Four things a trace settles. They are worth stating one by one, because «yes, it can be traced» on its own is also what the sites that take money from theft victims say.
Every hop is a transaction with a hash, a timestamp and an amount, and every one of them can be opened in a public block explorer and checked without taking our word for it. The work is not finding a secret record; it is deciding which of thousands of movements carry your money.
Funds sitting in a private wallet, funds inside a service that answers freeze requests, and funds already cashed out through a counter that does not are three different cases. Which one you are in decides whether anything can be done, and it is the first thing a trace settles.
The point of following the money is the address it stops at. When that address belongs to an exchange, a payment processor or a stablecoin issuer, there is a compliance department to send evidence to; when it does not, there is nobody to send anything to.
Thefts fragment. Part of a stolen balance is often converted or spent within hours while another part sits still for weeks, and the recoverable share is rarely the whole amount. In one documented case $18,000 of a $200,000 cold-wallet theft was frozen after the funds moved to Solana — a real outcome, and a partial one.
The most common reason people wait is the belief that they need a complete picture first. They do not: a hash and an account of what happened is enough to start, and building the picture is the work.
What we need from you to begin:
A transaction hash identifies one transfer on one chain. From it we establish which asset moved, from which address, to which, and at what time — the anchor everything after this is measured from.
The immediate movements out of the receiving address are followed far enough to see whether the funds are sitting still, being split, or already heading for a service that can be asked to stop them.
A person tells you what the sweep showed: whether the assets are traceable, whether they have reached somewhere that can act, and whether there is a realistic path. If there is not, that is the answer, and it costs nothing.
Once the addresses are confirmed, the stolen transactions are flagged with AML providers so the funds carry their history into whatever service they reach next. That is a separate step with its own page.
Step 04 is a different service with its own timings and its own page — what flagging does, what it does not, and why «flagged», «frozen» and «returned» are three separate events: AML monitoring. The full eleven-step case this sits inside is on the recovery process page.
Following stolen funds is not reading a list of transfers. Value moves through contract calls, event logs and approvals that never appear as a transfer in a wallet interface, and a trace that reads only the surface loses money that never left the chain.
A native or token transfer is the visible layer. Underneath it, contract executions move value through internal calls that never appear as a transfer in a wallet interface — which is why a trace that reads only the transfer list loses funds that never left the chain.
When value passes through a contract — a swap, a bridge, a lending pool — what happened is recorded in the events the contract emitted, not in a token transfer. Parsing those logs is how the economic movement is followed instead of the surface one.
A wallet drained by a signature was not hacked; the owner approved a contract that then moved the balance. The approval is on-chain, it is timestamped, and it establishes the moment the loss became possible.
Proceeds are routinely split across hundreds of fresh addresses. On UTXO chains such as Bitcoin, addresses spent together in one transaction are held by one party. On account chains, funding patterns and contract-interaction patterns do similar work. Each result is recorded with the inputs used, so a second analyst can reproduce or reject it.
The end of a trace is usually a deposit address at an exchange or a processor. Recognising that endpoint for what it is — and which service it belongs to — is what turns a chain of transactions into something an institution can act on.
This is where most traces are abandoned and where most of the value in this work sits. Movement through bridges, decentralised exchanges and wrapped assets is the ordinary shape of a theft in Web3, and following it is a different skill from reading one ledger: a bridge looks like an ending on the chain you are watching, because the funds arrive at a contract and go no further.
The funds arrive at a bridge contract or a swap service and, from the point of view of the first chain, stop there. A trace that treats that as the end of the trail reports a dead end that is not one.
Nothing physically moves between chains. The bridge takes custody or locks the asset on one side and releases a corresponding amount on the other — which means there are two records of one event, on two different ledgers, and neither refers to the other by name.
The withdrawal is correlated with the deposit through the bridge's own contract events, the amount, and the timing between the two. A correlation is a reasoned conclusion, not a proof: the report records what it rests on, and where two candidates fit equally well it says so.
Movement continues on the receiving chain, often straight into a swap for a different asset. The same reading applies there, and the trail is carried forward until it reaches a service that can be written to — or until it genuinely ends.
Frozen on Solana out of approximately $200,000 taken from a Ledger cold wallet after a seed-phrase compromise — the funds crossed chains before they could be stopped, and the recoverable part was intercepted on the far side. It is in the case file with the client’s own account of it.
We publish that ratio rather than the headline: $18,000 of $200,000 is what a real cross-chain interception looked like in that case. Every figure on this site, with the date it was measured, is on the data page.
