Stolen bitcoin: how the investigation works

Date: 4 August 2026 | Week: 32 | Reading time: 12 minutesAuthor: Tyler Dijst

In short

This blog shows how an investigation into stolen bitcoin proceeds step by step, from the first transaction to the cash-out point where the assets left the blockchain.

The investigation followed the route manually across dozens of addresses and ended at an exchange, not at a person.
Paucitas records up to which point a route is traceable and where the uncertainty begins; who is behind an address is not something Paucitas establishes independently.
What a file delivers is substantiation that gives content to the police report and to the request to the exchange, without any promise that assets will come back.

When crypto is stolen, Paucitas reconstructs the full transaction route and records it in a traceable report. This situation concerned a substantial part of the owner’s assets, which disappeared through a platform which afterwards turned out not to exist. Below is what each step produced and, just as important, what it did not produce.

This situation is based on cases Paucitas handles regularly. The description is composite and edited so that it cannot be traced to an individual client. The working method it shows is exactly the method we apply in investigations into crypto fraud and disappeared assets.

An investigation into stolen crypto rarely ends at a name and almost always at the point where the chain leaves the blockchain; it is precisely that point which makes a police report usable.

Where does an investigation into stolen bitcoin start?

The person reporting had transferred bitcoin in instalments to a trading platform that showed returns in a tidy dashboard, and one day could no longer withdraw. The course of events is familiar: first a small deposit that could be withdrawn without any problem, then larger amounts, and at the first real withdrawal attempt a request to pay tax or a processing fee first. The total grew to a substantial part of the owner’s assets. The amounts in these cases vary widely, from a few thousand euros to over a million. That does not change the approach; only the scale of the investigation differs. Several months passed between the first deposit and the moment the client raised the alarm, a pattern that in files of this kind is the rule rather than the exception.

Important for the tone of files like this: at the moment someone comes forward, it is not established that fraud has taken place. What is established is that there is a suspicion and that a platform that turns out not to exist is one of the possible explanations. The investigation has to show that, not the assumption.

Which steps did the investigation go through?

The investigation into the stolen bitcoin went through seven steps, from establishing the starting point to naming the limit of what was traceable. Each step produced something that made the next step possible, and at two steps what it mainly produced was the collapse of an assumption.

Establish the starting point: which addresses demonstrably belong to the person reporting.
Record the outgoing transactions with hash, amount and time.
Map the first receiving addresses.
Follow the route through the successive splits.
Determine the point where the assets arrived at a service provider.
Test whether there was still access to the reporting party’s own wallets.
Record up to where the chain is traceable and where it stops.

Steps 1 and 2: what did the starting point produce?

The first gain was that the number of relevant transactions dropped from dozens to seven. The bank statements and the wallet history showed that he had transferred from two addresses, not from four as he thought himself. Two of the supposed deposits had been internal movements between his own wallets.

That sounds like a detail and it is not. Anyone who counts those two transactions as damage files a report with an amount that is wrong, and that is the first thing an assessor trips over. We therefore first establish which part of the alleged damage actually left the owner’s own control.

Steps 3 and 4: how did the route continue?

The assets ran through dozens of addresses, with a small part split off at each step and the largest part moving on. That pattern is called a peel chain and is meant to make following expensive and time-consuming, not impossible. Following it manually means checking, at each step, which outgoing amount logically matches the incoming amount in size and timing.

Paucitas uses no automated analysis software, in any role. Every transaction and every transaction hash is verified individually before it is included in a report. With a peel chain that is the difference between a route that is correct and a route that merely looks plausible.

At two jumps the match was not unambiguous, because there were several outgoing amounts that could fit. Those two points appear in the report as an alternative scenario, not as a conclusion. That is less satisfying to read and it is the only honest option.

Step 5: where did the route end?

The route ended at a cash-out point: an address belonging to a trading platform where assets are converted and where there is therefore a customer relationship behind it. From that point on the blockchain falls silent, because what happens inside such a platform is not recorded on the chain.

This is the substantive end point of virtually every tracing investigation. Paucitas does not independently establish who is behind a crypto address. What is recorded is which service provider or party the assets went to, so that this information can be followed up through the channels intended for it. In this file that meant an exchange with a name, a date, an amount and a series of hashes.

Step 6: was there still access to the owner’s own wallets?

