You open your wallet and the balance reads zero. You did not send that money. Within a day, people on X and Telegram will offer to get it back for a fee. Treat every one of those offers as a second\u00a0scam.<\/p>\n
Disclosure: This story was written with the assistance of an AI writing program (Claude). I checked every figure against the source linked next to it. There are no affiliate links.<\/em><\/p>\n You are far from alone. Victims reported losing $11.4 billion to crypto-related crime in 2025, across 181,565 complaints to the FBI\u2019s Internet Crime Complaint Center, says the IC3 2025 annual report<\/a>. That is more than half of all the online crime losses the FBI counted that year. The average crypto complaint reported a loss of\u00a0$62,604.<\/p>\n Some of that money does come back. Your chance to recover stolen crypto depends on where it went next and how fast you\u00a0move.<\/p>\n Sometimes. No bank and no network can pull a crypto payment back. The US Federal Trade Commission puts it plainly<\/a>: \u201cCryptocurrency payments typically are not reversible.\u201d<\/p>\n Stolen coins return to their owner in four\u00a0ways:<\/p>\n An exchange freezes the account the money reached<\/strong>, after a police or court request, and a court later orders the funds returned.The company behind a stablecoin freezes the coins.<\/strong> The issuers of USDT and USDC, the two biggest dollar-pegged coins, can lock those tokens at a given\u00a0address.The platform at fault pays users back.<\/strong> If an app or exchange leaked your keys, its refund is often the fastest money you will\u00a0see.Police seize the funds<\/strong> from the thief and a court returns them to victims. That can take\u00a0years.<\/p>\n If the coins sit in a private wallet that only the thief controls, no exchange can freeze them. Unless they are a token whose issuer can freeze it, such as USDT or USDC, they stay there until the thief moves them or is caught. So the real question is where your money went next, and how fast you can find\u00a0out.<\/p>\n Move whatever is left.<\/strong> If your recovery phrase (the 12 or 24 backup words) or private key (the secret code that controls the wallet) leaked, the thief can take anything still in that wallet, and anything sent to it later. Make a new wallet on a clean device, with a new recovery phrase, and move the rest\u00a0there.Cancel token approvals.<\/strong> If you signed something on a website before the loss, that site may hold a standing permission to spend your tokens. Your wallet app, or a token-approval checker for your chain, can cancel\u00a0them.Write everything down.<\/strong> Save every transaction ID, the long code that names one payment on the chain. Save each address, with dates and times. Screenshot the chats, the website and the\u00a0app.Contact the platform in writing.<\/strong> If the loss happened on an exchange or through an app, open a support ticket now and ask for a freeze or a\u00a0refund.Do not pay anyone who offers to get it back.<\/strong> Messages offering recovery are a known follow-up scam, and US regulators warn victims about\u00a0them.Trace the money, then file a police report.<\/strong> A report with the trace attached gives police an exchange to\u00a0contact.The first 24 hours, in\u00a0order.<\/p>\n Yes, on most chains. Bitcoin, Ethereum, Solana and most other networks keep a public record of every payment that anyone can read. Each entry shows the address that sent it, the address that got it, the amount and the time. So stolen money leaves tracks, and bitcoin can be followed from address to address the same\u00a0way.<\/p>\n Thieves try to blur those tracks. They split the money across many wallets and pass it through middle wallets. They swap it into other coins, or carry it to another network through a bridge, a service that moves coins between chains. A mixer pools coins from many people so that what comes out cannot be matched to what went in. Privacy coins such as Monero hide who paid whom from the\u00a0start.<\/p>\n Following those moves from wallet to wallet is called crypto tracing, and doing it to a standard a court will accept is called blockchain forensics. The weak point for a thief is the exit. To turn stolen coins into dollars, most thieves need an exchange. An exchange gives each customer a deposit address of their own and keeps records of which account owns it. When a trail ends at a deposit address, police can ask that exchange who the customer is. That request is what turns a trace into a\u00a0name.