Guides · Tracing
Where Does Stolen Cryptocurrency Go?
After a theft or a scam, stolen cryptocurrency usually leaves the first receiving wallet. It may be split, swapped, bridged to another network, sent toward a custodial service, or left unspent. Some of those steps are clear on a public ledger. Others are only candidates, or they happen inside a service the public data cannot see. BNG SOFTWARE can map the steps the records support, including where the visible trail stops.
The first receiving wallet is rarely the end
Scam proceeds and stolen balances are often forwarded. The first hop shows where the victim's transfer landed. Later hops show what that wallet did next. A single screenshot of the first transfer cannot answer the destination question, and a fraudulent platform's account page cannot answer it either. The answer comes from the transfers recorded after the loss.
Patterns investigators actually look for
Without turning this into a manual, the recurring shapes of a post-theft path are familiar.
- A split into several smaller transfers.
- A swap into another asset on the same network.
- A bridge or other cross-chain movement, covered in How Does Cross-Chain Cryptocurrency Tracing Work?
- A transfer toward an address associated with a custodial service, covered in Can Stolen Crypto Be Traced to an Exchange?
- A deposit into a mixer or a similar service, where the onward link may be unresolved. See Can Cryptocurrency Be Traced Through Mixers?
- A wallet that receives funds and does not spend them during the period reviewed.
Can you commission a trace only to understand what happened?
Yes. Some people want a clear account of the path and are not asking anyone to pursue the assets. A review of that kind lists the transfers, the networks, and the point where the evidence no longer supports a next hop. It separates what was recorded from what is still a hypothesis. You can stop when you have that account. If you later want a lawyer to see it, the same findings can be read by counsel. Nothing in the trace requires you to start a legal process.
Do not send a seed phrase, a private key, or a password.
Request a Confidential Case Assessment
Where do assets go after a fund hack or an internal loss?
A fund loss often starts in a treasury wallet, a compromised key, a bridge, or a misdirected transfer. The onward path can cross several networks and several counterparties. Management usually needs a timeline it can share with its own counsel and, where appropriate, with investors' advisers. BNG SOFTWARE prepares that technical timeline from the on-chain records and the materials the fund provides. The report does not replace the fund's own legal, audit, or compliance duties.
If you want the assets back, or want to know whether to try
The destination map comes first either way. If the path reaches a custodial service, a later request may be possible. If it ends in an unresolved hop, that is important to know before more money is spent. The possibility question is covered in Can Stolen Cryptocurrency Be Recovered? and the order of the work in How Does Cryptocurrency Recovery Work?
For investigators
An investigator or an authority may need the same destination map as part of a wider case. BNG SOFTWARE provides the technical description of the path. The investigator decides what use to make of it, and any formal power remains with the authority.
What the public ledger does not show
An exchange can move value between customers on its own books. A website can display a profit that was never on-chain. A privacy feature can hide part of the path. Those gaps belong in the findings. Filling them with a guess would make the report less reliable, not more.
What you can keep while you decide
- The full transaction hash, copied as text rather than retyped.
- The network name, because similar strings can exist on different chains.
- The sending and receiving addresses and the approximate date.
- The messages or account pages that led to the payment, kept with their context.
The longer version of this list is in What Evidence Should You Preserve After a Crypto Scam? You should never include a seed phrase or private key in any of it.
Frequently asked questions
Does the money sit in the scammer's wallet?
Sometimes it does for a while. Often it moves again. The only way to know in a specific case is to follow the transactions from the records you have.
If it reached an exchange, is it waiting there for me?
No. A transfer toward an exchange is a destination clue. It is not a balance held for the victim. The exchange decides whether it can do anything with a later request.
Can you tell me the country the funds ended in?
A blockchain transfer does not record a country. A link to a known service may be a lead. A person's location is a different question and usually needs information the ledger does not hold.
Will you name the scammer?
The review identifies addresses and, where the data supports it, known services. It does not promise the legal name of a private individual.
Is this useful if I do not want to sue anyone?
Yes. Understanding the path is a complete reason to commission the work. You can stop when you have the account of where the recorded funds moved.
Further reading
Confidential Case Intake
Request a confidential case assessment
For a review of where the recorded funds moved, share a short description of what happened and any public transaction references you have. Please do not submit passwords, seed phrases, private keys or unnecessary identity documents through this form.