An exchange internal transfer moves value between two customer accounts on the same platform by changing balances in the exchange’s own database. Nothing is necessarily written to the public blockchain. That is why stolen funds can seem to vanish once they reach an exchange, and why the exchange’s records, not just blockchain data, often decide whether a case moves forward. If your account was taken over, the steps in the first hours matter more than anything else.
TL;DR
- An internal transfer between exchange customers can change balances without creating a public transaction, so a blockchain explorer alone cannot show where the money went.
- Only the exchange holds the records that tie deposits and withdrawals to specific customers. Investigators reach those records through law enforcement requests, legal process and well-built forensic reports.
- If your account was hacked, stop sending funds, secure the account, and preserve screenshots, transaction logs, emails and wallet addresses before anything else.
- Report to the FBI’s IC3 and the FTC. Only law enforcement can order a freeze, and a firm that promises to freeze your funds is a red flag.
- A forensic report that documents the on-chain trail up to the exchange gives you and your lawyer something concrete to put in front of investigators.
Table of Contents
- What an exchange internal transfer actually is
- How tracing stops at an exchange, and where it can continue
- Signs your exchange account was taken over
- What to do in the first hours
- What evidence to preserve
- Reporting in the United States
- Legal options and deadlines
- How a forensic investigation helps when the trail enters an exchange
- Work with Recovera Forensics
- FAQ
- Sources
What an exchange internal transfer actually is
When you send crypto from a private wallet to an exchange, you send it to a deposit address. On the blockchain, that looks like a normal transaction. After that, the exchange credits your account in its own books. If you then “send” funds to another user of the same exchange, many platforms treat it as a ledger entry: your balance goes down, the other balance goes up, and no new blockchain transaction is needed.
The WJN article on internal ledgers and blockchain evidence makes the same point: a transfer between customer accounts can change balances without creating another public transaction to follow, so the public chain alone cannot reveal the movement. Securities Analytics goes further and estimates that internal transactions at crypto exchanges run about ten times the volume of on-chain transactions, recorded on the exchange’s internal ledger instead.
The pooling is part of the picture too. Chainalysis compares a deposit to handing a $20 bill to an ATM: the service moves funds around internally, pooling and co-mingling them with other users’ funds, and you do not get the same bill back later. So even a withdrawal that happens minutes after a deposit may not be the “same” coins.
Why this matters if your crypto was stolen
Public blockchains are useful to investigators precisely because they are permanent. The FBI’s IC3 notes that cryptocurrency transactions are permanently recorded on public ledgers, which lets law enforcement trace money. Internal transfers are the gap in that record.
A federal civil forfeiture action described by Protos shows how serious the gap can be. Off-chain transfers within one large exchange’s ecosystem are not recorded on the public blockchain, and the filing said that layering makes it extremely difficult to trace funds forward to a cash-out point or backward to the original source. A victim’s trail can end at an exchange deposit address without any visible next hop.
How tracing stops at an exchange, and where it can continue
A typical theft trace looks like this: funds leave your wallet or account, pass through several intermediate addresses, and arrive at an address that belongs to an exchange. Mallesons Pulse describes what happens next: tracing stops because exchanges often use the same wallet for multiple customers, and customer-to-customer transactions may be carried out off chain in the exchange’s ledger. That article discusses courts in England and Wales, but the technical point holds anywhere.
Chainalysis states it plainly: only the exchange knows which deposits and withdrawals belong to which customers, and that information sits in order books that are not visible on blockchains or in analysis tools. The practical consequence is that the investigation has two halves.
| Stage | Where the data lives | Who can get it |
|---|---|---|
| Your wallet or account to the exchange deposit address | Public blockchain | Anyone, but reading it correctly takes forensic skill |
| Inside the exchange (internal transfers, account holder identity, KYC, login data) | Exchange’s private ledger and databases | The exchange, law enforcement, courts through legal process |
| Exchange withdrawal onward | Public blockchain again | Anyone, once the withdrawal address is known |
Investigators work both ends. They build the strongest possible on-chain case up to the deposit address, then use that evidence to ask the exchange, through the proper channel, for what only it can see. Chainalysis advises investigators to contact the service or subpoena it for post-deposit information, since the exchange’s internal records are required after deposit. After the exchange answers, the trail can pick up again at a withdrawal address.
We cover the on-chain half in more detail in our guide to blockchain forensics and how to trace and prove crypto fraud, and the bank end of the story in tracing crypto to a bank account.
