The scammers also ran a fake recovery service, contacting victims weeks later with promises to get their stolen crypto back