Someone has moved cryptocurrency that was not theirs to move: a scam, a compromised wallet, a director dissipating company assets before an insolvency. The instinct is that the money is gone. It usually is not gone. It has moved, and every movement is written to a public ledger that the thief cannot edit.
This guide explains how those movements are followed, what the trail typically looks like, where it ends, and what a solicitor or insolvency practitioner can do with the result.
The starting point
A trace begins with one transaction: the transfer that took the funds out of the victim's control. From its reference, the ledger gives the receiving address, the asset and the amount. Everything that address did next is public. So is everything the next address did, and so on.
The most useful thing a victim can provide is that first transaction reference, or failing that the address the funds were sent to and the approximate time. The second most useful thing is a clear account of what happened, because it tells the analyst what to expect: a romance scam and a compromised hardware wallet leave different patterns.
What the trail looks like
Funds rarely go straight from a victim to an exchange. A typical path has several steps, each chosen to make following harder:
- Splitting. The amount is divided across several addresses, sometimes many. Each branch has to be followed separately.
- Swapping. The stolen asset is exchanged for another, usually a stablecoin or the network's native coin, through a decentralised exchange. The value continues in the new asset and the trace continues with it.
- Bridging. Funds are moved to a different blockchain. The outgoing leg on one network has to be matched to the incoming leg on the other, by amount and timing, which is possible for most bridges.
- Layering. Funds pass through a chain of fresh addresses, each holding them briefly. This adds hops but no real obstacle.
- Mixing. Funds enter a service that pools them with others. This is the one step that genuinely breaks a trace, though funds leaving a mixer can sometimes be matched by amount and timing, with lower confidence.
Each branch is followed until it reaches an endpoint or falls below a threshold agreed with the client, because following every fraction of a penny is not useful.
Where the trail ends
The important endpoint is a deposit address at an exchange. Exchanges assign each customer their own address for receiving funds. When stolen funds arrive at one, they are inside a regulated business that knows who its customer is. Whether a given address belongs to an exchange, and which one, is established from public labels and from the address's own behaviour: deposit addresses sweep funds into a known exchange wallet shortly after receiving them. The report grades this with a confidence level, because labels are not perfect.
Other endpoints are wallets still holding the funds, dormant since they arrived; and services or contracts where funds have been converted into something else. Funds sitting in a dormant wallet can be watched, and will eventually move.
What the ledger cannot tell you
- Who controls an address. The ledger records keys, not names. Attribution to a person is an inference, or comes from outside the chain.
- Whose exchange account received the funds. Only the exchange knows. Getting that information requires the exchange's cooperation or a court order, which is a matter for a solicitor.
- What happened inside an exchange. Once funds are deposited, any trading or withdrawal to a bank account is off-chain.
- Funds after a mixer or on a network outside the trace's scope. The report says where the trail stopped and why.
What happens next
A trace on its own recovers nothing. Its value is that it tells a solicitor exactly where to direct the next step, and gives them a schedule of transactions to exhibit. In England and Wales the courts have shown willingness to treat cryptoassets as property and to grant orders against exchanges holding them, including orders requiring an exchange to disclose the account holder behind a deposit address and orders freezing the assets. The forms of relief and their availability are for the solicitor to advise on. Insolvency practitioners use the same schedule to identify antecedent transactions and to make demands of the exchanges holding dissipated assets.
Speed matters. Funds sitting in an exchange account can be withdrawn. A trace completed within days of the theft is worth far more than one completed months later.
Avoiding a second loss
Victims of a theft are targeted again, by "recovery" services that promise to retrieve funds for an upfront fee and by impostors claiming to be from an exchange or a law-enforcement body. Some rules of thumb: nobody legitimate needs your private key or recovery phrase to trace or recover funds; nobody legitimate guarantees recovery; and a tracing report is evidence for your solicitor, not a promise of a result. Report the theft to Action Fraud in the UK, or the equivalent body elsewhere, and to the exchange you believe received the funds.
What a useful report contains
The flow of funds drawn hop by hop with every transaction reference; the amounts at each step valued at the time; every endpoint identified, with the exchange named where one can be and the confidence stated; the obfuscation used and how each step was followed; what could not be established; and a schedule of transactions in a form that can be attached to a witness statement or a letter to an exchange.
That is what Lucidblock's funds tracing report is. It is not legal advice and it does not itself recover anything. It gives the people who can recover something the evidence they need to try.