⚠️ DISCLAIMER: Ministry of Cyber Affairs is an independent news, guides and directory service on cybercrime and cybersecurity, for victims and investigators. It is NOT an official government or ministry portal.
Website Scam CheckerNewCrypto ForensicsNew
Crypto Forensics

Where did the crypto go?

Paste a wallet address, a transaction ID, or the whole message from the scammer. We read the public blockchain, show what the address holds and where money went, check whether a stablecoin issuer has frozen it, and prepare the request letters and evidence file the police need. Facts only, each with a confidence grade.

  • Free
  • No sign-up
  • Bitcoin, Ethereum, TRON, Solana
  • Refuses seed phrases and private keys
  • Never says an address is a scam or safe

Never paste a recovery phrase (seed words) or a private key. This tool does not need one, and refuses it before it leaves your device. Public addresses and transaction IDs are all it uses.

Try:

  • I sent money to a scammer

    Paste the address you sent to (your wallet or exchange shows it in the transaction details) or the transaction ID. You will see where the money is now, whether it can be frozen, and what to tell the police.

    The first hourWhat happened to you?

  • I am an investigator

    Check addresses and transactions, trace a few hops forward or backward, and export a hop table, a report with a request manifest, and the freeze and disclosure letters from the handbook.

    Request lettersCasework checklistUTC timeline

  • I have a message or a screenshot's text

    Paste the whole chat, e-mail or statement. We list every wallet address and transaction ID in it with its position, flag any that fail their checksum (a typo), and you pick which to check.

    Red flags to look for

The first hour: six questions, in order

  1. 1Is the money still sitting in an address you can see?
    Note the balance and the time (UTC) and watch the address. Prepare freeze requests before you finish tracing.
  2. 2Is any of it in a token its issuer controls (USDT, USDC, PYUSD, USDP, PAXG, XAUt, RLUSD, EURC)?
    Send a freeze request to the issuer with the exact chain, token contract, address and your legal basis. Issuers can block a token even in a self-held wallet.
  3. 3Did it reach a deposit address at a crypto exchange?
    Send preservation, freeze and disclosure requests to that exchange through its law-enforcement channel. Not through customer support.
  4. 4In India: is money still in the banking system?
    Call 1930 and file at cybercrime.gov.in at once so banks can be alerted before the money moves on.
  5. 5Is there a phone, a seed phrase, a hardware wallet or an exchange app within reach?
    Follow the first-response rules: isolate, do not switch off, do not guess codes, and move assets only into a wallet the agency controls, under authority.
  6. 6Is someone now contacting the victim as a 'recovery agent' or an 'official' asking for a fee?
    Warn them. Real police and regulators never charge a fee to recover money, and 'recovery' contacts are a second scam.

How we grade what we tell you

  • C1Confirmed. A fact recorded on-chain or in an official record: a transaction, a block, an issuer freeze event, a record produced under legal process.
  • C2Strong. Several independent methods agree, for example common-input plus timing plus amount match, or two analytics tools plus exchange confirmation.
  • C3Moderate. One reliable heuristic or one reputable label, such as a change-address guess alone.
  • C4Lead. An unverified signal: a community report, a risk score, a pattern flag. Never present it as fact.

What this tool can and cannot tell you

It can

  • Read a balance, token holdings and recent activity, in UTC, from public explorers, and say which one it used.
  • Ask Tether, Circle, Paxos and PayPal USD’s own contracts whether an address is blocklisted, at a stated block.
  • Compare an address with the 506 wallets OFAC names on its sanctions list (file published 2026-10-27) and with addresses law enforcement has published in public alerts, such as the FBI’s 628 addresses tied to the October 2026 Binance theft.
  • Tell a real USDT or USDC contract from a look-alike token that merely uses the name.
  • Follow one asset forward or backward for up to four hops, stopping at contracts, sanctioned addresses and busy services, and list what it did not follow.
  • Flag collection addresses, machine-paced transfers, dormant wallets that wake up and address poisoning, as leads.
  • Build the freeze, preservation and disclosure letters, an evidence report with a request manifest, and a UTC timeline.

