You can trace stolen crypto on the public blockchain up to the point where it reaches an exchange or other custodian. The step from that exchange to a bank account is different. It is recorded in the exchange’s private books, not on the blockchain, so it normally takes a law enforcement request, a court order or the exchange’s own compliance process to see it. A good investigation maps the first part in detail and builds the case that gets the second part opened.
This guide explains where the trail is visible, where it stops, what to save, and what a realistic outcome looks like for a victim in the United States.
TL;DR
- Blockchain transfers between wallets are public and traceable. Bank deposits and exchange account holders are not visible on-chain.
- The key moment is the deposit into an exchange. That is where a forensic report can point to a specific platform and account, and where legal process takes over.
- Save transaction hashes, wallet addresses, amounts, dates, and every message with the scammer, then file with the FBI’s IC3.
- Tracing is evidence, not a refund. Private firms cannot seize funds, and anyone promising guaranteed recovery should be treated with caution.
Table of Contents
- What “crypto to bank” tracing actually means
- Where the trail is visible and where it stops
- Why the trail goes cold
- What only an exchange or legal process can provide
- What to do in the first 72 hours
- Perspective: why attribution beats a pretty graph
- What a forensic report for the bank-withdrawal question contains
- Does tracing mean you get the money back?
- Work with Recovera on your trace
- FAQ
- Sources
What “crypto to bank” tracing actually means
People use the phrase for two different situations, and the answer differs for each.
Your own transfer. You sold crypto on an exchange and want to know where the money is, or you want to understand how a withdrawal to your bank works. That is an account matter between you and the exchange. Support staff and your account history answer it, and no forensic work is needed.
Stolen or scammed funds. Someone took your crypto, and you want to know whether it ended up cashed out into a bank account. This is the investigative question, and it is what the rest of this article covers.
In the second case, “tracing” is a chain of three different kinds of evidence:
- On-chain movement. Where your coins went after leaving your wallet, hop by hop, across addresses.
- Platform attribution. Which exchange, payment service or other custodian received them.
- Account and bank records. Who owned the receiving account and which bank account got the fiat money.
The first is open to anyone with the right skills. The second is often possible to infer from patterns. The third is held by private companies and released only through formal channels.
Where the trail is visible and where it stops
The FBI states that law enforcement can trace cryptocurrency transactions on public blockchains. A federal court filing in the District of Columbia describes the same capability: investigators can follow blockchain transactions to see which addresses sent and received particular virtual currency. The same filing notes that officers use both free open-source blockchain explorers and commercial analysis tools.
Here is how the journey from wallet to bank usually breaks down.
| Stage | What happens | Who can see it | What it takes |
|---|---|---|---|
| Your wallet to the scammer’s first address | Funds leave your control | Anyone, on a public explorer | Your transaction hash |
| Intermediary addresses | Funds are split, merged or passed through many wallets | Anyone with tracing skills | Time and analytical tooling |
| Mixers, bridges, chain swaps | Funds change path or blockchain | Partly visible, harder to read | Specialized forensic methods |
| Deposit into an exchange | Coins arrive at an address controlled by a platform | Visible on-chain as a deposit | Address attribution |
| Exchange account and trading | Funds are credited to an account holder | The exchange only | Subpoena, warrant or exchange process |
| Withdrawal to a bank | Fiat money moves to a bank account | The exchange and the bank | Legal process |
The first four rows are blockchain forensics. The last two are not. That boundary is why a trace can tell you a platform received your funds but cannot, on its own, tell you whose bank account was paid.
How investigators follow funds to an exchange
The court filing mentioned above gives a concrete example of what the work looks like. Investigators traced victim funds through intermediary addresses and OKX accounts to the subject addresses. Using a method called LIFO tracing, they followed funds from initial deposit addresses through intermediary addresses to 22 accounts on that platform. They then linked those accounts by matching IP addresses, KYC details and other account information.
Notice what made the last step possible: the account data came from the exchange, not from the chain. The blockchain got the investigators to the door, and the platform’s records told them who was inside.
If your funds moved from one platform to another before cashing out, the trail has extra stages. Our guide to exchange-to-exchange tracing explains how those hops are reconstructed.
Why the trail goes cold
Several things make real cases harder than the diagrams suggest.
Linking addresses to people. An FBI law enforcement bulletin said that when investigating Bitcoin, the greatest challenge may be linking addresses to a real person. Addresses are pseudonymous. Identity comes from exchange records, device data, communications and other outside evidence.
