• BTC$84,609.79-1.9%
• ETH$2,678.46-2.3%
• USDT$1~0%
• XRP$1.53-3.1%
• BNB$767.15-2.7%
• USDC$1~0%

As a result, 772,440.7575 USDT (TRC20) and 182.3057699 SOL were frozen pending further investigation.

The investigation did not stop at tracing the assets themselves. Investigators were also able to identify individuals connected to the events:

“Thanks to the information provided – specifically the Know Your Customer (KYC) data of the individuals who claimed the stolen funds – we were able to coordinate additional proceedings through Interpol that will allow us to advance the case. Furthermore, we were able to track the funds with high precision.”

The case remains open, with further investigative work still underway.

CRIXTO's Role in Tracing the Funds

The recovery was not the result of a single platform acting alone.

CRIXTO cooperated closely throughout the investigation and provided information that helped trace the stolen assets further along their on-chain path. Their responsiveness gave investigators additional context needed to connect transactions, wallets, and movements of funds across the case.

That cooperation ultimately contributed to the recovery of a significant portion of the stolen assets.

Blockchain transactions themselves cannot simply be reversed, so the ability of affected companies, exchanges, compliance teams, investigators, and law-enforcement agencies to exchange reliable information quickly can determine whether stolen funds continue moving or can be intercepted.

Cryptocurrency investigations are particularly challenging because tracing transactions does not automatically reveal the identities of the people behind them. Information held by crypto services can therefore become an important bridge between on-chain activity and real-world investigative leads.

This challenge was also highlighted during the investigation:

“Cases involving cryptocurrencies are inherently complex, as they present significant challenges in identifying individuals. However, responsible and efficient organizations like ChangeNOW help foster a safer crypto ecosystem, enabling law enforcement agencies worldwide to conduct the necessary investigations.”

CRIXTO's willingness to engage rapidly and provide relevant information is a strong example of how cooperation between crypto businesses and investigators can translate into a real recovery for victims.

Working with Venezuela's CICPC

Venezuela's Scientific, Penal, and Criminal Investigations Corps, CICPC, became involved in the case and contacted ChangeNOW regarding the stopped transactions.

The agency requested information connected to the five exchanges as part of its investigation. After reviewing the evidence and tracing the relevant funds, CICPC formally requested the seizure of the assets that had been frozen on our side.

Before acting on the request, ChangeNOW carried out its standard verification procedures, including checks relating to the request itself and the destination wallets provided by investigators.

Once those checks were completed, the recovered assets were sent to addresses identified by CICPC as belonging to the victim.

But recovering the assets was only one part of the investigation. According to the lead investigator, seemingly small pieces of technical and account information can become valuable when investigators are trying to identify the people behind crypto transactions.

“A criminal investigation is like a puzzle, and every piece provided helps complete it – such as email addresses, IP addresses, connection logs or browser session data, associated devices, or any detail leading to the identification of an individual.”

In this case, investigators also encountered attempts to obscure identity through fake domains, disposable email addresses, and fraudulent subscriber information associated with IP addresses. These obstacles complicated attribution and required investigators to pursue alternative leads.

Why Cooperation Matters in Crypto Investigations

Crypto investigations often involve several independent organizations at once.

A victim or affected company may first identify suspicious activity. Blockchain analytics or exchanges may then identify related addresses. Other services may encounter the funds later in their transaction path, while law-enforcement investigators coordinate evidence and recovery efforts.

No single participant necessarily sees the entire picture.

In this case, information shared by CRIXTO, AQ Forensics, a trusted source, CICPC, and ChangeNOW helped connect different parts of that picture quickly enough to stop the funds before they could be moved again.

One lesson from the investigation was clear: speed is one of the most important factors in the first stages of a crypto theft case.

“The greatest mistake is allowing significant time to elapse after the incident. The faster wallet reports are submitted, the higher the likelihood of recovering and returning funds to the victim.”

Delays can give perpetrators more time to move assets through additional wallets and services, making interception and recovery increasingly difficult.

At the same time, AQ Forensics' work in this case illustrates why investigators may continue looking even when a wallet appears inactive. The next useful lead can come from surrounding activity and connections to other services rather than another transaction from the wallet itself.

Cases like this demonstrate why maintaining direct communication channels between crypto companies, compliance teams, investigators, and law enforcement can make a practical difference rather than simply producing another post-mortem report after the assets disappear.

Conclusion

The recovery of approximately $791,252 in USDT and SOL shows what coordinated action can achieve when information moves as quickly as the stolen assets themselves.

CRIXTO's prompt cooperation and assistance in tracing the funds provided valuable information to the investigation, while AQ Forensics' external on-chain analysis helped uncover an important connection in the transaction path. CICPC's investigative work and ChangeNOW's transaction monitoring and compliance procedures helped prevent the assets from moving further.

Most importantly, a substantial portion of the stolen funds was ultimately recovered and returned to the victim.

For crypto companies, the lesson is straightforward: fast reporting, preserved transaction data, and direct cooperation between affected businesses, exchanges, investigators, and law enforcement can materially improve the chances of recovering stolen assets.

As the lead investigator on the case put it, every piece of information can become part of the investigative puzzle. In a crypto theft case, getting those pieces to investigators quickly can be just as important as identifying the suspicious transaction itself.

We regularly report on similar investigations in our dedicated AML cases category, alongside practical guidance on safeguarding your crypto.