There is no such thing as a legitimate cryptocurrency recovery firm. This is because no private firm has the ability to recover stolen cryptocurrency, at least not by themselves.
Crypto recovery scams are incredibly common -- the vast majority of individuals and firms purporting to offer assistance with recovery are simply crypto recovery scammers.
Note that it is common for recovery scammers to tell victims that there are no upfront charges for their 'services'. Eventually either the scammer will claim to have recovered a bunch of funds, but you need to pay some 'fees' first before they can be released to you (advance fee fraud) or the scammer will send you some fake cryptocurrency tokens that are actually worthless and then request payment for their 'services'.
There are legitimate private crypto investigators and investigative agencies, and sometimes their work can lead to improved recovery prospects with the help and cooperation of other parties, including exchanges and law enforcement. Do your due diligence on any company you are considering hiring to ensure you aren't being defrauded by a scammer.
Additionally, note that the quality and scope of work provided by different firms can vary considerably and additionally there are also multiple 'legitimate' investigative firms out there that like to charge egregious amounts of money for what is often poor-quality or minimal amount that should only cost a small fraction of what they charge.