<\/p>\n On September 30, 2026, someone holding leaked private keys emptied 20,776 wallets of people using TradeWiz, a trading bot on Solana. It took about two and a half hours. Counting a small test run two days earlier and a second pass that evening, the take was about $459,000. Our research team at Bitquery published the full trail<\/a> the next\u00a0day.<\/p>\n On October 1, about 94% of the SOL taken (SOL is Solana\u2019s own coin) still sat in two wallets the stolen coins were swept into. Nobody can freeze SOL held there. But two small moves in the record pointed at exchanges.<\/p>\n The start.<\/strong> A month before the theft, the wallet that later took in the stolen coins got its first money: a quarter of a SOL withdrawn from MEXC, a crypto exchange. Three more small MEXC withdrawals followed. MEXC knows which customer account made\u00a0them.The first large cash-out.<\/strong> On October 1 that wallet sent 100 SOL to a middle wallet. It sat there 39 seconds, then moved to a deposit address at KuCoin, another exchange. Another 91 SOL took the same road 3 hours later. KuCoin knows which customer owns that deposit\u00a0address.<\/p>\n Neither move proves who the thief is. A deposit address proves only that an exchange account exists, and who holds it is a question for the exchange. We do not know who owns the middle wallet. What the two moves give police is two exchanges to\u00a0ask.<\/p>\n TradeWiz said on September 30 that a first wave of refunds had been sent. On October 1 it said the theft had been reported to police and that the exchanges that received the stolen funds had been contacted. For TradeWiz users, the refunds the company announced are the quickest route back. The trace gives police a way to reach whoever did\u00a0it.<\/p>\n The TradeWiz trail, as of October 1, 2026. Addresses shortened.<\/p>\n Two drained wallets that received new deposits after the theft were emptied again within 4 seconds. A wallet whose keys have leaked is burned for\u00a0good.<\/p>\n You can follow a trail like that without writing code. Bitquery MCP<\/a> connects an AI chatbot such as Claude or ChatGPT to Bitquery\u2019s chain data. MCP, short for Model Context Protocol, is a standard way for a chatbot to call a data source while it writes its answer. Once it is set up, you ask in plain English and the chatbot runs the lookups for\u00a0you.<\/p>\n It traces payments on 19 chains, among them Bitcoin, Ethereum, Solana, Tron, BNB Chain, Base, Polygon, Arbitrum and the XRP Ledger. It also labels addresses known to belong to exchanges, mixers and scams, which is how you spot the moment a trail reaches an exchange.<\/p>\n Setting it up takes a few\u00a0minutes:<\/strong><\/p>\n Create a Bitquery account and choose the AI Investigation MCP plan. It costs $149 per month, or $100 per month billed yearly. The cheaper $19 plan covers trading data only and has no\u00a0tracing.In Claude or ChatGPT, open the connector settings, add a custom connector, and paste the server address https:\/\/mcp.bitquery.io. ChatGPT allows custom connectors on its paid plans\u00a0only.Sign in to your Bitquery account when the chatbot\u00a0asks.<\/p>\n Then paste prompts like these<\/strong>, with your own address, chain and date filled\u00a0in:<\/p>\n \u201cMy wallet [address] on [chain] was drained on [date]. List every outgoing transfer from it that day, with amounts and receiving addresses.\u201d<\/em>\u201cFollow the largest transfer onward, one hop at a time. Stop when you reach an address labeled as an exchange, bridge or mixer, and show every\u00a0hop.\u201d<\/em>\u201cFor each exchange address you reached, tell me the exchange, whether it is a deposit address, and the transaction IDs that paid into\u00a0it.\u201d<\/em>\u201cWrite a one-page summary I can attach to a police report, with the timeline, addresses, transaction IDs, amounts and where the money\u00a0ended.\u201d<\/em>Four prompts that take you from a drained wallet to a police-ready summary.<\/p>\n A few cautions. Treat every label as a lead until you have checked it. Open each transaction ID the chatbot gives you on a block explorer, a public website that shows one chain\u2019s record, and check it yourself. Trails get much harder after a mixer or a privacy coin, and a chatbot can misread a very busy address. When the trail reaches an exchange, stop and report. That is the step that can freeze\u00a0money.