Never pay anyone who offers to recover your crypto. People who contact you after a theft offering "recovery", "hacking it back" or "fund tracing for a fee" are almost always running a second scam. Exchanges and police don't charge to freeze stolen funds. Pursuit will never ask you for money to get yours back, or for your seed phrase.

What a trace does

1. Find the thief's wallet. From a transaction we find who received your money. From an address we start there.
2. Look backwards. We follow where the thief's wallet got its first funds: an exchange (which knows who opened the account), a mixer, or a bridge. Other wallets funded the same way at the same time are likely the same person ("siblings").
3. Follow the money forward. Hop by hop, through swaps and bridges to other chains, until it stops, gets split into dust, or reaches a service like an exchange.
4. Flag what can still be frozen. A deposit address is an exchange account; the exchange can freeze it. USDT and USDC can be frozen by Tether and Circle wherever they sit.
5. Keep watching. With "Watch live", every wallet in the case is checked continuously and you're alerted the moment money moves or lands at an exchange.

What the findings mean

Exchange deposit

Money reached an address that forwards to an exchange. That exchange knows the account owner and can freeze it. This is the best chance of recovery.

Stablecoins freezable

USDT or USDC is sitting in a wallet. The issuer can freeze it, but only on a police request.

Funds parked

Money hasn't moved yet. Watch it.

Funded by exchange / mixer / bridge

Where the thief got the gas to start. An exchange funder is a lead for police; a mixer means they hid it.

Sibling wallets

Wallets funded by the same source within a short window. Likely the same operator, possibly other victims.

Peel chain

Money passed through a string of fresh wallets, a little peeled off each time. A common laundering pattern.

Bridge exit / swap hop

Money changed chain or token. We follow it when the bridge or swap can be matched.

Mixer used, sanctioned contact

The trail goes cold, or crosses a sanctioned service. Report it; police have other tools.

Timezone

When the wallet is active. A weak hint, never proof of anything.

Confidence

High: direct on-chain links you can verify yourself. Medium: a strong pattern (timing, amounts) but not a direct link. Low: a lead worth checking, not evidence.

Facts and attribution

Every freeze letter and incident report keeps two things apart: verified on-chain facts (transactions anyone can open on an explorer) and attribution (who we believe controls an address, with where that label came from, how confident we are, and how to check it). A traced destination is not an identified person, and a freeze is not a recovery.

What it can't do

• It can't tell you who the thief is. Only an exchange or police with a legal request can.
• It can't freeze anything itself, or get money back. It writes the request and tells you where to send it fast.
• Mixers, privacy coins and some cross-chain swaps break the trail. We say so when that happens.
• Busy wallets (exchanges, big contracts) aren't followed through; the money is mixed with everyone else's.
• Labels come from public sources and can be wrong or missing. Check the explorer links.
• The written story is generated from the evidence only, and any sentence that isn't backed by a cited piece of evidence is removed. It can still be incomplete.

Your data

Traces of public addresses are public. Details you type into the recovery pack are used to fill in documents and aren't stored. We never ask for your seed phrase or private key; anyone who does is stealing.

How often the trace is right · Look up or suggest a label · Check an evidence file