit is recovered from the frozen balance. The nominee, facing fraud claims, identifies the upstream operators in settlement. The platform's displayed profits were fictitious, but the actual deposits were real, and a portion is recovered. This outcome is more favourable than most due to prompt preservation of evidence in the initial 72 hours.
Ten Mistakes Crypto Fraud Victims Make
- No evidence discipline hashes, and chats unpreserved are leads that die.
- Confronting the scam, tipping the operators, burns the traceable window.
- Waiting for the platform "withdrawal pending" is a stage direction, not a status.
- Skipping the police report: the criminal file anchors restraint and leverage.
- DIY tracing presented as evidence: courts need forensic-grade reports, not screenshots.
- Paying "recovery agents" is the second scam and the most predictable event in this industry.
- Assuming anonymity is an immunity off-ramp; KYC has names; find them.
- Allowing embarrassment to delay action does not pause the movement of assets on the ledger; it is essential to act promptly regardless of emotional distress.
- Overlooking the fiat components is a mistake, as bank and M-Pesa records are instrumental in identifying the on-ramps and the individuals involved.
- Failing to implement preventive measures after an incident often results in a subsequent loss that closely resembles the initial one.
Frequently Asked Questions
Q1. Can stolen crypto be recovered in Kenya?
A. Recovery is sometimes possible, particularly when the tracing process identifies an off-ramp in time to obtain freezing orders and when civil claims are pursued against the identified recipients. The likelihood of recovery depends on the speed, quality of tracing, and effective execution.
Q2. What do I do first after a crypto scam?
You should preserve all relevant hashes, communications, and fiat transaction records. Do not alert the operators. Report the matter to the Directorate of Criminal Investigations and instruct legal counsel immediately to commence tracing and freezing procedures.
Q3. How do I report a crypto scam in Kenya?
A. You should file a criminal complaint with the Directorate of Criminal Investigations, accompanied by your indexed evidence. Submit suspicious transaction reports to the Financial Reporting Centre. For platforms, utilise the regulatory complaint channels provided under the VASP Act framework.
Q4. Can police trace Bitcoin?
A. Law enforcement engages exchanges' legal-process channels with court orders; private forensic tracers follow the public ledger professionally. Between the two, the "anonymous" frequently becomes named.
Q5. What if the scammer is abroad?
A. The location of the off-ramp, rather than the scammer's location, typically determines the appropriate strategy. Foreign exchanges often respond to local legal processes, and asset freezing can be coordinated across borders.
Q6. How long does recovery take?
A. The process of freezing and identifying assets may take several weeks if the opportunity remains available. Achieving full recovery through legal claims and execution can require several months to years, as is common in fraud litigation.
Q7. Are the funds gone forever if they went through a mixer?
A. Although recovery is more difficult when funds have passed through a mixer, it is not always impossible. Professional tracing can achieve some success despite significant obfuscation, but pursuing the fiat components and the operators' infrastructure is often more effective.
Q8. Can I sue the exchange?
A. Generally, you cannot sue the exchange unless there is evidence of wrongdoing by the platform. Legal claims are typically directed against the recipients and any parties who knowingly assisted. The compliance obligations of licensed platforms are more likely to assist in obtaining information than to establish liability.
Q9. What does recovery cost?
A. Tracing and urgent legal applications involve high costs. Engaging in a staged manner, with honest assessments of the prospects of success, can protect you from incurring expenses on futile claims, as is the practice in gold recovery matters.
Q10. How do I avoid this entirely?
A. Custody hygiene: Maintaining proper custody practices, verifying each transfer, conducting regulatory checks on platforms, and exercising scepticism toward unsolicited offers are essential disciplines that, if followed, will render this guide unnecessary.
Disclaimer: This article is general legal information, not legal advice. For guidance on your specific situation, book a consultation with our advocates.
