Following an investigation into funds stolen from a victim in Venezuela, CRIXTO worked closely with investigators and industry partners to help trace the movement of the stolen assets. AQ Forensics supported the investigation with external on-chain analysis, reconstructing transaction paths across multiple services. Information shared during the investigation helped identify wallets connected to the incident and supported efforts to recover a substantial portion of the funds.
After a tip from a trusted source, ChangeNOW blocklisted the compromised wallets and stopped five exchange attempts initiated from them. Once Venezuela's Scientific, Penal, and Criminal Investigations Corps (CICPC) formally requested the seizure of the frozen assets, we verified the request and returned 772,440.7575 USDT (TRC20) and 182.3057699 SOL, worth approximately $791,252, to wallets identified as belonging to the victim.
What happened
The case involved funds stolen from a victim in Venezuela and subsequently moved across the blockchain.
CRIXTO played an active role in responding to the incident, providing information that helped investigators and industry participants follow the movement of the stolen assets and identify relevant transactions and addresses. This kind of rapid cooperation is particularly important in crypto investigations, where funds can move between wallets, networks, and services within minutes.
AQ Forensics also supported the investigation with external on-chain analysis, reconstructing transaction paths across multiple services and identifying a previously unattributed wallet that appeared to have a connection to ChangeNOW. The team shared the relevant transaction data and technical findings with ChangeNOW for review.
The wallet itself initially appeared to offer no obvious next step. However, AQ Forensics continued examining activity around it, including services used by the same actors shortly before. As the team explained, an inactive wallet does not necessarily mean that an investigative trail has ended: access may have been lost, assets may already have been intercepted, or those controlling the wallet may simply be waiting before moving them again.
“When the obvious tracing path ends, we do not automatically assume the trail is over. In this case, we looked at services the same actors had used shortly before and asked whether the wallet could be linked to activity on their side. Sometimes the decisive lead comes from activity around the wallet rather than from the wallet itself.”
Based on the information available, ChangeNOW added the addresses to its blocklist as a precaution.
Once the addresses had been flagged, our monitoring system detected five exchange attempts initiated from them and stopped the transactions before the funds could move further.
As a result, 772,440.7575 USDT (TRC20) and 182.3057699 SOL were frozen pending further investigation.
The investigation did not stop at tracing the assets themselves. Investigators were also able to identify individuals connected to the events:
“Thanks to the information provided – specifically the Know Your Customer (KYC) data of the individuals who claimed the stolen funds – we were able to coordinate additional proceedings through Interpol that will allow us to advance the case. Furthermore, we were able to track the funds with high precision.”
The case remains open, with further investigative work still underway.
CRIXTO's Role in Tracing the Funds
The recovery was not the result of a single platform acting alone.
CRIXTO cooperated closely throughout the investigation and provided information that helped trace the stolen assets further along their on-chain path. Their responsiveness gave investigators additional context needed to connect transactions, wallets, and movements of funds across the case.
That cooperation ultimately contributed to the recovery of a significant portion of the stolen assets.
Blockchain transactions themselves cannot simply be reversed, so the ability of affected companies, exchanges, compliance teams, investigators, and law-enforcement agencies to exchange reliable information quickly can determine whether stolen funds continue moving or can be intercepted.
Cryptocurrency investigations are particularly challenging because tracing transactions does not automatically reveal the identities of the people behind them. Information held by crypto services can therefore become an important bridge between on-chain activity and real-world investigative leads.
This challenge was also highlighted during the investigation:
“Cases involving cryptocurrencies are inherently complex, as they present significant challenges in identifying individuals. However, responsible and efficient organizations like ChangeNOW help foster a safer crypto ecosystem, enabling law enforcement agencies worldwide to conduct the necessary investigations.”
CRIXTO's willingness to engage rapidly and provide relevant information is a strong example of how cooperation between crypto businesses and investigators can translate into a real recovery for victims.
Working with Venezuela's CICPC
Venezuela's Scientific, Penal, and Criminal Investigations Corps, CICPC, became involved in the case and contacted ChangeNOW regarding the stopped transactions.
The agency requested information connected to the five exchanges as part of its investigation. After reviewing the evidence and tracing the relevant funds, CICPC formally requested the seizure of the assets that had been frozen on our side.
Before acting on the request, ChangeNOW carried out its standard verification procedures, including checks relating to the request itself and the destination wallets provided by investigators.
Once those checks were completed, the recovered assets were sent to addresses identified by CICPC as belonging to the victim.
But recovering the assets was only one part of the investigation. According to the lead investigator, seemingly small pieces of technical and account information can become valuable when investigators are trying to identify the people behind crypto transactions.
“A criminal investigation is like a puzzle, and every piece provided helps complete it – such as email addresses, IP addresses, connection logs or browser session data, associated devices, or any detail leading to the identification of an individual.”
In this case, investigators also encountered attempts to obscure identity through fake domains, disposable email addresses, and fraudulent subscriber information associated with IP addresses. These obstacles complicated attribution and required investigators to pursue alternative leads.
Why Cooperation Matters in Crypto Investigations
Crypto investigations often involve several independent organizations at once.
A victim or affected company may first identify suspicious activity. Blockchain analytics or exchanges may then identify related addresses. Other services may encounter the funds later in their transaction path, while law-enforcement investigators coordinate evidence and recovery efforts.
No single participant necessarily sees the entire picture.
In this case, information shared by CRIXTO, AQ Forensics, a trusted source, CICPC, and ChangeNOW helped connect different parts of that picture quickly enough to stop the funds before they could be moved again.
One lesson from the investigation was clear: speed is one of the most important factors in the first stages of a crypto theft case.
“The greatest mistake is allowing significant time to elapse after the incident. The faster wallet reports are submitted, the higher the likelihood of recovering and returning funds to the victim.”
Delays can give perpetrators more time to move assets through additional wallets and services, making interception and recovery increasingly difficult.
At the same time, AQ Forensics' work in this case illustrates why investigators may continue looking even when a wallet appears inactive. The next useful lead can come from surrounding activity and connections to other services rather than another transaction from the wallet itself.
Cases like this demonstrate why maintaining direct communication channels between crypto companies, compliance teams, investigators, and law enforcement can make a practical difference rather than simply producing another post-mortem report after the assets disappear.
Conclusion
The recovery of approximately $791,252 in USDT and SOL shows what coordinated action can achieve when information moves as quickly as the stolen assets themselves.
CRIXTO's prompt cooperation and assistance in tracing the funds provided valuable information to the investigation, while AQ Forensics' external on-chain analysis helped uncover an important connection in the transaction path. CICPC's investigative work and ChangeNOW's transaction monitoring and compliance procedures helped prevent the assets from moving further.
Most importantly, a substantial portion of the stolen funds was ultimately recovered and returned to the victim.
For crypto companies, the lesson is straightforward: fast reporting, preserved transaction data, and direct cooperation between affected businesses, exchanges, investigators, and law enforcement can materially improve the chances of recovering stolen assets.
As the lead investigator on the case put it, every piece of information can become part of the investigative puzzle. In a crypto theft case, getting those pieces to investigators quickly can be just as important as identifying the suspicious transaction itself.
We regularly report on similar investigations in our dedicated AML cases category, alongside practical guidance on safeguarding your crypto.
