Crypto Fraud, Cold Calls and “Recovery” Scams in Cyprus. Why Victims Must Act Fast
Lessons from the UK judgment in Wilden v Person Unknown and AGPLAW’s recent Cyprus experience
14 July 2026
Crypto fraud is no longer limited to fake trading platforms and unrealistic investment promises. A growing number of victims are being targeted a second time by people claiming that they can “recover” lost cryptocurrency.
The pattern is often familiar, an unsolicited call with a convincing story, apparent knowledge of a previous investment, pressure to install screen-sharing or remote-access software, and instructions to buy or transfer further crypto. In many cases, the victim is told that another payment is required for “tax”, “AML clearance”, “wallet activation”, “verification”, “liquidity”, or “release of funds”.
For victims in Cyprus, the first message is simple: do not send further funds, do not provide your seed phrase or private key, and do not allow remote access to your device.
CySEC warns that investment scams are becoming increasingly sophisticated, that fraudsters may appear articulate and financially knowledgeable, and that victims should be cautious of unexpected contact, time pressure, false authority, unrealistic returns, follow-up “money back” offers and remote-access requests.
The recent English High Court judgment ‘Wilden v Person Unknown’
A recent English High Court judgment, Wilden v Person Unknown, is a useful example of how these scams can operate.
In that case, the claimant was contacted by a person using the name “Brian Smith”, who claimed he could help recover Bitcoin previously held on the EuropeFX platform. According to the judgment, the caller had detailed knowledge of the claimant’s earlier transactions, which made the approach appear legitimate. The claimant was then guided through the use of AnyDesk screen-sharing software and persuaded to buy and transfer further Bitcoin.
The claimant ultimately transferred approximately 32.5 BTC, worth about €2.6 million, through well-known exchanges and into wallets connected to the alleged fraud. Forensic investigators later traced the Bitcoin through blockchain transactions to infrastructure associated with HTX / Huobi.
The English court continued a proprietary and worldwide freezing injunction against the unknown wrongdoer and continued disclosure relief against Huobi / HTX. The judgment is important, but it should not be misunderstood: it was an interim-relief decision, not a final trial judgment and not a guarantee of recovery. Its practical lesson is that where victims preserve evidence and move quickly, courts may be prepared to grant urgent relief to preserve assets and obtain information.
Why this matters in Cyprus
Cyprus victims often face the same pattern: cold calls, fake messages and promises, remote-access requests or instructions to follow, crypto transfers, false dashboards, fake compliance explanations and pressure to pay more.
The difficulty is that crypto moves quickly. Funds may pass through several wallets, exchanges, bridges, mixers or stablecoin issuers within hours or days. Delay can make tracing and enforcement much harder.
But crypto fraud should not automatically be treated as hopeless. Many blockchain transactions are public. Wallet addresses, transaction hashes, exchange deposits, stablecoin movements and conversion points can provide a trail. The key is to act before that trail becomes too fragmented and before relevant records are deleted or assets are dissipated.
Cyprus legal tools: preservation, freezing and disclosure
Cyprus has a common-law-based legal system and a developed framework for urgent interim relief. In fraud and asset-tracing cases, Cyprus courts may grant freezing orders, disclosure orders, Norwich Pharmacal-type relief, search / Anton Piller orders, receivership and other interim measures where the legal tests are satisfied.
These remedies can be particularly important in crypto fraud cases because the victim may need to:
- identify the person behind a wallet or exchange account,
- preserve digital evidence before it is destroyed,
- freeze assets or proceeds before they are moved,
- obtain information from third parties such as exchanges, payment providers or service providers,
- coordinate civil, criminal and forensic steps across borders.
Each case is fact-specific. The availability of relief will depend on the evidence, urgency, jurisdictional links, the location of relevant persons or assets, and the proportionality of the orders sought.
