CRYPTO INVESTIGATION SERVICES · Fund tracing · AML forensics

We trace stolen crypto to where it cashes out. Hop by hop, across chains.

Bitquery's investigators follow the funds from the wallet that was hacked, through mixers and bridges, to the exchange or sanctioned entity on the other side — and attribute each address to a real entity. We deliver the evidence trail you need for stolen-fund recovery support, AML investigations and law-enforcement cooperation.

case · stolen-fundsactive investigation
Sourcehacked walletHop 10x4d1e…88c0Hop 20xab09…3f2dMixerlayeringExchangecash-outSanctionedOFAC SDN
source / flaggedmixerexchange
Trusted by 40,000+ developers & teams like
Binance logoChainalysis logoTRM Labs logoNansen logo0x logoCoinMarketCap logoCoin Metrics logoBybit logoLukka logo3Commas logoNexo logoTether logo
40+
Chains supported
1PB+
Blockchain data indexed
10B+
API calls / month
99.9%
Production uptime
01
Case intelligence

Every entity in a case, scored and attributed.

An investigation is a story about three kinds of wallet: where the funds were stolen, where they were laundered, and where they cashed out. We score and attribute each one so the case reads as named entities, not just hashes.

Source · hacked walletRisk 94
Stolen fundsExploit originMixer exposure
Where the theft began — funds leave the victim wallet and immediately start splitting across fresh intermediary addresses to break the trail.
Mixer / bridgeRisk 61
LayeringHigh velocityCross-chain
The obfuscation layer — funds pass through a mixer or bridge with short dwell time. We reconstruct pre/post-mix flow so the trail does not go cold here.
Exchange · cash-outRisk 18
Exchange depositKYC venueSubpoena target
Where it lands — a deposit address at a regulated, KYC'd exchange. This is the attributable end-point you can act on through law enforcement.
02
The trace we deliver

A full trace, hop by hop, to the cash-out.

We expand the source wallet into its complete flow graph — every hop, the entity on the other side, the amount, and where the path ends: an exchange you can subpoena, a mixer, or a sanctioned address.

HopFrom → ToEntityAmountType
1Hacked wallet 0x4d1e…88c0Unlabeled wallet412.0 ETHout
20x4d1e…88c0 MixerMixer / layering300.0 ETHmixer
3Mixer 0x71aa…02b4Exchange hot wallet168.4 ETHcash-out
3Mixer 0xSAN…c0deOFAC SDN address131.6 ETHsanctioned
03
Forget chasing funds across explorers

Tracing stolen funds by hand doesn't scale.

Following a wallet across explorers, spreadsheets and chains is slow and breaks at the first bridge or mixer. Our investigators return the whole graph — labeled — and the report you can hand to an exchange or a court.

What you're doing
Explorers & spreadsheets
Bitquery investigators
Follow funds across hops
Click address by address
Full multi-hop trace, end to end
Cross-chain & bridges
Correlate chains by hand
Tracked across chains & bridges
Know who's who
Guess from tags
Entity attribution on every address
Through a mixer
The trail goes cold
Pre/post-mixer flow reconstructed
Act on the result
No usable evidence
Court-ready report & subpoena targets
04
Investigations we run

What our forensics team delivers.

Every engagement starts with a free preliminary assessment of your case.

Tracing

Stolen-fund tracing

We start from the hacked wallet and follow every outflow through mixers and bridges until it lands at a cash-out venue — the evidence trail behind recovery support.

See the data
Attribution

Exchange attribution & subpoena targets

We resolve the cash-out counterparty to the exchange behind it and identify the regulated VASP and deposit address law enforcement can act on.

See the data
Reporting

Expert-witness reporting

We package the trace into a clear, defensible report — flow graphs, entity labels and amounts — suitable for exchanges, law enforcement and the courtroom.

Submit your case

What teams say about our data

"We did a thorough search of the market for the best onchain data. Bitquery came out on top — and now powers all live prices across Nansen. We don't think of them as a vendor. They're a partner."

