ICAR - Cyber Recovery

Directions Website

ICAR - Cyber Recovery Cyber investigation & digital asset tracing | Helping victims of online fraud document, trace & report stolen funds | Report Case: https://tally.so/r/NpVNlp

Wrong number texts cost Americans part of 470 million dollars in 2024, five times what was reported just four years earl...
26/08/2026

Wrong number texts cost Americans part of 470 million dollars in 2024, five times what was reported just four years earlier, according to the FTC.

The instinct to politely reply wrong number and move on feels harmless. It is not.

These messages are mass sent to scraped or randomly generated numbers, with a fake personal detail added specifically to prompt a reply. Once you respond, even briefly, the scammer treats it as a signal worth pursuing, either toward a slow relationship building scam or, in some cases, simply to confirm your number is active enough to resell.

Avoid engaging unknown contacts. Protect your funds.

In June 2025 the US Department of Justice seized more than 225 million dollars in stolen cryptocurrency, the largest sei...
26/08/2026

In June 2025 the US Department of Justice seized more than 225 million dollars in stolen cryptocurrency, the largest seizure of its kind on record.

So bitcoin is clearly traceable at that scale.
Why do so many individual scam victims still hear from local police that there is nothing that can be done.

The honest answer is not about technology. It is about resources.
Research published in late 2025 found that most local police departments lack a dedicated economic crime unit, and one UK force reported that fraud makes up more than 40 percent of all reported crime nationally while receiving less than 1 percent of police resources.

At ICAR - Cyber Recovery we consistently work with victims to ensure their cases are properly reported at the highest level of authorities where they can receive some positive attention.

25/08/2026

Scammers are posting fake jobs on Indeed. They are using real companies and conducting real we**am interviews

Once they “hire you” they ask for your information like your social security number, personal information and bank info. They also send you a list of items you need to purchase for the new job. Things like cloud storage and software licenses

One woman fell for it, provided all her information and her social security number. The real company never posted the job on Indeed and doesn’t even have a United States office

The woman who fell for it even left her old job and now can’t get her job back

Be careful out there guys.

CHECK IF THE SCAMMER'S IMAGE IS AI GENERATED Reverse image searching a dating profile photo takes about 5 minutes with f...
25/08/2026

CHECK IF THE SCAMMER'S IMAGE IS AI GENERATED

Reverse image searching a dating profile photo takes about 5 minutes with free tools, but in 2026, a clean result doesn’t guarantee what it used to.

AI image generators now produce realistic faces that have never been posted anywhere online, which means there’s nothing for a reverse search to match against, even when the entire profile is fake.

Our new guide covers the classic tools (Google Lens, TinEye, Yandex), the newer facial recognition search options, and critically — a live video call technique that catches what image search alone increasingly can’t: asking someone to turn fully sideways and wave a hand in front of their face, which current deepfake filters still struggle to handle.

🚨The Support Scam That Left a Trail on the BlockchainA US-based threat actor, Tiffany Milanovich, has been linked to at ...
21/08/2026

🚨The Support Scam That Left a Trail on the Blockchain

A US-based threat actor, Tiffany Milanovich, has been linked to at least $5M in alleged crypto thefts involving hardware-wallet and exchange-support impersonation scams.

Her role was reportedly that of a “caller” — contacting victims while posing as legitimate wallet or exchange support and convincing them to hand over access to their funds.

One of the most significant cases occurred in June 2026, when a victim lost approximately $1.2M in Bitcoin and Ethereum after a spoofed BitcoinIRA email was used to facilitate the attack.

Theft addresses:
"bc1ql2t0mwtf6unkr8vnlg9hy7njuv7vcvn9nxvlzy"
"0x491333e8ea6f4fc2a2475db01b649e1e4602ec3c"

Other alleged incidents include a $500K Coinbase theft and the movement of substantial funds through instant exchanges and stablecoins.

What makes this case particularly striking is the digital trail reportedly left behind: call recordings, Telegram conversations, screenshots, social media posts and on-chain transactions.

The lesson is simple:

A scammer may hide behind a fake support account, but blockchain transactions don't forget.

🔎 A recent investigation uncovered a sophisticated crypto laundering operation targeting victims in the United States.In...
21/08/2026

🔎 A recent investigation uncovered a sophisticated crypto laundering operation targeting victims in the United States.

In April 2026, an elderly US victim was targeted by scammers impersonating Coinbase support, resulting in a substantial loss of their life savings.

We’re pleased to share that $275K was recently seized and returned to the victim.

The investigation also uncovered $5M+ in additional stolen funds linked to the same group, moving from Ethereum and Bitcoin through centralized exchanges, into Tron and eventually OTC channels.

Theft TX:
"30125031d32a3a2ec9a6963d218bf2494d4392d9444586061a97d84511479346"

The case demonstrates how blockchain tracing can uncover wider networks behind individual crypto thefts.

