⚠️ DISCLAIMER: Ministry of Cyber Affairs is an independent news, guides and directory service on cybercrime and cybersecurity, for victims and investigators. It is NOT an official government or ministry portal.
Website Scam CheckerNewCrypto ForensicsNew
Investigator workspace

Trace it, document it, hand it to the police

The full Crypto Forensics workspace. Paste a wallet address, a transaction ID, or the whole message from the scammer. We read the public blockchain, show what the address holds and where money went, check whether a stablecoin issuer has frozen it, and prepare the request letters and evidence file an investigator needs. Facts only, each with a confidence grade. Just want a balance? Use the balance checker or a coin-specific checker.

  • Free
  • No sign-up
  • Bitcoin, Ethereum, TRON, Solana
  • Refuses seed phrases and private keys
  • Never says an address is a scam or safe

Never paste a recovery phrase (seed words) or a private key. This tool does not need one, and refuses it before it leaves your device. Public addresses and transaction IDs are all it uses.

Try:

  • I sent money to a scammer

    Paste the address you sent to (your wallet or exchange shows it in the transaction details) or the transaction ID. You will see where the money is now, whether it can be frozen, and what to tell the police.

    The first hourWhat happened to you?

  • I am an investigator

    Check addresses and transactions, trace a few hops forward or backward, and export a hop table, a report with a request manifest, and the freeze and disclosure letters from the handbook.

    Request lettersCasework checklistUTC timeline

  • I have a message or a screenshot's text

    Paste the whole chat, e-mail or statement. We list every wallet address and transaction ID in it with its position, flag any that fail their checksum (a typo), and you pick which to check.

    Red flags to look for

The first hour: six questions, in order

  1. 1Is the money still sitting in an address you can see?
    Note the balance and the time (UTC) and watch the address. Prepare freeze requests before you finish tracing.
  2. 2Is any of it in a token its issuer controls (USDT, USDC, PYUSD, USDP, PAXG, XAUt, RLUSD, EURC)?
    Send a freeze request to the issuer with the exact chain, token contract, address and your legal basis. Issuers can block a token even in a self-held wallet.
  3. 3Did it reach a deposit address at a crypto exchange?
    Send preservation, freeze and disclosure requests to that exchange through its law-enforcement channel. Not through customer support.
  4. 4In India: is money still in the banking system?
    Call 1930 and file at cybercrime.gov.in at once so banks can be alerted before the money moves on.
  5. 5Is there a phone, a seed phrase, a hardware wallet or an exchange app within reach?
    Follow the first-response rules: isolate, do not switch off, do not guess codes, and move assets only into a wallet the agency controls, under authority.
  6. 6Is someone now contacting the victim as a 'recovery agent' or an 'official' asking for a fee?
    Warn them. Real police and regulators never charge a fee to recover money, and 'recovery' contacts are a second scam.

How we grade what we tell you

  • C1Confirmed. A fact recorded on-chain or in an official record: a transaction, a block, an issuer freeze event, a record produced under legal process.
  • C2Strong. Several independent methods agree, for example common-input plus timing plus amount match, or two analytics tools plus exchange confirmation.
  • C3Moderate. One reliable heuristic or one reputable label, such as a change-address guess alone.
  • C4Lead. An unverified signal: a community report, a risk score, a pattern flag. Never present it as fact.

What this tool can and cannot tell you

It can

  • Read a balance, token holdings and recent activity, in UTC, from public explorers, and say which one it used.
  • Ask Tether, Circle, Paxos and PayPal USD’s own contracts whether an address is blocklisted, at a stated block.
  • Compare an address with the 506 wallets OFAC names on its sanctions list (file published 2026-10-27) and with addresses law enforcement has published in public alerts, such as the FBI’s 628 addresses tied to the October 2026 Binance theft.
  • Tell a real USDT or USDC contract from a look-alike token that merely uses the name.
  • Follow one asset forward or backward for up to four hops, stopping at contracts, sanctioned addresses and busy services, and list what it did not follow.
  • Flag collection addresses, machine-paced transfers, dormant wallets that wake up and address poisoning, as leads.
  • Build the freeze, preservation and disclosure letters, an evidence report with a request manifest, and a UTC timeline.

