Crypto that has been stolen from you is usually not hidden in the way people fear. Every transaction sits on a public ledger, so the money leaves a trail you can follow. What is hidden is the identity behind the wallets that received it. Finding the assets means tracing the movement hop by hop. Finding the person means reaching a service that knows who they are, usually an exchange, and that step takes legal process rather than a search box.
This guide explains what you can see yourself, what needs professional forensics, and what to do in the first hours so the trail stays usable.
TL;DR
- Crypto transfers are recorded permanently on public ledgers, so stolen funds can be traced even when the owner of the receiving wallet is unknown.
- Tracing follows value between addresses. Attribution, meaning who controlled an address, is a separate and harder step.
- The most useful end point of a trace is usually an exchange deposit address, because exchanges typically hold identity records that law enforcement can request.
- Save transaction hashes, addresses, chats and domain names now, and report to the FBI’s IC3.
- Be wary of anyone who asks for an up-front fee to “recover” funds. Recovery fraud is a documented second wave of scams.
Table of Contents
- What “hidden” really means on a blockchain
- Step 1: Preserve everything before you trace anything
- Step 2: Follow the funds with a public explorer
- Step 3: Find the point where identity exists
- When the trail gets harder: mixers, bridges and chain hopping
- Who can act on what you find
- Work with a forensic team on your case
- Protect yourself from recovery scams
- FAQ
- Sources
What “hidden” really means on a blockchain
People search for hidden crypto assets in two situations: they were scammed and the money vanished, or they suspect someone is concealing digital holdings. This article is written for the first group, scam and theft victims, and for the lawyers who support them.
The starting fact is encouraging. According to the FBI’s Internet Crime Complaint Center, cryptocurrency transactions are permanently recorded on publicly available distributed ledgers, which lets law enforcement follow money in ways that other financial systems do not allow. The FTC describes the same thing in plain terms: a blockchain is a public list of every cryptocurrency transaction, covering both the paying and the receiving side.
So the money is not invisible. Three things make it feel that way:
- Addresses are strings, not names. A wallet address says nothing about who holds it.
- Volume and speed. Scammers split funds across many addresses and move them within minutes.
- Obfuscation tools. Mixers, bridges between chains and rapid swaps are used to break the visible link between source and destination.
A professional framework separates two jobs. As a UK practitioner guide on crypto asset investigations puts it, tracing follows the value of assets between addresses, while attribution seeks to identify the person who controlled an address at a specific time. Keeping those two apart will save you from most false hopes. You can often trace on your own. You almost never attribute on your own.
Step 1: Preserve everything before you trace anything
A trace is only as good as the starting data. Before you open an explorer, collect and store what you have, in a folder that you do not edit afterward.
The FBI asks victims who report to provide transaction addresses, amounts and types, dates and times, transaction hashes, communications with the scammer, domain names, website addresses or applications, and associated identifiers. Use that list as your checklist. In practice:
- Transaction hashes (TXIDs). Copy each one from your wallet or exchange history. Also copy the receiving address for every transfer you made.
- Exact amounts, asset and network. “USDT” on one network is not the same trail as “USDT” on another, so note which one you used.
- Timestamps with time zone. Your records and the ledger need to line up.
- Every message. An OSCE guide on crypto crime lists communication records, promotional materials, identity information used by the scammer, and records of any software installed during the scam among the important evidence. Take screenshots, but also export chats where the app allows it.
- Websites and apps. Save the domain, the URL of any trading dashboard, and the name of any app you were told to install. Do not delete the app.
Do not confront the scammer. The FBI notes that victims should not tell suspected criminals that the FBI is involved, because it can compromise an investigation. For a fuller walkthrough of the first day, see our guide to the first 24 hours after stolen crypto, and for the evidence side, digital evidence preservation for U.S. cases.
Step 2: Follow the funds with a public explorer
You do not need special software to take the first look. Any block explorer for the relevant network lets you paste a transaction hash or address and see where value went next.
A simple routine:
- Paste the hash of your payment. Confirm the receiving address matches what the scammer gave you.
- Open that address and read its history. Note when funds arrived and the next outgoing transaction.
- Follow each outgoing transfer to the next address, and write down every hop: hash, from, to, amount, time.
