From address to exchange: how stolen crypto is traced

How do you find out where your stolen crypto went?

You start at your own address. In your wallet or in your exchange account history you will find the outgoing transaction with a transaction hash. That hash shows on the blockchain which address the money went to. From that address you follow the next outgoing transaction, and so on.

An example we see often: stolen ether goes from the victim’s wallet first to a freshly created address, then to a second and a third. From that third address the amount arrives at a well-known exchange. That exchange is not a random end point, but the place where the thief wants to turn the crypto into money.

Tracing crypto transactions: from address to exchange

Every transaction points to a next address, creating a chain that can be reconstructed. We map that chain and keep track of which part of the original loot ends up where, even when the amount is split along the way.

Intermediate addresses lengthen the trail but do not break it. As long as there is no mixer or cross-chain step in between, the route remains traceable. How tracing works in practice is explained on our page about stolen crypto tracing.

What is the cash-out point?

The cash-out point is where stolen crypto enters the regulated financial system, usually an exchange where the thief wants to sell or withdraw the coins. It is the turning point of the investigation: that is where an anonymous blockchain trail becomes a lead.

In the Netherlands, a crypto service provider falls under the Wwft, the Dutch anti-money laundering act, and must carry out customer due diligence, including identifying the customer. Whether a provider is licensed can be checked in the AFM register of crypto-asset service providers. What the term means exactly is explained under cash-out point in our glossary.

What can an exchange do after a theft?

An exchange can, provided it is approached through the right legal route, take a closer look at a suspicious account, preserve data and in some cases temporarily freeze funds. An exchange does not do this at the request of a private individual, but on the basis of a substantiated request from the police, the public prosecutor or a lawyer.

That is why a factual report showing the trail up to the cash-out point matters so much. Paucitas records which amount went to which exchange address at what moment, so it is clear what the exchange is being asked to investigate. What an exchange does next depends on its own procedures and the legal route; we make no commitment about that.

Can you get stolen crypto back if the trail leads to an exchange?

That cannot be said in advance. Mapping the trail and getting funds back are two different things. A report shows what happened and where the funds went; whether anything is frozen or repaid lies outside the blockchain and outside our control.

Beware of recovery fraud. Parties promising a “guaranteed recovery for a fee” play on that hope. Such a guarantee does not exist.

Working with a lawyer

After the cash-out point, the legal route comes into view, and a lawyer is the right party for that. Paucitas delivers the investigation report; the lawyer translates it into legal steps, such as a request to the exchange or civil proceedings. Paucitas does not give legal advice.

What the investigation of the wallet itself looks like is described in our article on what your transactions reveal after a theft, and what to do right after a theft in tracing stolen crypto. This article follows the trail further, up to the exchange.

What can you provide and what can you expect from an investigation?

In a free intake we calmly look at which transaction data is available and what an investigation could achieve in your situation, without promising an outcome. You can provide your information digitally or at our office; for each case you receive a list of what is needed.

Turnaround. An investigation takes from the same day to about two weeks, depending on the case.

Costs. Every investigation is tailored: you receive a custom quote in advance that we go through together, with no surprises.

Sources: Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft), art. 1a and 3; AFM, register of crypto-asset service providers; Dutch police, aid for reporting theft of cryptocurrency.