Sometimes. That is the honest answer, and it is more useful than it sounds, because what "sometimes" depends on is knowable — usually within the first days, often within the first call. Stolen crypto is recovered when the funds stop at a party who can be asked to hold them, when the request reaches that party while the funds are still there, and when a legal process in the right jurisdiction turns the hold into a return. It is not recovered when the funds reach a place nobody can ask, when the request arrives after they have left, or when the loss is too small to carry the process that returning it requires. This article goes through the factors in the order they decide a case, with the numbers we publish and the limits of those numbers.
What does "recovered" mean?
Two different events hide behind the word, and most of the misleading claims in this market come from confusing them.
A freeze is a stop. An exchange places a hold on an account, or a stablecoin issuer blacklists an address, and the funds cannot move. It is fast — days, sometimes hours — and it is the event that makes a case winnable. It is not a return: the funds are still on the thief's side of the ledger, immobilised.
A return is the transfer back to the victim, and it may come on a court decision or, for stablecoins, where the issuer applies it, through a burn-and-reissue procedure. It is slow — months — and it is the only event that puts money back in your wallet. When we say a case was recovered, we mean the second event; the numbers for each are published separately on our figures page, because merged into one they describe something that does not exist.
Factor one: what was stolen?
The asset decides who can be asked. A stablecoin — USDT, USDC — is a token issued by a company, and that company can freeze it at the address level, on a documented request through its published procedure; in our cases the response comes in 24–62 hours. Bitcoin and Ether have no issuer-level blacklist mechanism; they can be followed but not stopped in place. Their movement may be restricted when they reach a custodial service capable of acting, such as a centralised exchange. Monero and privacy chains built the same way are outside what we can evidence — we decline those cases rather than bill the attempt. Most thefts involve several assets in sequence, because thieves swap on the way out; the question is what the funds were at the point where they stopped, not what they were when they left.
Factor two: where did the funds stop?
This is the whole case. A blockchain shows every movement, so the funds can almost always be traced; the question is whether the trail ends at a party with a compliance desk. A centralised exchange, a payment processor, an OTC desk with a licence — these hold identities, answer freeze requests and obey court orders. A self-custody wallet answers nothing. A mixer breaks the trail into a statistical problem. Funds that were cashed out through an unlicensed OTC channel in a jurisdiction that does not respond are, in practice, gone.
Thieves know this, which is why the last leg of a laundering chain runs to places that cannot be asked. But the middle of the chain — where stablecoins and exchanges are used for speed and liquidity — is where cases are won, and it is also where the funds spend the least time. Establishing where the funds are now, and whether that party will act, is the investigative work; what it involves is on the crypto tracing page.
Factor three: how fast did the case move?
Funds at an exchange do not stay there. The window between the deposit and the withdrawal is the window in which a freeze is possible, and it is measured in days at most. Two things shorten the race. The first is flagging: the stolen transactions submitted to the screening providers exchanges rely on, so that the funds are stopped at the next compliance desk they touch — in our process this happens within four hours of intake, before any request is written. The second is the freeze request itself, supported by investigation materials such as the investigation report, and the two routes differ. At an exchange, the balance is frozen at the request of law enforcement: a victim who asks the exchange directly is typically turned down and referred to the police. To a stablecoin issuer, depending on the case and jurisdiction, a request may be submitted through law-enforcement or other accepted legal or compliance channels. In our cases an exchange has acted in 2–4 days, and a stablecoin issuer's response has come in 24–62 hours. A police report in your jurisdiction, or other formal law-enforcement documentation, may support a longer-term or more formal freeze, depending on the venue and jurisdiction, and filing it is the one step nobody can take on your behalf. What to do in the first day, in order, is on the reporting page — and the first four steps there cost nothing.
Factor four: which jurisdiction applies?
Which jurisdiction applies is not simply a question of where the funds are held: the exchange entity, the issuer, the defendant, the requesting authority and the applicable law can all matter, and it is usually not where the victim lives. The legal work — applications, orders, release — is done by lawyers admitted in the relevant jurisdiction. We work cases across 12 jurisdictions from Dubai; the legal steps in every one of them are carried out by partner law firms in the relevant jurisdiction, under our case management. We do not practise law. Cases with more than one jurisdiction take longer: 6–36 months in our experience, against 6–9 months for a return from a single exchange.
Factor five: how much was lost?
Recovery has a cost — tracing, evidence work, lawyers in a foreign court — and below a certain size the process costs more than it can return. Our published threshold is a loss from $200,000; smaller cases are reviewed individually rather than declined by default, and the honest answer at that size is often that the free steps — reporting, notifying the exchange — are what makes sense.
