From address to exchange: how stolen crypto is traced

Take a concrete example that often recurs in practice: stolen ether that is routed away from the victim’s wallet in a few steps. First to a freshly created address, then to a second, then to a third, and from that third intermediate address the amount arrives at a well-known exchange. That exchange is not a random end destination, but the point where the thief wants to convert the crypto into money. That is exactly where the lead for everything that follows lies.

How is stolen crypto traced to an exchange?

Stolen crypto is traced to an exchange by starting at the victim’s address and following the outgoing transactions one by one. Each transaction points to a next address, and so a chain emerges that can be reconstructed. We map that chain and keep track of which part of the original loot ends up where, even if the amount is split up along the way.

In our example, the ether runs from the victim’s wallet via three intermediate addresses to the exchange. Those intermediate addresses add no real anonymity; they lengthen the trail but do not break it. As long as no mixer or cross-chain step is involved, the route remains traceable. How that tracing works in practice we describe in our pillar ontracing stolen crypto, and the very first steps after a theft are set out in our blog onthe first steps to trace your crypto.

Why intermediate addresses do not erase the trail

A thief uses intermediate addresses to create distance between the theft and the payout point. To the eye, the money seems to disappear into a tangle of addresses, but every step is a public transaction with a timestamp and an amount. By placing those steps in order, a timeline emerges that shows how the loot moves towards the exchange. That is not a guess, but a reconstruction based on what the blockchain itself records.

What does the cash-out point mean?

The cash-out point is the place where stolen crypto enters the regulated financial system, usually an exchange where the thief wants to sell or withdraw the coins. It is the pivot of the entire investigation, because an exchange, unlike an anonymous wallet address, is bound by identification obligations. Behind an exchange account there is in principle a verified user.

Once the loot touches that point, the case shifts from purely technical tracing to a route in which other parties can make a difference. The cash-out point is therefore literally the link between the blockchain and the real world. What this concept means exactly you can read in our explanation ofthe cash-out point.

What can an exchange do after a theft?

An exchange can, provided it is approached through the proper legal channel, take a closer look at a suspicious account, preserve data and in some cases temporarily freeze balances. An exchange does not do this at the request of a private individual, but on the basis of a substantiated request fromthe police, the public prosecutor or a lawyer. That is why a factual, traceable report showing the trail up to the cash-out point is so important: it forms the substantiation on which such a request can rest.

We record which amount went to which exchange address at which moment, so it is clear exactly what the exchange is being asked to investigate. What an exchange does next depends on its internal procedures and the legal route; on that we make no promise and remain neutral.

The line between investigation and payout

Mapping the trail and actually recovering funds are two different things. A report shows what happened and where the funds went; whether anything is frozen or repaid lies outside the blockchain and beyond our influence. Those who confuse the two risk encountering parties who exploit that hope with a “guaranteed return for a fee”. Such a guarantee is a hallmark of follow-up fraud and does not exist in reality.

Working with a lawyer: the logical next step

After the cash-out point the legal route comes into view, and there a lawyer is the appropriate party. Our role is factual and supporting: we deliver the investigation report, the lawyer translates it into legal steps, such as a request towards the exchange or civil proceedings. That division of tasks is deliberate. We give no legal advice and pass no legal judgement; that belongs with a lawyer or the relevant authority.

What the broader investigation after a theft looks like, from reading the wallet to the reconstruction, we describe in our blog onwhat your transactions reveal after a theft. That blog looks at the wallet itself; this blog follows the trail further, all the way to the exchange.

Start with a free intake

If your crypto has been stolen and you want to know whether the trail can be followed to an exchange, we will calmly review it with you in a free intake. We discuss which transaction data is available and what an investigation can yield in your situation, without promising an outcome. That way you know where you stand before taking further steps.