It cannot

  • Say who owns an address. A blockchain shows movement, not identity, and we do not label owners.
  • Call an address a scam or safe. A pattern is a lead, and busy exchanges trip the same rules.
  • Freeze or recover anything. Only an issuer, an exchange, a bank or a court can, on a request from the police or a court.
  • Trace through mixers, privacy coins such as Monero, or across a bridge on its own: it stops there and says so.
  • Replace a licensed analytics platform or an examiner. Confirm critical figures on a second source before they go in a complaint or affidavit.
  • Read more than the most recent records of an address; older history needs an explorer.

What happened to you?

Pick the closest type of crypto crime to see how it works, the red flags, and the first actions. These come from the Ministry's handbook for law-enforcement investigators.

Relationship-investment scam (often called pig-butchering)

Contact by a 'wrong number' message, social media, dating or professional networks. Weeks of grooming, then a fake trading platform or app with fake profits. Withdrawals are blocked by 'tax', 'AML fee' or 'verification deposit' demands, again and again.

Red flags

  • Unsolicited contact that moves quickly to private messaging
  • Guaranteed or very high returns
  • Cannot withdraw without paying a fee or tax
  • Told to keep it secret from family or the bank

First actions

  1. Step 1: Capture the chats, the platform address or app and the payment instructions before they vanish.
  2. Step 2: Trace the victim's deposits to the collection wallet, then forward to the consolidation wallet and the exchange or cash-out point.
  3. Step 3: Freeze USDT or USDC where it sits; send exchange requests in parallel.
  4. Step 4: Warn the victim about 'recovery' scams.

The first hour: act in this order

Minutes matter while money sits in a freezable stablecoin or at an exchange. Freeze in parallel with tracing; do not wait for the perfect picture.

  1. 1

    Is the money still sitting in an address you can see?

    Note the balance and the time (UTC) and watch the address. Prepare freeze requests before you finish tracing.

  2. 2

    Is any of it in a token its issuer controls (USDT, USDC, PYUSD, USDP, PAXG, XAUt, RLUSD, EURC)?

    Send a freeze request to the issuer with the exact chain, token contract, address and your legal basis. Issuers can block a token even in a self-held wallet.

  3. 3

    Did it reach a deposit address at a crypto exchange?

    Send preservation, freeze and disclosure requests to that exchange through its law-enforcement channel. Not through customer support.

  4. 4

    In India: is money still in the banking system?

    Call 1930 and file at cybercrime.gov.in at once so banks can be alerted before the money moves on.

  5. 5

    Is there a phone, a seed phrase, a hardware wallet or an exchange app within reach?

    Follow the first-response rules: isolate, do not switch off, do not guess codes, and move assets only into a wallet the agency controls, under authority.

  6. 6

    Is someone now contacting the victim as a 'recovery agent' or an 'official' asking for a fee?

    Warn them. Real police and regulators never charge a fee to recover money, and 'recovery' contacts are a second scam.

Five rules to remember

  1. Record the hard facts (chain, contract, transaction ID, block, UTC time, amount) before interpreting anything.
  2. Freeze in parallel with tracing. While funds sit in stablecoins or at an exchange, minutes matter.
  3. A blockchain shows movement, not identity. Grade every attribution.
  4. Never expose a seed phrase or private key.
  5. Every action needs a documented legal basis.

Red flags

Signs that a person, a payment or a wallet is part of a crypto scam.

In the contact

  • Unsolicited contact that quickly moves to private messaging
  • Guaranteed or very high returns, pressure, secrecy ('do not tell family or the bank')
  • You cannot withdraw without paying a fee or tax
  • A request for your seed phrase, private key, remote access or wallet 'verification'
  • 'Recovery' offers that need a payment
  • Official-looking orders sent over chat, or a demand to stay on a video call

In the payment

  • A 'government agency' said to pay in digital assets, wire abroad, or buy gold or gift cards
  • A payment to 'recover' lost money without proof that the service is real
  • Withdrawals from savings to buy gold to hand to a courier
  • A receiving money service claiming to be 'approved by FinCEN'; an exchange advertising 'no KYC'
  • Stablecoins advertised as 'unfreezable'
  • An address posted on messaging platforms next to Chinese-language money-laundering terms
  • An exchange customer behaving like an OTC broker with the exchange's liquidity

