We Know Exactly
Which Exchange
Holds Your Stolen Crypto.
Most stolen crypto ends up at a centralized exchange to be cashed out. We identify exactly which exchange, which account cluster, and which deposit address — using our proprietary VASP attribution database and advanced on-chain clustering. Then we file the legal hold request directly, getting funds frozen before they disappear.
Exchange intelligence identifies where stolen crypto was cashed out. BlockTrace pinpoints centralized-exchange deposit addresses, clusters related wallets, and links funds to KYC-verified accounts — giving attorneys and law enforcement the attribution needed to file freeze requests and KYC subpoenas before the funds are withdrawn.
Six Exchange Intelligence Services
From identifying which exchange holds stolen funds to preparing KYC subpoenas and mapping OTC desk networks — our exchange intelligence capabilities cover every stage of the fund recovery pathway.
VASP Attribution & Exchange Identification
We fingerprint exchange deposit addresses using our proprietary database of 10,000+ VASP address patterns — identifying the specific exchange and often the sub-account cluster with high confidence.
Exchange Deposit Address Tracing
We trace stolen funds through the complete on-chain path using blockchain transaction tracing — through wallets, mixers, and bridges — until they arrive at a known exchange deposit address, confirming exactly where funds are held.
KYC Subpoena Package Preparation
We prepare complete KYC disclosure request packages — formatted to each exchange's specific compliance requirements — enabling your attorney to compel the exchange to reveal the account holder's identity.
OTC Desk Network Mapping
OTC (over-the-counter) desks are used by scammers to convert large USDT holdings to fiat without going through regulated exchanges. We identify and map OTC desk wallet clusters and operator networks.
Exchange Legal Hold Filing
We file legal hold requests directly with exchange compliance teams — leveraging direct relationships to achieve faster response times and higher acceptance rates than standard cold submissions. Our legal support team can coordinate the full process with your attorney.
AML Compliance Exchange Intelligence
For compliance teams and regulators needing to understand exchange exposure to illicit funds — we provide transaction risk scoring, VASP exposure reports, and AML-grade exchange intelligence for regulatory use.
The VASP Attribution Database
Our proprietary VASP (Virtual Asset Service Provider) attribution database is the core engine behind our exchange identification capability — built over three years of forensic investigations.
Exchanges We Cover & Contact
Our exchange intelligence and direct compliance relationships span all major centralized exchanges, P2P platforms, and OTC desks globally.
OTC Desk & P2P Network Mapping
Not all stolen crypto reaches a regulated centralized exchange. Sophisticated scammers — particularly pig butchering operations — route funds through OTC (over-the-counter) desks and P2P platforms to convert to fiat without KYC exposure. We identify and map these networks.
OTC desks process large, off-exchange trades between counterparties. They're heavily used across Southeast Asia to convert scam proceeds. We identify OTC desk wallet clusters through behavioral analysis, transaction patterns, and OSINT intelligence.
OTC Desk Fingerprinting
OTC desks have distinct transaction patterns — batch consolidations, consistent withdrawal amounts, and timing signatures. We use these behavioral fingerprints to identify OTC desk wallets even when they're not labeled in any public database.
P2P Exchange Attribution
LocalBitcoins, Paxful, Noones, and regional P2P platforms have attributable deposit address patterns. We identify when stolen funds enter these platforms and flag the associated trader accounts for subpoena or law enforcement action.
Cash-Out Network Intelligence
We map the complete OTC and P2P infrastructure used by specific scam operations — identifying repeat operators, shared wallet infrastructure, and geographic cash-out patterns. Combined with our crypto scam investigation service, this intelligence is valuable for law enforcement and organised crime investigations.
From Trace to Exchange Freeze in Hours
How our exchange intelligence service takes a stolen wallet address and produces a frozen exchange account — step by step.
Input Validation
We receive victim wallet address, TXID, and theft details. Investigator queries VASP database immediately — often confirming exchange identity within minutes.
On-Chain Trace
Full hop-by-hop blockchain trace through wallets, bridges, and mixers to the exchange deposit address — with VASP confidence scoring at every step.
Freeze Package Build
Exchange-specific legal hold documentation prepared — formatted to each VASP's compliance requirements with blockchain evidence summary and TXID exhibits.
Compliance Submission
Legal hold request submitted directly to exchange compliance team via our established channels. Confirmation of receipt obtained and tracked.
Account Frozen
Exchange confirms account freeze pending court order. Our forensic evidence report and KYC subpoena package are delivered to your attorney to file a formal disclosure order and preserve funds legally.
Live Exchange Attribution Feed
A sample of active exchange attribution results from our live case investigations — showing the types of exchange identifications our system produces in real time.
How VASP Attribution Actually Works
The technical methodology behind our exchange intelligence — from raw blockchain data to confirmed VASP identity.
Address Pattern Fingerprinting
Every exchange generates deposit addresses with unique structural patterns — derivation paths, address formats, and encoding conventions specific to their internal infrastructure. We fingerprint these patterns to identify exchange ownership of unknown addresses.
Behavioral Transaction Analysis
Exchange deposit accounts show distinctive behavioral patterns — rapid forwarding to hot wallets, consistent fee structures, batch consolidation timing, and relationship graphs to known exchange cold wallets. These behaviors confirm or corroborate pattern-based attribution.
OSINT Cross-Reference
Blockchain data alone sometimes isn't enough. We cross-reference candidate exchange addresses against OSINT sources — exchange APIs, blockchain explorers with VASP labelling, forum mentions, and peer-to-peer transaction records — to achieve multi-source confirmation.
