A crypto payment can’t be reversed. Stolen coins come back when someone in the trail can freeze them, or when the company at fault pays. Here is how to find out where yours went and who to tell.
You open your wallet and the balance reads zero. You did not send that money. Within a day, people on X and Telegram will offer to get it back for a fee. Treat every one of those offers as a second scam.
Disclosure: This story was written with the assistance of an AI writing program (Claude). I checked every figure against the source linked next to it. There are no affiliate links.
You are far from alone. Victims reported losing $11.4 billion to crypto-related crime in 2025, across 181,565 complaints to the FBI’s Internet Crime Complaint Center, says the IC3 2025 annual report. That is more than half of all the online crime losses the FBI counted that year. The average crypto complaint reported a loss of $62,604.
Some of that money does come back. Your chance to recover stolen crypto depends on where it went next and how fast you move.
Can stolen crypto be recovered?
Sometimes. No bank and no network can pull a crypto payment back. The US Federal Trade Commission puts it plainly: “Cryptocurrency payments typically are not reversible.”
Stolen coins return to their owner in four ways:
An exchange freezes the account the money reached, after a police or court request, and a court later orders the funds returned.The company behind a stablecoin freezes the coins. The issuers of USDT and USDC, the two biggest dollar-pegged coins, can lock those tokens at a given address.The platform at fault pays users back. If an app or exchange leaked your keys, its refund is often the fastest money you will see.Police seize the funds from the thief and a court returns them to victims. That can take years.
If the coins sit in a private wallet that only the thief controls, no exchange can freeze them. Unless they are a token whose issuer can freeze it, such as USDT or USDC, they stay there until the thief moves them or is caught. So the real question is where your money went next, and how fast you can find out.
What to do in the first 24 hours after crypto is stolen
Move whatever is left. If your recovery phrase (the 12 or 24 backup words) or private key (the secret code that controls the wallet) leaked, the thief can take anything still in that wallet, and anything sent to it later. Make a new wallet on a clean device, with a new recovery phrase, and move the rest there.Cancel token approvals. If you signed something on a website before the loss, that site may hold a standing permission to spend your tokens. Your wallet app, or a token-approval checker for your chain, can cancel them.Write everything down. Save every transaction ID, the long code that names one payment on the chain. Save each address, with dates and times. Screenshot the chats, the website and the app.Contact the platform in writing. If the loss happened on an exchange or through an app, open a support ticket now and ask for a freeze or a refund.Do not pay anyone who offers to get it back. Messages offering recovery are a known follow-up scam, and US regulators warn victims about them.Trace the money, then file a police report. A report with the trace attached gives police an exchange to contact.The first 24 hours, in order.
Is crypto traceable? How crypto tracing works
Yes, on most chains. Bitcoin, Ethereum, Solana and most other networks keep a public record of every payment that anyone can read. Each entry shows the address that sent it, the address that got it, the amount and the time. So stolen money leaves tracks, and bitcoin can be followed from address to address the same way.
Thieves try to blur those tracks. They split the money across many wallets and pass it through middle wallets. They swap it into other coins, or carry it to another network through a bridge, a service that moves coins between chains. A mixer pools coins from many people so that what comes out cannot be matched to what went in. Privacy coins such as Monero hide who paid whom from the start.
Following those moves from wallet to wallet is called crypto tracing, and doing it to a standard a court will accept is called blockchain forensics. The weak point for a thief is the exit. To turn stolen coins into dollars, most thieves need an exchange. An exchange gives each customer a deposit address of their own and keeps records of which account owns it. When a trail ends at a deposit address, police can ask that exchange who the customer is. That request is what turns a trace into a name.
A real trail: the TradeWiz drain
On September 30, 2026, someone holding leaked private keys emptied 20,776 wallets of people using TradeWiz, a trading bot on Solana. It took about two and a half hours. Counting a small test run two days earlier and a second pass that evening, the take was about $459,000. Our research team at Bitquery published the full trail the next day.
On October 1, about 94% of the SOL taken (SOL is Solana’s own coin) still sat in two wallets the stolen coins were swept into. Nobody can freeze SOL held there. But two small moves in the record pointed at exchanges.