In the wallet

  • Unlimited token approvals or unknown spenders
  • Off-chain signature requests or EIP-7702 delegation prompts
  • An address similar to a known counterparty but not identical
  • Sites asking you to paste commands or code
  • A familiar site with an unexpected certificate or a new 'connect wallet' prompt

A relationship-investment scam, stage by stage

StageWhat the scammer doesEvidence to capture
ContactUnsolicited message; moves to WhatsApp or TelegramHandles, numbers, first messages, platform IDs
GroomingDaily chats, lifestyle photos, AI-assisted languageFull chat export, images (reverse-search), profiles
BaitA private platform, 'insider signals'Platform address or app, download link, domain registration
FatteningSmall withdrawals allowed to build trustThe victim's deposits and withdrawals with transaction IDs
KillWithdrawal blocked by fees, taxes or a 'regulator hold'Fee demands, wallet addresses, bank or UPI details
Exit and re-victimisationSilence, then 'recovery' offersRecovery-agent contacts and the fee payment trail

How money gets frozen and recovered

Six levers, fastest and most reliable first. Which one applies depends on where the money is sitting.

1. Issuer freeze

Centrally issued tokens (USDT, USDC, PYUSD, USDP, PAXG, XAUt, RLUSD, EURC, USD1) can be blocklisted by the issuer even in self-custody, for that token on that chain only.

2. Exchange freeze

Freeze the receiving account at a custodial exchange and obtain KYC, IP, device and ledger records.

3. Network governance

In rare cases a network's council acts, as the Arbitrum Security Council did after the October 2026 Binance theft.

4. Bank-layer hold

Hold the fiat legs: in India through 1930 and the CFCFRMS system; elsewhere the banks' fraud teams and court orders.

5. Court orders

Restraint or attachment, proprietary or freezing injunctions, and disclosure orders.

6. Keys or long-horizon tracing

Key acquisition through a lawful search, or tracing to a later cash-out, for native BTC or ETH in self-custody.

Freeze, burn and seizure are different

Freeze.
Movement is blocked and the balance stays recorded. This is a restraint, not a seizure.
Burn or wipe.
The issuer destroys the balance and reduces supply. The backing reserve is a separate off-chain matter.
Clawback.
The issuer recovers tokens by burn or transfer, depending on the code.
Seizure.
Value is placed under state control (a controlled wallet, an issuer re-issue to a lawful recipient, a custodian transfer). It needs legal authority.

Tokens whose issuers can freeze them

Identification only. Always confirm the contract on the issuer’s own page. A freeze applies to that token on that chain only.

TokenChainContract
USDTethereum0xdAC17F958D2ee523a2206206994597C13D831ec7
USDTtronTR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t
USDCethereum0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48
EURCethereum0x1aBaEA1f7C830bD89Acc67eC4af516284b1bC33c
PYUSDethereum0x6c3ea9036406852006290770BEdFcAbA0e23A0e8
USDPethereum0x8E870D67F660D95d5be530380D0eC0bd388289E1
PAXGethereum0x45804880De22913dAFE09f4980848ECE6EcbAf78
XAUtethereum0x68749665FF8D2d112Fa859AA293F07A622782F38
RLUSDethereum0x8292Bb45bf1Ee4d140127049757C2E0fF06317eD
USDCsolanaEPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
USDTsolanaEs9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB

How the money is moved on

Scam proceeds usually run through three stages: victim payments, rapid on-chain laundering, then integration through mule networks and over-the-counter traders. These are the roles and regional patterns investigators look for.

Laundering roles

Guarantee marketplace
Chinese-language Telegram escrow networks selling laundering and other illicit services, settling mostly in TRON USDT. They reappear under new names after takedowns, so map merchants and settlement addresses rather than single addresses.
U-merchant (U商)
A USDT over-the-counter merchant converting cash and USDT.
Black U (黑U)
Tainted USDT sold at a discount for fast liquidation. A 10 to 20 percent discount, or a premium paid to launder, is an indicator.
Courier and washing cell (车手, 水房)
Cash-out couriers, and the cell that dispatches them. The cash leg and the crypto leg are deliberately kept apart, so CCTV, banknote serial numbers and timing matter.
Mule account
A bank, payment or exchange account used to move proceeds for others. Dormant accounts with sudden rapid in-and-out flows are the signal.

