Can Stolen Crypto Be Traced? How Onchain Tracing Works

Video transcript

Can stolen crypto be traced? Usually, yes, since every blockchain transfer is public. Getting it back is rarer.

Tracing works in three steps. Follow the flow hop by hop, cluster the addresses one owner controls, then attribute them to exchanges, mixers and known attackers.

Launderers attack each step. Mixers break the link, bridges fragment the trail, privacy coins hide it, non-KYC offramps leave no identity, and address sprawl slows analysis.

Speed decides recovery. Of the six point three six billion dollars taken from Binance, TRM Labs says about two point seven billion was frozen by half past midnight UTC.

Stablecoin issuers can freeze tokens without a name. Bitcoin and ETH have no issuer, so they must be stopped at an exchange or seized. About two point four billion dollars from Binance stayed out of reach.

Recovery is uneven. Hacken data reported by Cointelegraph shows 33 percent of third quarter 2026 losses returned or reversed, almost all from two incidents.

Act immediately. Report to law enforcement, contact SEAL nine one one, and alert the exchanges and issuers involved. The FBI warns private recovery firms cannot issue seizure orders.

Guardian's Managed Security watches contracts on every block, and its twenty four seven team works to a fifteen minute SLA on Critical alerts.

Read the full article, or talk to Guardian about catching theft while funds can still be frozen.

Every bitcoin and Ethereum transfer is public. That makes stolen crypto easier to follow than cash; getting it back is another matter.

Of the $6.36 billion taken from Binance on October 29, 2026, about $2.7 billion was frozen by 00:30 UTC the next day, per TRM Labs.

About $2.4 billion in ETH and BTC stayed beyond any issuer's reach. Tracing could follow it; no issuer could freeze it.

How Tracing Works

A public blockchain is a shared ledger. As the Bitcoin white paper puts it, "The public can see that someone is sending an amount to someone else."

What it lacks is "information linking the transaction to anyone." Tracing supplies that link in three steps:

1. Follow the flow: map every transfer out of the victim's address, hop by hop.
2. Cluster addresses: group the addresses one owner controls.
3. Attribute: match clusters to exchanges, bridges, mixers and known attackers.

Clustering starts with the ledger itself. The white paper notes that multi-input transactions "necessarily reveal that their inputs were owned by the same owner."

Attribution can go public. After the 2025 Bybit theft, the FBI published the attackers' Ethereum addresses so others could block them.

Where names come from

The chain shows addresses, not people. Identity usually sits with a regulated exchange.

The FATF notes that where stablecoins sit with a service provider, authorities can reach the customer's identity "through lawful requests."

Seized evidence can close the loop too. In the Bitfinex case, agents found a cloud file listing 2,000 addresses "along with corresponding private keys," per court filings quoted by The Block.

Where Trails Go Cold

Launderers attack each step. The common methods:

Each row has a primary source:

• Mixers: Treasury said in 2022 that Tornado Cash had laundered over $7 billion since 2019, including over $455 million stolen by the Lazarus Group.
• Bridges: the FATF says chain hopping can "complicate traceability," and wrapped stablecoins on other chains may weaken an issuer's freeze.
• Privacy coins: Monero says "the sender, receiver, and amount of every single transaction are hidden."
• Offramps: with an unlicensed provider, the FATF notes, no intermediary collects customer identification.
• Sprawl: the FBI said Bybit's thieves dispersed assets "across thousands of addresses on multiple blockchains."

Speed matters as much as method. During the Binance theft, TRM says the attacker sold about 325 million USDT for ETH at a discount of more than 10%, racing the freezes.

From Trace to Recovery

A trace only returns money when someone with control acts on it. There are three routes.

Stablecoin freezes

Centrally issued stablecoins can be frozen at the token level. USDC's contract gives a blacklister role the power to block an address.

A freeze does not need a name. Once an address is linked to crime, the FATF says, "executing freezing functions remain feasible."

The Binance theft showed the speed this allows. Per TRM:

Frozen is not yet returned. Across all cases, Tether says about 1.2 billion USDT obtained through fraud and theft has gone back to owners and law enforcement through reissuance.

For the full sequence, see our Binance hack explainer.

Exchange freezes

Bitcoin and ETH have no issuer to freeze them. They can still be stopped where they meet an exchange.

After Bybit, the FBI asked exchanges, bridges, RPC node operators and DeFi services to block transactions with the thieves' addresses.

