Can Stolen Cryptocurrency Really Be Traced?
Cryptocurrency fraud can move quickly. Funds may pass through several wallets, exchanges, blockchain networks and digital assets within hours of a victim making a payment.
Despite this movement, cryptocurrency is not necessarily untraceable.
Transactions recorded on public blockchains may allow investigators to follow funds between wallet addresses, identify transaction patterns and establish where assets reached exchanges or other identifiable services.
The extent of any trace depends on the cryptocurrency involved, the transaction route, the quality of the available evidence and whether the relevant platforms or jurisdictions can be identified.
Tracing stolen cryptocurrency does not automatically reveal the person controlling a wallet. It also does not guarantee that funds can be frozen or recovered. Blockchain analysis is one part of a wider process that may involve banks, exchanges, solicitors, courts and law-enforcement authorities.
How Cryptocurrency Transactions Can Be Traced
Most widely used blockchains maintain a public record of transactions.
This record may show:
- The wallet addresses involved
- The cryptocurrency transferred
- The date and time of the transaction
- The amount transferred
- Subsequent transfers from the receiving wallet
- Interactions with exchanges, bridges and other services
- The balance and transaction history of relevant addresses
Specialist blockchain-analysis tools can help organise this information and identify patterns across large numbers of transactions.
An investigation may begin with a wallet address supplied by the victim, a transaction identifier, an exchange receipt or records showing where conventional currency was converted into cryptocurrency.
From that starting point, the movement of funds may be mapped across relevant supported blockchain networks.
The analysis may identify that assets were:
- Split between several wallets
- Combined with funds from other sources
- Sent to a centralised exchange
- Converted into another cryptocurrency
- Moved through a cross-chain bridge
- Transferred through a decentralised exchange
- Sent to a gambling or payment service
- Deposited into a wallet connected to other known activity
These movements can make the analysis more complicated, but they do not necessarily remove the transaction history.
What Information Is Needed to Begin a Trace?
The strongest starting point is usually a confirmed cryptocurrency transaction.
Useful information may include:
- Transaction identifiers
- Wallet addresses
- Exchange account records
- Bank statements showing payments to an exchange
- Screenshots of the investment platform
- Emails, messages and telephone numbers
- Website addresses and social-media profiles
- Names used by the suspected fraudsters
- Payment instructions
- Cryptocurrency type and network
- Dates and amounts of transfers
- Withdrawal records
- Details of any further payment demands
Victims should preserve the original records wherever possible.
Screenshots may be helpful, but downloadable account statements, full message histories, transaction records and complete email headers can provide stronger information.
Victims should not continue communicating with suspected fraudsters solely to obtain more evidence where doing so may expose them to further pressure, payments or account compromise.
Does a Wallet Address Reveal Someone’s Identity?
A cryptocurrency wallet address does not usually display the name of the person or organisation controlling it.
Blockchain analysis can show what happened between wallet addresses, but identity attribution requires additional information.
A wallet may become attributable where it is linked to:
- A verified exchange account
- A bank payment
- An email address or telephone number
- A website or investment platform
- Communications sent to the victim
- Publicly identified criminal activity
- A company or business
- Records obtained through legal disclosure
- Devices or account information obtained by authorities
Some exchanges require customers to provide identity information. Where stolen funds reach one of these platforms, the exchange may hold information about the account holder.
That information is not publicly available merely because the transaction appears on a blockchain. Access usually depends on the exchange’s procedures, applicable law, law-enforcement enquiries or formal legal disclosure.
Some wallet controllers may never be identified. Investigators should therefore distinguish transaction tracing from reliable identity attribution.
Can Funds Still Be Traced After They Are Converted?
Fraudsters frequently convert cryptocurrency in an attempt to complicate the transaction trail.
Funds may move:
- From Bitcoin to a stablecoin
- Between different tokens
- From one blockchain to another
- Through decentralised exchanges
- Through cross-chain bridges
- Into privacy-focused assets
- Through services designed to combine or obscure transactions
A conversion does not necessarily end the trace.
Where the relevant networks and transactions are visible, analysis may continue across several assets and blockchains. The investigator must establish which service or smart contract was used and identify the corresponding transaction on the destination network.
However, the difficulty can increase significantly.
The available tools may not support every blockchain, token or service. Some privacy-enhancing technologies reduce the information visible to outside observers. In other cases, funds may pass through services that retain limited information or operate from jurisdictions where cooperation is difficult.
The report should explain where the transaction path remains visible and where the evidence becomes limited or uncertain.
What Role Do Exchanges and Off-Ramps Play?
Centralised exchanges and other conversion services can be important points in a cryptocurrency investigation.
An exchange may hold:
- Customer identity information
- Account access records
- Deposit and withdrawal histories
- Linked bank-account information
- Device or internet-protocol records
- Records of other connected wallets
These details may help connect blockchain activity to a person, company or conventional financial account.
An exchange may also be the point where cryptocurrency is converted into pounds, dollars or another conventional currency. This is sometimes described as an off-ramp.
