A hacker recently posed as a Ledger employee and got into my stepdad's account and stole all of his Bitcoin.

Does anyone know of some sort of private investigator for crypto that could help trace the funds?

He has the transaction IDs and I know there are services that will alert all the major exchanges and try to trace the money.

Any help anyone can offer would be greatly appreciated. He is an older man and we are talking a significant amount of money.

I reached out to a couple of groups that got recommended by a BTC expert friend of mine.

Cipherblade and chainalysis

mrmill3218 said:

---

I reached out to a couple of groups that got recommended by a BTC expert friend of mine.

Cipherblade and chainalysis

---

Good luck to him. Chainanalysis is a well known group .

I heard on a podcast recently about scammers that will steal money/crypto through social engineering. And then they will contact the victim later posing as some sort of authority that is able to investigate and get the money returned…for a fee. Obviously they take that fee and disappear.
The pitch is they are investigating a stimulating and identified that person as a victim. The victim often hasn't told anyone else, so it sounds more legit.

How much and when did it happen? A positive outcome
For your dad is highly unlikely, but engaging LE, preferably the FBI, quickly is critical. He may not get his money back, but his actions after the fact could contribute to the take down of his scammer. PM me if you want. I can't help directly but I can offer some guidance and let you know what to expect.

MRB10 said:

---

If it's been transferred it can't be recovered, unfortunately. Many have learned the "never give your private keys to ANYONE" lesson this way, me included.

File a police report if it's a substantial amount. I'd be surprised if they do anything about it. The scammers name may be able to be figured out but there are many ways to obfuscate who they are.

---

It's my understanding that law enforcement won't do anything unless it is a high profile case. If the dollar amount is great enough to justify paying some money to a forensic PI, that would be my next step. I have a contact if you're interested.

Hey thank you for the reply. It looks like I'm not able to PM. Can you please reach out to me via email?

MarkRmiller89@gmail.com

Very interested. Please reach out to me via email.

MarkRmiller89@gmail.com

Got it and emailed you if you want to pull your email down.

mrmill3218 said:

---

Very interested. Please reach out to me via email.

MarkRmiller89@gmail.com

---

Email sent.

Are the hackers who stole the bitcoin PTA mom's who speak out at school board meetings?

If not, unlikely the FBI will respond.

Tormentos said:

---

Yeah would be interested to hear details of what happened so we can all be aware. Did he give away his pass phrase?

---

Curious of this as well. I got 5 consecutive calls from an 800 number that I kept declining. I googled the number and it showed as my bank. I answered the next call and knew something was wrong because, 1) I could barely understand the guy and 2) connection was very poor. While he was talking, I logged on to my account and nothing was amiss. He gave me a number to call him back on to help me with unauthorized purchases from my checking account. I took down the number and immediately called the number for my bank on my card. They assured me my account was secure and that the spoofers can make their number show any name. They also confirmed that the number the guy gave me was not one if their numbers. They said they don't call. They send alert via email.

This was about 9 pm on a Sunday night. I blocked that number. They've tried 2 more numbers that show my banks name which I blocked as well.

Sick this happened to your step-father. I'd reach out to Zach immediately as I believe he now works routinely with law enforcement and the security teams on foreign exchanges.

https://www.wired.com/story/meet-zachxbt-243-million-crypto-theft/

Just by the nature of decentralized currency it is extremely difficult to recover once it is removed from a centralized exchange.

I'd always recommend to anyone these days to hold through the ETFs or on a secured centralized exchange.

How would I get in touch with Zach?

I don't know if it'll help but you might try talking to the local FBI office.

https://maps.app.goo.gl/G7hb4r1vPABxR3aX7

mrmill3218 said:

---

How would I get in touch with Zach?

---

DM him on X and emphasize it is a big loss.

Done. Thank you for your help!

Tormentos said:

---

Yeah would be interested to hear details of what happened so we can all be aware. Did he give away his pass phrase?

---

Can you expand on this OP?

I was watching a video on YouTube about scams and the guy said to be wary and vet any service that claims to help you recover stolen crypto after being scammed. He said he sees comments on his videos where one person says they lost their crypto asking for help and someone replies saying XYZ service got it back for them and that turns out to be a scam company.

It's likely the person claiming to have lost the coin and the person giving the recommendation are the same person and trying to trick others (who have already been scammed so they are easier targets) to use the scam service they are providing.

I am not implying that is what is going on here with all the recent posts with this topic but I would be very careful using any of these services.

Fake Coinbase scammer explains how they do it:

Recently I was called by someone pretending to be Coinbase support, trying to steal bitcoin.

I decided to turn the tables on him and ask him about being a scammer.

Things got wild - he completely changed his personality & told me everything.

Presenting: To Catch a Scammer 🕵️‍♂️ pic.twitter.com/OZ6TQAiq5s

— Nick Neuman (@Nneuman) November 20, 2024

Two biggest takeaways from IMO for people to understand:

1) They have too much faith in security. LastPass is still in business. LastPass whose sole purpose was to keep your passwords safe, let all your passwords out to a hacker. LastPass is still in business.

2) Any thing you can think someone could possibly do on the Internet, they can do much faster than you think they can, and at scale.

One of the more common phishing scams is an email about an invoice payment or subscription fee with a phone number to call if you didn't authorize the payment. My guess is something like that happened where ultimately a remote login occurred.

I called once and immediately knew it was a scam when they said I had to be at my computer to get the refund. I played stupid and wasted about 15 min of the scammers time. Then I started talking in an Indian accent making fun of him until he hung up.

Tell your parents or grandparents never to click any links or let anyone remote login to their computer if they call about these types of emails. If they do, make sure they factory reset their PC and change all their passwords.

Tell them they should never call any number from an email or click any link from an email or open any attachment from an email unless they know the sender personally.

If they get an "invoice" from Company X they don't recognize, ignore it.

If they get an email from a company they do business with (like their credit card or bank), then tell them to call the number on their card or billing statement.

We're about to move into an era where scams are going to become MUCH more sophisticated. For now, they all revolve around people assuming any call/email/text is legitimate when they should assume the opposite.