Return of stolen cryptocurrency and blockchain investigation

The faster the response to an incident, the greater the chance of a refund!

After something unpleasant has happened and funds have been lost, your task is to approach the situation as objectively and without emotion as possible. Document every detail of the incident: what happened, how it happened, who was involved, when it happened, under what circumstances, what the interaction steps were, and where the funds were transferred.
Being specific and accurate in detail will help in future investigations or interactions with law enforcement.

Save all emails related to the fraudulent transaction, screenshots of messages from instant messengers and social networks, as well as any other possible evidence.

In the case of communication in Telegram, export the full chat in JSON format to extract the account ID — this information may be needed by specialists. If there were telephone conversations, take a photo of the call history. Record the names of the attackers' websites and save payment receipts, especially if fiat funds were used. You need to act quickly: some data may be lost, and attackers may try to erase some information.

The information you collect will be very useful in providing incident details to relevant authorities and cybersecurity experts.

The blockchain is like an open ledger: every transaction is recorded. Knowing the user’s address, you can track where and how much money he sent. Using a blockchain browser, you can track the movement of funds.

If this process seems too complicated to you, you can contact professionals in specialized companies. They have tools that not only visualize the flow of funds, but also overlay markup on addresses, facilitating data analysis.

Stolen cryptocurrency funds are usually quickly converted into fiat money. To do this, scammers have a limited number of options available to them:

• CEX (centralized crypto exchanges)
• OTC P2P transactions (over-the-counter transactions between individuals)
• ATM (cryptocurrency ATMs)

Stolen funds can travel through transit addresses, use blockchain bridges, and interact with smart contracts and mixers to make their movement more difficult to track.

The importance of receiving notifications of every movement of funds cannot be overstated, as this allows for a timely response, for example, if funds have arrived at the deposit address of the exchange.

If you don’t have enough knowledge, turn to blockchain investigation companies — it’s time to scrutinize every transaction and every address.

It is necessary to analyze the nature of the behavior of the funds, as well as the mention of related data on the Internet. This information should be organized in such a way that it is ready to be provided to law enforcement agencies and crypto exchanges. It is important to highlight key transactions, highlighting their hashes, and provide the data in a format that can be understood by any party that will assist in the return.

Here is key information to provide to law enforcement for follow-up requests:

• Phone numbers from which the attackers contacted you, along with the time and date of the calls. Despite the possibility of using temporary numbers, attackers can make mistakes.
• Site domain of scammers. Law enforcement agencies will be able to request information about the owner, IP logs and payment information from the domain registrar and hosting provider.
• Advertising platforms where you saw ads from scammers. As in the case of a domain, the attacker registered a personal account to launch advertising.
• Telegram-Username and Telegram-ID, if the communication was via Telegram, you can get a lot of useful information about the attacker… the groups he is a member of, his other messages, etc.
• Scammer profiles on social networks. Social networks collect extensive data about users, including logins, location, contacts and interests.
• Sites with reviews of scammers. Attackers often publish fake reviews about their fraudulent service, but in addition to "lies," these reviews also contain digital clues about the user.
• Email addresses. Mail services store information about logins, locations, and devices used.
• Exchanges and crypto exchangers, which the attacker could use to launder funds. This information will allow law enforcement agencies to send requests for the provision of data under the KYC (Know Your Client) procedure.

Regardless of the location of the exchange, they do not seek to support illegal activities on their platform.

Most licensed exchanges actively cooperate with law enforcement agencies, blocking funds if fraud is suspected.

If you notice that your funds have been transferred to an exchange, please contact their technical support. Please note that a double application will be required: first in person or through a specialist, and then on behalf of law enforcement agencies.