Cluster Propagation
Once an exchange deposit address is identified, we propagate the attribution across the entire cluster — identifying all related deposit addresses controlled by the same exchange infrastructure. This enables multi-transaction attribution from a single confirmed seed address.
Chainalysis & TRM Labs Integration
We supplement our proprietary database with industry-leading blockchain analytics tools — Chainalysis Reactor and TRM Labs — providing additional VASP labelling coverage, sanctions screening, and exchange-level risk scoring across all major networks.
Direct Exchange Confirmation
For high-value or ambiguous cases, we confirm VASP attribution directly — through exchange test transactions, API endpoint verification, or direct compliance communication. Direct confirmation eliminates attribution uncertainty for court-critical evidence.
Exchanges Identified. Funds Frozen.
Anonymised case summaries showing exchange intelligence outcomes across different scam types and blockchain networks.
Built For Every Recovery Scenario
Our exchange intelligence service serves fraud victims, attorneys, compliance teams, and law enforcement across all use cases involving crypto asset recovery or investigation.
Scam & Theft Victims
You sent crypto to a scammer. The most urgent question is: which exchange did it end up at, and can we freeze it? We answer both — fast enough to matter.
Attorneys Filing for Freezing Orders
You represent a victim and need confirmed exchange identification — with high-confidence attribution and VASP-specific subpoena documentation ready to file immediately. See our dedicated legal support services for attorneys.
Investigators & Cybercrime Units
You're building a criminal case and need confirmed exchange attribution — with evidence-grade documentation linking stolen funds to specific exchange accounts for production subpoenas.
AML & Compliance Officers
You need to understand exchange exposure to illicit funds — for SAR filing, regulatory reporting, or due diligence on specific wallet counterparties and their VASP relationships.
Service Packages
All pricing discussed upfront before work begins. No hidden fees. No contingency.
Full exchange intelligence report with compliance liaison, freeze filing & court-admissible evidence.
View details →Dedicated investigator for law firms & compliance teams. Volume pricing & white-label services.
View details →No hidden fees · Worldwide coverage
Know Which Exchange.
File The Freeze. Today.
Every hour of delay reduces freeze success rates. Our exchange intelligence identifies where your stolen crypto is — and files the legal hold before it's cashed out. 86% success rate when filed within 72 hours.
Exchange Intelligence FAQ
Everything you need to know about how we identify exchanges and file freeze requests.
How do you identify which exchange holds stolen crypto?
We use our proprietary VASP attribution database of over 10,000 exchange deposit address patterns, combined with Chainalysis Reactor, TRM Labs, and on-chain clustering heuristics. When stolen funds are traced using blockchain transaction tracing to an address matching a known exchange pattern, we confirm the specific VASP — and often the sub-account cluster — with high confidence. Every attribution includes a confidence score and supporting rationale suitable for court evidence.
Can you freeze crypto at an exchange without a court order?
Yes, in many cases. Exchanges have voluntary compliance procedures for responding to credible fraud reports. When we submit a well-documented legal hold request with our forensic evidence, major exchanges — especially those with direct compliance relationships — will often provisionally freeze the account pending a formal court order. This buys critical time for your attorney to obtain a court-backed freezing order. Our 86% freeze success rate reflects this voluntary compliance mechanism.
How quickly can you identify an exchange and file a freeze request?
Exchange identification can often be completed within 2–6 hours of case intake for simple single-chain traces. The legal hold package can then be prepared and submitted within hours. Our fastest end-to-end result (exchange identified, legal hold filed, freeze confirmed) was 6 hours from initial contact for a Kraken case. We immediately begin VASP database queries upon receiving the victim's wallet address.
What is a KYC subpoena and how does it work?
A KYC (Know Your Customer) subpoena is a legal order compelling an exchange to disclose the identity of the account holder associated with a specific deposit address. We prepare the blockchain forensic evidence package that your attorney uses to file this order with the court. Once granted, the exchange must reveal the account registration details — name, address, government ID, email, phone number — enabling civil or criminal action against the identified individual.
What if the scammer used multiple exchanges?
This is common in complex cases — we identified 6 exchange endpoints across 4 VASPs in one case. We prepare separate legal hold packages for each identified exchange simultaneously, and track the freeze status across all of them. Our multi-VASP capability means you don't lose coverage just because the scammer spread funds across multiple platforms.
Can you trace funds that went through an OTC desk or P2P exchange?
Yes. OTC desks are identifiable through behavioral analysis — they have distinctive transaction patterns including batch consolidations, rapid forwarding, and consistent fee structures. P2P platforms like Paxful and Noones have attributable deposit address patterns. We identify and map these networks, and where OTC funds eventually reach a regulated exchange (which they typically must to convert to fiat), we trace the full chain and file accordingly.
Do you have relationships with Asian exchanges like Binance, Huobi, and OKX?
Yes. Binance, OKX, and Huobi/HTX are among our most common case endpoints — particularly for USDT-based pig butchering scams routed through Southeast Asia. We have established compliance submission channels with all three. While we cannot guarantee freeze outcomes (exchanges operate independently), our direct relationships significantly improve response times and acceptance rates compared to cold legal submissions.
What happens after the exchange freezes the account?
A voluntary exchange freeze is provisional — typically held for 30–90 days pending a formal court order. Your attorney files for a formal freezing order (WFO, TRO, or Mareva injunction) in the relevant jurisdiction during this window. We prepare the KYC disclosure request to go alongside — compelling the exchange to reveal the account holder's identity. Once identity is confirmed, civil or criminal proceedings against the individual can proceed.