Can Stolen Crypto Be Traced? How to Follow Stolen ETH On-Chain

By Merunas Grincalaitis, founder of MEV DAO and a developer who builds MEV, sniping and trading bots on Ethereum. Last updated: October 2026.

TL;DR: Yes, stolen crypto on Ethereum can almost always be traced, because every transfer is public and permanent. You can follow it yourself on Etherscan in a few minutes. What's hard is the next step: putting a name on the address and getting the money back. That usually only happens when the funds reach a service that can freeze them, like a centralized exchange or a stablecoin issuer such as Tether or Circle, and police or a court get involved. So trace it, write it down, report it fast, and ignore anyone who promises recovery for an upfront fee.

When someone's wallet gets drained, the first message I get is usually "where did my money go?" and the second is "can you find the guy?" The first question has a precise answer. The second one is more complicated, and I'd rather explain why honestly than let you find out from a "recovery agent" who charges you twice.

Can stolen crypto be traced?

On a public blockchain like Ethereum, yes. Every transaction records the sending address, the receiving address, the amount and the time, and anyone can read it. Nothing is hidden by default. That's very different from cash, and it's why investigators can still follow funds years after a theft.

The best example is the Bybit hack. On February 21, 2025, about $1.5 billion was stolen from the exchange. Five days later the FBI published a notice attributing it to North Korean actors it calls "TraderTraitor," and listed dozens of Ethereum addresses holding the stolen funds, asking exchanges, bridges and node operators to block them. That's tracing working at full speed. It's also a reminder of the limit: by then the funds had already been converted and spread across thousands of addresses on several chains.

How do you trace stolen ETH yourself?

You don't need paid tools to do the first pass. Here's what I do on Etherscan:

Open your own address and find the transaction that took the funds. Copy the transaction hash and the receiving address.
Check every tab. ETH transfers show under Transactions, but tokens show under Token Transfers (ERC-20) and NFT Transfers, and ETH moved by a contract shows under Internal Transactions. Drains often hit several of them.
Click the thief's address and follow the outflows. Note each address the funds go to next, with amounts and timestamps. Thieves usually split funds quickly, so follow the largest amounts first.
Look for labels. Etherscan tags known addresses, such as exchange deposit wallets, bridges and routers. A label like an exchange's name is the most useful thing you can find, because that exchange knows who its customer is.
Note where the trail gets hard. Swaps on a decentralized exchange are still traceable. Bridges move funds to another chain where you have to pick the trail up again on that chain's explorer. Mixers break the direct link between deposit and withdrawal.
Save everything in a document: transaction hashes, addresses, amounts, times in UTC, and screenshots. This is what police and exchanges will ask for.

Free visual tools like Arkham, Breadcrumbs or MetaSleuth can draw the flow as a graph, which helps when the funds get split many ways. They show the same public data, just arranged better.

Can you find out who owns a wallet address?

Usually not from the blockchain alone. Addresses are pseudonymous: they aren't tied to a name, but they aren't anonymous either. The owner gets exposed when the address touches something linked to their identity:

A centralized exchange. Regulated exchanges collect ID from their customers. They won't tell you, but they respond to police and court requests.
An ENS name or social profile. If the address has an ENS name or was posted publicly, it may lead somewhere, though professional thieves avoid that.
Reuse. The same address or pattern linked to earlier thefts, which analytics firms track.

So tracing gives you a map. Identifying a person almost always needs law enforcement, because they're the ones who can legally get the customer data behind an exchange account.

Who can freeze stolen crypto?

