If your crypto was stolen, start by reporting it and preserving the transaction details. Do not wait for a blockchain trace. Once you have filed a report, a wallet address or transaction hash can be used to check whether the stolen cryptocurrency moved to another wallet, an exchange or another identifiable service.

People often arrive here with two urgent questions: can stolen cryptocurrency be traced, and is there any chance of getting it back? The honest answer to both is “sometimes.” A public blockchain can preserve useful evidence, but a trace has technical and legal limits. This guide explains what to do first, how cryptocurrency tracing works in Canada and how to avoid losing more money to a recovery scam.

This article is general information for people who have lost funds, as well as the lawyers, accountants and family members helping them. It is not legal advice, and no tracing service can guarantee recovery.

My crypto was stolen. What should I do first?

Stop sending money, even if the person or platform says that one more payment will unlock a withdrawal. Save your messages and transaction records before blocking anyone or closing an account. If a password, private key or seed phrase may have been exposed, secure any accounts or assets that are still under your control.

Then make the reports. The sooner police, the reporting centre and any exchange involved receive the transaction details, the better. Cryptocurrency can move through several wallets in minutes, so a prompt report with partial information is more useful than a perfect report filed weeks later.

How to report cryptocurrency fraud in Canada

1. Contact your local police

The Canadian Anti-Fraud Centre advises victims of fraud or cybercrime to contact their local police as soon as possible. Ask for a police file number and keep it with your records. That number gives an exchange, lawyer or investigator a specific complaint to refer to later.

2. File a national fraud report

Use the RCMP’s Report Cybercrime and Fraud website to submit the incident online. The online form is available at any time and allows anonymous reports. You can also call the Canadian Anti-Fraud Centre at 1-888-495-8501, Monday to Friday from 10 am to 4:45 pm Eastern, except holidays.

Report the incident even if the amount seems small or you believe the cryptocurrency is gone. National reports help law enforcement connect wallet addresses, websites and fraud scripts that may appear in complaints from other victims.

3. Notify the exchange or wallet provider

If the funds left an account you hold with an exchange, contact its fraud or compliance team in writing. If a trace shows that the funds reached another exchange, include that information in your police report and keep a copy of any notice you send. A written notice creates a useful timestamp, but it does not force the platform to freeze funds or disclose customer information.

What information is needed to trace stolen cryptocurrency?

You do not need a long technical report to get started. Gather whatever you have from the following list:

• Transaction hash or transaction ID: the unique identifier for the transfer. One confirmed transaction is often enough to begin.
• Wallet addresses: your sending address and the address that received the funds.
• Network: Bitcoin, Ethereum, Base, Polygon or another blockchain. A similar-looking address may appear on more than one network.
• Date, time and amount: record them as precisely as possible, including the type of cryptocurrency.
• Supporting evidence: screenshots, emails, text messages, usernames, phone numbers, website addresses and withdrawal confirmations.

A screenshot of a withdrawal or payment confirmation may contain the details needed to locate the transaction. Never send a seed phrase, private key, password or one-time security code to an investigator. Those credentials are not required for blockchain tracing.

Can stolen cryptocurrency be traced?

Stolen cryptocurrency can often be traced across a public blockchain for at least part of its journey. Bitcoin and Ethereum-compatible networks publish transaction histories that anyone can inspect. Those records do not expire, and a completed transfer cannot be edited after the fact.

That does not mean every stolen Bitcoin or crypto payment can be followed to a person. The on-chain trail may end or become uncertain when funds move through a mixer, are converted to a privacy-focused asset, cross an unsupported network or enter a pooled exchange wallet. This is why a careful report describes what the records prove and clearly labels anything that is only a lead.

How cryptocurrency tracing works

A crypto trace begins with a known transaction. From there, the investigator or tracing tool reviews the receiving address and follows later transfers through the blockchain. The aim is to build a custody path that answers four practical questions:

1. Where did the funds move after the reported transaction?
2. When did each transfer happen, and how much was transferred?
3. Did the funds enter a known exchange, payment service or other identifiable platform?
4. Which records should be included in a police complaint or reviewed by counsel?

A useful trace should let another person check the work. It should include transaction hashes, wallet addresses, dates, amounts and an explanation of how any platform attribution was made.

What a cryptocurrency trace can and cannot prove

Good cryptocurrency tracing separates confirmed records from interpretation. In practice, a report may contain several types of findings:

• Confirmed on-chain transfer: the blockchain shows that a specific amount moved from one address to another.
• Estimated flow: the funds were combined with other assets, so the report uses a stated method to estimate where they went next.
• Service attribution: an address appears to be associated with a known exchange or platform. This is a lead, not proof of who controls the account.
• Third-party report: another source has publicly linked an address to suspicious activity. The source should be cited and the allegation should not be presented as a proven fact.