<\/p>\n Bitquery\u2019s video introducing the MCP for crypto investigations:<\/p>\n https:\/\/medium.com\/media\/3ad26de47ceff5190fd452cba084d95a\/href<\/a><\/p>\n Report it even if you expect nothing to happen. The report is the record that police and exchanges ask for, and the FBI asks victims to file \u201cregardless of the amount\u00a0lost.\u201d<\/p>\n Put these in the\u00a0report:<\/strong><\/p>\n a plain timeline of what happened, with dates and\u00a0timesevery transaction ID and address, yours and the\u00a0thief\u2019sthe amounts, the coin names, and which chain each payment was\u00a0onwhere the trail ended, with the exchange name and deposit address, if you traced\u00a0itscreenshots of chats, websites and app names, and any ticket number from the\u00a0platform<\/p>\n Where to\u00a0file:<\/strong><\/p>\n United States:<\/strong> the FBI\u2019s IC3 at ic3.gov<\/a>, and the FTC at reportfraud.ftc.gov<\/a>.United Kingdom:<\/strong> Report Fraud at reportfraud.police.uk<\/a> or 0300 123 2040, for England, Wales and Northern Ireland. In Scotland, call 101. Report Fraud replaced Action Fraud in December\u00a02025.Canada:<\/strong> the Canadian Anti-Fraud Centre at antifraudcentre-centreantifraude.ca<\/a> or 1\u2013888\u2013495\u20138501, and your local\u00a0police.Australia:<\/strong> ReportCyber at cyber.gov.au<\/a>.India:<\/strong> cybercrime.gov.in<\/a>, or call\u00a01930.Anywhere else:<\/strong> your local police or national police cyber\u00a0unit.<\/p>\n Then send your report number to the exchange the trail reached. An exchange will usually want a police report or a court order before it freezes an account, and it can only freeze what is still\u00a0there.<\/p>\n Search for crypto recovery and you will find pages promising to get your coins back. The US Commodity Futures Trading Commission keeps a warning page<\/a> about these firms, which target people who have already lost money. Several of the signs below are on its list. Walk away if a recovery\u00a0service:<\/p>\n messaged you first, often after you posted about your\u00a0losswants a fee before doing any work, with reasons the fee can\u2019t come out of the recovered moneypromises that your coins will come\u00a0backtalks only on Telegram or WhatsApp, or writes from a free email\u00a0addressasks for your recovery phrase, your private key, or your bank details so the recovered money can be paid\u00a0inclaims to be a hacker who can reverse a transaction, or to work with the\u00a0FBI<\/p>\n Nobody can reverse a payment on a public chain. And the CFTC says that agencies prosecuting fraud \u201cwill never ask you for\u00a0money.\u201d<\/p>\n A real expert tells you what is likely before you pay, and that is often bad news. The scope and the price are in writing. The expert never takes your keys or holds your coins. The work product is a report you own, which you or your lawyer hand to police and exchanges.<\/p>\n Tracing it yourself works well for a few hops. Get help when the sum is large, or when a lawyer or an exchange needs a report it can rely on. Trails that cross several chains or pass through a mixer also take far more hours than most victims\u00a0have.<\/p>\n Tracing firms and some law firms do this work. Bitquery, where I work, is one of them. Bitquery\u2019s tracing team<\/a> follows stolen funds across more than 40 chains to the point where they cash out. It packages the trace into a report with flow graphs and named addresses, \u201csuitable for exchanges, law-enforcement agencies and expert-witness use in court.\u201d In the service\u2019s own words: \u201cWe conduct a preliminary investigation and assessment free of charge.\u201d After that you get a written proposal with the cost of further work, and \u201cIf we are unable to assist in recovery, you will not incur additional charges.\u201d The page also says it cannot guarantee full recovery. Nobody honest\u00a0can.<\/p>\n Two ways to follow the\u00a0money.<\/p>\n How long does crypto recovery\u00a0take?<\/strong><\/p>\n A freeze happens within hours or days of a report, if it happens at all. Getting frozen money released to you through a court can take months or years. Any firm that promises you a date is guessing.