The address the funds stop at decides everything that can happen next. Four of these five endings are useful; one is not, and a trace that reaches it says so.
| Endpoint | What it means | Timing |
|---|---|---|
| A private wallet no service involved | Nothing to write to. The addresses are flagged and watched, and the case waits for the funds to move somewhere that answers | Watched for the life of the case |
| An exchange or payment processor with a compliance function | The endpoint a trace is trying to reach: evidence goes to the compliance team, and the account holder is identifiable through legal process — not by us, and not from the address | Freeze request 2–4 days · formal block +2–3 days after a police report |
| A stablecoin issuer USDT, USDC and their equivalents | The token can be frozen at the contract level by the issuer, through its official procedure. We claim no private channel to any issuer, because we have none | Issuer responds in 24–62 hours |
| A mixer or a tumbler funds pooled with other users | Not automatically the end, and not automatically recoverable either — a narrower question with its own methods and its own page | Case by case |
| A service that does not answer or a jurisdiction with no route in | The trace is complete and the path is not. The report says so rather than presenting an unreachable endpoint as progress | — |
Mixers are a narrower question than the rest of this page and have their own methods — mixer tracing. What a stablecoin issuer can and cannot do with a frozen balance is set out on Tether emission.
A chain list is the claim a prospective client is most likely to check by asking. Ours is short on purpose.
We do not work with Monero. Its design means we cannot produce the evidence an exchange or a court would need, and taking the case anyway would be selling an attempt we know will not stand up.
If your funds moved onto a network we do not cover, we say so at the assessment rather than after an engagement letter. Where the trail crosses into one, the report records where it left our coverage.
Wire transfers, card payments and non-crypto assets are outside this work entirely, including the parts of a fraud that started with them.
People arrive believing they are one, and the belief is expensive: it is what makes a firm quoting a freeze timing sound like a firm promising your money back next week.
| Tracing | AML monitoring | Recovery | |
|---|---|---|---|
| What it is | Reconstructing where the funds went | Marking the stolen transactions so services see them | Getting the money back to its owner |
| What it produces | A documented trail and the endpoints it reaches | A flag that travels with the funds | A release of funds by decision of somebody else |
| Who decides the outcome | The chain — the transactions either link or they do not | The AML providers and the services that read them | Exchanges, token issuers, police and courts |
| How long it takes | Days to weeks, depending on hops and chains | Within 4 hours of intake, then continuously | 6–9 months from an exchange; 6–36 months for complex cases |
The service as a whole — who does this work, what it costs a case to be accepted, and what the evidence is used for — is on crypto investigations. How the trace becomes a document an institution accepts is on blockchain forensics.
Five things, and the fifth is the one that separates a forensic document from a sales document.
The structure of the full forensic report — the exhibits, the evidence log, the methodology note, and what jurisdictions expect of it — is on blockchain forensics, because a reader needing that needs it in one place rather than in fragments across five pages.
Every line here costs us work. They are published because the alternative — a capability list with no limits in it — is indistinguishable from the sites this industry has a reputation for.
Speed matters more than technique here. Transactions flagged within hours of a theft are caught far more often than funds traced weeks later, and nothing about the method compensates for the delay.
Copy the identifier of every transfer that left your wallet, and of any deposit you made to the platform. If you still have access to the account or the wallet interface, save that view now — access is the thing people lose next.
Moving a remaining balance through the same wallet, or through a service you were told to use, makes both traces harder and can push what survived into the same path as what is gone.
[email protected] or +971 56 182 9077. You get a person’s answer on whether this is traceable and whether there is a realistic path — including the answer that there is not. Every channel we answer on is on the contact page.
A formal block at an exchange rests on a police report in your jurisdiction. The case is stronger with one and slower without, and filing it costs you nothing but the hour it takes.
Run the ten-point check on our verification page — it is written to work on us and on everyone else you are considering. Anyone who contacts you first, after the theft, offering recovery for an up-front payment is a second fraud aimed at victims of the first.
Founder and CEO, StarCompliance · blockchain investigations since 2022 · interviewed by ForkLog, 23 July 2024 · on Bitcoin.com News, 30 April 2025 · LinkedIn. The registry record behind that name is on credentials, and every external mention of it on press.
Reviewed by: compliance reviewer — not named: no reviewer profile has been supplied. We would rather name nobody than name someone we have not asked.
Disclaimer. This page is informational and is not legal advice. Tracing establishes where assets moved; it does not move them. Outcomes in asset recovery depend on exchanges, token issuers and courts, and no outcome is promised. Figures are from our own case register as of 30 July 2026, each published with the period it covers. StarCompliance does not practise law; legal steps are executed by admitted lawyers in the relevant jurisdiction.