From address to exchange: how stolen crypto is traced
Date: | Week 27 | Reading time: 7 minutes | Updated: Author: Tyler Dijst
In short
You can trace stolen crypto because every transaction is public on the blockchain: from your address, through intermediate addresses, to the point where the proceeds reach an exchange. Whether that trail leads anywhere differs per case. Paucitas works it out for you and records it in a report.
Paucitas is an independent expert firm in the Netherlands that investigates crypto fraud, in hundreds of cases a year. Behind an exchange account there is, in principle, a verified customer, and that is often where the lead lies.
Get in touch with Paucitas or ring +31 20 244 5774, 24/7. The sooner we look, the fresher the trail.
In a nutshell
After a theft, crypto seems to vanish, but the trail stays visible. The key point is the exchange where the thief wants to cash out. Paucitas maps the route up to there, so you know where your crypto went and what the next steps are.
Your crypto has gone. Perhaps through a hack, a fake platform or someone you trusted. That is a horrible feeling, and it often comes with the thought that nothing can be done. That is by no means always true.
This blog explains in broad terms how the trail of stolen crypto runs and why the exchange matters so much. The detailed work is best left to Paucitas.
Can you trace stolen crypto?
Yes, in most cases. Every transaction is recorded on the blockchain with a time and an amount, and it stays there. The thief can move the money, but cannot make it invisible. So the real question is not whether there is a trail, but where the proceeds touch the ordinary financial world again.
That sounds simple, but in practice a thief splits amounts, uses many addresses or swaps coins. Then it quickly becomes hard to follow. Paucitas keeps track of which part of your original amount ends up where. How that wider investigation works is on tracing stolen crypto.
4 steps from your wallet to the exchange
- The outgoing transaction. Your wallet or exchange history shows the transaction in which the money left, with a transaction hash. That hash is the start of the trail.
- The intermediate addresses. Often the money first goes to one or more newly created addresses. That lengthens the trail, but does not break it.
- The cash-out point. In the end the thief wants to turn the crypto into money. That usually happens at an exchange.
- Recording it. Which amount went to which exchange address, and when? Paucitas records that in a report anyone can follow and understand step by step.
If a mixer or a jump to another blockchain sits in between, it gets harder, but not always impossible. More on that in tracing crypto through multiple wallets and mixers. Paucitas does all its tracing itself, without tracing tools. Paucitas does more than trace transactions: we also go through all conversations, documents, emails and other communication, so that a complete picture emerges, with a timeline and where all the money went, step by step.
Have you got the transaction hash or your wallet address to hand? Get in touch with Paucitas. With those details we can often tell you quickly whether there is a trail to follow.
An example from practice
One Sunday morning a man found that his ether had been moved. The evening before, he had clicked a link in an email. Via three new addresses, the amount reached a well-known exchange within two days.
Paucitas mapped the route and recorded which part of his ether reached the exchange address and when. That way he knew exactly what had happened. For his police report and his talks with a solicitor, the report was a strong attachment.
Paucitas takes privacy very seriously and never shares clients' personal details. This is a composite example: names, amounts and details have been changed. The situation is one we see in practice.
What is the cash-out point and why does it matter?
The cash-out point is where stolen crypto enters the regulated financial system, usually an exchange. That is where an anonymous trail becomes a lead. Cryptoasset businesses in the UK fall under the FCA anti-money laundering regime and must carry out customer due diligence, which includes identifying their customers.
If approached in the right way, an exchange can look more closely at an account, preserve data and sometimes temporarily freeze funds. An exchange does not do this at the request of a private individual, but on the basis of a well-founded request from the police or a solicitor. A factual report is essential for that.
Will you get your crypto back if the trail leads to an exchange?
Nobody can promise that in advance, Paucitas included. Mapping the trail and recovering funds are two different things. What happens at the exchange depends on its own procedures and the legal route.
What is true: without a trail there is nothing to start with. The report shows whether money is still available, or where it went, and what the next steps are. If it is a scam, reporting it to the police is one of those steps, and the Paucitas report is then a strong attachment that sets everything out fully and clearly. Sometimes it also turns out to be your own wallet that you can regain access to, or something other than you thought is going on.
Beware of anyone promising "guaranteed recovery for a fee". That is often a recovery scam, a second fraud. The FCA warns about these recovery room scams.
What is the best thing to do now?
- Do not change anything in your wallet and keep all the details: addresses, transaction hashes, emails and chats.
- See which details to preserve in preserving evidence after crypto theft.
- Let Paucitas take a look and map the trail.
Paucitas provides the report; a solicitor translates it into legal steps. Paucitas does not give legal advice. What an investigation of your own wallet looks like is in investigating a hacked wallet.
What does an investigation cost and how quickly can you get help?
- Costs: every investigation is tailored. You receive a bespoke quote in advance, which we go through together, so there are no surprises.
- Turnaround: from the same day to around two weeks.
- Contact: you can ring at any time, 24/7. We answer the form within 1 to 3 hours, and email within 24 hours, usually the same day.
Want to know where your crypto went? Get in touch for a free intake, or ring +31 20 244 5774. A real-world example is in case study: a transaction traced to the exchange.
Sources: FCA, cryptoasset AML regime; Money Laundering Regulations 2017, regulation 28; Report Fraud; Police Scotland, scams and frauds; FCA, recovery room scams.
Do you have questions about this blog?
Feel free to get in touch with Paucitas. Paucitas can be reached by phone 24/7, including evenings and weekends. Through the contact form we usually reply within 1 to 3 hours, and we answer e-mail within 24 hours.
Contact form
Usually a reply within 1 to 3 hours
"*" indicates required fields
We only use your details to contact you about your request. You can read more about this in our privacy statement.
Frequently asked questions about tracing stolen crypto
Can I see for myself where my stolen crypto went?
Paucitas finds that the first step is often possible, yes: with the transaction hash you can see which address the money went to. After that it quickly gets complicated through splits and intermediate addresses. Paucitas maps the whole route.
What is the cash-out point?
Paucitas means the point where stolen crypto enters the regulated financial system, usually an exchange. An exchange must identify its customers, which is why this is often the lead for next steps.
Will I get my stolen crypto back if the trail leads to an exchange?
Paucitas: that depends on your situation. If you still have access to your own wallet or account holding funds, there may still be options. If everything has been sent to the fraudsters, the picture is different. That cannot be judged from a distance. Paucitas first looks at your situation and tells you honestly what is and is not possible. Be careful with anyone who promises in advance that your money will come back. In doubt? Contact Paucitas and you will know where you stand.
What can I do with the Paucitas report?
Paucitas provides a report that shows whether money is still available or where it went, and what the next steps are. In a scam it is a strong attachment to a police report, because it sets everything out fully and clearly.
How quickly should I act?
Paucitas recommends: preferably soon. The trail on the blockchain stays, but an exchange can only act while the money is still there. Feel free to ring, 24/7.
From Amsterdam, for the whole of the UK
Everything can be done fully online. Prefer to meet in person? You are very welcome at our office in Amsterdam, by appointment.
Paucitas is an independent expert firm based in the Netherlands that, for clients across the UK, investigates investment fraud and crypto fraud, establishes the origin and legitimacy of crypto assets and prepares expert reports for legal proceedings and compliance.
Your own situation
If you are reading this, you probably have a question about your own situation. That is exactly what Paucitas does.
The first step is contact by phone. You can book that call by phone or through the contact form, so you do not have to wait. In the call we look together at what can factually be established in your case and what Paucitas can examine for you.