- Stop and flag the address when it looks like a service rather than an individual wallet, for example one that receives from thousands of unrelated senders.
The documentation habit matters more than the tool. Investigator Nick Furneaux notes in his book on investigating cryptocurrencies that address and transaction formats are confusing enough that investigators can easily get lost without a systematic record of each hop. A spreadsheet with one row per hop is enough for a first pass.
Typical patterns you may see on a scam trail:
- A fast split. Your deposit is divided into several smaller transfers within minutes.
- Peeling. A large balance sheds small amounts to new addresses over a long chain.
- A pause. Funds sit still for days. This is common after the first burst of activity.
- A consolidation. Many addresses feed into a single one, which suggests a common controller or a service.
A public explorer shows you the chain. It does not tell you which addresses belong together or who stands behind them. That is where forensic clustering and attribution come in. Our overview of how blockchain forensics traces and proves crypto fraud explains the method in more depth.
Step 3: Find the point where identity exists
The goal of a trace is not to follow coins forever. It is to reach a place where a real identity is on file. A blockchain group’s law enforcement guide describes the primary goal as following the flow of funds to an entity, such as an exchange, that collects KYC information.
That is why an exchange deposit address is the most valuable find. In the United States, exchanges are treated as money services businesses that register with FinCEN and collect know-your-customer data, and investigators can obtain records, which may include names and IP addresses, with a grand jury subpoena. The same federal bulletin notes that commercial blockchain-analysis tools can cluster addresses to help associate them with an individual or entity.
Two points follow for victims:
- You cannot subpoena an exchange yourself before a case exists. Exchanges generally release account data through legal process, not on request from a victim. What you can do is document the deposit address and give it to law enforcement or your attorney.
- Clustering is evidence-building, not proof of identity. Grouping addresses that are likely controlled by the same party maps the fraud network. Tying that cluster to a named person still needs records from a service provider or other corroboration.
This is the work we focus on: identifying scam wallets within hours and analyzing their behavior with wallet activity checks built for court use.
When the trail gets harder: mixers, bridges and chain hopping
Some trails are clean, and some are deliberately messy. Authorities have shown that messy does not mean untraceable. In a widely reported U.S. Department of Justice case, investigators used public blockchain data and private-sector analysis to follow stolen Bitcoin through chain hopping, peeling and mixing, leading to a seizure of more than US$3.6 billion.
What each obfuscation method does to your search:
| Method | What it does | What it means for the trace |
|---|---|---|
| Peeling chain | Moves small amounts off a large balance repeatedly | Long but followable; patterns help link addresses |
| Cross-chain bridge | Moves value from one network to another | Trail continues on a second ledger; both sides must be matched |
| Rapid swaps | Converts one asset into another | Requires reading the swap transaction, not just the wallet |
| Mixer | Pools funds from many users | Direct link is broken; analysts look at timing, amounts and what happens after the pool |
This is where do-it-yourself tracing usually stops, and where a forensic engagement earns its place. Reconstructing flows through mixers and bridges, and showing the reasoning in a form a court can follow, is the core of our cryptocurrency tracing work.
Who can act on what you find
A trace gives you leads. Action comes from institutions with legal authority.
Law enforcement. In the United States, file a report with the FBI’s Internet Crime Complaint Center at ic3.gov. IC3 asks for transaction details, how you met the scammer, the platforms used to communicate, any web domain involved, and phone numbers or other identifiers. Our guide to filing an IC3 complaint in seven steps walks through the form, and what to report to prompt a police investigation explains how to make a report useful to the people reading it.
Exchanges. If your trace ends at a regulated exchange, a fast notice with the deposit address and hashes can help your attorney or investigators ask that the account be reviewed. Timing matters, because funds that sit in an exchange account one day may be gone the next.
Courts. A lawyer can use a forensic report to support a civil claim, subpoenas to service providers, or a request to freeze assets. The U.S. Department of Justice itself states that the private sector is the first line of defense in detecting suspicious activity, and that timely cooperation between companies and law enforcement is critical. For lawyers, our guidance on admitting blockchain evidence in U.S. court and crypto chain of custody covers how a trace becomes usable evidence.
Keep expectations realistic. A trace does not guarantee that funds come back. It establishes where they went, who may be reachable, and what a court or agency can be shown.
