If your cryptocurrency has been stolen, it can usually be traced. Public blockchains record every transfer permanently, and forensic tools can follow the funds from your wallet through intermediary addresses to wherever they land. Recovery, though, is a race: tracing stolen cryptocurrency is only useful if investigators and exchanges can act before the thief cashes out, which is often a matter of hours. The steps below are what gives you a realistic chance.
What to Do in the First 72 Hours
Industry guidance treats the first 72 hours as the window when recovery is still realistic. After that, funds typically clear through exchanges or mixing services and become far harder to pursue.
Three things need to happen in parallel, not in sequence:
- File a complaint with the FBI’s Internet Crime Complaint Center at IC3.gov. The IC3 is the federal intake point for cyber-enabled crime, and the information victims submit is what lets the FBI investigate, track threats, and in some cases freeze stolen funds.1FBI. File Cyber Scam Complaints with the IC3
- File a report with your local police. This creates a parallel record and is often required by exchanges or insurers.
- Preserve the evidence. Save every transaction hash, wallet address, screenshot, and any messages exchanged with the person who stole from you. Do not delete the compromised wallet.
Do not contact the exchange’s customer support expecting them to freeze the thief’s account on your word. Exchanges are legally structured to respond to law enforcement and court orders, not individual requests. Your path to a freeze runs through the FBI, local law enforcement, or a court, backed by a forensic report that documents the fund flow.
One intervention can work even faster. Stablecoin issuers have the technical ability to freeze specific wallet addresses, blocking the tokens from moving at all. Tether, the issuer of USDT, has reported working with over 340 law enforcement agencies across 65 countries and freezing more than $4.4 billion in assets since 2023. If your stolen funds are a dollar-pegged stablecoin, flagging that fact in your IC3 report matters.
Information to Gather Before You Report
A forensic trace cannot start without specific technical identifiers. Isolating one theft among millions of daily transactions is essentially impossible without them.
The most important piece is the transaction ID, also called a TXID or hash. This alphanumeric string is the unique receipt for the transfer that moved your funds. You can usually find it in your wallet’s transaction history, or by searching your public wallet address on a block explorer, which is a free online tool for viewing blockchain data. If you were using a custodial platform like Coinbase or Kraken, the transaction details page in your account will show it.
Also document:
- The exact amount stolen. Small discrepancies can send an investigator down the wrong path, especially if the thief split the assets across multiple transactions.
- The precise timestamp. This lets analysts filter the ledger to the specific block containing your transaction.
- Your wallet address and the recipient address where the funds first went. A block explorer can confirm both.
Having these ready lets a forensic professional or federal agent skip preliminary data gathering and move directly to tracking.
How a Blockchain Trace Actually Works
Public blockchains like Bitcoin and Ethereum are shared ledgers. Every transfer is permanently recorded, and anyone with the right software can watch funds move in real time. Users transact through alphanumeric wallet addresses rather than legal names, so the addresses alone don’t reveal who controls them. That pseudo-anonymity creates an illusion of safety for thieves, and it only holds until someone connects an address to a real-world identity.
Investigators build that connection with a few core techniques. Address clustering groups wallets that are likely controlled by the same person: when a transaction pulls funds from multiple addresses at once, it reveals that one party controls all of them. Chain analysis tracks funds through a “peeling chain,” where a thief moves a large sum through a long sequence of transactions, skipping small amounts off at each step. Risk scoring flags addresses based on their proximity to known illicit activity, like ransomware payments or darknet markets. Visualization tools map all of this as a branching diagram showing where the money went.
Not every trace succeeds. Thieves use techniques designed to break the forensic trail, and a victim should know where tracing commonly runs into walls:
- Mixers. Mixing services pool funds from many users and redistribute them, severing the on-chain link between deposit and withdrawal. The U.S. Treasury’s Office of Foreign Assets Control sanctioned Tornado Cash in August 2022 for facilitating the laundering of billions in stolen cryptocurrency.2U.S. Department of the Treasury. U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash
- Cross-chain bridges and chain-hopping. Moving stolen tokens from one blockchain to another, swapping assets, then bridging again multiplies the manual work needed to trace. Investigations spanning more than three blockchains are increasingly common.
- Privacy coins. Monero and similar coins hide transaction amounts, senders, and recipients by default. When stolen funds are converted to a privacy coin, the on-chain trail usually ends at that conversion.