Where the trail ends decides the legal route

Licensed exchange deposit addressPreservation, freeze and disclosure under domestic process
Offshore or unlicensed exchangeDirect request where lawful; otherwise mutual legal assistance
OTC desk or P2P merchantThe bank or UPI legs of the trade; the exchange's P2P order records
Stablecoin redeemed for fiatThe issuer's law-enforcement channel and redemption records
Crypto debit-card or payment programmeThe card programme manager and the issuing bank's KYC
Unhosted wallet still holding valueLive watch, issuer freeze for tokens, key acquisition by lawful search

Exchanges usually run a separate deposit address per customer, swept within minutes into pooled hot wallets, and keep reserves in warm and cold wallets that move rarely and in large amounts. A deposit address points to one customer, but only the exchange's ledger can name that customer. A hot or cold wallet identifies the exchange, not the customer: never describe a hot wallet as the suspect. You cannot freeze a pooled wallet; ask the exchange to freeze the customer account credited by the deposit, giving the transaction ID, amount and UTC time, and send preservation and freeze requests immediately.

Regional signatures: China, Hong Kong and South-East Asia

Patterns, not case data. Cross-check figures against current official releases before citing them.

SignatureWhat it looks likeInvestigative angle
Compound-based relationship-investment fraudLong grooming, a fake trading app, small early withdrawals, then withdrawals blocked by 'tax', 'insurance' or 'processing fee' demands. Run from compounds with trafficked labour, mainly in Cambodia, Myanmar and Laos (UNODC, April 2025).The fee demand is the near-universal terminal indicator. Trace the USDT (often TRON) collection wallet backward to find other victims. Treat workers as possible trafficking victims.
'Professor' or 'trading mentor' groupsA social-media ad, then a WhatsApp or Telegram 'VIP group' with a mentor persona and fake profit screenshots. The platform shows huge fictitious balances.Preserve member lists and admin handles. Map the payment rails (usually bank or e-wallet mule accounts, then USDT).
Crypto pyramid schemesWallet, mining or 'public chain' projects with an entry fee, downline recruitment and team commissions. Older investors are often targeted through seminars.Collection and promoter wallets, referral trees and fiat channels. Promoters and outsourced providers may be liable as well as operators.
Unlicensed or fake trading platforms (Hong Kong)Celebrity promotion; money-changer shops selling USDT over the counter as the on-ramp; sudden withdrawal fees or caps when the platform fails.Check the Hong Kong SFC's lists of licensed and suspicious virtual-asset trading platforms. Applicant status is not a licence.
Fake job-interview calls with a 'script'The victim is asked to download or run a file or 'meeting fix' during a call. It installs wallet-draining malware.Image the device; identify the drainer or sweeper; report the domains and binaries.
Deepfake officials on video callsFake video conferences with synthetic senior officials or executives demanding urgent 'confidential' transfers.Preserve meeting links and payment instructions; verify identities out of band; bank-layer holds for the fiat legs.
SIM-box and VoIP gatewaysOverseas calls converted to local caller IDs through banks of SIM cards near borders.Telecom legal process for gateway locations, SIM registrations and IP data records.
Regulator-perimeter abuseClaims of foreign 'registration', fake regulator logos, or offices that do not exist on maps.Check the regulator's own registers.
Underground-banking cash-outUSDT sold through OTC 'U-merchants', money-changers and guarantee marketplaces, with bank or card mules on the fiat side.See the laundering roles below: the rate premium or discount is itself an indicator.

Request letters

Preservation, exchange, stablecoin-issuer and India section 94 requests, plus the recovery-scam advisory for victims and a letter of request checklist. Built in your browser from the handbook's templates.

Pick a letter, fill in what you know, and copy it. It is built in your browser: nothing you type here is sent to us or stored. Real recipients (the issuer’s or exchange’s law-enforcement channel) must be looked up on their own official pages.

Preservation request (exchange, platform, registrar, host). Send first and at once, in parallel with everything else. It asks the recipient to keep the records while formal process is prepared.

Letter

Subject: Preservation request - [Agency] case [reference] - URGENT

[Agency] is investigating [offence(s)] under [statute/provisions]. We request that you preserve, pending formal legal process, all records relating to the identifiers below for [period, for example 90 days or as your policy allows], and confirm preservation.