AGPLAW’s Cyprus experience in crypto and digital-asset fraud
AGPLAW has already acted in a number of Cyprus proceedings involving alleged misappropriation of digital assets and cryptocurrencies.
In a recent Limassol District Court matter, AGPLAW obtained an Anton Piller order on behalf of clients in a case involving digital assets, cryptocurrency wallets and electronic devices. The order allowed for the search and preservation of digital and physical evidence, including devices and crypto-related materials. The matter involved AGPLAW’s legal team and IT experts, and the Anton Piller relief was combined with freezing relief aimed at preventing dissipation of assets exceeding USD 6 million.
The matter was handled by AGPLAW’s Disputes team, including Maria Constantinou, Partner | Disputes, and Angelos G. Paphitis, Managing Partner, with support from the wider litigation team.
This type of work illustrates the practical response that crypto-fraud cases may require in Cyprus: urgent legal applications, careful evidence preservation, forensic support, digital-device handling, wallet analysis, transaction tracing and, where appropriate, applications directed at exchanges or other service providers.
In related crypto-asset recovery work, AGPLAW has also sought Cyprus court reliefs aimed at preserving accounts, wallets and cryptoassets connected to identified transaction hashes and exchange infrastructure, demonstrating the importance of combining blockchain tracing with urgent legal action.
What victims should do immediately
Victims of suspected crypto fraud should act quickly and methodically. First, stop communicating with the suspected fraudsters. Do not warn them that you are taking legal advice. Do not argue with them. Do not give them further information.
Second, do not send any more money or crypto. Requests for tax payments, release fees, AML charges, unlocking deposits or wallet activation fees are common features of recovery scams.
Third, secure your devices and accounts. Remove remote-access tools, change passwords, enable genuine two-factor authentication and consider using a clean device for banking, email and exchange access.
Fourth, preserve evidence. Keep transaction hashes, wallet addresses, screenshots, emails, WhatsApp or Telegram messages, call logs, phone numbers, fake platform URLs, exchange records, bank transfers, card payments and any evidence of remote-access software.
Fifth, contact your bank and relevant exchanges quickly. In some cases, records can be preserved or accounts flagged.
Sixth, obtain legal advice before making informal approaches that may alert wrongdoers or undermine later court applications.
How AGPLAW assists victims
AGPLAW’s role is not to promise recovery. No professional can guarantee that stolen crypto will be recovered. Our work is to assess the facts, preserve evidence, coordinate with forensic specialists where needed, and advise on realistic civil, criminal and regulatory options. In appropriate cases, this may include urgent interim relief in Cyprus or coordination with lawyers and investigators in other jurisdictions.
Our crypto-fraud response may include:
- reviewing the timeline, communications, wallet addresses and transaction hashes,
- preparing an evidence bundle for police, regulators, exchanges and court applications,
- coordinating blockchain forensic analysis,
- advising on freezing, disclosure, preservation and search orders,
- preparing formal exchange correspondence and preservation requests,
- supporting victims in parallel civil and criminal steps,
- helping victims avoid follow-up recovery scams.
A realistic message for victims
The lesson from Wilden and from recent Cyprus practice is not that recovery is guaranteed. The lesson is that speed, evidence and legal strategy matter.
Crypto fraud cases require urgent coordination between lawyers and forensic investigators. The earlier a victim acts, the better the chance of preserving useful evidence and identifying realistic legal options.
These scams are sophisticated, they use pressure, false authority, technical language and apparently credible information. Any delay helps the fraudsters.
For an initial assessment, contact AGPLAW’s Disputes Department at agp@agplaw.com
Disclaimer:
Articles on this Insights page are provided for general information only and reflect the position as of their publication date. They may not account for later legal, regulatory, case-law, or practice developments. They do not constitute legal advice, a legal opinion, or any other professional advice, and should not be relied on as a substitute for advice based on specific circumstances. Readers should seek appropriate professional advice before acting or refraining from acting on the information provided. Publication does not create a lawyer-client relationship.
