Help, in simple words.

1. 1
   Breathe. This is not your fault.

   These scams are run by professionals. Clever, careful people fall for them every day.

2. 2
   Don't send money to anyone who promises to get it back.

   People who message you offering to “recover” your crypto are almost always a second scam.

3. 3
   Never share your 12 or 24 secret words.

   That's your recovery phrase. Nobody real — not the police, not an exchange, not us — will ever ask for it.

4. 4
   Find the transaction ID if you can.

   It's a long code of letters and numbers, and it usually starts with 0x. The guide below shows you where to find it. Can't find it? Golden Hour still writes your police report from what you tell it.

5. 5
   Use Golden Hour, then call for help.

   Golden Hour writes the letters for you. In India, also call 1930 — the free cyber-fraud helpline.

Which app was the money taken from? Pick one. The buttons in your app may look a little different — look for words like Activity, History or Transactions.

The fox app. On a phone or as a browser add-on.

1. 1

   Open MetaMask and unlock it with your password.

2. 2

   Tap “Activity”. It's usually a tab under your balance or at the bottom of the screen.

   Wallet

   Tokens

   NFTs

   Activitytap

   ETH0.00

   USDT0.00
3. 3

   Tap the transfer you didn't make. It will say “Sent” or “Send”.

   Activity

   SentToday, 4:03 pm−4.98 ETHtap

   Received12 Aug+0.5 ETH
4. 4

   Tap “Copy transaction ID” — or “View on block explorer”, then copy the long code starting with 0x.

   Sent

   StatusConfirmed

   Amount−4.98 ETH

   Copy transaction IDtap

Wallet

An app that holds your crypto, like a purse on your phone.

Wallet address

A long code that people use to send you crypto. It starts with 0x — or with T on the Tron network. Safe to share — like an account number.

Recovery phrase (12 or 24 words)

The master key to your wallet. Never type it into a website or tell it to anyone.

Transaction

One transfer of money from one wallet to another.

Transaction ID (also “hash” or “TxID”)

The receipt number of a transfer. A long code that usually starts with 0x (on Tron it has no 0x). Golden Hour needs this.

Exchange

A company where people buy and sell crypto, like Binance or Coinbase. They know who their customers are.

Deposit address

A wallet address an exchange gives to one customer. If stolen money lands there, the exchange can find that customer.

Freeze

When an exchange stops an account from moving money, so it can't disappear while police investigate.

Hop

One step in the trail. Thieves move money through many wallets to hide it; each move is a hop.

Tron

Another crypto network. Most investment and romance scammers ask to be paid in USDT on Tron. Golden Hour can follow the money there too.

USDT and USDC

Crypto coins meant to be worth about one US dollar. They are made by two companies, Tether and Circle, and those companies can freeze them.

After a theft, scammers look for victims to rob a second time. If you see any of these, stop and don't reply:

• ⚠They contact you first — on Telegram, WhatsApp, Instagram, X, or by email — after you posted about your loss.
• ⚠They promise to “recover” or “hack back” your crypto.
• ⚠They ask for an upfront fee, a “tax”, or a “gas fee” before releasing your money.
• ⚠They ask for your recovery phrase, or ask you to install an app or connect your wallet to a website.
• ⚠They claim to be from the police, a government agency, or “blockchain forensics” and want payment in crypto.

Got a message and not sure? Paste it into Is this a scam? — it looks for these warning signs privately, right on your device.

• Sit with them and stay calm. Shame stops people asking for help — remind them it is not their fault.
• Do the steps together: find the transaction ID on their phone, then start a case on Golden Hour on their behalf — put their name and phone number in the letters.
• Help them make the call (1930 in India) and send the freeze request. Exchanges reply by email — check it with them.
• Afterwards: move anything left in that wallet to a new one, and set up a rule together: never install an app or “update” someone sends in a chat.

1. Within hours. The exchange may freeze the account that received your money. They will usually ask for a police report number — that's why you file one.
2. Within days. The police can ask the exchange who owns the account. The evidence file proves exactly where your money went. If USDT or USDC is still in the scammer's wallet, Golden Hour also writes a letter asking Tether or Circle to freeze it — the police usually send it.
3. Over weeks or months. If the money is still frozen, it can be returned through the police or a court. It takes time, and it isn't guaranteed — but acting fast gives you the best chance.

Keep the evidence file and your letters. If anyone asks whether they're genuine, send them to the verify page.