If your crypto got stolen you can return it sometimes – only if you act fast. The blockchain keeps a visible record of stolen funds for years, but the chance to freeze them can disappear very fast.
In a ChangeNOW X Space, Albert Quehenberger, CEO of AQ Forensics and ChangeNOW Ambassador, explained what happens after a crypto theft. He covered what to do first, how investigators follow stolen funds, why platforms run AML checks and how to avoid fake recovery services.
This guide turns that talk into plain steps for you.
Key Terms in Plain Words
- Transaction hash (TXID): a unique ID of one transfer on a blockchain. Think of it as a receipt number.
- Wallet address: the public “account number” that others send crypto to.
- Tracing: following stolen funds from wallet to wallet on a public blockchain.
- Recovery: getting the stolen funds back to the victim. It is a different step from tracing.
- Freeze: a platform blocks an account or a transfer so the funds cannot move further.
- AML check: an anti-money-laundering review. A platform checks where funds came from and where they are going.
- Chain hopping: moving funds from one blockchain to another to make tracing harder.
- Mixing service: a service that blends many users’ coins to hide who sent what.
- Seed phrase and private key: the secret words and the secret key that give full control of a wallet. Nobody who offers to help you should ever ask for them.
- Blockchain investigator: a specialist who traces funds and prepares evidence for platforms and police.
Can Stolen Crypto Be Recovered?
You can recover stolen crypto mostly when you act fast and the funds reach a platform that can freeze them.
Tracing means following the coins on the blockchain. It works like a parcel tracking page: the record is public, so investigators can see every wallet the coins passed through.
Recovery is harder, because nobody can reverse a crypto transfer or take coins out of someone else’s wallet. The coins can be stopped only if the thief sends them to a platform that can freeze them, such as an exchange. Thieves move funds fast, so this chance can disappear quickly.
Albert explained:
“The blockchain trail can remain visible for years. But that doesn’t mean that the assets can still be recovered years later.” – Albert Quehenberger, CEO of AQ Forensics
He spoke from personal experience: he had lost six bitcoins himself, and too much time had passed in that case.
“The transaction history may stay, but the opportunity to act can disappear very fast.”
How long a case takes varies a lot.
“The fastest investigation we did where we had really a success to recover the funds and bring them back took us, I would say, seven days. The longest investigation took us almost three years.”
How Do I Recover Stolen Crypto From a Scam? Start With the First Hour
Protect anything that is still at risk, save the evidence and report the case to the police. Then ask a qualified investigator for an initial review. Rules differ by country, so check with your local police.
The Ledger–CryptoBilis investigation is a recent example of how quickly stolen wallet funds can begin moving across multiple blockchains before the attack vector itself is fully understood.
- Protect what is left. Secure any funds that are still at risk.
- Save the evidence. Wallet addresses, transaction hashes, wallet history, screenshots and chats with the scammer.
- Report to law enforcement.
- Contact a qualified investigator for an initial review.
Albert’s advice in his own words:
“Save the transaction information you have like wallet addresses, transaction hashes, transaction activity history from the wallet you have used, screenshots, the communication between the perpetrators and the victim and report the case to law enforcement.” – Albert Quehenberger
How Do Investigators Trace Stolen Crypto?
To recover funds from a stolen crypto wallet, investigators start with a transaction hash, rebuild the path of the funds and check it against off-chain information such as exchanges and public sources. A hash is a starting point, not proof of who owned the funds.
“The first thing we always ask, first of all, is what has happened, what problem should we solve? And we are always verifying that the assets really belong to the person who is getting in touch with us.” – Albert Quehenberger
One wrong assumption can send the whole investigation in the wrong direction.
“One of the most important things is making sure we don’t accidentally trace through a service wallet and take the wrong direction.The hardest part is not always following the transaction. It is to understand what the transaction really means.” – Albert Quehenberger
The blockchain shows that wallet A sent funds to wallet B. It does not show who controls wallet B. A wallet with many transactions can look suspicious and still be a service or platform address.
That is why investigators do not judge a wallet by its activity alone.
Albert summed it up in one line:
For a victim, this means: do not guess. Send the investigator every address and transaction hash you have, and let them check what each wallet really is.
How Thieves Move Stolen Crypto
Most cases start with manipulation, not hacking. After that, thieves split the funds, use throwaway wallets, swap into stablecoins and move across blockchains.
