Your hacked Instagram is posting crypto scams: what to tell your followers while you recover

The takeover is bad. The hour after it is worse, because the attacker is not sitting on your account; they are working it. Stories about a “trading mentor”, posts about the “crypto opportunity that changed my life”, direct messages to your closest followers asking them to invest in something with your face on it. By the time you notice, three people have already replied.

Recovery is one job. Containment is the other, and it starts now.

First: tell people, everywhere you can

You cannot post on the hijacked account, so use everything else. In order of reach:

1. Another platform where your audience overlaps: TikTok, YouTube, X, LinkedIn, Facebook. One clear post: “My Instagram @handle has been hacked. Anything it posts or messages about crypto, trading or investing is a scam and is not me. Do not send money. I will confirm here when it is back.”
2. A trusted friend’s Instagram story, tagging your handle, with the same words. Stories reach the followers you share.
3. Email list, newsletter, website banner if you have them.
4. Group chats and close contacts by message, because the attacker DMs the people who trust you most.

Screenshot each warning with its timestamp. If a follower later loses money, the record that you warned promptly matters.

Second: have a few people report the account

Ask five or six contacts, not fifty, to report the account from within the app, choosing the option that the account has been hacked, and to report the scam posts as scams or fraud. A handful of genuine reports from established accounts adds weight to your recovery case and speeds enforcement on the scam content. A coordinated wave of reports looks like brigading and is discounted.

Third: keep evidence you will need twice

You will need it for the recovery and, very likely, for the disable appeal that follows. Collect, with dates and times visible:

• Screenshots of every scam post, story and DM you can see or that contacts forward to you.
• The security emails from Meta about changed email, phone and password, including the timestamps.
• Any messages the attacker sent you demanding payment for the account back.
• Your own warnings, as posted, with timestamps.
• If money was lost by anyone, their screenshots of the conversation and payment.

Store it outside Instagram.

Fourth: run the recovery, in order

The sequence is the same as any takeover and it is time-critical: use the revert links in Meta’s security emails if they still work, then the hacked-account flow at instagram.com/hacked with the identity check, after securing the email account so that codes are not intercepted. The full sequence is in our hacked account recovery guide. Do not pay the attacker. Do not pay anyone who messages you offering to get the account back; that is the second scam that follows the first.

Fifth: expect the disable, and appeal it in the right order

Scam content gets accounts disabled, and the system does not know that someone else posted it. Many hijacked accounts are disabled for fraud while the owner is still trying to recover them. When that happens:

1. Complete recovery first. Meta will not review a disable until it can confirm who owns the account.
2. Then appeal the disable through the account’s appeal flow and, if needed, the Help Center forms, with a short statement: the account was taken over on [date], the scam content was posted by the attacker, recovery was completed on [date] with reference [x], and the evidence is attached.
3. Attach the security emails and the scam screenshots. They prove both the takeover and its timeline.

Appeals filed in this order resolve; appeals that try to argue the disable before proving ownership stall.

Sixth: after you are back

Delete every scam post and story, and check archived and hidden content too. Post a confirmation that the account is yours again and repeat the warning about anything sent while it was compromised. Reply to the people who were messaged. Then secure it: new unique password, authenticator-app two-factor, every unknown session logged out, every unfamiliar third-party app removed, recovery email and phone confirmed as yours. The patterns that let attackers in are described in how takeovers actually happen; close the one that applied to you.

If a follower lost money

Point them to their bank’s fraud process and, where the amount justifies it, the police. Give them your screenshots of the takeover and your warnings. Whether you have any liability is a legal question that varies by country and circumstances, and worth a lawyer’s fifteen minutes if a large sum is involved. What is not in question is that a fast, documented public warning is both the right thing and the strongest position.

When to get help

Containment is something you can do in the next hour with no help at all. Recovery and the disable appeal that follows are where the order of steps starts to matter, and where the cases we see go wrong: codes requested before the email was secured, appeals filed before ownership was proven, replacement accounts created mid-process. Our hacked account recovery work handles that sequence: evidence prepared once and used twice, official channels in the right order, and a written record. No hacks back, no insider contacts, no guaranteed outcomes, and a free case review first.