Most stolen crypto ends up at a centralized exchange to be cashed out. We identify exactly which exchange, which account cluster, and which deposit address — using our proprietary VASP attribution database and advanced on-chain clustering. Then we file the legal hold request directly, getting funds frozen before they disappear.
From identifying which exchange holds stolen funds to preparing KYC subpoenas and mapping OTC desk networks — our exchange intelligence capabilities cover every stage of the fund recovery pathway.
We fingerprint exchange deposit addresses using our proprietary database of 10,000+ VASP address patterns — identifying the specific exchange and often the sub-account cluster with high confidence.
We trace stolen funds through the complete on-chain path using blockchain transaction tracing — through wallets, mixers, and bridges — until they arrive at a known exchange deposit address, confirming exactly where funds are held.
We prepare complete KYC disclosure request packages — formatted to each exchange's specific compliance requirements — enabling your attorney to compel the exchange to reveal the account holder's identity.
OTC (over-the-counter) desks are used by scammers to convert large USDT holdings to fiat without going through regulated exchanges. We identify and map OTC desk wallet clusters and operator networks.
We file legal hold requests directly with exchange compliance teams — leveraging direct relationships to achieve faster response times and higher acceptance rates than standard cold submissions. Our legal support team can coordinate the full process with your attorney.
For compliance teams and regulators needing to understand exchange exposure to illicit funds — we provide transaction risk scoring, VASP exposure reports, and AML-grade exchange intelligence for regulatory use.
Our proprietary VASP (Virtual Asset Service Provider) attribution database is the core engine behind our exchange identification capability — built over three years of forensic investigations.
Our exchange intelligence and direct compliance relationships span all major centralized exchanges, P2P platforms, and OTC desks globally.
Not all stolen crypto reaches a regulated centralized exchange. Sophisticated scammers — particularly pig butchering operations — route funds through OTC (over-the-counter) desks and P2P platforms to convert to fiat without KYC exposure. We identify and map these networks.
OTC desks process large, off-exchange trades between counterparties. They're heavily used across Southeast Asia to convert scam proceeds. We identify OTC desk wallet clusters through behavioral analysis, transaction patterns, and OSINT intelligence.
OTC desks have distinct transaction patterns — batch consolidations, consistent withdrawal amounts, and timing signatures. We use these behavioral fingerprints to identify OTC desk wallets even when they're not labeled in any public database.
LocalBitcoins, Paxful, Noones, and regional P2P platforms have attributable deposit address patterns. We identify when stolen funds enter these platforms and flag the associated trader accounts for subpoena or law enforcement action.
We map the complete OTC and P2P infrastructure used by specific scam operations — identifying repeat operators, shared wallet infrastructure, and geographic cash-out patterns. Combined with our crypto scam investigation service, this intelligence is valuable for law enforcement and organised crime investigations.
How our exchange intelligence service takes a stolen wallet address and produces a frozen exchange account — step by step.
We receive victim wallet address, TXID, and theft details. Investigator queries VASP database immediately — often confirming exchange identity within minutes.
Full hop-by-hop blockchain trace through wallets, bridges, and mixers to the exchange deposit address — with VASP confidence scoring at every step.
Exchange-specific legal hold documentation prepared — formatted to each VASP's compliance requirements with blockchain evidence summary and TXID exhibits.
Legal hold request submitted directly to exchange compliance team via our established channels. Confirmation of receipt obtained and tracked.
Exchange confirms account freeze pending court order. Our forensic evidence report and KYC subpoena package are delivered to your attorney to file a formal disclosure order and preserve funds legally.
A sample of active exchange attribution results from our live case investigations — showing the types of exchange identifications our system produces in real time.
The technical methodology behind our exchange intelligence — from raw blockchain data to confirmed VASP identity.
Every exchange generates deposit addresses with unique structural patterns — derivation paths, address formats, and encoding conventions specific to their internal infrastructure. We fingerprint these patterns to identify exchange ownership of unknown addresses.
Exchange deposit accounts show distinctive behavioral patterns — rapid forwarding to hot wallets, consistent fee structures, batch consolidation timing, and relationship graphs to known exchange cold wallets. These behaviors confirm or corroborate pattern-based attribution.
Blockchain data alone sometimes isn't enough. We cross-reference candidate exchange addresses against OSINT sources — exchange APIs, blockchain explorers with VASP labelling, forum mentions, and peer-to-peer transaction records — to achieve multi-source confirmation.
Once an exchange deposit address is identified, we propagate the attribution across the entire cluster — identifying all related deposit addresses controlled by the same exchange infrastructure. This enables multi-transaction attribution from a single confirmed seed address.
