Stolen Bitcoin: How to Trace It and When You Can Get It Back
Stolen Bitcoin can sometimes be recovered, but only when the coins reach a service that knows its customers. What to do first, how a trace works, and three cases where the coins came back.
Stolen Bitcoin can sometimes be recovered. It happens when the coins reach a service that knows who its customers are, such as a regulated exchange, and the police or a court can ask that service to freeze the account. Most of the time that does not happen fast enough, or at all. This guide covers what to do first, how a trace works, where traces stop, and three cases where the coins came back.
What to do in the first hours
- Stop sending. Do not pay any "fee" to unlock, release or recover the coins. That is how a first loss becomes a second one.
- Write everything down. Save the transaction IDs, the addresses you paid, the dates and amounts, and screenshots of the chats, emails or websites involved.
- Report it. In the US, file at the FBI's Internet Crime Complaint Center and the Federal Trade Commission. If it was an investment or trading scheme, also tell the CFTC or the SEC. In England, Wales and Northern Ireland, report to Report Fraud, which replaced Action Fraud; in Scotland, call the police on 101. Elsewhere, start with your local police.
- Tell the exchange you sent from. It cannot reverse a Bitcoin payment, but it may be able to flag the receiving address, and it keeps records the police may need.
Watch out for recovery scams
People who have just lost money are a target. In June 2024 the FBI warned about fake law firms that contact crypto scam victims and offer to get their money back. Victims reported more than $9.9 million in losses to these firms in one year. The FBI's advice is plain: law enforcement does not charge victims a fee to investigate. Be wary of anyone who promises recovery, asks for an upfront payment, or contacts you first.
How a trace works
Every Bitcoin payment sits on a public ledger. A trace follows the coins from the address you paid to the next address, and the next, until they reach somewhere useful.
| What the trace looks for | Why it matters |
|---|---|
| The real payment in each transaction | A Bitcoin payment often sends some coins back to the sender as change. The trace must follow the payment, not the change. |
| Addresses spent together | When one payment spends coins from several addresses, one wallet most likely controls all of them. |
| Labelled addresses | An address known to belong to an exchange, a mixer or a known scam tells you what happened to the coins. |
| An exchange deposit address | This is the goal. The exchange knows whose account that address belongs to, and a court or the police can ask. |
Where traces stop
Many traces end at an address with no name. The thief moves the coins through fresh addresses, each used once, or through a mixer, or to a service that does not check its customers.
The 2020 Twitter hack shows this. Victims sent 13.15 BTC to three scam addresses. We followed the coins with the Bitquery MCP server and checked all 41 addresses the two main hack wallets paid against Bitquery's labels. None was marked as an exchange. The case was solved off the ledger, through other evidence. The full trace shows each step.
Trace it yourself with the Bitquery MCP server
The Bitquery MCP server lets you ask an AI client, such as Claude or ChatGPT, to follow a Bitcoin payment step by step. Connect it with one URL, https://mcp.bitquery.io. Tracing sits on the AI Investigation MCP plan, at $149 per month on our pricing page. The setup guide covers each client.
I sent Bitcoin in transaction <your tx id>. Which output was the
payment and which was change?
Where did the address I paid send the coins? Follow the largest
payment three steps and label every address.
Is any of these addresses an exchange deposit address, a mixer
or a known scam?
| Tool | What it does |
|---|---|
btc_tx_flow | Lists the inputs and outputs of one transaction and marks change |
btc_address_flow_summary | Shows who an address paid and who paid it |
btc_related_addresses | Finds addresses spent together, likely one owner |
labels_for_addresses | Checks addresses against exchange, mixer and scam labels |
No AI client? MoneyFlow Lite follows funds from an address in your browser, on 17 chains including Bitcoin. It draws on your Bitquery API quota; try it on the 7-day trial.
A trace you run yourself does not get your coins back. It gives you, the police or a lawyer the addresses and transactions to put in a report or a legal request to an exchange.