Signs your exchange account was taken over
An account takeover is the other reason people search this topic. The attacker logs in as you and moves funds out, sometimes to another account on the same exchange, which is exactly the internal transfer that leaves no public record. Bitget’s support center lists the signs of a possible hack: unfamiliar logins, unauthorized transactions, changed account settings, and security alerts about password or 2FA changes.
In practice, watch for:
- Emails about a login from a device or location you do not recognize.
- Password reset or two-factor authentication change notices you did not request.
- Withdrawal or transfer confirmations for activity you did not make.
- New withdrawal addresses on your whitelist, or changed API keys.
- Your phone suddenly losing service, which can point to a SIM swap. If that happened, see our page on SIM swap crypto investigations.
Phishing is a common way in. If you entered credentials on a fake login page or signed a malicious approval, our phishing crypto recovery playbook walks through the first hours.
What to do in the first hours
Speed matters because funds can be moved on and cashed out quickly. Our own guidance on how long victims have to seek an exchange freeze is built around the first 24 to 72 hours. A sensible order of actions:
- Stop further losses. Chainready’s advice, as summarized by NatLawReview, includes not sending any more crypto anywhere until you understand what happened.
- Preserve evidence first. The same source says to preserve wallet addresses, transaction IDs or hashes, and screenshots of communications before taking other action.
- Contact the exchange through its official support channel, tell it the account was compromised, and ask that the account be secured. Use the exchange’s app or its typed-in web address, not links in emails.
- Secure what you still control. Change passwords on your email and exchange accounts from a clean device, and move to an authenticator app or hardware key instead of SMS codes.
- Report to law enforcement (details below).
Order matters in step 2 because locking down accounts can change what you see on screen. Capture it first.
What evidence to preserve
Kaplan Rothstein Prüss Peraza recommends capturing screenshots of the dashboard showing balances, recent transaction history and unauthorized transfers, exporting transaction logs as CSV or PDF with timestamps, wallet addresses and amounts, and saving related emails about login attempts, password resets and 2FA changes, plus SIM-swap communications if they apply. NatLawReview adds email headers and platform URLs to the list.
Build a simple folder with:
- Full-page screenshots with the date and time visible, taken before you change anything.
- Exported account statements and transaction histories from the exchange.
- Every transaction hash, source address and destination address involved.
- The original emails with headers, not forwards.
- A written timeline: when you last used the account legitimately, when you noticed the problem, what you did next.
- The names, handles and phone numbers of anyone who contacted you.
Why so much detail? Because the person reviewing your case, whether an investigator, an exchange compliance team or a judge, needs to rely on it. We explain how to keep it reliable in our guides to digital evidence preservation and crypto chain of custody.
Reporting in the United States
The IC3 encourages victims to submit an Internet Crime Complaint online and to include transaction details such as addresses, amounts, hashes and timestamps. NatLawReview also points to the FTC’s ReportFraud.ftc.gov for consumer fraud reports and notes that reporting to several agencies can help the case get linked into larger investigations.
Our step-by-step page on filing an IC3 complaint shows what to put in each field, and what to report to trigger a police crypto investigation explains how reports reach investigators.
Freezes come from law enforcement
Chainabuse’s safety center states that only law enforcement can issue a freezing order once it identifies where funds are, recommends reporting ideally the same day, and warns that private firms promising to freeze funds are likely scams. We agree with that. What a forensic firm does is different: it documents the trail so that the people with legal authority can act on it quickly and with confidence.
Legal options and deadlines
Internal transfers can end with funds sitting in an account that the exchange or authorities later restrict. If the government seizes property and starts a nonjudicial civil forfeiture, the deadlines are short. Under 18 U.S.C. § 983(a)(2), a claim may be filed by the deadline stated in a personal notice letter, no earlier than 35 days after mailing; if the letter never arrives, the claim is due no later than 30 days after final publication. After a claim is filed, the government has 90 days to file a forfeiture complaint or return the property pending one.
Hodder Law notes that when the DEA seizes assets it generally has 60 days from seizure to send written notice, and that deadlines run from the date of mailing or publication, not from when you see the notice. Check your mail and the email on file with exchanges, and talk to an attorney at once if you receive anything.
In a civil suit, DigitalAsset.Law explains that the judgment is only worth what can actually be collected against it, and that limitation periods vary by claim and by jurisdiction, and may start when the fraud was or should have been discovered. Ask a licensed attorney about your own deadlines early. If you are exploring card or bank routes, read about crypto chargebacks.