On Ethereum itself, nobody can reverse a transaction. But some places the funds can land are controlled by companies that can freeze them:

Where the funds go	Traceable?	Can it be frozen?	Who can act
Thief's own wallet	Yes	No	Nobody, unless it holds a freezable token
USDT (Tether)	Yes	Yes, the issuer can freeze an address	Tether, usually at police request
USDC (Circle)	Yes	Yes, under a legal or regulatory order	Circle
Centralized exchange deposit	Yes	Yes, the exchange can lock the account	Exchange, after a report or police request
DEX swap	Yes	No	Nobody
Bridge to another chain	Yes, with more work	Rarely	Sometimes the bridge operator
Mixer	Much harder	No	Nobody

Stablecoin freezes are bigger than most people expect. Tether said in a September 28, 2026 update that it works with more than 340 law enforcement agencies in 70 countries and that those efforts have resulted in more than $5 billion in assets being frozen. Circle's access denial policy says it blocks USDC addresses for legal or regulatory orders, certain urgent law enforcement requests, and network security emergencies. Neither of them freezes funds just because a victim emails them, so the report has to come through the right channel.

Mixers are the other side of it. Tornado Cash was sanctioned by the US Treasury in 2022, and Treasury removed those sanctions on March 21, 2025. Whatever you think about that, funds that go through a mixer are much harder to follow, which is why thieves use them.

How do you report stolen crypto to the police?

Speed matters most, because funds are usually moved again within hours or days. This is the order I'd follow:

Secure what's left first. If the wallet still holds tokens, an attacker who has your key will take them. My wallet drained checklist covers the first hour.
File a police report with your local police or national cybercrime unit. In the US, that's the FBI's IC3. Include the transaction hashes, the thief's addresses and your trace document. A report number also helps when you contact exchanges.
Contact the exchange where funds landed, through its official support or law enforcement channel, with the report number and the deposit transaction. Ask them to review and hold the funds.
Flag the address on Etherscan. Its Report/Flag Address option sends a form to Etherscan, and addresses proven to be involved in scams get a public warning label. That won't return your money, but it warns the next person.

It's worth doing even if it feels hopeless. The FBI's 2025 Internet Crime Report recorded 181,565 cryptocurrency-related complaints and about $11.4 billion in reported crypto losses, and the bureau's Operation Level Up notified more than 8,000 victims of crypto investment fraud. Patterns across many reports are how investigators connect cases.

Does tracing get your money back?

Usually not by itself, and I'd be lying if I said otherwise. Chainalysis estimated more than $3.4 billion stolen in 2025, plus 158,000 personal wallet compromises affecting at least 80,000 victims. Most of those individual cases never see a refund. Recovery happens when funds sit somewhere freezable and a legal process follows, and that takes time.

This is exactly what fake "crypto tracing" and "fund recovery" companies exploit. They show you a nice graph of where your funds went, which anyone can make from public data, then ask for a fee to "unlock" the recovery. I wrote a whole post on how to spot recovery scams. Real investigators don't need your seed phrase, and they don't guarantee results.

What can often be saved is whatever is still in the wallet: staked tokens, vesting, airdrops, NFTs, or tokens the thief hasn't bothered with yet. Those can be moved out with a private bundle before the sweeper bot catches them.

Frequently asked questions

Can a crypto scammer be traced?

The scammer's addresses and every transfer they make can be traced on a public blockchain. Identifying the person usually requires police or a court to get customer data from an exchange or service the funds passed through.

Can a blockchain wallet be traced?

Yes. Every transaction a wallet sends or receives on Ethereum is public, so its full history can be followed on a block explorer. What isn't public is the owner's identity.

Is there a way to find out who owns a crypto wallet?

Not directly from the blockchain. The owner can be identified when the address interacts with an exchange that verified their ID, or links to an ENS name or public profile. Exchanges only share that data with law enforcement.

Can police track stolen crypto?

Yes. Police use the same public data plus blockchain analytics tools, and they can legally request customer information from exchanges and ask stablecoin issuers to freeze funds. Recovery depends on where the funds end up.

Can stolen USDT be frozen?

Yes. Tether can freeze USDT at a specific address, and it usually does so in cooperation with law enforcement. Report the theft to police quickly with the transaction hashes and addresses.

Should I pay a company to trace my stolen crypto?

Be very careful. Basic tracing can be done for free on a block explorer, and many paid "tracing" or "recovery" services are scams that target victims. Never share your seed phrase or pay an upfront recovery fee.

If tokens are still stuck in a compromised wallet with a sweeper bot watching it, that part I can help with. See the MEV DAO token rescue service or message me on Telegram.