If your crypto got stolen you can return it sometimes – only if you act fast. The blockchain keeps a visible record of stolen funds for years, but the chance to freeze them can disappear very fast.
If your crypto got stolen you can return it sometimes – only if you act fast. The blockchain keeps a visible record of stolen funds for years, but the chance to freeze them can disappear very fast.
In a ChangeNOW X Space, Albert Quehenberger, CEO of AQ Forensics and ChangeNOW Ambassador, explained what happens after a crypto theft. He covered what to do first, how investigators follow stolen funds, why platforms run AML checks and how to avoid fake recovery services.
This guide turns that talk into plain steps for you.
You can recover stolen crypto mostly when you act fast and the funds reach a platform that can freeze them.
Tracing means following the coins on the blockchain. It works like a parcel tracking page: the record is public, so investigators can see every wallet the coins passed through.
Recovery is harder, because nobody can reverse a crypto transfer or take coins out of someone else’s wallet. The coins can be stopped only if the thief sends them to a platform that can freeze them, such as an exchange. Thieves move funds fast, so this chance can disappear quickly.
Albert explained:
“The blockchain trail can remain visible for years. But that doesn’t mean that the assets can still be recovered years later.” – Albert Quehenberger, CEO of AQ Forensics
He spoke from personal experience: he had lost six bitcoins himself, and too much time had passed in that case.
“The transaction history may stay, but the opportunity to act can disappear very fast.”
How long a case takes varies a lot.
“The fastest investigation we did where we had really a success to recover the funds and bring them back took us, I would say, seven days. The longest investigation took us almost three years.”
Protect anything that is still at risk, save the evidence and report the case to the police. Then ask a qualified investigator for an initial review. Rules differ by country, so check with your local police.
Albert’s advice in his own words:
“Save the transaction information you have like wallet addresses, transaction hashes, transaction activity history from the wallet you have used, screenshots, the communication between the perpetrators and the victim and report the case to law enforcement.” – Albert Quehenberger
To recover funds from a stolen crypto wallet, investigators start with a transaction hash, rebuild the path of the funds and check it against off-chain information such as exchanges and public sources. A hash is a starting point, not proof of who owned the funds.
“The first thing we always ask, first of all, is what has happened, what problem should we solve? And we are always verifying that the assets really belong to the person who is getting in touch with us.” – Albert Quehenberger
One wrong assumption can send the whole investigation in the wrong direction.
“One of the most important things is making sure we don’t accidentally trace through a service wallet and take the wrong direction.The hardest part is not always following the transaction. It is to understand what the transaction really means.” – Albert Quehenberger
The blockchain shows that wallet A sent funds to wallet B. It does not show who controls wallet B. A wallet with many transactions can look suspicious and still be a service or platform address.
That is why investigators do not judge a wallet by its activity alone.
Albert summed it up in one line:
For a victim, this means: do not guess. Send the investigator every address and transaction hash you have, and let them check what each wallet really is.
Most cases start with manipulation, not hacking. After that, thieves split the funds, use throwaway wallets, swap into stablecoins and move across blockchains.
“Criminals are trying in 95% of all the cases to manipulate the victims, that the victims are sending the funds away on their own, setting them under psychological pressure. Splitting funds is probably one of the most common patterns I see on a daily basis. What we also see are some wallets that are only created, used once and then abandoned.” – Albert Quehenberger
Chain hopping is another common method. Albert said it was once one of the harder paths to follow, while current tools and methods can track many cross-chain flows.
Platforms such as exchanges and swap services. To get stolen crypto back, you need one that can freeze the funds and law enforcement to return them. Investigators can trace funds, but they cannot take them.
Not every platform can freeze funds. Decentralized protocols often have no technical way to block a single address, or choose not to on principle.
The September 2026 Bitget case shows the gap. After about $387.5 million was stolen from Bitget, its CEO publicly asked THORChain to refuse service to the attacker’s addresses. THORChain declined. Its operators can halt trading on a whole chain, but they cannot freeze one address, and the team said it treats every user equally. CoinDesk reported that part of the stolen ETH was then swapped into bitcoin through the protocol.
Albert described platforms as the point where tracing turns into action:
“They are very often the only point where blockchain intelligence becomes real action. We can trace the funds, but we cannot simply take somebody’s assets.” – Albert Quehenberger
He described the recovery path as several connected steps:
The authorities also double-check the investigators’ work:
“We are not allowed to transfer funds away from a platform. We always need law enforcement getting involved into such recovery cases.The authorities then review our findings very, very carefully themselves just to make sure that we did not make any mistakes.” – Albert Quehenberger
The legal part is slower than the blockchain part.
ChangeNOW explains how this works on its side in its latest AML statement. If funds are subject to a lawful request from the authorities, ChangeNOW cannot refund or release them until it is legally permitted to. Its support team also cannot discuss case details until the authorities approve sharing them.
To understand the risk behind a transaction. The same check that can annoy a user can also stop stolen funds before they move further.
“In simple terms, AML systems help platforms understand risks or possible risks. Where did the assets come from, where are they going, are they connected to fraud or high-risk entities, hacks, exploits, sanctions or other risk activity.” – Albert Quehenberger
At ChangeNOW, AML reviews are part of platform risk work. When a transaction is connected to theft or fraud, a review can help preserve funds while the case is checked and the authorities get involved.
If your own transaction was put on hold, this guide explains why a transaction gets flagged and what happens during an AML review.
See real examples in the ChangeNOW AML cases.
Anyone who guarantees recovery is a red flag. Many fake services target victims right after the first theft.
“A guaranteed recovery is always the biggest warning sign and the huge red flag. Nobody can guarantee that stolen funds can be recovered successfully. Not a lawyer, not law enforcement, nobody can do that.” – Albert Quehenberger
Other warning signs:
Scammers rely on emotion.
“They do not try to hack our computers or smartphones. They try to hack us via our emotions.Then they look for support and they got scammed again. We had some clients that got scammed three, four, five times in a row.” – Albert Quehenberger
Albert described victims who were hit several times in a row: first by an investment or romance scam, then by a fake recovery service promising a guaranteed return.
Slow down when someone pressures you to send funds, and never share your seed phrase or private key. Prevention comes before recovery.
AQ Forensics now puts more work into earlier detection. Albert mentioned that the team is building in-house platforms for wallet monitoring, unusual activity detection and analysis of transactions that pass through mixing services.
To understand who controls a wallet in the first place, read What Is a Self-Custody Wallet?
Check it now, while nothing has gone wrong. The trail of stolen crypto can stay visible for years, but the chance to act does not. Answer these four questions honestly:
If any answer is “no”, start there.
Questions about a transaction? Feel free to contact ChangeNOW support. Have your transaction hash ready.
Bitget Hack Explained: How $387.5M Was Stolen
Bitget has confirmed a major security breach affecting approximately $387.5 million in assets across its hot and warm wallet infrastructure. Private-key compromise has been ruled out.
Over $790,000 in USDT and SOL Seized and Returned | Venezuela's CICPC & ChangeNOW
Over $790K in stolen USDT and SOL was recovered in Venezuela. See how CICPC, CRIXTO, AQ Forensics, and ChangeNOW worked together to trace, freeze, and recover the funds.
Why Was My Transaction Placed Under AML/Compliance Review?
Your crypto transfer suddenly stopped mid-way? Here's what an AML flag really means for you.