“Criminals are trying in 95% of all the cases to manipulate the victims, they are sending the funds away on their own, setting them under psychological pressure. Splitting funds is probably one of the most common patterns I see on a daily basis. What we also see are some wallets that are only created, used once and then abandoned.” – Albert Quehenberger
Chain hopping is another common method. Albert said it was once one of the harder paths to follow, while current tools and methods can track many cross-chain flows.
Who Can Freeze Stolen Funds?
Platforms such as exchanges and swap services. To get stolen crypto back, you need one that can freeze the funds and law enforcement to return them. Investigators can trace funds, but they cannot take them.
Not every platform can freeze funds. Decentralized protocols often have no technical way to block a single address, or choose not to on principle.
The September 2026 Bitget case shows the gap. After about $387.5 million was stolen from Bitget, its CEO publicly asked THORChain to refuse service to the attacker’s addresses. THORChain declined. Its operators can halt trading on a whole chain, but they cannot freeze one address, and the team said it treats every user equally. CoinDesk reported that part of the stolen ETH was then swapped into bitcoin through the protocol.
Albert described platforms as the point where tracing turns into action:
“They are very often the only point where blockchain intelligence becomes real action. We can trace the funds, but we cannot simply take somebody’s assets.” – Albert Quehenberger
He described the recovery path as several connected steps:
- Trace the assets.
- Document the flow.
- Contact platforms.
- Freeze funds where possible.
- Let the authorities handle seizure and return.
The authorities also double-check the investigators’ work:
“We are not allowed to transfer funds away from a platform. We always need law enforcement getting involved into such recovery cases.The authorities then review our findings very, very carefully themselves just to make sure that we did not make any mistakes.” – Albert Quehenberger
The legal part is slower than the blockchain part.
ChangeNOW explains how this works on its side in its latest AML statement. If funds are subject to a lawful request from the authorities, ChangeNOW cannot refund or release them until it is legally permitted to. Its support team also cannot discuss case details until the authorities approve sharing them.
Why Does a Platform Ask Me Extra Questions?
To understand the risk behind a transaction. The same check that can annoy a user can also stop stolen funds before they move further.
“In simple terms, AML systems help platforms understand risks or possible risks. Where did the assets come from, where are they going, are they connected to fraud or high-risk entities, hacks, exploits, sanctions or other risk activity.” – Albert Quehenberger
At ChangeNOW, AML reviews are part of platform risk work. When a transaction is connected to theft or fraud, a review can help preserve funds while the case is checked and the authorities get involved.
If your own transaction was put on hold, this guide explains why a transaction gets flagged and what happens during an AML review.
See real examples in the ChangeNOW AML cases.
How to Spot a Fake Recovery Service
Anyone who guarantees recovery is a red flag. Many fake services target victims right after the first theft.
“A guaranteed recovery is always the biggest warning sign and the huge red flag. Nobody can guarantee that stolen funds can be recovered successfully. Not a lawyer, not law enforcement, nobody can do that.” – Albert Quehenberger
Other warning signs:
- An upfront payment to release “recovered” money.
- A request for your seed phrase or private key.
- A claim that a private company was hired by a government to return your funds.
Scammers rely on emotion.
“They do not try to hack our computers or smartphones. They try to hack us via our emotions.Then they look for support and they got scammed again. We had some clients that got scammed three, four, five times in a row.” – Albert Quehenberger
Albert described victims who were hit several times in a row: first by an investment or romance scam, then by a fake recovery service promising a guaranteed return.
How Can I Reduce the Risk of a Theft?
Slow down when someone pressures you to send funds, and never share your seed phrase or private key. Prevention comes before recovery.
AQ Forensics now puts more work into earlier detection. Albert mentioned that the team is building in-house platforms for wallet monitoring, unusual activity detection and analysis of transactions that pass through mixing services.
To understand who controls a wallet in the first place, read What Is a Self-Custody Wallet?
Are You Ready for the First Hour?
Check it now, while nothing has gone wrong. The trail of stolen crypto can stay visible for years, but the chance to act does not. Answer these four questions honestly:
- Could you find your wallet addresses and transaction hashes in under a minute?
- Do you know which platform and which police department you would contact first?
- If someone rushed you to send funds today, would you stop and check?
- If a stranger promised guaranteed recovery, would you walk away?
If any answer is “no”, start there.
Questions about a transaction? Feel free to contact ChangeNOW support. Have your transaction hash ready.