What the numbers say
We publish our figures with the period each one covers, because a number without a period is not evidence. Across our own cases: 200+ successful cases since 2022; $42.5M recovered in 2025 and $10M recovered in 2024 — two separate years, not added into a lifetime total we have not published; over $500M in assets traced in 2025; and 68% success rate on accepted cases · measured over the past 24 months. The word accepted is doing the work in the last figure: we decline cases where we see no realistic prospect, so the rate describes what happens to the cases we take, not to every theft that reaches us. None of these figures is independently audited — they come from our own case register, and the boundaries of each are stated on the figures page rather than left to be discovered.
The clocks, side by side
- First response to a submitted case: free; we aim to respond within 2 business hours — including the answer that there is nothing to pursue.
- Stolen transactions flagged with AML screening providers: within 4 hours of intake.
- Freeze request to an exchange: 2–4 days. Freeze request to a stablecoin issuer: response in 24–62 hours.
- A police report or other formal law-enforcement documentation: may support a longer-term or more formal freeze, depending on the venue and jurisdiction — there is no universal timing.
- Return from an exchange, on a court decision: 6–9 months.
- Return of USDT through the issuer: first payout 12–20 months in (including a 3-month lock), then quarterly instalments to roughly 24 months in full — the phases are on the Tether emission page.
- Complex or multi-jurisdiction cases: 6–36 months.
Anyone quoting the first three lines as if they were the last three is describing a freeze as a return. That confusion is where this industry does most of its lying, and it is worth reading Crypto Recovery vs. Freeze in 2026: Two Clocks, Real Timelines before believing any timeline, including ours.
What "no" looks like
A meaningful share of the enquiries we receive end at the assessment, and the reasons repeat. The funds went to Monero. They were cashed out through an unlicensed channel months ago and nothing remains at any venue that answers. The "balance" the victim is trying to recover only ever existed on a scheme's dashboard and never corresponded to assets — the deposits are the loss, not the "profits". The source of the funds cannot be confirmed, which we require on our side as much as an exchange does on its own. Or the loss is real and traceable but too small to carry a process that involves lawyers in another country. In each case the answer is given at the assessment, at no cost, and it is the answer — not a smaller version of the pitch.
What to do now, in order
Preserve the evidence — hashes, addresses, screenshots, the messages that led to the loss. Report to the national cybercrime portal and to the police where you live. Notify the exchange or platform through its official channel, with the hashes attached. Then decide whether the loss justifies an investigation, and get that decision from an assessment rather than a sales call. Which scam type you were in changes the odds and the next step — a wallet drainer, a fake exchange, a romance scheme and a rug pull end differently — and each is set out on the scam types page. If the funds are traceable and the loss is significant, the eleven steps from intake to a court-ordered return are on the recovery process page.
If the funds are traceable and the loss is significant, send us the transaction hashes: the assessment is free, and we aim to respond within two business hours, including when the answer is that there is nothing to pursue. Write through the contact page or message @StarCompliance on Telegram.
Questions people ask about recovering stolen crypto
Can the police get my crypto back?
A police report is essential — it, or other formal law-enforcement documentation, may support a longer-term or more formal freeze — but reporting alone rarely returns funds. Recovery runs through freezes at exchanges or issuers and then through a legal process, and someone has to follow the funds to a venue that can act and put the evidence in front of it.
The funds are frozen. When do I get them back?
It depends on the route. At an exchange, typically on a court decision — in our cases 6–9 months after the freeze. Through a stablecoin issuer, where it applies its reissue procedure — in our cases a first payout 12–20 months in. A freeze is the point at which the case becomes winnable, not the point at which it is won.
Is there any point if the theft was months ago?
Less than if it was yesterday, but not none. Funds sometimes sit at a venue for a long time, and the free assessment can establish whether they still do. The assessment is free precisely so that this question can be answered without committing to anything.
Can StarCompliance promise a recovery?
No, and no legitimate firm can. Freezes and returns are decided by exchanges, issuers and courts. What we publish are our measured figures and our refusals, so that the odds can be judged on evidence rather than on a promise.
How large does a loss need to be for a case?
Our published threshold is a loss from $200,000. Smaller cases are reviewed individually rather than declined by default, and at that size the free steps — reporting and notifying the exchange — are often what makes sense.
Which assets can be frozen?
A stablecoin such as USDT or USDC can be frozen by its issuer at the address level. Bitcoin and Ether have no issuer-level blacklist mechanism. Their movement may be restricted when they reach a custodial service capable of acting, such as a centralised exchange. We do not take Monero cases: its design means we cannot produce the evidence an exchange or a court would need.
This article is informational material, not legal advice, and no outcome is promised: decisions on freezing and releasing funds are made by exchanges, issuers and courts. Figures are from StarCompliance casework and are published, with the period each covers, on our figures page.
