Can all stolen crypto be followed?

On public blockchains the transactions themselves are always visible. What differs is how far the trail stays readable, and that is what the report states per step.

Does tracing help if the funds went through a mixer?

Often yes, but with more reservation. We record what can still be established and where the certainty ends, rather than presenting a guess as a finding.

What does a tracing report achieve in practice?

It names the endpoints. Where a route ends at an identifying service, there is a party that can be addressed by your lawyer or by the police.

←Back to Questions

Can stolen crypto be traced and what does that achieve?

By S.E. (Simcha) Schrijver, blockchain investigator at Paucitas

Paucitas traces stolen crypto across the blockchain and records where the funds went and at which service they arrived. Whether stolen crypto can be traced is a question of data rather than of hope, and we answer it with the route, the endpoints and what each endpoint means for your next step.

What Paucitas does

Tracing begins with one certainty: the transaction with which your balance left your wallet. From there we follow each onward step, note every split and every merge, and establish at which point the funds reach a service rather than another private address.

A route rarely runs in a straight line. Funds are split, swapped into another coin and brought back together, and it is exactly that pattern which tells you whether you are looking at an opportunist or at an operation that does this often.

Asking whether stolen crypto can be traced usually means asking two things at once: can the transactions be followed, and does following them lead anywhere. On a public blockchain the first is nearly always yes. The second depends on where the trail ends, and there are only three real outcomes: an identifying service, a self held wallet, or a service that publishes nothing.

What you supply

You supply the address or the wallet the balance disappeared from, the transaction hash of the outgoing transaction if you have it, and the date and the time. Anything else you kept, such as a phishing message or a screenshot of the moment you noticed, helps us place the event.

If you have any monitoring in place on the address, or if you noticed later movements yourself, add the dates. Funds that sat still for months and then moved usually moved for a reason, and that reason is often a service preparing to convert them.

What you receive

You receive a report with the route, the endpoints and an explanation of what each endpoint means in practice. In one anonymised case a stolen balance of just over nine bitcoin ran through six intermediate addresses and one swap into a stablecoin, and the remainder arrived at a trading platform that identifies its customers.

That last detail is the point of tracing. An endpoint at an identifying service gives your lawyer or the police something to address, while an endpoint at a self-hosted wallet tells you honestly that the trail stops there.

The three outcomes matter because they determine who can act. An identifying service can be approached by a lawyer or by the authorities. A self held wallet can be monitored but not addressed. A non publishing service ends the route for practical purposes, and saying so plainly is more useful than a report that leaves the impression that something is still pending.

How to get started

You send the address, the date and where possible the transaction hash. We tell you within a day whether the route is worth following and what a report would cover. The contact page is enough for a first look, and there is no cost attached to that assessment.

Speed helps but is not decisive. The transactions stay on the chain, so an older theft can still be traced; what fades is the willingness of services to act and the availability of your own records. If the theft happened years ago, it is still worth one short message.

Whether funds can actually be claimed at a service is for that service or the competent authority to decide.

Further reading