Our perspective
Most victims arrive with the same belief: the blockchain is public, so someone can simply look the money up. For the first part of the trail that is true. Then the funds hit an exchange and the picture changes, because the exchange’s ledger is private.
We think the answer is not to give up at the deposit address, and not to promise what no private firm can deliver. The answer is a rigorous forensic reconstruction of everything that is visible: the path from your wallet, the clustering of related addresses, the way funds pass through mixers and bridges, and the exact deposit addresses where the trail enters an exchange. That is what makes a request to an exchange or an agency specific enough to act on.
Our approach is to analyze transaction patterns on public blockchains, connect wallet activity to potential fraud networks, and put it in a report suitable for legal proceedings. We work directly with law firms and with individual victims, and we explain each step of the process plainly.
cristian
How a forensic investigation helps when the trail enters an exchange
A good investigation does several things at once.
It pins down the last visible point. Many victims only have a scammer’s wallet address or a screenshot. A forensic analyst follows every hop, identifies the exchange deposit addresses and records the transaction hashes, timestamps and amounts. You can see how we approach this in identifying scam wallets within hours and wallet activity analysis.
It looks for patterns beyond one wallet. Scam operations rarely use a single address. Linked deposits to the same exchange, repeated timing and shared funding sources can connect your case to others, which is the kind of link NatLawReview describes when reports are tied into larger investigations.
It adds open-source context. OSINT work on domains, social profiles and contact details can help attribute activity to real-world actors, which is useful for the exchange’s compliance team and for counsel.
It produces something a court or agency can read. Screenshots of a block explorer are not enough. Reports need methods, sources and clear documentation. Our pages on using crypto forensics in court and forensic affidavits explain what that means, and law firms can look at our SEC-ready crypto fraud reports.
What a report cannot do is force an exchange to hand over records. That requires law enforcement or a court order. The report’s job is to make that request credible and fast.
Work with Recovera Forensics
If your funds moved through an exchange, we can investigate the on-chain trail, preserve the evidence and prepare a technical report for your attorney or for law enforcement. Our cryptocurrency scam investigation and evidence preservation services are available to individuals, and our services for law firms and professional offices cover technical analysis and documentation. Pricing is set per engagement, so contact us through the site to discuss your case. For a wider overview, start with our crypto fraud investigation action guide.
FAQ
Can stolen crypto be traced after it enters an exchange?
The public blockchain shows the funds up to the exchange’s deposit address. After that, the movement may be recorded only in the exchange’s internal ledger, which investigators can reach through law enforcement requests or legal process. If the funds later leave through a withdrawal, the trail becomes visible on-chain again.
What should I do if my exchange account was hacked?
Stop sending funds, then capture screenshots, transaction logs, emails and wallet addresses before changing settings. Next, contact the exchange through its official channel, secure your email and 2FA, and file reports with the IC3 and the FTC. Speak to an attorney about deadlines that apply to your situation.
Can a private company freeze my stolen funds?
No. Chainabuse states that only law enforcement can issue freezing orders, and it warns that firms promising freezes are likely scams. A legitimate forensic firm documents the trail so that law enforcement and the exchange can act on it.
Does an internal transfer mean the money is gone?
Not necessarily. The movement is hidden from the public chain, but the exchange still has a record of which accounts were involved, including account holder information. That is why prompt reporting and a well-documented case matter.
Sources
- FBI details how USDT is laundered through Binance | Protos
- Chainalysis explains how it uses Reactor to track and analyze blockchain transactions | Crowdfund Insider
- Crypto Fraud Evidence: Internal Ledger and Blockchain | WJN
- Fraud within Crypto Companies | Securities Analytics
- Locating stolen cryptocurrency: disclosure orders | Mallesons Pulse
- What Should I do if My Account is Hacked? | Bitget Support
- Strategies for Successful Cryptocurrency Recovery After a Scam | NatLawReview
- How To Preserve Evidence After A Crypto Account Hack | Kaplan Rothstein Prüss Peraza
- Cryptocurrency | Internet Crime Complaint Center (IC3)
- Reporting your case to law enforcement | Chainabuse Safety Support Center
- 18 U.S.C. § 983: General rules for civil forfeiture proceedings
- The DEA Seized My USDT or USDC: What Happens Now? | Hodder Law
- Crypto Fraud & Asset Recovery | Digital Asset Law