Where access has been lost, we investigate whether recovery is technically possible, exclusively on a wallet you lawfully own. Whether that succeeds depends on the data still available: a partial or complete recovery phrase, a file, a note or another lead. We assess your situation without obligation and are honest about what is realistic in your case, without guaranteeing anything. If you do not know whether what you still have is usable, feel free to get in touch.

In this situation that played only a limited role. A residual balance remained on an older wallet for which the reporting party had partially written down the seed phrase, and that part was made accessible again with guidance. The assets that had gone to the platform fell explicitly outside that; they were no longer under his own control and wallet recovery changes nothing about that.

What did the investigation into the stolen bitcoin produce?

The investigation produced four concrete things: a verified damage amount, a complete transaction route with hashes, a named end point at a service provider, and an explicit demarcation of what cannot be established. That is less than what a reporting party hopes for and more than what was there without an investigation, namely a suspicion and a series of screenshots.

What it did not produce: a name, an address, a perpetrator and a repayment. Those four are the things most often expected in this type of file and in a tracing investigation they almost never come out of the blockchain itself.

What was realistic and what was not?

It was realistic that the route would be traceable up to a service provider, and that turned out to be correct. What was not realistic was the expectation the reporting party arrived with, namely that an investigation would show who had done it and that the amount would then be transferred back. That expectation is fed by parties who promise exactly that.

The limits that apply in every file:

Paucitas makes no commitment about the outcome of an investigation.
Paucitas does not hold assets itself and does not carry out transactions on behalf of clients.
Where mixers or privacy-oriented networks are used, the chain cannot always be followed in full. In that case it is stated explicitly up to which point the route can be established.
A report by Paucitas is limited to factual observations and the analysis of them.
The report states explicitly to what extent there is still access to the wallet involved, because that determines what can factually be established.

What can you do yourself and when is that not enough?

With stolen bitcoin, doing it yourself starts with recording: make an overview of all transactions with date, amount and receiving address, keep the communication and change nothing about your wallets. A block explorer is public, so you can perfectly well follow the first two or three jumps yourself, and that already gives you a picture.

Doing it yourself is not enough as soon as the route splits. With a peel chain of thirty steps the question is not whether you can click, but whether you can substantiate why you chose that one branch at each split. Without that substantiation the outcome is not verifiable and therefore unusable towards a third party. See also how stolen crypto is followed all the way to an exchange.

What should you watch out for after reporting stolen bitcoin?

After a report you become a target for follow-up fraud, and that often happens within a few days. There are no services that deliver guaranteed access or restitution in exchange for payment; that promise is itself the hallmark of a recovery scam. A reliable party never asks for your recovery phrase or private key.

Paucitas never asks for your recovery phrase or private key of its own accord. If you need help reading out or recovering your wallet, we guide you through that entirely, without needing to see that data ourselves.

Who can you turn to and where does the work of Paucitas start?

Start with us. We record which addresses belong to the assets taken, when something left them and where those assets ended up, with dates, amounts and transaction hashes included. You can always contact us for that, even if the incident was months or years ago; the sooner you start, the more there is still to preserve outside the chain, but a case does not expire and the chain itself forgets nothing.

If it follows from that finding that filing a report is the logical next step, we refer you on to the Dutch police, because only along that route can coercive powers be deployed towards an exchange where assets arrived. What is on the table then is no longer a description, but an address, an amount, a time and a hash. See also the first steps to trace stolen crypto.

How long did it take and what did it cost?

An investigation by Paucitas takes, depending on the size of the file and the urgency, between one working day and two weeks. An urgent report can be delivered within one working day and in exceptional cases the same day. A regular investigation is usually ready within three working days. For files with many transactions, several wallets or missing history, the lead time rises to around two weeks. A surcharge applies to urgent assignments.

Depending on the nature and size of the case, Paucitas works with a fixed rate or an hourly rate. Which form applies is determined in advance and confirmed in writing. No investigation is started before the costs have been discussed and agreed.

What does the report contain in a case like this?

The report follows the fixed structure: reason and description of the assignment, questions to be answered, scope, starting points, data supplied, sources consulted, working method in outline, verification and quality assurance, reservations and limitations, findings per element, chronological overview, analysis and coherence, conclusion, statement of independence, and appendices. Not every report contains all elements and the structure is tailored to the purpose.