$245,000 Lost to a Fake Meeting App: Here’s How the Scam WorkedA few weeks ago, we came across a sophisticated crypto th...
21/08/2026

$245,000 Lost to a Fake Meeting App: Here’s How the Scam Worked

A few weeks ago, we came across a sophisticated crypto theft that is a powerful reminder of how convincing social engineering attacks can be.

The victim lost approximately $245,000 after being persuaded to download what appeared to be a legitimate meeting application called “Vortax.”

Here’s how the attack unfolded:

1. The impersonation started on X
The attacker posed as Peter Lauten from a16z and contacted a team about a potential podcast partnership.

2. The attacker exploited a username change
The real account had previously used the username before changing it to .

The impersonator then claimed the old username.

The deception was made more convincing because some a16z web pages and older posts still referenced the previous username.

3. The victim was socially engineered
The impersonator eventually convinced the victim to install a “meeting” application called Vortax.

It wasn't a legitimate meeting application.

It was malware.

4. The crypto wallets were compromised
Following the installation, the victim's cryptocurrency assets were transferred out of their wallets.

The stolen funds were then routed through multiple intermediary addresses before ultimately reaching exchange-related addresses.

The identified theft address:

"0x77aFC774c38D6A712e1A1F5Ea7c88Fe14BFA10F6"

5. The funds were traced
Blockchain analysis allowed the movement of the stolen assets to be mapped across the intermediary addresses and onward to exchanges.

The funds were subsequently recovered with investigative assistance.

What can we learn from this?
🔹 Verify identity independently. A familiar name, profile photo or company affiliation does not prove an account is genuine.

🔹 Be extremely cautious with downloads. An unexpected request to install software should be treated as a major red flag.

🔹 Check account history. Username changes, unusual account activity and inconsistencies between official websites and social profiles can reveal impersonation.

🔹 Search before installing. A quick search for “Vortax” would have revealed warnings associated with the website.

🔹 Act quickly after a theft. Blockchain transactions are permanent, but rapid tracing and reporting can help identify where stolen assets move and where intervention may still be possible.

This case demonstrates why social engineering + malware + cryptocurrency can be an extremely dangerous combination.

And importantly, the blockchain can leave a trail.

The question is knowing how to follow it.

📌 Check the comment for full case details and investigation

A Note From Us — And Why We’ve Been QuietTo everyone who has been asking, “Why have you not been publishing?” — we see y...
20/08/2026

A Note From Us — And Why We’ve Been Quiet

To everyone who has been asking, “Why have you not been publishing?” — we see you, and we truly appreciate you. ❤️
Your messages remind us that the work we share here genuinely matters.

The truth is, we’ve been extremely busy offline, walking several clients through active fraud-recovery cases. Some situations have been incredibly difficult. We’ve supported people through emotional and mental-health crises, law-enforcement processes, legal procedures, and the complicated steps involved in pursuing their cases.

For some victims, the financial loss has been more than money; it has affected their families, their peace of mind, and their will to keep going. That is why, behind the scenes, we have had to give our full attention to the people who needed us most.
It has been strenuous, but it has also reminded us exactly why this work matters.

Last week, we were able to recover stolen funds for 3 clients and we failed to recover for 2 other clients.
We will share the Testimonials soon.

To our subscribers, clients, and community: thank you for your patience, your trust, and for checking in on us.
We are making a full return to our online activities from tomorrow, 20 August, with regular newsletters, updates, educational resources, and communication with our community.
We haven't gone anywhere. We’ve simply been busy doing the work behind the scenes.

We’re back. And we’re keeping the mission moving. 🌍

— International Cyber Asset Recovery (ICAR)

Before you send crypto to a new address, it takes about 5 minutes to check whether it's linked to a known scam, using fr...
18/08/2026

Before you send crypto to a new address, it takes about 5 minutes to check whether it's linked to a known scam, using free tools anyone can access.

Paste the address into a blockchain explorer like Etherscan to check its history and any phishing labels. Search it on Chainabuse and CryptoScamDB, free public databases where past scam victims report fraudulent addresses.
And watch out for 'address poisoning' — a tactic where scammers send a tiny transaction from a look-alike address, hoping you'll copy the wrong one from your history later.

Our new guide walks through the full step-by-step process, plus what to do if you've already sent funds to an address that turns out to be flagged.

Address

122 Leadenhall Street
London
EC3V4AC

Opening Hours

Monday 12am - 12am
Tuesday 12am - 12am
Wednesday 12am - 12am
Thursday 12am - 12am
Friday 12am - 12am
Saturday 12am - 12am

Website

, ,

Alerts

Be the first to know and let us send you an email when ICAR - Cyber Recovery posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share

Category