<\/p>\n How much does crypto recovery\u00a0cost?<\/strong><\/p>\n Reporting to police costs nothing. Tracing it yourself with Bitquery MCP costs the $149 monthly plan. Paid experts charge for their time, and Bitquery\u2019s first review<\/a> is free, with later work quoted in writing. Be wary of anyone who wants a large fee before looking at your\u00a0case.<\/p>\n Can police trace\u00a0crypto?<\/strong><\/p>\n Yes. Police and the FBI read the same public chain records that private tracers do, with similar tools. What they can do and you cannot is make an exchange hand over a customer\u2019s details.<\/p>\n Can bitcoin be\u00a0traced?<\/strong><\/p>\n Yes. Every bitcoin payment sits on a public record, so stolen bitcoin can be followed from address to address. A mixer makes the trail harder to read and can break\u00a0it.<\/p>\n Can stolen bitcoin be recovered?<\/strong><\/p>\n Sometimes. Bitcoin\u2019s record is public, so stolen bitcoin can be followed from address to address. It comes back only if it reaches an exchange or service that freezes it, or if police seize\u00a0it.<\/p>\n What is the best crypto recovery\u00a0service?<\/strong><\/p>\n No ranking of recovery firms is worth trusting, because nobody can verify their results. Judge a service by its terms instead. A sound one puts its price in writing, makes no promise of recovery, never asks for your keys, and hands you a tracing report you can give to police. Bitquery\u2019s team works on those terms, as the disclosure above\u00a0notes.<\/p>\n Are crypto recovery services\u00a0scams?<\/strong><\/p>\n Many are, which is why the CFTC keeps a warning page about them. A real service will not guarantee results, will not ask for your keys, and will put its fee in writing. If one asks for an upfront fee or your recovery phrase, walk\u00a0away.<\/p>\n Can I get my money back from a pig butchering scam?<\/strong><\/p>\n Sometimes, if police reach the exchange where the scammers cashed out before that account is emptied. A pig butchering scam is a long fake friendship or romance that ends with a fake investment site. The FBI describes crypto investment scams as long-term schemes that often start with a text message, a social media contact or a dating app. It calls them the highest source of financial losses to Americans in 2025, at $7.2 billion. Report fast and include every address the scammer told you to\u00a0pay.<\/p>\n If your coins were stolen this week, start with the first-24-hours list above. Then follow the money with Bitquery MCP<\/a>, or send the case to an expert before the trail goes\u00a0cold.<\/p>\n How to Recover Stolen Crypto: Follow the Money, Then Report It<\/a> was originally published in Coinmonks<\/a> on Medium, where people are continuing the conversation by highlighting and responding to this story.<\/p>","protected":false},"excerpt":{"rendered":" A crypto payment can\u2019t be reversed. Stolen coins come back when someone in the trail can freeze them, or when the company at fault pays. Here is how to find out where yours went and who to\u00a0tell. You open your wallet and the balance reads zero. You did not send that money. Within a day, […]<\/p>\n","protected":false},"author":0,"featured_media":237140,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-237139","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-interesting"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/237139"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=237139"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/237139\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/media\/237140"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=237139"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=237139"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=237139"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Can stolen crypto be recovered?<\/h4>\n
What to do in the first 24 hours after crypto is\u00a0stolen<\/h4>\n
Is crypto traceable? How crypto tracing\u00a0works<\/h4>\n
A real trail: the TradeWiz\u00a0drain<\/h4>\n
How to trace stolen crypto yourself with\u00a0AI<\/h4>\n
How to report crypto theft to the\u00a0police<\/h4>\n
Crypto recovery scams: how to spot a fake recovery\u00a0service<\/h4>\n
How to tell a legitimate crypto recovery\u00a0company<\/h4>\n
When to hire a crypto investigator<\/h4>\n
Questions people ask after crypto is\u00a0stolen<\/h4>\n