Three cases where the coins came back
Each of these took years, and each went through police or a court.
| Case | What was taken | What came back |
|---|---|---|
| Mt. Gox, 2014 | 850,000 BTC lost when the exchange collapsed | The trustee recovered about 142,000 BTC and has been repaying creditors since mid-2024 |
| Silk Road, 2012 | 50,676 BTC taken by James Zhong | US agents seized the coins at his home in November 2021 |
| Bitfinex, 2016 | 119,754 BTC taken in a hack | US agents had seized more than $3.6 billion linked to it by February 2022 |
Mt. Gox. The Tokyo exchange lost 850,000 BTC in 2014 and filed for bankruptcy. The trustee recovered about 142,000 BTC, plus Bitcoin Cash and yen. About 19,500 creditors had been repaid by March 2025, many through Kraken and Bitstamp, The Block reported.
Silk Road. In 2012, James Zhong tricked the Silk Road marketplace into releasing 50,676 BTC through a set of fake accounts. Agents found the keys in an underground safe and on a small computer hidden in a popcorn tin. He pleaded guilty to wire fraud in 2022, The Block reported.
Bitfinex. Ilya Lichtenstein hacked the exchange in 2016 and moved 119,754 BTC through more than 2,000 transactions. He and his wife laundered part of it through exchanges, darknet markets and mixers. Investigators traced the funds and seized more than $3.6 billion in 2022. Lichtenstein was sentenced to five years in November 2024.
How Bitcoin gets stolen, and how to make it harder
- Stolen keys or seed phrase. Anyone with your seed phrase controls your coins. Never type it into a website or share it with anyone. Keep it offline.
- Fake websites and apps. Phishing sites copy wallets and exchanges. Type addresses yourself and use bookmarks.
- Fake giveaways. "Send 1 BTC, get 2 back" is always a scam, even from a famous account. The Twitter hack used exactly this line.
- Fake investments. Schemes that promise high, steady returns and then make withdrawals hard or charge "fees" to release them.
- Look-alike addresses. Scammers send tiny payments from addresses that copy the first and last characters of ones you use. Check every character before you send. Our whale-tracking guide shows real examples.
Bitquery's investigation service
Bitquery also runs a crypto investigation service. The first assessment is free. After it, we send a proposal with the charges for a full investigation. If we cannot assist in recovery, there are no additional charges. No one can guarantee recovery, and we do not.
Trace the money by asking an AI
Connect the Bitquery MCP server to Claude, Cursor or ChatGPT and ask in plain English where funds from an address went. The agent follows each hop, names the exchanges and mixers on the path, and returns the transactions behind every step.
Frequently asked questions
Can stolen Bitcoin be recovered?
Sometimes. Recovery needs the coins to reach a service that knows its customers, and a police or court request to that service before the coins move on. Many thefts are never recovered.
Can someone guarantee to recover my Bitcoin?
No. Anyone who guarantees recovery, especially for an upfront fee, is likely running a scam. The FBI says law enforcement does not charge victims to investigate.
How long does recovery take?
When it happens, it usually takes years. Mt. Gox creditors started getting coins back about ten years after the collapse.
Can I trace stolen Bitcoin myself?
Yes. The ledger is public, and tools like the Bitquery MCP server follow each payment and check addresses against known labels. A trace gives you evidence; getting the coins back still needs the police, a court or the exchange.
Related reading
- How to trace Bitcoin transactions and addresses
- Where did the Twitter hack Bitcoin go? A full trace
- How to recover scammed Bitcoin
First published in April 2024 by Divyasshree and Dheeraj M. Rewritten on 15 October 2026: the cases were re-checked against the Justice Department, the FBI and news reports, Coinpath and the non-Bitcoin cases were removed, and AI tools helped draft the text. Bitquery sells the MCP server and the investigation service named above. This guide is for information only and is not legal advice. It names people only where courts or prosecutors have named them.
Subscribe to our newsletter
Subscribe and never miss any updates related to our APIs, new developments & latest news etc. Our newsletter is sent once a week on Monday.