A trace cannot reveal a name simply by reading the blockchain. Wallet addresses are pseudonymous. It also cannot compel an exchange to identify a customer, freeze an account or return funds.

How can an exchange account be identified?

If the custody path ends at an exchange, the next step is legal rather than technical. Police may seek account information through lawful process. In a civil matter, a lawyer may ask a court for an order requiring a third party to preserve records or disclose relevant information.

Neither route is automatic. The platform may operate outside Canada, a Canadian court may not have jurisdiction, or the exchange may hold the assets in an omnibus wallet that combines deposits from many users. In those situations, the platform may not be able to connect a particular on-chain deposit to a specific customer without additional internal records.

This is where a well-documented trace can help. It gives police or counsel a precise destination address, transaction history, dates and amounts to assess. It supports the request; it does not replace the legal process.

Can stolen cryptocurrency be recovered?

Recovery is possible in some cases, but it should never be promised. It may depend on whether the funds are still held by an identifiable service, whether that service can connect the deposit to an account, and whether police or a court can act before the funds move again.

A tracing report does not recover cryptocurrency by itself. Its value is in documenting the path and making a complaint more specific. Whether the amount lost justifies professional tracing or legal action is a decision to make with clear information about the likely cost and the limits of the evidence.

How to spot a crypto recovery scam

People who report cryptocurrency fraud are often targeted again. A caller or message may claim that your funds have been found and can be released after you pay a tax, insurance charge, wallet activation fee or other advance payment. That is a common crypto recovery scam.

The Canadian Investment Regulatory Organization reported that Canadians lost more than $22 million to recovery fraud in 2025. Treat the following signs as serious warnings:

• The person contacted you without being asked and already knows details of your loss.
• They guarantee that your stolen crypto will be recovered.
• They ask for an upfront payment to release or return funds.
• They request your seed phrase, private key, password, one-time code or remote access to your device.
• They claim to have a special relationship with an exchange, regulator or police service.
• They pressure you to act immediately or keep the conversation secret.

There is a difference between paying for defined investigative work and paying someone who promises to return your money. Before hiring anyone, ask what the deliverable is, what the service cannot do and how its findings can be independently checked.

When professional crypto tracing may help

Professional cryptocurrency tracing may be worth considering when the loss is significant, you plan to pursue the matter with police or a lawyer, or an insurer needs the on-chain movements documented. It may also help when several transactions or wallets make the path difficult to explain in a standard complaint.

It is less likely to be worth the cost if you expect the report itself to return the funds. Before paying, make sure you understand the scope, price and final deliverable. Garuna Group’s cryptocurrency tracing tool provides a custody-path report and a complaint packet for self-filing. It is optional. Your first step should still be reporting the incident.

What to do in the next hour

1. Stop sending money and save every message, receipt and screenshot.
2. Write down the wallet addresses, transaction hashes, dates, amounts and networks involved.
3. Contact your local police and ask for a file number.
4. Report the crypto fraud online at reportcyberandfraud.canada.ca or call 1-888-495-8501 during phone hours.
5. Notify any exchange or wallet provider involved in writing.
6. Tell someone you trust, especially before responding to anyone who offers recovery.

These steps cannot guarantee that stolen cryptocurrency will be returned. They do give police, platforms and counsel a documented incident they can assess and act on.

Questions about tracing stolen cryptocurrency

Can stolen cryptocurrency be traced?

Often, at least in part. Public blockchains such as Bitcoin and Ethereum permanently record transfers, so a trace can follow the available path from a known transaction. The trail may become unclear if funds enter a mixer, move to a privacy coin or reach a pooled exchange wallet.

How do I report cryptocurrency fraud in Canada?

Contact your local police as soon as possible and keep the file number. Then report the incident online at reportcyberandfraud.canada.ca or call the Canadian Anti-Fraud Centre at 1-888-495-8501. You do not need a completed cryptocurrency trace before filing a report.

Can a crypto trace identify the person who stole my funds?

Not by itself. A trace may show that funds reached an exchange or another service, but a wallet address does not contain the owner’s name. Customer identification normally has to come from the platform through a police request or valid court process.

What do I need to trace stolen Bitcoin or cryptocurrency?

A transaction hash or wallet address is usually enough to begin. Dates, amounts, the blockchain network and screenshots make the report more useful. Never provide a seed phrase, private key or password.

Can a cryptocurrency recovery service guarantee results?

No. Recovery depends on where the funds went and whether a platform, police service or court can act. Be cautious with any service that promises recovery, asks for another payment to release funds or requests access to your wallet or device.