Identifiers:
- Wallet addresses (with chain): [addresses]
- Memo or destination tag: [memo/tag, if any]
- Transaction IDs (with UTC times): [TXIDs]

Records to preserve: subscriber and KYC information; account creation and login records with IP addresses, timestamps (UTC) and device identifiers; transaction, deposit and withdrawal records; linked accounts and payment instruments; communications and support tickets; content associated with the identifiers.

Please do not notify the account holder [if the law permits a non-disclosure request, cite it].

Contact: [officer name, rank], [official e-mail, phone]
Date and time sent: [date and time sent, UTC]

Anything still in [square brackets] must be completed before sending. Have a supervising officer or counsel review legal process.

UTC timeline

Mixed-time-zone events from exchange logs, chats and bank statements, merged into one sorted UTC timeline.

Exchange logs, chat exports and bank statements use different time zones. Paste events as CSV (columns: timestamp, tz, source, description), and get one sorted UTC timeline. A zone can be a name like Asia/Kolkata or an offset like +05:30; leave it empty if the timestamp already carries one. Runs in your browser: nothing is sent or stored.

The UTC timeline appears here.

Casework quality

What separates a defensible case file from a quick lookup: how the case is opened, the checks a forward trace usually misses, and review before anything leaves the unit.

Tracing checks a forward trace misses

Backward tracing (source of funds)
Trace inflows into a collection or consolidation address back to their sources. In relationship-investment scams this often reveals further victims, and it shows who funded the gas (an attribution clue).
Swap reconstruction
Decode the swap: input token, output token, amounts, recipient. Continue the trace with the output token from the recipient. It is the same wallet holding a different asset.
Bridge release
Do not stop at a bridge deposit. Find the release on the destination chain by message ID, or by amount minus fees within a time window.
Time-window correlation
Align block times (UTC, to the second) with victim payments, chat messages, exchange logins and withdrawals. A transfer minutes after a victim's payment with no other plausible source is strong circumstantial evidence; grade it C2 only with corroboration.
Dispersion pattern
Name the shape: fan-out (one to many), fan-in (many to one), serial (one to one) or hybrid, and compare it with the typology's usual pattern.
Account clustering
On EVM, TRON and Solana, link addresses through a shared gas funder, a common deployer, approval patterns and reused deposit addresses. Grade each link and name the heuristic.
Cash-out point
Classify each endpoint, because the endpoint decides the legal route.

Analyst pitfalls and the guardrail for each

Confirmation bias: an early hypothesis colours every later fact
Keep a list of alternative explanations and test each new fact against all of them.
Relying on one tool or vendor
Use two independent sources for every critical link; pull raw data from an explorer or node.
Web pages, chats and channels deleted before capture
Capture and hash at first contact.
Cluster contamination: CoinJoin, exchange batching, one EVM address on several chains
Name the heuristic, grade it, and never apply common-input ownership to CoinJoin.
Losing the trail at a bridge
Check whether the destination of each large transfer is a bridge or router, then find the release on the other chain.
Time-zone confusion
Normalise everything to UTC and keep the original zone beside each reported time.
Broken chain of custody
Log every hand-over of every file and device.
Premature contact with the subject, or using an exchange's customer-support line
Act only through legal process. Customer support is not a law-enforcement channel, and early contact moves the funds.
Stale sanctions status: lists change and delistings happen
Re-screen at intake and again at finalisation.
Role confusion
Police do not file suspicious-activity reports; reporting entities file them with their financial-intelligence unit.

Case opening record

Complete this before any lookup. It keeps queries within lawful purpose and the file defensible.

Peer review checklist

A second analyst ticks every item before anything leaves the unit. 0 of 9 done.

How we grade findings

  • C1 Confirmed. A fact recorded on-chain or in an official record: a transaction, a block, an issuer freeze event, a record produced under legal process.
  • C2 Strong. Several independent methods agree, for example common-input plus timing plus amount match, or two analytics tools plus exchange confirmation.
  • C3 Moderate. One reliable heuristic or one reputable label, such as a change-address guess alone.
  • C4 Lead. An unverified signal: a community report, a risk score, a pattern flag. Never present it as fact.