Our perspective
Most victims come to us believing their crypto has disappeared. In nearly every case the first conversation is about the opposite: the ledger kept a record, and the question is whether that record has been read carefully enough.
We built our approach around the gap between a basic wallet lookup and a defensible investigation. A lookup shows you the next address. An investigation connects wallet activity to a wider fraud network, reconstructs flows through mixers and bridges, and documents each step so that a lawyer, an agency or a judge can follow the reasoning without taking our word for it.
We also work directly with law firms, because a trace is worth most when it is written for the proceeding it will be used in. Our reports are designed to be technical and court-ready, and our process is transparent: you know what we are examining and why.
If you are deciding whether to engage a specialist, start early. Evidence preserved in the first days is easier to defend than evidence reconstructed months later.
cristian
Work with a forensic team on your case
If your own trace has stalled at a bridge, a mixer or a cluster of addresses you cannot explain, that is the point to bring in an investigator. We handle cryptocurrency scam investigations, OSINT attribution and evidence preservation, and we prepare technical reports for law firms and professional offices. Our site does not publish fixed prices, because cases are scoped per engagement. Contact us with your hashes and a short timeline and we will tell you what an investigation would involve.
Protect yourself from recovery scams
After a loss, a second wave of fraud often arrives: messages offering to retrieve your money. The FBI warns that scammers sometimes engage in “recovery fraud,” impersonating law enforcement or private firms to get victims to pay for services that never deliver.
IC3 has described the pattern: fraudulent recovery businesses often charge an up-front fee, produce inaccurate or incomplete reports, or stop communicating after an initial deposit. It also notes that law enforcement does not charge victims.
A short checklist before you hire anyone:
- Be skeptical of anyone who contacts you first about your loss.
- Be wary of any promise to recover funds, or any claim of a connection to law enforcement.
- Ask for a written scope: what will be investigated, what the deliverable is, and how the work is billed.
- Ask to see a sample report structure, so you know what you will receive.
- Never pay a “release fee” or “tax” to withdraw funds from a platform. The FBI advises victims to avoid paying additional fees or taxes to withdraw funds if they believe they are already victims.
If you are comparing options, our step-by-step crypto fraud investigation guide shows what a legitimate process looks like from intake to report.
FAQ
Can I find who owns a crypto wallet myself?
You can see a wallet’s transactions on a public explorer, but the ledger does not list names. Identifying the owner usually requires records held by an exchange or another service, which law enforcement can request through legal process. A forensic report can help point investigators to the right service.
Can stolen crypto be traced if it went through a mixer?
Often yes, at least partly. Mixing breaks the direct link, but analysts examine timing, amounts and what happens to funds after they leave the pool. U.S. authorities have traced stolen Bitcoin through mixing and chain hopping in major cases, though results vary by case.
What should I do first after I realize I was scammed?
Save every transaction hash, address, message and website, stop contact with the scammer, and file a report with IC3. Do not tell the scammer that law enforcement is involved, and do not pay any fee to “release” funds. Then decide whether to bring in a forensic investigator or attorney.
Will reporting to the FBI get my money back?
A report does not guarantee recovery, but it puts your case in front of the agency that can use legal process against exchanges and other service providers. A complete report with hashes, addresses and a timeline makes your case far more usable. Pairing it with a forensic trace can strengthen it.
How is a forensic investigation different from a free wallet lookup?
A lookup shows individual transactions. An investigation documents the full flow of funds, groups related addresses, looks for exchange deposit points, and produces a report written for legal use. That documentation is what lawyers and agencies can act on.
Sources
- Cryptocurrency, Internet Crime Complaint Center (IC3)
- What To Know About Cryptocurrency and Scams, FTC
- Cryptocurrency Assets: Investigation, Tracing, Attribution
- Cryptocurrency Investment Fraud, FBI
- Decoding Crypto Crime, OSCE
- Chapter 10: Following the Money, Investigating Cryptocurrencies
- Law Enforcement Resource Guide for Cryptocurrency Investigations
- Consolidated Bulletin, February 2019
- US Department of Justice, aided by cryptocurrency exchanges, DLA Piper
- Cryptocurrency, IC3 reporting guidance
- Report of the Attorney General, U.S. Department of Justice
- IC3 Public Service Announcement, August 2023
