A user says their tokens are stuck. A playbook for teams
A stuck-token ticket has one question underneath it: can anyone move the funds out of the address they went to, and is that you. The chain answers it in minutes. This playbook takes a ticket from first reply to either a safe return or a clear, written no.
1. Ask for three things, and never for a fourth
Ask for the address the funds were sent to, the transaction hash, and the network. Never ask for a recovery phrase or a private key, and say so in your first reply: scammers impersonate support agents on exactly these tickets.
2. Work out which case it is
Stuck-token tickets usually fall into one of four cases:
| Where the funds went | Who can usually act |
|---|---|
| Your token contract itself | Your team, only if the contract has a function that can move tokens out |
| Another contract you run (a vault, a bridge, a protocol) | Your team, through that contract's admin or upgrade path, if it has one |
| Your exchange wallet, on a network you do not credit | Your team, since you hold that wallet's key |
| The user's own address, on another network | The user, with their own key |
3. Find out who can act, from the chain
Check who owns or administers the contract, whether it is upgradeable and who controls the upgrade, and whether its verified code has a function that can send the tokens out. If nobody can move them, that is still an answer: write it down with the evidence and send it. The free check does this for any single address and shows every read it made.
4. Verify the person before you move anything
Ask the user to sign a short message with the address that sent the funds. That proves they control the sender, which a screenshot does not. Match the token, the amount and the transaction. Return funds to the address they came from, unless the sender signs a request naming another.
5. Move it safely
Build the exact call, decode it, and have every signer on your multisig read the decoded version before approving. Record the transaction hash of the return and send it to the user as proof.
6. Publish a policy
Say publicly whether you return mistaken transfers, any minimum amount or fee, what you need from the user and how long it takes. A published policy cuts repeat tickets and gives users a way to tell your real support from someone pretending to be you.
7. Stop the next one
Token contracts can refuse transfers to their own address. Deposit pages can name the network in large type next to the address. Both remove the most common causes before a ticket exists.
Tools for this
The single-address check is free for everyone, including teams, with no account. For teams that get these tickets often, the paid plan adds a whole-contract scan that lists what users sent to your contract by mistake, from $29 a month, prepaid. Watching a contract for new mistaken deposits is part of the paid plans and is not yet live.