We supplement our proprietary database with industry-leading blockchain analytics tools — Chainalysis Reactor and TRM Labs — providing additional VASP labelling coverage, sanctions screening, and exchange-level risk scoring across all major networks.
For high-value or ambiguous cases, we confirm VASP attribution directly — through exchange test transactions, API endpoint verification, or direct compliance communication. Direct confirmation eliminates attribution uncertainty for court-critical evidence.
Anonymised case summaries showing exchange intelligence outcomes across different scam types and blockchain networks.
Our exchange intelligence service serves fraud victims, attorneys, compliance teams, and law enforcement across all use cases involving crypto asset recovery or investigation.
You sent crypto to a scammer. The most urgent question is: which exchange did it end up at, and can we freeze it? We answer both — fast enough to matter.
You represent a victim and need confirmed exchange identification — with high-confidence attribution and VASP-specific subpoena documentation ready to file immediately. See our dedicated legal support services for attorneys.
You're building a criminal case and need confirmed exchange attribution — with evidence-grade documentation linking stolen funds to specific exchange accounts for production subpoenas.
You need to understand exchange exposure to illicit funds — for SAR filing, regulatory reporting, or due diligence on specific wallet counterparties and their VASP relationships.
All pricing discussed upfront before work begins. No hidden fees. No contingency.
Full exchange intelligence report with compliance liaison, freeze filing & court-admissible evidence.
View details →Dedicated investigator for law firms & compliance teams. Volume pricing & white-label services.
View details →No hidden fees · Worldwide coverage
Every hour of delay reduces freeze success rates. Our exchange intelligence identifies where your stolen crypto is — and files the legal hold before it's cashed out. 86% success rate when filed within 72 hours.
Everything you need to know about how we identify exchanges and file freeze requests.
We use our proprietary VASP attribution database of over 10,000 exchange deposit address patterns, combined with Chainalysis Reactor, TRM Labs, and on-chain clustering heuristics. When stolen funds are traced using blockchain transaction tracing to an address matching a known exchange pattern, we confirm the specific VASP — and often the sub-account cluster — with high confidence. Every attribution includes a confidence score and supporting rationale suitable for court evidence.
Yes, in many cases. Exchanges have voluntary compliance procedures for responding to credible fraud reports. When we submit a well-documented legal hold request with our forensic evidence, major exchanges — especially those with direct compliance relationships — will often provisionally freeze the account pending a formal court order. This buys critical time for your attorney to obtain a court-backed freezing order. Our 86% freeze success rate reflects this voluntary compliance mechanism.
Exchange identification can often be completed within 2–6 hours of case intake for simple single-chain traces. The legal hold package can then be prepared and submitted within hours. Our fastest end-to-end result (exchange identified, legal hold filed, freeze confirmed) was 6 hours from initial contact for a Kraken case. We immediately begin VASP database queries upon receiving the victim's wallet address.
A KYC (Know Your Customer) subpoena is a legal order compelling an exchange to disclose the identity of the account holder associated with a specific deposit address. We prepare the blockchain forensic evidence package that your attorney uses to file this order with the court. Once granted, the exchange must reveal the account registration details — name, address, government ID, email, phone number — enabling civil or criminal action against the identified individual.
This is common in complex cases — we identified 6 exchange endpoints across 4 VASPs in one case. We prepare separate legal hold packages for each identified exchange simultaneously, and track the freeze status across all of them. Our multi-VASP capability means you don't lose coverage just because the scammer spread funds across multiple platforms.
Yes. OTC desks are identifiable through behavioral analysis — they have distinctive transaction patterns including batch consolidations, rapid forwarding, and consistent fee structures. P2P platforms like Paxful and Noones have attributable deposit address patterns. We identify and map these networks, and where OTC funds eventually reach a regulated exchange (which they typically must to convert to fiat), we trace the full chain and file accordingly.
Yes. Binance, OKX, and Huobi/HTX are among our most common case endpoints — particularly for USDT-based pig butchering scams routed through Southeast Asia. We have established compliance submission channels with all three. While we cannot guarantee freeze outcomes (exchanges operate independently), our direct relationships significantly improve response times and acceptance rates compared to cold legal submissions.
A voluntary exchange freeze is provisional — typically held for 30–90 days pending a formal court order. Your attorney files for a formal freezing order (WFO, TRO, or Mareva injunction) in the relevant jurisdiction during this window. We prepare the KYC disclosure request to go alongside — compelling the exchange to reveal the account holder's identity. Once identity is confirmed, civil or criminal proceedings against the individual can proceed.