In India

A short guide to the reporting and legal steps. Verify amendments and your High Court's position before relying on any section.

Report
Call 1930 and file at cybercrime.gov.in at once, and keep the acknowledgement number. Early reporting lets the CFCFRMS system alert banks before the money is layered or turned into USDT.
Data from a service provider
Section 94 of the Bharatiya Nagarik Suraksha Sanhita (BNSS) is the basis for a production notice, including through the I4C Sahyog portal.
Electronic evidence in court
A certificate under section 63 of the Bharatiya Sakshya Adhiniyam (BSA), 2023, for every export and screenshot set.
Attachment of proceeds
Section 107 BNSS with a Magistrate's order, or provisional attachment under section 5 of the PMLA. The Kerala and Bombay High Courts held that police cannot debit-freeze accounts under section 106; follow your High Court's position.
VDA service providers
Regulated for anti-money-laundering by FIU-IND (guidelines updated 8 January 2026): PAN, selfie with liveness, onboarding location and IP, the Travel Rule, and records kept five years.

Bank-side help: How to report bank fraud in India · Cybercrime help by country.

Questions people ask

I sent crypto to a scammer. Can I get it back?

Sometimes, but speed decides it. Money that is still in a stablecoin such as USDT or USDC can be frozen by the issuer, and money that reached a regulated exchange can be frozen by the exchange, both only through the police or a court. Money in Bitcoin or Ether in a wallet the scammer controls cannot be frozen by anyone. Report to the police straight away, keep every transaction ID and message, and be careful of anyone who offers to recover it for a fee: that is a second scam. Real police and regulators never charge to recover money.

What can this tool tell me about a wallet address?

What it holds now, its recent activity in UTC, which addresses sent to it or received from it, whether a stablecoin issuer has blocklisted it, whether it appears on the US OFAC sanctions list, whether a token named USDT or USDC is really the issuer's contract, and pattern flags such as a collection address or address poisoning. Every finding has a confidence grade from C1 (a confirmed fact on the chain) to C4 (a lead).

Does it tell me who owns an address, or whether it is a scam?

No. A blockchain shows value moving between addresses. It does not show who controls an address, and we do not label owners or call an address a scam. Only an exchange's own records, produced under legal process, can connect a deposit to a named customer. Treat every pattern flag as a lead.

Which blockchains does it read?

Bitcoin, Ethereum, Optimism and Gnosis, TRON (the main rail for USDT in scam cases) and Solana. A 0x address exists on every EVM chain, so for Base, Arbitrum, Polygon, BNB Smart Chain and Avalanche the result links to the public explorers. Litecoin, Dogecoin, XRP, TON and Monero addresses are recognised, with a pointer to the right explorer. Solana transaction signatures are not looked up, because a Solana private key has the same shape and could not be told apart safely; paste the wallet address instead.

What do the confidence grades C1 to C4 mean?

C1 is a fact recorded on-chain or in an official record. C2 means several independent methods agree. C3 is one reliable heuristic or label. C4 is an unverified lead, such as a pattern flag or a community report. A C3 or C4 finding should never be presented as fact in a complaint, affidavit or freeze request.

Is it safe to paste my seed phrase?

Never. Anyone who has your recovery phrase or private key controls your money. This tool does not need one, and refuses anything that looks like one in your browser before it is sent. If you shared a recovery phrase with anyone, move your funds to a brand-new wallet from a clean device now.

What is a freeze request, and who sends it?

A request to a stablecoin issuer (such as Tether or Circle) or an exchange to block an address and keep its records. It is sent by the police or a court, not by a victim, and it needs a legal basis. The Request letters section builds the text from the handbook's templates for the officer to review and send.

Do you store what I check?

We keep a usage log for this tool: the public address or transaction ID, the chain, the result, your IP address, country and browser, as we do for Website Check. We never keep anything the secrets guard refused, text you paste to extract addresses from, letters, or case details: those are built in your browser and are gone when you close the page.

Is this legal advice, or enough for court?

No. It is a reference and a lead generator. Confirm any figure you rely on on a second source (each result links to public explorers), have a second analyst review it, and take legal advice on the authority for each request in your jurisdiction. The handbook behind this tool says the same: a tool's output is a lead, not a verdict.