Jurisdiction. The FBI notes that crypto’s global reach can create jurisdictional challenges for U.S. law enforcement, especially when funds enter countries with weak anti-money-laundering rules.
Obfuscation. Scammers often move funds through many wallets, swap assets, use cross-chain bridges or route through mixing services. These steps do not make tracing impossible, but they multiply the work and can leave parts of the trail as probabilities rather than certainties.
Speed. Funds that sit in a scammer’s wallet can be frozen only if someone acts. Funds that have already hit an exchange and been withdrawn are much harder to reach. That is why the first hours matter, and why we wrote about the 24 to 72 hour window to seek an exchange freeze.
What only an exchange or legal process can provide
Two points from the FBI’s 2023 guidance are worth knowing before you hire anyone. Private-sector recovery companies cannot issue seizure orders, and exchanges typically freeze an account only under their own internal processes or in response to legal process.
In practice, this means:
- Account holder identity (name, ID documents, IP logs, linked bank accounts) comes from the exchange through a subpoena, warrant or a law enforcement request.
- Bank account details come from the bank, again through legal process.
- Freezes and seizures come from the exchange’s compliance team acting on a credible report, or from a court or agency with the authority to seize.
Federal agencies have formal rules for handling seized digital assets. For example, DHS’s HSI Directive 18-04, issued in 2018, sets policy for the seizure, handling and disposition of cryptocurrency as high-risk property in federal investigations.
So what does a private forensic report add? It organizes the trail into something a compliance team, a prosecutor or a civil attorney can act on quickly: clear hashes, a map of the flow, the platforms involved and the deposit addresses to ask about. A police report with a vague description tends to wait. A report that names the exact deposit address and the transaction hash gives everyone something to check.
What to do in the first 72 hours
You do not need to understand tracing to do the most useful things.
1. Save the technical record
The FBI asks victims to provide addresses, amounts and types of cryptocurrency, transaction hashes, dates and times, and other information about the scam such as communication platforms, website domains and phone numbers. Copy these before anything changes. Take screenshots of the exchange or wallet history, and export the transaction records where the platform allows it.
2. Save the human record
2023 FBI guidance on scam victims asks you to preserve how you met the scammer, emails and texts, phone numbers, website domains or apps used, and details of any exchanges involved. Do not delete chats, even embarrassing ones. They help attribute the scheme to a person or group.
3. Report to the FBI’s IC3
File at the Internet Crime Complaint Center. If you do not have every transaction hash, the FBI still encourages you to file with whatever information you have. Our walkthrough on how to file an IC3 complaint and preserve crypto evidence covers the fields that matter, and our 24-hour action list for U.S. victims puts the whole sequence in order.
4. Contact the exchange you used
If you sent funds from an exchange account, tell its fraud team immediately with the hashes. If your funds are known to have reached a particular platform, a report to that platform’s compliance team, backed by your IC3 complaint number, gives it a reason to act. Where a card or bank payment funded the purchase, also look at whether a dispute is possible; see our overview of crypto chargebacks for victims and counsel.
5. Get the trace done properly
Free block explorers show you the first hops. They rarely show the full picture once funds split across dozens of addresses. Commissioning a cryptocurrency tracing investigation produces a document that follows the flow end to end and flags the points where legal process can reveal more.
Why order matters: the same hash that starts your IC3 report starts the trace. Collect it once, then use it everywhere.
Perspective: why attribution beats a pretty graph
We see the same pattern in many cases. A victim arrives with a screenshot from a free explorer showing their funds moving through three or four addresses, and they assume the rest is a matter of following the line. The line is rarely the hard part. The hard part is deciding which address in a web of hundreds is the one a platform controls, and proving it in a way someone else can check.
That is where we put our effort. We reconstruct flows through mixers and bridges where the evidence allows, tie wallet behavior to known patterns in fraud networks, and write the results as a technical report designed for use in legal proceedings. We work directly with law firms because a tracing report is most useful when it reaches the people who can send a subpoena or file a motion.
We also tell victims plainly what a report is. It is not a seizure order, and we do not promise outcomes. It is the groundwork that makes an exchange freeze request, a police referral or a civil claim specific enough to be acted on. A transparent process, with the steps explained in plain language, is part of how we try to treat people who are already having a terrible month.
cristian
What a forensic report for the bank-withdrawal question contains
If your goal is to learn whether and where stolen funds were cashed out, a solid report typically covers:
- Transaction map. Every hop from your wallet to the endpoint, with hashes, timestamps and amounts.
