Questions and answers › Stolen funds and fraud

Can an exchange identify who received stolen crypto?

Usually yes, through its client checks, but it discloses the identity mainly to authorities, not to victims.

In short

In most cases yes: a regulated exchange must verify its clients, so it knows who holds the account that received the funds. It will, however, generally disclose that identity only to authorities such as police, prosecutors or courts, not to the victim directly. What a victim can often obtain quickly is a precautionary freeze of the account, if the exchange accepts a well-documented report.

What the exchange knows

Exchanges subject to anti-money-laundering rules collect identity documents and other data on their clients. They also keep technical and transactional records that can be decisive for an investigation.

  • Name, address and identity documents of the account holder.
  • Login data such as IP addresses and devices.
  • Bank accounts or cards used for deposits and withdrawals.
  • Where the funds went after they arrived.

Who can obtain the identity

Data protection and confidentiality rules prevent exchanges from handing client data to private persons. The identity is normally obtained by a prosecutor or court through a disclosure order, sometimes called a production order. Depending on national law and the stage of the proceedings, the victim's lawyer may then see it in the case file.

Many large exchanges have dedicated channels for law-enforcement requests, which can speed this up.

First, find the right exchange

Nobody can ask an exchange to act without knowing that it received the funds. Tracing follows the funds to deposit addresses that on-chain analysis attributes to a specific service. Not every service can be identified with certainty, and some funds pass through brokers or smaller platforms that hold accounts at larger exchanges.

When the exchange is in another country

Exchanges are often registered in a different country from the victim. A foreign prosecutor's order does not bind them directly, so the formal route is mutual legal assistance: the authority in your country asks the authority where the exchange is based to obtain the data or order a freeze. This can take months.

In practice, many exchanges respond voluntarily to requests from foreign authorities and preserve the data on request, which shortens the wait.

What to send the exchange

  • The deposit address and the transactions that reached it, with amounts and times.
  • The tracing path from the victim's wallet.
  • A copy or reference of the criminal complaint.
  • A clear request: freeze the account and preserve the data for the authorities.

How Advisorn helps

Advisorn Forensics identifies the exchanges and payment services that received the funds, and sends them freeze and information requests. We prepare the material the authorities need to request the account holder's identity.

Legal references

Council of Europe Convention on Cybercrime (Budapest, 2001), art. 18 (production order) and art. 29 (expedited preservation of stored computer data). Example: Swiss Criminal Procedure Code art. 265 (duty of disclosure).

Updated November 2026 · General information, not legal or tax advice on your specific case.

Do you have a similar case?

Describe your situation in about a minute: we get back to you with a first assessment.