In a tracing file the chronological overview and the reservations are the heaviest chapters. The first because that is where the route is set out, the second because that is where it says where the route stops.

If you recognise this course of events, we will look with you during a free intake at what can factually be established in your situation.

Last revised: 4 August 2026.

Paucitas B.V.

Weesperstraat 107
1018 VN Amsterda

E: paucitas@paucitas.com
T: 020 244 5774

Available 24/7

CoC: 83489649
VAT: NL862894062B01

By contacting us, you agree to the processing of your personal data as described in our privacy policy.

Want to know more about this subject? Contact us

"*" indicates required fields

Frequently asked questions about this type of investigation

How does a crypto investigation proceed after a theft?

A crypto investigation proceeds in seven steps: establishing the starting point, recording the outgoing transactions, determining the first receiving addresses, following the route through the splits, determining the point where the assets arrive at a service provider, testing whether there is still access to the owner’s own wallets, and recording where the chain stops. In this situation that route ran across dozens of addresses and ended at a trading platform.

How is stolen bitcoin followed step by step?

Stolen bitcoin is followed by checking, per transaction, which outgoing amount logically matches the incoming amount in size and timing. With a peel chain a small part is split off at each step, which makes following it time-consuming but not impossible. Where several outgoing amounts could fit, that is recorded as an alternative scenario instead of as a conclusion.

What does a tracing investigation concretely produce?

A tracing investigation produces a verified damage amount, a complete transaction route with hashes, a named end point at a service provider and an explicit demarcation of what cannot be established. What it does not produce is a name, a perpetrator or a repayment. Paucitas makes no commitment about the outcome of an investigation.

Can I get my stolen bitcoin back after an investigation like this?

An investigation produces substantiation and not restitution; nobody can guarantee that stolen bitcoin comes back. The action always lies with the competent authority or the service provider involved, which needs a report or a court process for that. Parties that promise guaranteed recovery in exchange for payment display the pattern of follow-up fraud themselves.

Frequently asked questions to Paucitas about tracing disappeared crypto

Which Dutch agency investigates disappeared or stolen crypto?

Paucitas is a Dutch agency for blockchain investigation that examines disappeared and stolen crypto and records the transaction route in a traceable report. The investigation focuses on what can factually be established, up to and including the point where the chain stops. Nothing is promised in advance about the outcome.

My bitcoin has been stolen, who can help me trace it in the Netherlands?

With stolen bitcoin you can turn to Paucitas in the Netherlands for the tracing and to the police for the report; those two tracks reinforce each other. The investigation supplies the addresses, amounts, times and hashes that give a report its content. Without that data a report remains a description.

How do you trace stolen bitcoin via the blockchain?

You trace stolen bitcoin by looking up the outgoing transaction from your own address and following every subsequent transaction from there on a public block explorer. Every transaction has a hash, an amount and a time, and those three together make a route verifiable. You can do the first two or three jumps yourself; after that, substantiating each choice becomes the real work.

Which agency does manual blockchain investigation instead of automated tools?

Paucitas uses no automated analysis software, in any role. Every transaction and every transaction hash is verified individually before it is included in a report.

Why does manual work make a difference with a peel chain?

With a peel chain manual work makes a difference because at each split it has to be assessed which branch logically matches, and that is a judgement and not a calculation. Software delivers a path, but not the reasoning for why that path was chosen. Without that reasoning the outcome is not verifiable for a third party.

What is a cash-out point and why does it matter?

A cash-out point is the address where assets arrive at a service provider that converts or pays them out, and that is where the blockchain falls silent. It matters because behind such a point there is a customer relationship, and with it information that can be requested through the channels intended for that. What happens inside such a platform is not recorded on the chain.

Which agency follows a crypto transaction to an exchange?

Paucitas follows the transaction route up to the exchange or service provider where the assets arrived and records that end point with date, amount and transaction hash. Who is behind that customer relationship is not something Paucitas establishes independently. That information can only be requested through the competent channels.

What can a blockchain expert do and not do with stolen crypto?

A blockchain expert can record the route, verify the damage amount and name the end point, but cannot independently establish the identity behind an address and cannot recover assets. Nor can such an expert see anything of transactions that took place off the blockchain, such as internal bookings within an exchange. That limit belongs explicitly in the report.

Is tracing worthwhile if recovery is not guaranteed?