It cannot

  • Say who owns an address. A blockchain shows movement, not identity, and we do not label owners.
  • Call an address a scam or safe. A pattern is a lead, and busy exchanges trip the same rules.
  • Freeze or recover anything. Only an issuer, an exchange, a bank or a court can, on a request from the police or a court.
  • Trace through mixers, privacy coins such as Monero, or across a bridge on its own: it stops there and says so.
  • Replace a licensed analytics platform or an examiner. Confirm critical figures on a second source before they go in a complaint or affidavit.
  • Read more than the most recent records of an address; older history needs an explorer.

What happened to you?

Pick the closest type of crypto crime to see how it works, the red flags, and the first actions. These come from the Ministry's handbook for law-enforcement investigators.

Relationship-investment scam (often called pig-butchering)

Contact by a 'wrong number' message, social media, dating or professional networks. Weeks of grooming, then a fake trading platform or app with fake profits. Withdrawals are blocked by 'tax', 'AML fee' or 'verification deposit' demands, again and again.

Red flags

  • Unsolicited contact that moves quickly to private messaging
  • Guaranteed or very high returns
  • Cannot withdraw without paying a fee or tax
  • Told to keep it secret from family or the bank

First actions

  1. Step 1: Capture the chats, the platform address or app and the payment instructions before they vanish.
  2. Step 2: Trace the victim's deposits to the collection wallet, then forward to the consolidation wallet and the exchange or cash-out point.
  3. Step 3: Freeze USDT or USDC where it sits; send exchange requests in parallel.
  4. Step 4: Warn the victim about 'recovery' scams.

Request letters

Preservation, exchange, stablecoin-issuer and India section 94 requests, plus the recovery-scam advisory for victims and a letter of request checklist. Built in your browser from the handbook's templates.

Pick a letter, fill in what you know, and copy it. It is built in your browser: nothing you type here is sent to us or stored. Real recipients (the issuer’s or exchange’s law-enforcement channel) must be looked up on their own official pages.

Preservation request (exchange, platform, registrar, host). Send first and at once, in parallel with everything else. It asks the recipient to keep the records while formal process is prepared.

Letter

Subject: Preservation request - [Agency] case [reference] - URGENT

[Agency] is investigating [offence(s)] under [statute/provisions]. We request that you preserve, pending formal legal process, all records relating to the identifiers below for [period, for example 90 days or as your policy allows], and confirm preservation.

Identifiers:
- Wallet addresses (with chain): [addresses]
- Memo or destination tag: [memo/tag, if any]
- Transaction IDs (with UTC times): [TXIDs]

Records to preserve: subscriber and KYC information; account creation and login records with IP addresses, timestamps (UTC) and device identifiers; transaction, deposit and withdrawal records; linked accounts and payment instruments; communications and support tickets; content associated with the identifiers.

Please do not notify the account holder [if the law permits a non-disclosure request, cite it].

Contact: [officer name, rank], [official e-mail, phone]
Date and time sent: [date and time sent, UTC]

Anything still in [square brackets] must be completed before sending. Have a supervising officer or counsel review legal process.

UTC timeline

Mixed-time-zone events from exchange logs, chats and bank statements, merged into one sorted UTC timeline.

Exchange logs, chat exports and bank statements use different time zones. Paste events as CSV (columns: timestamp, tz, source, description), and get one sorted UTC timeline. A zone can be a name like Asia/Kolkata or an offset like +05:30; leave it empty if the timestamp already carries one. Runs in your browser: nothing is sent or stored.

The UTC timeline appears here.

Casework quality

What separates a defensible case file from a quick lookup: how the case is opened, the checks a forward trace usually misses, and review before anything leaves the unit.

Tracing checks a forward trace misses

Backward tracing (source of funds)
Trace inflows into a collection or consolidation address back to their sources. In relationship-investment scams this often reveals further victims, and it shows who funded the gas (an attribution clue).
Swap reconstruction
Decode the swap: input token, output token, amounts, recipient. Continue the trace with the output token from the recipient. It is the same wallet holding a different asset.
Bridge release
Do not stop at a bridge deposit. Find the release on the destination chain by message ID, or by amount minus fees within a time window.
Time-window correlation
Align block times (UTC, to the second) with victim payments, chat messages, exchange logins and withdrawals. A transfer minutes after a victim's payment with no other plausible source is strong circumstantial evidence; grade it C2 only with corroboration.
Dispersion pattern
Name the shape: fan-out (one to many), fan-in (many to one), serial (one to one) or hybrid, and compare it with the typology's usual pattern.
Account clustering
On EVM, TRON and Solana, link addresses through a shared gas funder, a common deployer, approval patterns and reused deposit addresses. Grade each link and name the heuristic.
Cash-out point
Classify each endpoint, because the endpoint decides the legal route.

