Rug pull · DeFi exploit
The liquidity is gone. The trail is not.
Whoever drained the pool had to move the funds somewhere, and every hop is recorded permanently on a public ledger. Start from the deployer or pool address and follow it to the point where it reaches an exchange, which is where a person can be identified through legal process.
Tracing is not recovery
No tool reverses a blockchain transaction, so treat any guarantee that funds come back as a claim nobody can honestly make. What tracing produces is evidence: a documented path, a named exchange, and a date. That is what law enforcement and a receiving exchange can act on.
How the money usually moves
- 01Liquidity leaves the poolThe paired asset is withdrawn to an address the operators control, often the deployer or an address it funded.
- 02It splitsThe balance is broken across several fresh addresses to make the flow harder to follow by eye. Splits are trivial to follow programmatically, because each one is a transaction.
- 03It bridges or swapsFunds are often moved to another chain or converted to a stablecoin. A canonical bridge deposit names its destination in the transaction the sender signed.
- 04It reaches an off-rampSooner or later the proceeds hit an exchange with know-your-customer records, or a mixer. The exchange is the actionable end of the trail.
What the report gives you
The path out of the pool
Follow the withdrawn liquidity hop by hop from the deployer or pool address, across splits and consolidations, with every transaction cited so anyone can check it on a block explorer.
Off-ramps worth a subpoena
Where funds reached a fiat exchange, the account holder can usually be identified through legal process. Leads are graded in three evidence tiers, so you know which are dated direct deposits and which are inferred before you draft anything.
Mixers, bridges and sanctioned addresses
Movement into a mixer is flagged as a signal rather than proof. Where funds cross to another chain through a canonical bridge, the destination is read from the deposit transaction's own calldata and the trace continues there as a separate linked report.
A wallet that is still being watched
Put the deployer address under monitoring and you get an email within the hour of its next transaction. Dormant proceeds often move months later, and that movement is the moment a freeze becomes realistic.
When many people were hit at once
A rug pull has one deployer and one pool, and every holder was harmed through the same two addresses. That means a single trace describes the common trail for everyone affected, which is worth more than a hundred separate accounts of the same event. Group the reports under a matter, add your own commentary, and export the whole file as one branded PDF. Every report carries a content hash so a recipient can confirm it is unaltered at walletdna.com/verify without an account, which matters when the same exhibit is circulating among counsel for many claimants.
What to do now
Preserve everything
The token contract address, the pool address, your own transactions, and every screenshot of the project's promises. Sites and social accounts disappear quickly after a pull.
File with law enforcement
In the US that is ic3.gov. Attach the trace. A report naming a specific receiving exchange and date is far more actionable than a narrative account.
Write to the receiving exchange
Compliance teams act on credible, documented reports more often than people expect. Include the transaction hashes and the police report number.
Watch the deployer wallet
Proceeds frequently sit still for months. Monitoring turns the next movement into an email within the hour.
Questions
What is a rug pull?
A token or DeFi project whose operators take the pooled funds and abandon it. In the common form, the team seeds a liquidity pool, promotes the token, then withdraws the paired asset once enough buyers have entered, leaving holders with a token nobody will buy. Variants include a mint function that dilutes holders without warning, a transfer restriction that lets buyers in but not out, and a contract upgrade that redirects withdrawals.
Is a rug pull the same as a DeFi exploit?
Not quite, and the difference matters for what you file. A rug pull is the operators taking the funds. An exploit is an outside attacker using a flaw in the contract. On-chain the money often moves the same way afterwards, so the tracing work is similar, but who you are pursuing, and under what theory, is not.
Can the funds be traced if the team was anonymous?
The funds, yes. The people, not from the chain alone. Every movement of the drained liquidity is public and permanent, so the trail to an exchange or a bridge is fully visible. Turning an address into a person happens off-chain, through the exchange that received the funds, under legal process. Anonymity is a discovery problem, not a tracing problem.
What address should I start from?
The most useful starting points are the token contract's deployer address, the liquidity pool address, and the address that received the withdrawn liquidity. Any block explorer shows these from the token contract. Your own transaction to the pool is also a valid start, since it dates your loss and leads to the same pool.
Hundreds of people were hit. Does that help?
It usually does. Victims of the same rug pull are nearly always harmed through the same deployer address and the same pool, so one trace describes the common trail for everyone. That shared record is what a coordinated set of IC3 filings, or a class action, is built on. It also raises the profile of the underlying complaint at a receiving exchange.
Can WalletDNA get my money back?
No, and nothing can reverse a blockchain transaction. What tracing does is produce evidence: where the funds went, which regulated exchange received them, and when. That is what law enforcement and an exchange's compliance team can act on.
Start from the deployer address
Free to run, across 18 chains. The theft case flow documents it, traces it, and puts the wallet under monitoring in one pass.
Start a case, free