Where the Trail Leads: Exchanges as Identification Points
The real goal of most traces is to identify the moment stolen funds hit a centralized exchange. Exchanges that accept or transmit virtual currency are classified as money services businesses under FinCEN regulations and must comply with the Bank Secrecy Act.3FinCEN. Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies Federal law requires them to run customer identification programs that verify the name, address, and other identifying information of anyone opening an account.4Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
Exchanges assign deposit addresses to individual users. When a trace shows stolen funds entering one of those addresses, investigators can pinpoint the account responsible. That connection replaces the pseudo-anonymity of the blockchain with a verified legal identity, and it’s what transforms a digital investigation into a legal case. Law enforcement can then seek seizure warrants or emergency restraining orders that compel the exchange to lock the account and prevent outgoing transfers.
Reporting to Law Enforcement and Hiring a Private Investigator
A well-prepared forensic report presents the evidence as a chronological narrative: the theft, the movement of funds through intermediary wallets, and the final destination. Visual diagrams of the fund flow and clear data confirming the destination exchange make it easier for an agent to assess the case. Law enforcement receives an enormous volume of complaints, and a report that does the tracing work for them stands out.
That’s why some victims hire a private blockchain forensics firm in addition to filing with the IC3. Private firms can move faster than federal agencies and specialize in closing the gap between on-chain evidence and real-world identification. What they cannot do is subpoena anyone. They cannot compel an exchange to hand over user data or freeze an account. Only law enforcement and courts can.
The practical combination is a private investigator producing the forensic trace and report, and law enforcement using that report to obtain legal process. If you hire a private firm, verify their methodology. A reputable firm will explain how they handle attribution and error, and their findings should be reproducible by an independent analyst reviewing the same data.
Civil Lawsuits When the Thief Is Unknown
Criminal prosecution isn’t the only path. Under the Computer Fraud and Abuse Act, anyone who suffers damage or loss from a violation can bring a civil action for compensatory damages and injunctive relief. The statute of limitations is two years from the act or from the date the victim discovered the damage, whichever is later.5Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
When the thief is anonymous, victims can file a John Doe lawsuit naming unknown defendants by their wallet addresses. Courts have adapted to this. In at least one notable case, a court authorized service of process by airdropping a specially created token into the defendants’ wallets, with the token containing a link to a website hosting the summons and complaint. The court found this method reasonably calculated to notify the defendants because the wallet address was the digital space where they were known to be active.
Civil suits also open discovery. Courts can compel exchanges to disclose the identities of account holders tied to specific wallets. A civil judgment doesn’t guarantee recovery, but it creates mechanisms for seizing assets that a criminal investigation alone might not reach.
Penalties the Thief May Face
Cryptocurrency theft can trigger overlapping federal charges. A first offense under the fraud provisions of the Computer Fraud and Abuse Act carries up to five years in prison; offenses involving damage, threats, or extortion carry up to ten years for a first conviction and twenty for a repeat.5Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers Moving stolen crypto through multiple wallets, mixers, or exchanges to disguise its origin can add federal money laundering charges, each count carrying up to twenty years and a fine of up to $500,000 or twice the value of the property involved, whichever is greater.6Office of the Law Revision Counsel. 18 USC 1956 – Laundering of Monetary Instruments
Federal courts can order forfeiture of any property traceable to a money laundering offense, which lets the government seize crypto holdings directly.7Office of the Law Revision Counsel. 18 USC 981 – Civil Forfeiture For restitution, courts must order defendants convicted of property offenses to return the stolen property or pay the victim an amount equal to its value.8Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes
Recovery Scams to Avoid
After a theft, scammers posing as recovery specialists, law firms, or government agents will contact you offering to get your money back. The FTC’s guidance is blunt: nobody legitimate will call, email, or message you on social media with an unsolicited offer to recover stolen cryptocurrency.9Federal Trade Commission. Worried About Crypto Exchange Losses? Don’t Pay Money for Help Recovering Money
The FBI has issued a specific warning about fictitious law firms targeting crypto scam victims. These operations impersonate real lawyers, produce documents with legitimate-looking letterhead, and claim to be “authorized partners” of U.S. government agencies. No law firm is an officially authorized partner of any U.S. government agency for fund recovery, and the government does not charge fees for law enforcement services.10Internet Crime Complaint Center. Fictitious Law Firms Targeting Cryptocurrency Scam Victims
Common red flags:
- Unsolicited contact, often with suspiciously specific knowledge of the amounts and dates of your original theft.
- Upfront payment demands, especially in cryptocurrency, gift cards, or wire transfers before any work is done.
- References to agencies that don’t exist or claims that you’re on a “government list of scam victims” with recoverable funds.
- Being placed in private group chats on messaging apps or told not to discuss the recovery with anyone.
- Refusal to appear on video, inability to provide a verifiable bar license number, or payment directed to a third-party trading company.
Before engaging any recovery service, search the company name along with “complaint” or “scam.” If a suspected recovery scammer has already contacted you, report that contact to the IC3 as a separate incident.