The start. A month before the theft, the wallet that later took in the stolen coins got its first money: a quarter of a SOL withdrawn from MEXC, a crypto exchange. Three more small MEXC withdrawals followed. MEXC knows which customer account made them.The first large cash-out. On October 1 that wallet sent 100 SOL to a middle wallet. It sat there 39 seconds, then moved to a deposit address at KuCoin, another exchange. Another 91 SOL took the same road 3 hours later. KuCoin knows which customer owns that deposit address.
Neither move proves who the thief is. A deposit address proves only that an exchange account exists, and who holds it is a question for the exchange. We do not know who owns the middle wallet. What the two moves give police is two exchanges to ask.
TradeWiz said on September 30 that a first wave of refunds had been sent. On October 1 it said the theft had been reported to police and that the exchanges that received the stolen funds had been contacted. For TradeWiz users, the refunds the company announced are the quickest route back. The trace gives police a way to reach whoever did it.
The TradeWiz trail, as of October 1, 2026. Addresses shortened.
Two drained wallets that received new deposits after the theft were emptied again within 4 seconds. A wallet whose keys have leaked is burned for good.
How to trace stolen crypto yourself with AI
You can follow a trail like that without writing code. Bitquery MCP connects an AI chatbot such as Claude or ChatGPT to Bitquery’s chain data. MCP, short for Model Context Protocol, is a standard way for a chatbot to call a data source while it writes its answer. Once it is set up, you ask in plain English and the chatbot runs the lookups for you.
It traces payments on 19 chains, among them Bitcoin, Ethereum, Solana, Tron, BNB Chain, Base, Polygon, Arbitrum and the XRP Ledger. It also labels addresses known to belong to exchanges, mixers and scams, which is how you spot the moment a trail reaches an exchange.
Setting it up takes a few minutes:
Create a Bitquery account and choose the AI Investigation MCP plan. It costs $149 per month, or $100 per month billed yearly. The cheaper $19 plan covers trading data only and has no tracing.In Claude or ChatGPT, open the connector settings, add a custom connector, and paste the server address https://mcp.bitquery.io. ChatGPT allows custom connectors on its paid plans only.Sign in to your Bitquery account when the chatbot asks.
Then paste prompts like these, with your own address, chain and date filled in:
“My wallet [address] on [chain] was drained on [date]. List every outgoing transfer from it that day, with amounts and receiving addresses.”“Follow the largest transfer onward, one hop at a time. Stop when you reach an address labeled as an exchange, bridge or mixer, and show every hop.”“For each exchange address you reached, tell me the exchange, whether it is a deposit address, and the transaction IDs that paid into it.”“Write a one-page summary I can attach to a police report, with the timeline, addresses, transaction IDs, amounts and where the money ended.”Four prompts that take you from a drained wallet to a police-ready summary.
A few cautions. Treat every label as a lead until you have checked it. Open each transaction ID the chatbot gives you on a block explorer, a public website that shows one chain’s record, and check it yourself. Trails get much harder after a mixer or a privacy coin, and a chatbot can misread a very busy address. When the trail reaches an exchange, stop and report. That is the step that can freeze money.
Bitquery’s video introducing the MCP for crypto investigations:
https://medium.com/media/3ad26de47ceff5190fd452cba084d95a/href
How to report crypto theft to the police
Report it even if you expect nothing to happen. The report is the record that police and exchanges ask for, and the FBI asks victims to file “regardless of the amount lost.”
Put these in the report:
a plain timeline of what happened, with dates and timesevery transaction ID and address, yours and the thief’sthe amounts, the coin names, and which chain each payment was onwhere the trail ended, with the exchange name and deposit address, if you traced itscreenshots of chats, websites and app names, and any ticket number from the platform
Where to file:
United States: the FBI’s IC3 at ic3.gov, and the FTC at reportfraud.ftc.gov.United Kingdom: Report Fraud at reportfraud.police.uk or 0300 123 2040, for England, Wales and Northern Ireland. In Scotland, call 101. Report Fraud replaced Action Fraud in December 2025.Canada: the Canadian Anti-Fraud Centre at antifraudcentre-centreantifraude.ca or 1–888–495–8501, and your local police.Australia: ReportCyber at cyber.gov.au.India: cybercrime.gov.in, or call 1930.Anywhere else: your local police or national police cyber unit.
