How to Track Stolen Crypto: A Step-by-Step Guide

If your cryptocurrency was stolen — through a scam, a phishing attack, a compromised wallet, or a rug pull — there are steps you can take immediately to trace where the funds went. This guide explains what's realistically possible and how to do it.

Why blockchain tracing works

Unlike a stolen bank transfer, crypto transactions are permanently recorded on a public ledger. Every transaction — including the one that drained your wallet — is there forever, visible to anyone who knows how to read it.

What blockchain analysis does is follow that trail: from your wallet to the thief's address, then to wherever they moved the funds next. Often, stolen funds eventually land at a centralised exchange — and exchanges have KYC data on their users. If law enforcement can compel the exchange to identify the account holder, recovery becomes possible.

Step 1: Get the thief's address immediately

Before anything else, you need the address the funds were sent to. Find it in your wallet's transaction history — it should be the most recent outgoing transaction. Copy it and save it somewhere safe.

If your wallet was compromised (private key stolen) rather than you sending to a scammer, look for the transaction that drained your wallet — the destination address is what you need.

Step 2: Run a fund flow analysis

Paste the thief's address into WalletDNA. The fund flow analysis will trace where the funds went after they arrived at that address — up to 2 hops.

What you're looking for:

• Exchange deposits. If the funds moved to a known exchange (Binance, Coinbase, Kraken, etc.), that exchange has KYC on the receiving account. This is your best lead.
• Mixer inputs. If the funds went into a mixer (Tornado Cash, etc.), the trail becomes harder to follow but not impossible — and mixer use is itself a red flag that law enforcement takes seriously.
• Dormant wallets. Sometimes funds sit. If the address is holding your funds and hasn't moved them, there's more time to act.
• Known scammer addresses. The address may already be in WalletDNA's database as a known threat actor, which means others have been victimised and there may already be an active investigation.

Step 3: Download the PDF report

WalletDNA generates a PDF with the full analysis — risk score, entity attribution, fund flow diagram, AI narrative, and evidence links. Download it immediately.

This PDF is your documentation. You will need it for every step that follows. Having a clean, professional report significantly increases the chance that law enforcement and exchanges take your case seriously.

Step 4: Report to the receiving exchange

If the fund flow analysis identified an exchange deposit, contact that exchange directly. Most major exchanges have a dedicated fraud or law enforcement team. Submit:

• The destination address on their platform
• The transaction hash showing the transfer
• Your WalletDNA PDF report
• A brief description of how the theft occurred

Exchanges cannot freeze accounts without legal process in most jurisdictions, but they can flag the account internally and cooperate with law enforcement. Acting quickly — before the funds are moved to another address or withdrawn — is critical.

Step 5: File a report with law enforcement

File reports with all relevant authorities. In the US, this means the FBI's Internet Crime Complaint Center (IC3) at ic3.gov and your local FBI field office. In the UK, Action Fraud. In the EU, your national cybercrime unit.

Include your WalletDNA report. Law enforcement agencies increasingly have blockchain analytics capability and may be able to take the trace further than consumer tools allow. They can also compel exchanges to freeze accounts — which you cannot do as a private individual.

Do not expect a rapid response. These investigations take time. But filing creates a record, and if there are other victims of the same scammer, your report contributes to a case that may already be building.

Step 6: Consider a crypto recovery specialist

For losses over $10,000, it may be worth consulting a specialist crypto recovery firm or legal team. Be cautious: this space has its own scammers who promise recovery and charge fees upfront. Legitimate specialists work on contingency or charge only for documented investigation time.

A credible firm will ask for your blockchain trace data — exactly what WalletDNA produces — before agreeing to take a case.

What not to do

• Don't pay upfront "recovery fees." Anyone who guarantees crypto recovery and asks for payment first is a scammer running a secondary fraud on victims.
• Don't interact with the thief's address again. Sending small amounts to “test” or provoke a response is ineffective and may complicate any legal case.
• Don't wait. Crypto moves fast. The sooner you trace and report, the better.