A
Alexander Karsten
Nansen
40+
Chains traced wallet-to-wallet
multi-hop
Paths through mixers & bridges
entity
Attribution on every address

Bitquery does the hard work of parsing blockchain transaction data into a usable form so that we don't have to. We use their interface to diagnose issues with complex transactions and their analytics as a starting point for our own.

0x Protocol logo
Alex Knaggs
0x Protocol

They proved they had the technology to deliver sophisticated data solutions. We extended our support through the Binance X fellowship — building an open-source library of visualization widgets on their blockchain data.

Director, Binance X logo
Flora Sun
Director, Binance X

The complex raw data is available at different levels of detail and from different viewpoints — whether we need simple aggregated transfers or parameters for failed contract calls. The support is responsive, friendly and quick.

Backend Developer, Blockpit logo
Jan Dreske
Backend Developer, Blockpit

Partnering with Bitquery has been highly cost-effective — leveraging their established infrastructure rather than building our own let us rapidly expand our blockchain support and reach a much broader segment of on-chain users.

Co-Founder, Syla logo
Nick Christie
Co-Founder, Syla

Bitquery's products are very intuitive and easy to use. We currently use their products to obtain DEX-related trading and liquidity information, which saves us the manpower and tedious technical details required to develop our own system. Their excellent technical team deserves special praise; they provide near-24/7 support and resolve issues quickly. I greatly appreciate their products and work ethic.

Ourbit logo
Data Team
Ourbit

Bitquery provides the infrastructure we rely on every day. Fast, reliable, and comprehensive across the chains that matter to our business.

Webacy
Webacy
webacy.com
05
Pricing

Start free. Scale when you ship.

Query every blockchain on every plan — no chain is paywalled. Move to commercial when you need volume, SLAs and bulk datashares.

Developer
$0 / month
Free plan for developers or small projects.
  • All blockchains, all plans
  • 10 requests / minute
  • 2 streams for testing
  • GraphQL IDE access
Get started free
Most popular
Commercial
Custom
Tailored solutions for business and enterprise.
  • Scalable calls, no throttling
  • SQL, Cloud, Kafka & more
  • 24/7 engineering access
  • Dedicated onboarding & SLA
Talk to sales
Datashares
Custom
Bulk historical & real-time data on your cloud.
  • Snowflake, BigQuery, S3, Azure
  • No setup or infrastructure
  • Structured for AI agents & MCP
  • Audit data for custodians
Talk to sales
FAQ

Crypto investigations, answered.

How much time does it take to recover the funds?
The duration varies based on several factors, such as the tracking of funds, whether the funds are held in private wallets or sent to crypto exchanges or other services, and the jurisdiction of those services.
What types of cases can you help with?
Our expertise extends to a wide range of scenarios, including ransomware attacks, pig-butchering scams, investment fraud, accounting-system hacking, phishing schemes, and dealing with scammers on platforms like Telegram.
How much does it cost?
We conduct a preliminary investigation and assessment free of charge. Following this, we present a proposal including charges for further investigation. Once accepted, we commence a thorough investigation and consultation. If we are unable to assist in recovery, you will not incur additional charges.
What are the chances of getting my funds back?
The anonymous, global and irreversible nature of cryptocurrency makes tracking and recovery challenging. While we cannot guarantee full recovery in every case, our experience meaningfully increases the possibility of partial or complete retrieval — by meticulously tracking the funds, supporting legal action, and cooperating with exchanges and law-enforcement agencies.
How do you trace where stolen funds went?
We start from the source wallet and follow every outbound hop — the receiving wallet, the amount and the entity on the other side — across 40+ chains, stitching bridge and mixer hops into one continuous path to the cash-out point.
Can you produce a report for exchanges or law enforcement?
Yes. We package the trace into a clear, defensible report — flow graphs, entity attribution and amounts — suitable for exchanges, law-enforcement agencies and expert-witness use in court.

Submit your case. We follow the money.

Free preliminary assessment, every chain traced, entity attribution and a defensible report. Talk to our investigators about your stolen-funds or AML case.

Free preliminary assessment · No recovery, no additional charge · AML & forensics ready