Identifying an exchange or off-ramp does not mean the investigator can access the account or compel the platform to disclose information.
The exchange decides how it responds under its internal procedures and the laws that apply to it. Disclosure or restrictions may require involvement from solicitors, courts or law-enforcement authorities.
Funds may also have left the platform before it is contacted. Prompt reporting can therefore be important, although speed does not guarantee that assets will remain available.
Does Cryptocurrency Regulation Help Victims Recover Stolen Funds?
Cryptocurrency regulation may improve oversight of firms operating within the regulated financial system, but it does not automatically enable victims to recover stolen assets.
The Financial Conduct Authority’s financial-promotions regime applies to qualifying cryptocurrency promotions capable of affecting UK consumers. This can include promotions issued by businesses based overseas.
Firms marketing qualifying cryptoassets to UK consumers must use a lawful route and comply with requirements intended to ensure that promotions are clear, fair and not misleading.
The UK’s broader regulatory regime for cryptoasset firms is scheduled to begin on 25 October 2027. Firms carrying out activities within its scope will be subject to the applicable authorisation, conduct, governance and record-keeping requirements.
These measures may strengthen oversight and make compliant firms easier to identify and supervise. They may also improve the quality of records available when transactions pass through regulated exchanges or other firms within scope.
However, regulation and recovery remain separate issues.
A regulatory breach does not automatically:
- Reveal who controls a cryptocurrency wallet
- Establish that particular assets belong to a victim
- Stop a blockchain transaction
- Freeze assets held overseas
- Compel every platform to disclose customer information
- Return stolen funds to the victim
Cryptocurrency may also move through unhosted wallets, decentralised services, cross-chain bridges and overseas entities outside the practical reach of UK regulators.
Where stolen assets reach an identifiable exchange or regulated institution, investigators may be able to document the transaction path and provide information for legal advisers, platforms or authorities to consider.
Access to customer records or restrictions on an account will normally depend on the institution’s procedures, applicable law or formal legal powers.
Regulation can support the wider response, but it does not replace the need to trace the assets and establish an appropriate legal route for further action.
Tracing, Freezing and Recovery Are Different
Cryptocurrency tracing is sometimes described as if locating a wallet means the funds can immediately be recovered.
In practice, several different stages may be involved.
Tracing involves mapping transactions and identifying relevant wallets, services, entities or jurisdictions.
Attribution involves establishing who appears to control a wallet or account.
Freezing restricts dealings with an account or asset. This may require action by an exchange, bank, court or authorised authority.
Seizure involves an authority taking control of assets under relevant legal powers.
Recovery means that assets are returned, realised or otherwise applied for the benefit of the person legally entitled to them.
An investigation may support one or more of these stages, but it does not control the final outcome.
Even where funds are located, recovery may depend on:
- Whether the assets remain in the identified wallet or account
- Whether the platform can restrict the assets
- The identity and location of the account holder
- The jurisdiction governing the platform
- The legal basis for the victim’s claim
- The evidence connecting the funds to the fraud
- The availability of court or law-enforcement action
- Competing claims over the assets
- The costs and proportionality of further proceedings
Tracing should therefore be treated as an intelligence and evidence-development process rather than a guarantee of restitution.
Can Cryptocurrency Be Recovered from an Unhosted Wallet?
An unhosted wallet is controlled directly by the person holding the relevant private keys rather than by a centralised exchange.
A third party cannot usually freeze an unhosted wallet in the same way that a centralised exchange may restrict an account.
Blockchain analysis may still show the wallet’s transactions and monitor subsequent movements. However, obtaining control of the assets generally requires:
- Cooperation from the wallet controller
- Access to the private keys
- Transfer of the funds to a service capable of restricting them
- Seizure by an authority with the necessary technical and legal powers
- Another lawful mechanism appropriate to the jurisdiction
Merely identifying the wallet does not give an investigator, solicitor or victim access to its contents.
The wallet may nevertheless provide useful evidence. Its transaction history could reveal connections to exchanges, other victims, conventional payment accounts or additional wallets.
What Happens When Funds Move Overseas?
Cryptocurrency fraud frequently crosses several jurisdictions.
The victim may be in the UK, while the suspected fraudsters, exchange, company and wallet infrastructure are located elsewhere.
Cross-border matters can raise questions about:
- Which court has jurisdiction
- Where an exchange or company is legally based
- Whether local law recognises the relevant claim
- How disclosure or freezing orders can be obtained
- Whether a UK order will be recognised overseas
- Which authorities should receive the report
- The cost of involving overseas legal advisers
An exchange’s website may be available in the UK without the business itself being incorporated or regulated here.
The investigation should therefore identify the relevant legal entity and jurisdiction wherever possible rather than relying only on the platform’s trading name.
International asset tracing can help establish the countries, companies and services involved. Solicitors can then advise on the available legal options.