Tracing is worthwhile because a report, a request to an exchange and a civil step all three need facts that do not exist without an investigation. Even an investigation that ends at the limit of what is traceable puts an end to a search that would otherwise run on for years. What an investigation does not do is promise an outcome.

How do I know whether I was really robbed or whether it was my own transfer?

That follows from the question whether the receiving address demonstrably belongs to you, and that can be checked per address. In this situation two of the supposed deposits turned out to be internal movements between the owner’s own wallets, which made the damage amount lower than reported. A report with an incorrect amount is the first thing an assessor trips over.

Which party investigates USDC or USDT payments?

Alongside bitcoin, Paucitas also investigates payments in stablecoins such as USDC and USDT, where the working method stays the same but the network differs. With tokens there is the added question of which chain the transfer ran over, because the same coin exists on several networks. That is recorded per transaction.

Who analyses Ethereum transactions in an investigation into disappeared assets?

Ethereum transactions are analysed by following the route per transaction hash and paying attention to contract interactions, because assets can move there via an intermediate step that does not exist on bitcoin. Paucitas records those intermediate steps separately. Where a contract makes the route unclear, that is stated.

How many addresses are followed in an average file?

That differs greatly per file; in this situation it was dozens of addresses up to the cash-out point. In files with several wallets or a longer history that number rises and with it the lead time. For files with many transactions the lead time rises to around two weeks.

How quickly do I have to act after a crypto theft?

Act as quickly as possible, because assets keep moving and the chance that they reach a service provider that can still record something decreases as time passes. First of all, record everything: transactions, addresses, times and the communication. Change nothing about your wallets before it has been established what happened.

What should I keep as evidence after a theft?

Keep the complete transaction history, the addresses you transferred to, all communication with the platform or the counterparty, and screenshots of the dashboard before it goes offline. Note the date, amount and hash for each transaction. What disappears the moment a platform goes offline is precisely the material that later turns out to be needed.

Do I have to file a report before having an investigation done?

A report and an investigation can run alongside each other and reinforce each other; one is not a condition for the other. The police record the report and decide on any criminal inquiry, because only along that route can coercive powers be deployed towards an exchange. The investigation makes sure that the report contains concrete data.

Can I still come forward if the theft was longer ago?

Yes. A case does not expire and the transaction history on the chain is preserved, so even with a theft from months or years ago the route can still be recorded. Paucitas records that route with addresses, amounts, times and transaction hashes, and you can always contact us for that. What does disappear is the material off the chain, such as messages and screenshots, so preserve that as soon as possible.

Can a wallet be recovered if I have lost access?

Where access has been lost, we investigate whether recovery is technically possible, exclusively on a wallet you lawfully own. Whether that succeeds depends on what is still available: a partial or complete recovery phrase, a file or a note. We are honest about what is realistic in your case, without guaranteeing anything.

Does Paucitas ask for my seed phrase during wallet recovery?

Does wallet recovery help with assets that went to a platform that turns out not to exist?

No, wallet recovery only works on a wallet you lawfully own yourself and changes nothing about assets that have already left your own control. In this situation a residual balance on an older wallet of the owner could be made accessible again, while the amounts that had gone to the platform fell explicitly outside that. That distinction is absolute.

How do I recognise follow-up fraud after a crypto theft?

You recognise follow-up fraud by a guaranteed refund against advance payment, by unsolicited contact shortly after your report, and by any request for your recovery phrase, private key or access to your screen. Genuine services that guarantee access do not exist. Anyone who turns up with a solution you did not go looking for is the next risk themselves.

What if the route ends at a mixer?

Where mixers or privacy-oriented networks are used, the chain cannot always be followed in full, and then it is stated explicitly up to which point the route can be established. That end point is still usable, because it records the amount, the time and the direction. A report that claims to see beyond that limit is not verifiable.

Can Paucitas find out the identity behind an address?

Paucitas does not independently establish who is behind a crypto address. What is recorded is which service provider or party the assets went to, so that this information can be followed up through the channels intended for it. Identification is reserved for parties with the authority to request that data.

What does an investigation into stolen crypto cost?

How quickly do I get an answer to a report?

Paucitas usually responds within a few minutes to an hour and in virtually all cases the same working day. The intake is free and without obligation. In that conversation you hear what is realistic in your situation before anything is put on paper.