Analyst pitfalls and the guardrail for each

Confirmation bias: an early hypothesis colours every later fact
Keep a list of alternative explanations and test each new fact against all of them.
Relying on one tool or vendor
Use two independent sources for every critical link; pull raw data from an explorer or node.
Web pages, chats and channels deleted before capture
Capture and hash at first contact.
Cluster contamination: CoinJoin, exchange batching, one EVM address on several chains
Name the heuristic, grade it, and never apply common-input ownership to CoinJoin.
Losing the trail at a bridge
Check whether the destination of each large transfer is a bridge or router, then find the release on the other chain.
Time-zone confusion
Normalise everything to UTC and keep the original zone beside each reported time.
Broken chain of custody
Log every hand-over of every file and device.
Premature contact with the subject, or using an exchange's customer-support line
Act only through legal process. Customer support is not a law-enforcement channel, and early contact moves the funds.
Stale sanctions status: lists change and delistings happen
Re-screen at intake and again at finalisation.
Role confusion
Police do not file suspicious-activity reports; reporting entities file them with their financial-intelligence unit.

Case opening record

Complete this before any lookup. It keeps queries within lawful purpose and the file defensible.

Peer review checklist

A second analyst ticks every item before anything leaves the unit. 0 of 9 done.

How we grade findings

  • C1 Confirmed. A fact recorded on-chain or in an official record: a transaction, a block, an issuer freeze event, a record produced under legal process.
  • C2 Strong. Several independent methods agree, for example common-input plus timing plus amount match, or two analytics tools plus exchange confirmation.
  • C3 Moderate. One reliable heuristic or one reputable label, such as a change-address guess alone.
  • C4 Lead. An unverified signal: a community report, a risk score, a pattern flag. Never present it as fact.

How Crypto Forensics works, and where the data comes from

  • Blockchain data

    Read-only, from public explorers: mempool.space (Bitcoin), Blockscout (Ethereum, Optimism, Gnosis), TronGrid (TRON) and the Solana network. Stablecoin freeze status is read from the issuer’s own contract through a public Ethereum node or TronGrid. We never ask for a key, never sign or send anything, and only fixed provider hosts are contacted: no address you type is ever fetched as a link.

  • Sanctions list

    OFAC Specially Designated Nationals (SDN) list, SDN.CSV, Sanctions List Service. File published 2026-10-27, 506 wallet addresses. A non-match is worded “no match in this file”, never “clean”. File SHA-256 5f240bed79d504e7a54788b4cd1c7f84e6afa56cd4778653b70b0771b6a8509d. Law-enforcement alerts read from the agency’s own page: FBI, 2026-10-31 (628 addresses). Appearing on a list is a recorded fact; the attribution is the agency’s.

  • The handbook behind it

    The method, grades, templates and checklists follow the Ministry’s Crypto & Virtual Digital Asset Investigation: Guide and Handbook for Law Enforcement (Edition 1.0, November 2026), written for police, financial-intelligence units, prosecutors and forensic examiners. It is a training aid, not legal advice. Statutes, cases, platform policies and statistics change; items that could not be confirmed against a primary source are marked “verify”.

  • Your privacy

    Recovery phrases and private keys are refused in your browser. Letters, case files, labels and timelines are built in your browser and are not sent to us. We keep a usage log of public addresses and transaction IDs looked up, with your IP address, country and browser, to see whether the tool is used and to deal with abuse.

More help

Crypto Forensics is an information tool, not legal, financial or investment advice, and it does not recover money. Every search, seizure, freeze, disclosure request or transfer needs lawful authority in the governing jurisdiction. Mentions of products, issuers and exchanges are for identification only and are not endorsements. If you have lost money, report to the police and your bank now.