Tracing and Recovering Stolen Crypto

Why Tracing Is the Easy Part

Every transfer is recorded forever, so an investigator can follow stolen coins from your outgoing transaction through intermediary and consolidation addresses, hop by hop. The popular belief that cryptocurrency is untraceable has it backwards. Tracing is routine.

It is the step after tracing that fails, and that is usually where the disappointment arrives.

Why Recovery Is the Hard Part

On a permissionless chain, control is the private key. Nobody can move coins without it, and nobody can reverse a confirmed transaction. Recovery therefore depends on the funds stopping somewhere a third party controls, and in practice there are only three such places: a regulated exchange or custodian holding the balance, a centrally issued token whose issuer can freeze it, and a court order compelling one of them to act.

Chainalysis makes the same point in its analysis of seizable assets: confiscating permissionless assets requires obtaining keys or intercepting funds at centralised off ramps, whereas stablecoins can be frozen by their issuers. If a thief keeps the proceeds in self custody and never touches a cooperative venue, tracing produces a detailed map of somewhere you cannot go.

When the pieces do line up, the amounts can be substantial. In June 2025 the Department of Justice filed a civil forfeiture complaint against 225.3 million dollars, mostly in a frozen stablecoin, traced with blockchain analysis on behalf of more than four hundred suspected victims. Note what did the work: an investigation, an issuer, and a court.

The Second Scam

Because victims go looking for help, an industry has grown up to meet them, and it is worth knowing what it is.

The FBI's public service announcement on recovery fraud is direct: private sector recovery companies cannot issue seizure orders, and exchanges freeze accounts only through their own processes or in response to legal process. The pattern it describes is an up front fee followed by silence, or a thin tracing report and a request for more money.

A later advisory documents fictitious law firms running the same play, sometimes claiming to work alongside the FBI, and states the rule that settles it: law enforcement does not charge victims a fee for investigating crimes.

The practical rule: report to law enforcement and to any exchange involved as soon as you can, keep every transaction hash and address, and treat any up front fee as disqualifying on its own. Anyone offering to reverse a transaction or freeze an ordinary address for you is describing a power that does not exist. If this has happened to you, none of it was obvious in advance, and the people who design these schemes do it full time.