Stolen crypto: trace it, check it, report it
Paste the address the funds went to. You will see where they moved, which entity holds them now, and whether the address is already linked to known theft.
Free · No account required
The first few hours matter most
Once stolen funds reach a service that can freeze them, speed decides the outcome. Work through these in order.
- 1
Secure what is left
Create a new wallet on a device you trust and move any remaining balance. If a key or seed phrase leaked, that wallet stays compromised forever.
- 2
Record the transactions
Save the transaction hashes and the destination addresses. This is the evidence everything else depends on.
- 3
Trace the destination
Check the receiving address above. If funds moved to an exchange, that exchange is the one party who can still freeze them.
- 4
Report to police and the exchange
File with your national cybercrime unit and contact the exchange with your transaction hashes and case number.
Beware of recovery scams
Victims are routinely approached by “recovery experts” who promise to get the funds back for an upfront fee. Nobody can reverse a blockchain transaction. These approaches are a second scam aimed at people who have already lost money, and PublicAML will never ask you to pay to recover anything.
How an address gets labelled as stolen funds
Calling an address “stolen funds” is an accusation about a real person, so the label always says what it rests on. We do not merge these into a single unexplained verdict.
- Listed by an official authorityPresent on an OFAC or EU sanctions list, or named in a law-enforcement designation. The strongest signal available.
- Confirmed stolen-funds addressTied to a documented incident where the theft and the destination are both independently established.
- Multiple independent reportsSeveral unrelated parties reported the same address with evidence that holds up on review.
- Connected through on-chain exposureNot reported itself, but received funds traceable to an address in one of the categories above.
- Reported by one userA single unverified report. Shown as exactly that, and never presented as an established fact.
- Attribution disputedThe owner has contested the label and it is under separate review.
We do not publish an open, unmoderated list of accused addresses. An unreviewed feed of allegations is trivially abused for false accusations and extortion, which is why every label passes through review and can be appealed.
If you received tainted funds unknowingly
Traders, merchants and OTC desks regularly receive funds with a history they had no way to know about. That is why every result reports source-of-funds risk separately from the address’s own score — clean behaviour funded by tainted money is a different situation from wrongdoing, and the two should not be collapsed together.
Keep records of what you sold or provided in exchange. If an exchange later asks about the origin of a balance, contemporaneous records are what resolve it.
Stolen cryptocurrency — common questions
My crypto was stolen. What should I do first?
Move any remaining balance to a new wallet created on a clean device, since a compromised key stays compromised. Record the transaction hashes of the theft. Then check where the funds went and report the receiving address so it is flagged for others.
Can stolen cryptocurrency be recovered?
Rarely, and never by reversing the transaction. Recovery generally only happens when funds reach a centralised exchange that freezes them, or when law enforcement seizes them. Tracing quickly and reporting to the exchange and police is what makes that possible.
How does PublicAML decide an address holds stolen funds?
Through documented evidence, not a single report. Labels come from official sanctions and law-enforcement listings, verified incident data, and corroborated community reports. Each label states what it is based on — reported by one user, multiple independent reports, on-chain exposure, or confirmed by an authority — rather than collapsing everything into one unexplained verdict.
Someone offered to recover my stolen crypto for a fee. Is that legitimate?
Almost certainly not. Recovery services that contact victims and ask for an upfront payment are themselves one of the most common follow-up scams. Nobody can reverse a blockchain transaction, and PublicAML will never charge you to recover funds.
Can I check whether an address I am about to use is linked to stolen funds?
Yes, and it is free. Paste the address above to see its risk score, entity attribution and the source of its incoming funds, including exposure to known stolen-fund addresses.
My address received stolen funds without me knowing. What now?
This happens, particularly to traders and merchants. The result separates the address score from source-of-funds risk for exactly this reason. Keep records showing what you sold or provided in exchange, since an exchange may ask about the origin of the balance.
Ready to file? Report the address.