Then send your report number to the exchange the trail reached. An exchange will usually want a police report or a court order before it freezes an account, and it can only freeze what is still there.
Crypto recovery scams: how to spot a fake recovery service
Search for crypto recovery and you will find pages promising to get your coins back. The US Commodity Futures Trading Commission keeps a warning page about these firms, which target people who have already lost money. Several of the signs below are on its list. Walk away if a recovery service:
messaged you first, often after you posted about your losswants a fee before doing any work, with reasons the fee can’t come out of the recovered moneypromises that your coins will come backtalks only on Telegram or WhatsApp, or writes from a free email addressasks for your recovery phrase, your private key, or your bank details so the recovered money can be paid inclaims to be a hacker who can reverse a transaction, or to work with the FBI
Nobody can reverse a payment on a public chain. And the CFTC says that agencies prosecuting fraud “will never ask you for money.”
How to tell a legitimate crypto recovery company
A real expert tells you what is likely before you pay, and that is often bad news. The scope and the price are in writing. The expert never takes your keys or holds your coins. The work product is a report you own, which you or your lawyer hand to police and exchanges.
When to hire a crypto investigator
Tracing it yourself works well for a few hops. Get help when the sum is large, or when a lawyer or an exchange needs a report it can rely on. Trails that cross several chains or pass through a mixer also take far more hours than most victims have.
Tracing firms and some law firms do this work. Bitquery, where I work, is one of them. Bitquery’s tracing team follows stolen funds across more than 40 chains to the point where they cash out. It packages the trace into a report with flow graphs and named addresses, “suitable for exchanges, law-enforcement agencies and expert-witness use in court.” In the service’s own words: “We conduct a preliminary investigation and assessment free of charge.” After that you get a written proposal with the cost of further work, and “If we are unable to assist in recovery, you will not incur additional charges.” The page also says it cannot guarantee full recovery. Nobody honest can.
Two ways to follow the money.
Questions people ask after crypto is stolen
How long does crypto recovery take?
A freeze happens within hours or days of a report, if it happens at all. Getting frozen money released to you through a court can take months or years. Any firm that promises you a date is guessing.
How much does crypto recovery cost?
Reporting to police costs nothing. Tracing it yourself with Bitquery MCP costs the $149 monthly plan. Paid experts charge for their time, and Bitquery’s first review is free, with later work quoted in writing. Be wary of anyone who wants a large fee before looking at your case.
Can police trace crypto?
Yes. Police and the FBI read the same public chain records that private tracers do, with similar tools. What they can do and you cannot is make an exchange hand over a customer’s details.
Can bitcoin be traced?
Yes. Every bitcoin payment sits on a public record, so stolen bitcoin can be followed from address to address. A mixer makes the trail harder to read and can break it.
Can stolen bitcoin be recovered?
Sometimes. Bitcoin’s record is public, so stolen bitcoin can be followed from address to address. It comes back only if it reaches an exchange or service that freezes it, or if police seize it.
What is the best crypto recovery service?
No ranking of recovery firms is worth trusting, because nobody can verify their results. Judge a service by its terms instead. A sound one puts its price in writing, makes no promise of recovery, never asks for your keys, and hands you a tracing report you can give to police. Bitquery’s team works on those terms, as the disclosure above notes.
Are crypto recovery services scams?
Many are, which is why the CFTC keeps a warning page about them. A real service will not guarantee results, will not ask for your keys, and will put its fee in writing. If one asks for an upfront fee or your recovery phrase, walk away.
Can I get my money back from a pig butchering scam?
Sometimes, if police reach the exchange where the scammers cashed out before that account is emptied. A pig butchering scam is a long fake friendship or romance that ends with a fake investment site. The FBI describes crypto investment scams as long-term schemes that often start with a text message, a social media contact or a dating app. It calls them the highest source of financial losses to Americans in 2025, at $7.2 billion. Report fast and include every address the scammer told you to pay.
If your coins were stolen this week, start with the first-24-hours list above. Then follow the money with Bitquery MCP, or send the case to an expert before the trail goes cold.
How to Recover Stolen Crypto: Follow the Money, Then Report It was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.