How Fraudsters Complicate Cryptocurrency Tracing
Fraudsters may attempt to make transactions harder to follow by using:
- Multiple intermediary wallets
- Money-mule accounts
- Decentralised exchanges
- Cross-chain bridges
- High-frequency token swaps
- Privacy-focused assets
- Mixing services
- False exchange accounts
- Accounts opened using stolen identities
- Over-the-counter brokers
- Gambling platforms
- Shell companies
- Several layers of conventional bank accounts
These techniques can increase the time, cost and uncertainty of an investigation.
They do not mean that every transaction becomes invisible. A useful trace may still identify exchange touchpoints, linked wallets, transaction patterns, conversion points or connections to conventional assets.
Investigators should avoid implying that every layer can be resolved or that every wallet can be attributed.
Warning Signs of Cryptocurrency Recovery Scams
Victims of cryptocurrency fraud are frequently targeted again by people claiming they can recover the lost funds.
Recovery scammers may claim that:
- The cryptocurrency has already been located
- A wallet has been frozen
- A court or regulator is holding the funds
- A fee or tax must be paid before release
- Special software can reverse blockchain transactions
- They work for an exchange, regulator or law-enforcement agency
- They can retrieve funds without supporting evidence
- Recovery is guaranteed
Requests for advance payments should be treated cautiously, especially where the supposed recovery provider contacted the victim unexpectedly.
Victims should independently verify:
- The identity and legal status of the provider
- How the provider obtained their details
- The proposed scope of work
- Whether the provider distinguishes tracing from recovery
- What evidence supports claims that funds have been located
- Whether legal or exchange action will be required
- The fees and possible additional costs
- Whether any outcome is being guaranteed
No legitimate investigator can guarantee that stolen cryptocurrency will be recovered.
What Should Victims Do After Cryptocurrency Fraud?
Victims should act promptly while avoiding further payments or contact that could increase the loss.
Practical steps may include:
- Contact the bank or payment provider
Report any conventional payment used to purchase or transfer the cryptocurrency.
- Contact the exchange
Provide the relevant transaction details and ask the platform to preserve records or review any account involved.
- Preserve the evidence
Retain transaction identifiers, wallet addresses, messages, emails, bank records, platform screenshots and account statements.
- Secure relevant accounts
Change compromised passwords and review email, exchange and banking security.
- Report the fraud
Make reports to the appropriate authorities and provide accurate transaction information.
- Obtain legal advice where appropriate
Legal advice may be particularly important where the value is substantial, an exchange has been identified or urgent protective measures may be considered.
- Assess whether tracing is proportionate
A preliminary review can consider the value of the loss, the available identifiers, the transaction route and the likely cost of further work.
Victims should not pay additional supposed taxes, release charges, verification fees or insurance deposits demanded by the fraudster.
What Can a Cryptocurrency-Tracing Report Include?
Depending on the available information and scope, a report may include:
- Confirmation of the initial transaction
- A visual map of the movement of funds
- Relevant wallet addresses
- Transaction dates and amounts
- Cryptocurrency conversions
- Cross-chain movements
- Identified exchanges or service providers
- Connections to other known wallets
- Indicators of aggregation with other victims’ funds
- Possible links to conventional financial accounts
- Jurisdictions and legal entities requiring further attention
- Limitations in the available evidence
- Areas requiring exchange, banking or legal disclosure
Reports should distinguish clearly between:
- Confirmed blockchain transactions
- Attributed wallets or accounts
- Probable connections
- Possible connections
- Unverified intelligence
Transaction mapping does not, by itself, prove that a particular person committed fraud or legally owns every asset passing through a wallet.
Can Stolen Cryptocurrency Always Be Traced?
No.
Some cases provide a clear transaction trail from the victim’s wallet to an identifiable exchange. Others become substantially more difficult because of privacy-enhancing technology, unsupported networks, false identities or services operating in uncooperative jurisdictions.
The feasibility of a trace may depend on:
- The quality of the starting information
- The blockchain and assets involved
- How quickly the matter is reviewed
- The number of transactions
- The use of cross-chain or privacy services
- Whether an identifiable platform is involved
- Whether relevant conventional financial records exist
- The value of the loss
- The jurisdictions involved
A preliminary assessment should establish what can realistically be examined before a broader investigation is commissioned.
Cryptocurrency Asset Tracing Services
Conflict International provides Asset Tracing Services for individuals, businesses, law firms and professional advisers dealing with cryptocurrency fraud and disputed digital assets.
Our work may include:
- Blockchain transaction analysis
- Wallet and transaction mapping
- Identification of exchange and service-provider touchpoints
- Cross-chain transaction review
- Connected-party and corporate research
- Conventional asset enquiries where relevant
- Reporting for review by legal and professional advisers
We distinguish confirmed transactions from possible attribution and clearly explain where additional exchange, banking or legal disclosure may be required.
We do not promise that every wallet controller can be identified or that traced cryptocurrency will be frozen or recovered.
To discuss a cryptocurrency asset-tracing matter, contact Conflict International with the available transaction records and supporting information.