Law enforcement seizures

• Bitfinex: in February 2022, the Justice Department seized about 94,636 BTC from the 2016 hack, worth about $3.6 billion, per The Block.
• Colonial Pipeline: in June 2021, the FBI seized $2.3 million in bitcoin from the ransom paid to DarkSide, CNBC reported.

Both depended on reaching the keys or the wallet. The Bitfinex coins were seized more than five years after the theft.

Recovery is uneven

Hacken's Q3 2026 data, as Cointelegraph reported it, shows the spread:

• Losses: $1.18 billion across 107 incidents.
• Returned or reversed: about $387 million, or 33%.
• Two incidents make up almost all of that: a $272 million white hat return and a $111.2 million chain rollback.
• Neither returned nor covered by operators: about $384 million, or 32%.

Among the incidents Cointelegraph names, issuer freezes were small: Circle and Tether froze about $340,000 tied to the Bitget theft.

When to Call Professionals

Immediately. A freeze only works while funds are still in a freezable form, and attackers know it.

• Law enforcement: in the US, report at ic3.gov with transaction details and receiving addresses.
• SEAL 911: a free, around-the-clock hotline that connects anyone facing an active incident with vetted researchers.
• Exchanges and issuers the funds reach, with addresses, hashes and amounts in one message.
• An incident responder with tracing tools, to label addresses and prepare freeze requests.

Be wary of anyone selling recovery. The FBI warns that "private sector recovery companies cannot issue seizure orders to recover cryptocurrency."

For the first-hour checklist and recovery scam red flags, see what to do when a wallet is drained.

How Guardian Helps

The first minutes decide what can still be frozen, so detection comes first.

Guardian's Managed Security monitors contracts on every block for privileged calls, role changes, upgrades, multisig transactions and large fund movements.

When something fires, a Guardian engineer responds. Its 24/7 MDR team works to a 15-minute SLA on Critical alerts.

For exchanges, our incident response plan sets out who to ask for freezes, and in what order.

Frequently Asked Questions

Can stolen bitcoin be traced?

Yes. Every bitcoin transfer is public, so investigators can follow stolen coins from address to address. Bitcoin has no issuer that can freeze it, so recovery depends on an exchange stopping a deposit or authorities seizing the keys.

Can police recover stolen crypto?

Sometimes. US authorities seized about 94,636 BTC tied to the 2016 Bitfinex hack in 2022, and $2.3 million of the Colonial Pipeline ransom in 2021. Seizures depend on reaching the keys, the wallet or a cooperating custodian.

How much stolen crypto is recovered?

It varies. Hacken data reported by Cointelegraph shows 33% of Q3 2026 losses returned or reversed, almost all in two incidents. TRM Labs counted about $2.7 billion of Binance's $6.36 billion loss frozen by 00:30 UTC on October 30.

Can crypto be traced through a mixer?

It gets much harder. A mixer pools many users' funds and pays out separately, breaking the link between deposit and withdrawal. If funds later reach a regulated exchange, the FATF notes, authorities can seek the customer's identity through lawful requests.

Sources

• Satoshi Nakamoto: Bitcoin, A Peer-to-Peer Electronic Cash System, section 10, Privacy (2008)
• FATF: Targeted Report on Stablecoins and Unhosted Wallets, paragraphs 54 to 58 and 63 (March 2026), FIAU Malta hosted copy
• TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (October 29, 2026)
• Tether: Tether Freezes Over $1.5 Billion From Binance Hack (November 2, 2026)
• Circle: stablecoin-evm, Blacklistable.sol (GitHub)
• FBI IC3: North Korea Responsible for $1.5 Billion Bybit Hack (February 26, 2025)
• U.S. Treasury: U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash (August 8, 2022)
• Monero Project: What is Monero
• The Block: US government seizes $3.6 billion in bitcoin tied to 2016 hack of crypto exchange Bitfinex, quoting the Justice Department (February 8, 2022)
• CNBC: U.S. recovers some of the money paid in the Colonial Pipeline ransom, officials say (June 7, 2021)
• Cointelegraph: Bitget, Liquid Exploits Push Q3 Crypto Hacks Toward $1.2B, citing Hacken (October 15, 2026)
• Security Alliance: SEAL 911
• FBI IC3: Increase in Companies Falsely Claiming an Ability to Recover Funds Lost in Cryptocurrency Investment Scams (August 11, 2023)
• FBI IC3: FBI Warns of Scammers Impersonating the IC3 (July 20, 2026)
• Guardian: Managed Security
• Guardian: Guardian Announces Managed Security