When crypto is stolen, the thief's problem is not holding the coins — it is converting them into something spendable. That almost always means passing them through a service that screens incoming deposits: an exchange, a payment processor, a broker.
AML flagging puts a marker on the stolen transactions in the systems those compliance teams read, so the funds arrive already carrying their history. We do this within four hours of intake, before the freeze request, before the police report, before anything slower begins. Then we keep watching, because stolen funds move.
AML monitoring is not a standalone subscription service here. It is part of the investigation, included from the first hours of a case. If what you need is compliance screening software to run inside your own company, that is a tool vendor's business, not ours, and we will tell you so instead of selling you a case you do not need.
This is the distinction the whole industry blurs, and the one that separates an honest recovery firm from an advance-fee scheme. Flagging is not freezing. Freezing is not repayment.
| Stage | What is true afterwards | Timing |
|---|---|---|
| 1. Flagged to AML providers | The funds carry a marker. They can still move, but they now arrive somewhere with their history attached | within 4 hours of intake |
| 2. Frozen by an exchange, on request | The funds have stopped moving. They are not yours yet | 2–4 days after filing |
| 3. Returned by court decision or issuer payout | The money is back with you. This is the only stage that counts | 6–9 months from an exchange |
Add 2–3 days for the formal block once a police report is in place. Stablecoins: first payout 12–20 months, full repayment around 24 months in quarterly instalments.
Ask any recovery firm "how fast can you get my money back?" A dishonest answer quotes stage 1 or stage 2 (hours, or a few days), because those numbers are real and impressive and answer a different question. Our answer to that question is months, and it is on our data page with everything else.
Six steps, each with the time it actually takes. The flagging is the third of them, and the only one measured in hours.
That is all we need to start — the addresses and transactions involved. A human reads the case, not a form.
Across Ethereum, Bitcoin, Tron, BSC, Polygon and Solana, using industry analytics tooling alongside our own transaction graphs.
Within four hours of intake, so the marker is in place before the funds reach a service that screens deposits.
To the exchanges holding the funds and, for stablecoins, the issuer through its official procedure.
Stolen funds move through exchanges, bridges and mixers; every move is another chance to reach a screening service. Our own signal system watches the traced addresses throughout.
Forensic reports are produced to a standard that holds up in court proceedings, and the legal steps are carried out by partner law firms in the relevant jurisdiction, under our case management.
The tracing behind step 02 is described in full on crypto tracing, the reports behind step 06 on blockchain forensics, and the eleven steps a full case runs through on the recovery process page.
The chains, the counterparties and the threshold — stated so a reader can tell before writing to us whether their case is one we can work.
| Area | Covered |
|---|---|
| Chains | Ethereum · Bitcoin · Tron · BSC · Polygon · Solana |
| Exchange freeze requests | Filed with the exchange holding the funds — Binance, OKX, HTX and others |
| Stablecoin issuers | Filed through the issuer's official freeze procedure; observed response 24–62 hours |
| Jurisdictions | 12, worked from Dubai, with legal steps through local partner firms |
| Analytics partners | Global Ledger and BitOK — both partnerships announced by the partners themselves; BitOK's includes client access to their KYT tooling |
| Case threshold | From $200,000; smaller cases considered individually |
The partnership announcements are on the partners' own sites, linked from our press page. A partnership claimed only on our own page would prove nothing. For stablecoins specifically, the issuer procedure and what it can and cannot do is set out on Tether emission.
A recovery firm is defined by what it turns down. Every line here costs us work, and every one of them is the reason the figures on this site are the size they are.
One case, with the part that is often quoted and the part that is usually left out.
CoinsPaid — recovered for the payment processor, and covered by Bitcoin.com News rather than only by us. The funds in that case were frozen in 48 hours, and that figure describes the freeze, nothing else. The recovery is a separate process on the timescale set out on our data page. We spell that out because quoting the 48 as if it were the repayment is precisely the trick this page is about.
Further documented cases — including one where $18,000 was frozen out of $200,000 stolen — are on the data page, with the frozen and the recovered kept in separate columns, and in the case file.
Speed matters more here than anywhere else in the process: the earlier the transactions are flagged, the more chances the marker has to catch the funds before they are cashed out.
[email protected] or +971 56 182 9077. Do not wait until you have a complete picture — we build that. Every channel we answer on is listed on the contact page.
We tell you what we think is recoverable and what is not, including when the answer is "nothing" — that call costs you nothing either way.
The formal block at an exchange rests on a police report; the case is stronger with one and slower without. Where to file it, in what order, and what to put in it are set out on our reporting guide.
Run the ten-point check on our verification page — it works on us and on everyone else you are considering.
If anyone contacts you after a theft offering to recover the funds for an up-front payment, having found you rather than the other way round — that is a second scam aimed at victims of the first. It is the most common thing that happens to people in your position. Verify anyone you approach, including us.
Founder and CEO, StarCompliance · blockchain investigations since 2022 · interviewed by ForkLog, 23 July 2024 · on Bitcoin.com News, 30 April 2025 · LinkedIn. The registry record behind that name is on credentials, and every external mention of it on press.
Reviewed by: compliance reviewer — not named: no reviewer profile has been supplied. We would rather name nobody than name someone we have not asked.
Disclaimer. This page is informational and is not legal advice. Timings are observed turnarounds from our own cases, stated as of 30 July 2026, and vary by case. Flagging, freezing and repayment are separate stages and no stage guarantees the next: recovery decisions rest with courts, exchanges and token issuers. Legal steps are carried out by partner law firms in the relevant jurisdiction; StarCompliance does not practise law.