- Methodology. How hops were attributed, including any assumptions about co-spending, timing or the accounting method used to follow mixed funds.
- Platform identification. The exchanges or services that received funds, and the specific deposit addresses.
- Behavioral links. Connections to other wallets or cases that suggest a common operator.
- Open-source findings. Domains, social accounts and public records that tie the scheme to identifiable entities.
- Limits. Clear statements of what is established and what is inference.
The last item is not a weakness. Courts and compliance teams trust reports that separate fact from inference. Our notes on admitting blockchain evidence in U.S. court and the checks analysts run on wallet activity explain what that separation looks like in practice.
Does tracing mean you get the money back?
No, and it is better to hear that now. Tracing identifies where funds went. Recovery happens only if someone with authority freezes or seizes them, or a court awards them to you and the defendant can be reached.
Chainalysis, a blockchain analytics firm, makes the point that rapid identification of crypto assets can help facilitate arrests, increase seizure and recovery, and aid prosecutions. That describes improved odds, not guarantees, and the sooner the identification, the better those odds.
Recovery scams are a second wave
Victims are a target for follow-up fraud. The FBI cautions victims to be wary of anyone claiming they can recover their funds, because the offer may be another scam. A 2024 FBI field office warning also advises not to pay additional fees or taxes that a scammer says are needed to unlock or withdraw frozen funds.
When you evaluate any investigator, including us, look for these signs of a legitimate engagement:
- It describes the work as investigation and reporting, not a guaranteed return.
- It explains that it cannot seize funds itself.
- It does not ask you to send crypto to “unlock” anything.
- It gives you a written scope and the deliverable you will receive.
- It can explain, in plain terms, how it reached any conclusion.
We discuss this in more depth in our piece on whether a crypto recovery scam risk makes paid forensics worthwhile.
Work with Recovera on your trace
If your funds were taken in a scam, phishing attack or fraudulent trading platform, our team investigates the flow of assets, preserves the digital evidence and prepares a technical report built for legal use. Our scam investigation and evidence preservation services cover cryptocurrency tracing, OSINT attribution, Forex and online trading fraud, and gambling-related claims. Law firms can look at our services for professional offices. Pricing is set per engagement, so contact us with your case details for scope.
FAQ
Can the FBI trace crypto to a bank account?
The FBI says law enforcement can trace transactions on public blockchains. To reach the bank side, agents typically use legal process directed at the exchange and the bank, because those records are not public. That is why a complete IC3 report matters: it gives investigators the addresses and hashes to start from.
Can I find out who owns a wallet address?
Not from the blockchain alone. Addresses are pseudonymous, and identity usually comes from an exchange’s account records, which are released through legal process, or from outside evidence such as messages and domains. A forensic report can attribute behavior and link addresses to each other, which narrows where to ask.
What if I only have a screenshot and no transaction hash?
File anyway. The FBI encourages victims to submit whatever information they have. An investigator can often reconstruct the hash from your wallet address, the amount and the approximate date, so keep your wallet or exchange history intact.
How long do I have before the trail is lost?
The blockchain record does not expire, but your chances of a freeze shrink quickly once funds leave an exchange. Act within the first one to three days if you can, and read our guide to stolen crypto and exchange freezes. Late reports are still worth filing, since they can link to other victims’ cases.
Do I need a lawyer as well as a forensic investigator?
If you want to pursue a civil claim, a subpoena or a court order, yes. The investigator builds the technical evidence, and an attorney uses it to ask a court or platform for action. We work with law firms for exactly that reason.
Sources
- Cryptocurrency, Internet Crime Complaint Center (IC3)
- U.S. District Court for the District of Columbia filing on tracing victim funds
- FBI Guidance for Cryptocurrency Scam Victims, IC3 (2023)
- Increase in Recovery Scams, IC3 (2023)
- FBI Guidance for Cryptocurrency Scam Victims, PSA 8.16.2023
- HSI Directive 18-04: Seizure and Forfeiture of Cryptocurrency
- Virtual Currency: Investigative Challenges and Opportunities, FBI Law Enforcement Bulletin
- Cryptocurrency Investment Fraud a Growing Problem in Maryland, FBI Baltimore
- Cryptocurrency Field Guide for Law Enforcement, Chainalysis