Glossary

Address poisoning.
Planting a look-alike address in a victim's transaction history (through dust or zero-value transfers) to cause a copy-paste error.
Approval (allowance).
Permission a wallet gives a contract to move its tokens. Drainers abuse it.
Bridge.
Moves value between blockchains.
Change address.
The output that returns the remainder of a Bitcoin-type payment to the spender.
CoinJoin.
A transaction combining many users' inputs to break links.
Common-input ownership.
The guess that inputs spent together are controlled by one entity. A heuristic (C3) that CoinJoin and exchange batching break.
Custodial wallet.
An account at a service that holds the private keys.
Derivation path.
The rule by which a wallet turns a seed into addresses. A valid seed that shows an empty wallet may need another path.
Destination tag or memo.
A field identifying a customer at a shared exchange address (XRP, Stellar, TON and others). Always include it in a request.
Drainer.
A kit that empties a wallet after the victim signs an approval or transaction.
EIP-7702.
An Ethereum feature (May 2025) letting an account delegate its execution to contract code. Abused to create sweepers.
Exchange hot wallet.
A pooled exchange address. It identifies the exchange, not a customer.
Freeze, burn, seizure.
Three different things: movement blocked, balance destroyed, value transferred into state control.
Mixer.
A service pooling funds to obscure their origin. Analyse what goes in and what comes out to exchanges.
Passphrase (25th word).
An optional extra secret that opens a separate hidden wallet from the same seed.
Peel chain.
A series of transactions each paying out a small amount and forwarding a large remainder.
Private key.
The secret that authorises spending from an address. Whoever holds it controls the funds.
Seed phrase.
A 12 to 24 word backup (BIP-39) that regenerates all of a wallet's keys. Never share it.
Stablecoin.
A token designed to track a currency or commodity. Most centrally issued ones can be frozen by the issuer.
Travel Rule.
The requirement that originator and beneficiary information accompany transfers between service providers.
TXID.
The transaction hash that uniquely identifies a blockchain transaction.
Unhosted wallet.
A self-custody wallet not held by a service provider.
UTXO.
Unspent transaction output: the unit of value in Bitcoin-type chains.
VASP.
Virtual asset service provider, such as an exchange. In India, a VDA service provider.
xpub.
An extended public key that reveals all addresses of a wallet account without any spending power. Safe to share with an analyst.

How Crypto Forensics works, and where the data comes from

  • Blockchain data

    Read-only, from public explorers: mempool.space (Bitcoin), Blockscout (Ethereum, Optimism, Gnosis), TronGrid (TRON) and the Solana network. Stablecoin freeze status is read from the issuer’s own contract through a public Ethereum node or TronGrid. We never ask for a key, never sign or send anything, and only fixed provider hosts are contacted: no address you type is ever fetched as a link.

  • Sanctions list

    OFAC Specially Designated Nationals (SDN) list, SDN.CSV, Sanctions List Service. File published 2026-10-27, 506 wallet addresses. A non-match is worded “no match in this file”, never “clean”. File SHA-256 5f240bed79d504e7a54788b4cd1c7f84e6afa56cd4778653b70b0771b6a8509d. Law-enforcement alerts read from the agency’s own page: FBI, 2026-10-31 (628 addresses). Appearing on a list is a recorded fact; the attribution is the agency’s.

  • The handbook behind it

    The method, grades, templates and checklists follow the Ministry’s Crypto & Virtual Digital Asset Investigation: Guide and Handbook for Law Enforcement (Edition 1.0, November 2026), written for police, financial-intelligence units, prosecutors and forensic examiners. It is a training aid, not legal advice. Statutes, cases, platform policies and statistics change; items that could not be confirmed against a primary source are marked “verify”.

  • Your privacy

    Recovery phrases and private keys are refused in your browser. Letters, case files, labels and timelines are built in your browser and are not sent to us. We keep a usage log of public addresses and transaction IDs looked up, with your IP address, country and browser, to see whether the tool is used and to deal with abuse.

More help

Crypto Forensics is an information tool, not legal, financial or investment advice, and it does not recover money. Every search, seizure, freeze, disclosure request or transfer needs lawful authority in the governing jurisdiction. Mentions of products, issuers and exchanges are for identification only and are not endorsements. If you have lost money, report to the police and your bank now.