Can stolen crypto be traced and what does that achieve?

What Paucitas does

Tracing begins with one certainty: the transaction with which your balance left your wallet. From there we follow each onward step, note every split and every merge, and establish at which point the funds reach a service rather than another private address.

A route rarely runs in a straight line. Funds are split, swapped into another coin and brought back together, and it is exactly that pattern which tells you whether you are looking at an opportunist or at an operation that does this often.

Asking whether stolen crypto can be traced usually means asking two things at once: can the transactions be followed, and does following them lead anywhere. On a public blockchain the first is nearly always yes. The second depends on where the trail ends, and there are only three real outcomes: an identifying service, a self held wallet, or a service that publishes nothing.

What you supply

You supply Paucitas with the address or the wallet the balance disappeared from, the transaction hash of the outgoing transaction if you have it, and the date and the time. Anything else you kept, such as a phishing message or a screenshot of the moment you noticed, helps us place the event.

If you have any monitoring in place on the address, or if you noticed later movements yourself, add the dates. Funds that sat still for months and then moved usually moved for a reason, and that reason is often a service preparing to convert them.

What you receive

You receive a report from Paucitas with the route, the endpoints and an explanation of what each endpoint means in practice. In one anonymised case a stolen balance of just over nine bitcoin ran through six intermediate addresses and one swap into a stablecoin, and the remainder arrived at a trading platform that identifies its customers.

That last detail is the point of tracing. An endpoint at an identifying service gives your lawyer or the police something to address, while an endpoint at a self-hosted wallet tells you honestly that the trail stops there.

The three outcomes matter because they determine who can act. An identifying service can be approached by a lawyer or by the authorities. A self held wallet can be monitored but not addressed. A non publishing service ends the route for practical purposes, and saying so plainly is more useful than a report that leaves the impression that something is still pending.

How to get started

You send Paucitas the address, the date and where possible the transaction hash. We tell you within a day whether the route is worth following and what a report would cover. The contact page is enough for a first look, and there is no cost attached to that assessment.

Speed helps but is not decisive. The transactions stay on the chain, so an older theft can still be traced; what fades is the willingness of services to act and the availability of your own records. If the theft happened years ago, it is still worth one short message.

Whether funds can actually be claimed at a service is for that service or the competent authority to decide.

Would you like to know what this means for your situation? Ring us on +31 20 244 5774, day or night, or fill in our contact form and you will hear from us within 1 to 3 hours. We answer emails within 24 hours, usually the same day. The intake is free and without obligation.