Crypto guide

Questions people ask, and a glossary

Plain answers to the questions victims and investigators ask most, and the terms used across these guides.

I sent crypto to a scammer. Can I get it back?

Sometimes, but speed decides it. Money that is still in a stablecoin such as USDT or USDC can be frozen by the issuer, and money that reached a regulated exchange can be frozen by the exchange, both only through the police or a court. Money in Bitcoin or Ether in a wallet the scammer controls cannot be frozen by anyone. Report to the police straight away, keep every transaction ID and message, and be careful of anyone who offers to recover it for a fee: that is a second scam. Real police and regulators never charge to recover money.

What can this tool tell me about a wallet address?

What it holds now, its recent activity in UTC, which addresses sent to it or received from it, whether a stablecoin issuer has blocklisted it, whether it appears on the US OFAC sanctions list, whether a token named USDT or USDC is really the issuer's contract, and pattern flags such as a collection address or address poisoning. Every finding has a confidence grade from C1 (a confirmed fact on the chain) to C4 (a lead).

Does it tell me who owns an address, or whether it is a scam?

No. A blockchain shows value moving between addresses. It does not show who controls an address, and we do not label owners or call an address a scam. Only an exchange's own records, produced under legal process, can connect a deposit to a named customer. Treat every pattern flag as a lead.

Which blockchains does it read?

Bitcoin, Ethereum, Optimism and Gnosis, TRON (the main rail for USDT in scam cases) and Solana. A 0x address exists on every EVM chain, so for Base, Arbitrum, Polygon, BNB Smart Chain and Avalanche the result links to the public explorers. Litecoin, Dogecoin, XRP, TON and Monero addresses are recognised, with a pointer to the right explorer. Solana transaction signatures are not looked up, because a Solana private key has the same shape and could not be told apart safely; paste the wallet address instead.

What do the confidence grades C1 to C4 mean?

C1 is a fact recorded on-chain or in an official record. C2 means several independent methods agree. C3 is one reliable heuristic or label. C4 is an unverified lead, such as a pattern flag or a community report. A C3 or C4 finding should never be presented as fact in a complaint, affidavit or freeze request.

Is it safe to paste my seed phrase?

Never. Anyone who has your recovery phrase or private key controls your money. This tool does not need one, and refuses anything that looks like one in your browser before it is sent. If you shared a recovery phrase with anyone, move your funds to a brand-new wallet from a clean device now.

What is a freeze request, and who sends it?

A request to a stablecoin issuer (such as Tether or Circle) or an exchange to block an address and keep its records. It is sent by the police or a court, not by a victim, and it needs a legal basis. The Request letters section builds the text from the handbook's templates for the officer to review and send.

Do you store what I check?

We keep a usage log for this tool: the public address or transaction ID, the chain, the result, your IP address, country and browser, as we do for Website Check. We never keep anything the secrets guard refused, text you paste to extract addresses from, letters, or case details: those are built in your browser and are gone when you close the page.

Is this legal advice, or enough for court?

No. It is a reference and a lead generator. Confirm any figure you rely on on a second source (each result links to public explorers), have a second analyst review it, and take legal advice on the authority for each request in your jurisdiction. The handbook behind this tool says the same: a tool's output is a lead, not a verdict.

Glossary

Address poisoning.: Planting a look-alike address in a victim's transaction history (through dust or zero-value transfers) to cause a copy-paste error.
Approval (allowance).: Permission a wallet gives a contract to move its tokens. Drainers abuse it.
Bridge.: Moves value between blockchains.
Change address.: The output that returns the remainder of a Bitcoin-type payment to the spender.
CoinJoin.: A transaction combining many users' inputs to break links.
Common-input ownership.: The guess that inputs spent together are controlled by one entity. A heuristic (C3) that CoinJoin and exchange batching break.
Custodial wallet.: An account at a service that holds the private keys.
Derivation path.: The rule by which a wallet turns a seed into addresses. A valid seed that shows an empty wallet may need another path.
Destination tag or memo.: A field identifying a customer at a shared exchange address (XRP, Stellar, TON and others). Always include it in a request.
Drainer.: A kit that empties a wallet after the victim signs an approval or transaction.
EIP-7702.: An Ethereum feature (May 2025) letting an account delegate its execution to contract code. Abused to create sweepers.
Exchange hot wallet.: A pooled exchange address. It identifies the exchange, not a customer.
Freeze, burn, seizure.: Three different things: movement blocked, balance destroyed, value transferred into state control.
Mixer.: A service pooling funds to obscure their origin. Analyse what goes in and what comes out to exchanges.
Passphrase (25th word).: An optional extra secret that opens a separate hidden wallet from the same seed.
Peel chain.: A series of transactions each paying out a small amount and forwarding a large remainder.
Private key.: The secret that authorises spending from an address. Whoever holds it controls the funds.
Seed phrase.: A 12 to 24 word backup (BIP-39) that regenerates all of a wallet's keys. Never share it.
Stablecoin.: A token designed to track a currency or commodity. Most centrally issued ones can be frozen by the issuer.
Travel Rule.: The requirement that originator and beneficiary information accompany transfers between service providers.
TXID.: The transaction hash that uniquely identifies a blockchain transaction.
Unhosted wallet.: A self-custody wallet not held by a service provider.
UTXO.: Unspent transaction output: the unit of value in Bitcoin-type chains.
VASP.: Virtual asset service provider, such as an exchange. In India, a VDA service provider.
xpub.: An extended public key that reveals all addresses of a wallet account without any spending power. Safe to share with an analyst.

What next?

More crypto guides

This is information, not legal, financial or investment advice, and it does not recover money. Report crime to the police first.