How Do Fake Crypto Support Accounts on X Try to Steal Your Wallet?

Complain in public that a withdrawal is stuck and you may get three replies before the exchange has read your post. The accounts look official and helpful. Their job is to move you somewhere private and get one thing from you.

What people on X are asking

In October 2026 a web3 user warned about people who slide into your DMs claiming they can recover stolen funds, noting that whenever someone posts about being drained, "dm me, I can help" replies appear almost at once. In November a blockchain analytics account called the "support" DM that asks for your seed phrase the most repeated scam in crypto. And in June a Canadian exchange reminded users that its only official X account is its main handle, with no side accounts and no DM verification requests.

What people in the thread said

• @cryptotaxprepHQ replied that the "recovery guy" in the replies is simply the second half of the same drain. The FBI's own warnings support that: recovery offers aimed at victims are a recognised follow-on scam.
• @KYVORAWALLET pointed out that anyone asking for the words to an already-drained wallet wants whatever is left or whatever you send next, and that real recovery starts with transaction hashes and a police report, never a seed phrase. That matches IC3's advice to report with transaction details.

These are community comments, summarised in our words; the data and sources below come first.

The fact-checked answer

The scale. The FBI's Internet Crime Complaint Center (IC3) received 149,686 complaints involving cryptocurrency in 2024, with reported losses of $9.3 billion, a 66% rise in losses on the year. Tech and customer support scams, which include fake help desks, accounted for about $1.46 billion across all payment types.

The playbook IC3 describes. In an August 2024 public service announcement, IC3 warned that criminals pose as employees of cryptocurrency exchanges. They make unsolicited contact, create urgency (your account is "compromised" or "frozen"), and ask for log-in details, links to click or identity documents. Their advice: do not respond, do not click links, contact the exchange through its official website or app, and never share log-in credentials or seed phrases.

UXS decision diagram

Is this "support" message real?

Text version of the diagram

1. Did you contact the platform first, through its own app or website? If no: Unsolicited contact: treat as a scam and do not reply
2. Is the conversation inside the platform's own app or verified help portal? If no: DMs, Telegram or WhatsApp: real support does not move you there
3. Does it avoid asking for your seed phrase, password, 2FA code or remote access? If no: Stop. No real support team needs these
4. Does it avoid asking you to sign a transaction, "validate" a wallet or pay a fee first? If no: A signature can approve token spending; a fee up front is the classic recovery scam
5. Otherwise: Probably real, but still confirm the ticket number inside the official app

Diagram drawn by UXS. A simplified decision aid for education, not a recommendation.

Step 1: the bait. A public complaint about a stuck withdrawal or a hack tells scammers someone is stressed. Impostors search for those posts and reply with lookalike names and copied profile pictures.

Step 2: move to private. The reply says "DM for faster help", often with a Telegram or WhatsApp link. In private, nobody else can warn you.

Step 3: the ask. It is always one of a few things:

• Seed phrase or private key, often via a "validation" form. Whoever has those words owns the wallet; see our seed phrase guide.
• Login codes or remote access "to diagnose the issue".
• A wallet signature on a fake site; a token approval lets them move your tokens later.
• An up-front fee or "release tax" to unlock funds.

Step 4: the second wave. IC3's June 2024 warning described fictitious law firms that contact fraud victims offering to recover their money, sometimes claiming to work with the FBI or other agencies. Reported losses to these schemes topped $9.9 million between February 2023 and February 2024.

Free PDF

Fake crypto support checklist (PDF)

Print or save. Use it before you reply to any "support" or "recovery" message.

Before you reply

Red flags (tick any)

1. Contact came first from them, not me
2. Asked to move to DMs, Telegram or WhatsApp
3. Asked for my seed phrase, private key, password or 2FA code
4. Asked me to install a remote-access app or sign on a website
5. Asked for a fee, or offered paid recovery

If I already shared something

Fill-in fields in the PDF: Platform name and its official support URL (typed by me); Did I open a ticket first? Ticket number; Where did the message come from (reply, DM, email, phone)?; Time I shared it and what I shared; Transaction hashes of any outgoing transfers; Report filed at ic3.gov (date) and with the platform.

Download the PDF (44 KB, made by UXS, no sign-up)

If you already shared something. Move what is left to a new wallet with a new seed phrase, revoke token approvals, change exchange passwords and 2FA, and save every transaction hash for a report to ic3.gov. Ignore anyone who then offers paid recovery; our page on hardware and hot wallets explains why a phrase should never be typed into anything online.

Decision helper

Related reading: what a rug pull is, whether proof of reserves proves an exchange is solvent and how to spot a prop firm scam.

Common mistakes

• Answering the first reply to a public complaint.
• Trusting a checkmark or a follower count.
• Typing a seed phrase into any website, form or chat.
• Paying a "recovery" service after a theft.

FAQ

Will an exchange ever DM me on X first?

Treat any unsolicited DM as fake. IC3 advises contacting the exchange through its official site or app.

Can someone steal my crypto without my seed phrase?

Yes, if you sign a malicious token approval or give remote access to a device with an open wallet.

Are crypto recovery services real?

IC3 has warned about fake recovery firms and law firms that target victims and charge fees up front.

Where do I report a crypto scam in the US?

At ic3.gov, with transaction hashes, wallet addresses and screenshots.

How much did Americans lose to crypto fraud in 2024?

IC3 recorded $9.3 billion in crypto-related losses from 149,686 complaints.

How do I check if a support account is real?

Go to the platform's website yourself and use the support link there; never use a link from the message.