“We traced your crypto”: what that sentence is actually worth
It is the moment clients wait for, and the moment I most often have to slow down. Finding where the coins went is real work and it matters. It is also not the same thing as getting them back, and the distance between the two is where most of the disappointment in this field lives.
What a trace is, in plain terms
Public blockchains record every transfer, permanently, for anyone to read. What they do not record is who owns anything: an address is a string, not a name. So tracing is not detective work on people. It is following value from your address through however many hops the fraudsters used, until it arrives somewhere that has a legal identity — an exchange, a payment processor, an over-the-counter desk. That arrival point is the whole prize. Everything before it is a map of a maze; only there does the maze have a door with a company behind it.
Sometimes the trace ends badly instead: in a mixer, in a chain of swaps across different blockchains, in a platform registered where nobody answers a request from Italy. I say so when it happens. A trace that ends nowhere still has a use — it documents the loss and the route, and it goes into the file — but it will not be the thing that recovers the money.
What changed in Europe on 30 December 2024
Until recently, even an arrival at a European exchange often told you little. Since Regulation (EU) 2023/1113 became applicable — the travel rule, adapted into Italian law by Legislative Decree 204/2024 — providers of crypto-asset services in the Union have to collect and pass on information about the originator and the beneficiary of a transfer. In practice, a transfer between two regulated European providers now has a name attached at both ends, held by someone with an obligation to keep it.
It is worth being precise about the limits: this binds regulated providers. It does not reach transfers between two self-hosted wallets, and it does not conjure identity out of a platform that operates outside the Union and ignores European correspondence. What it does, reliably, is make the first hop into a European service far more informative than it was two years ago.
Who can actually freeze anything — and it is not us
Three different powers get confused here constantly. An exchange can block an account under its own compliance rules, usually briefly and at its discretion, and it is not going to do that on the strength of an email from a stranger. The issuer of a stablecoin can freeze tokens at specific addresses, and the large issuers do, at the request of authorities — which is a real avenue, and equally an avenue that runs through authorities rather than around them. The third power is the one with teeth: in Italy, seizure ordered in criminal proceedings, applied for by the public prosecutor (art. 321 c.p.p.). A victim cannot request it directly. The protective seizure the injured party can ask for in their own name arrives later, once the prosecution has been formally commenced and they have joined the proceedings as a civil claimant (art. 316 c.p.p.).
Which sets the order of operations, and it is not the order most people try. The trace does not go to the exchange. It goes into the criminal complaint as an annex, with transaction hashes, timestamps and the list of addresses laid out so that a prosecutor can act on it without redoing the work — and the prosecutor is the one who writes to the exchange. The weeks lost writing directly to a support desk are weeks during which the balance keeps moving.
A trace is a map, not a key. It tells you where the money is standing. It does not open the door, and it does not prove whose hand put it there.
Two claims that should end a conversation
The first: anyone offering, for a fee paid up front, to “recover” or “retrieve” your coins from the blockchain. Coins move only with the private key. There is no technical operation, no specialist tool and no contact inside the network that changes that. What is being sold is the second fraud — and it is sold, deliberately, to people who have already lost money once, using lists of the first fraud's victims.
The second is subtler and comes from better-dressed people: that because the trace shows the money reaching an exchange, the exchange owes it to you. It does not follow. The exchange took custody of assets from a customer who, as far as its records go, deposited them normally. A claim against that company needs its own basis — its own failures, its own knowledge — and that is a separate assessment, not a conclusion you can read off a chart of arrows.
What makes a trace useful in a case file
Three things, and they are unglamorous. It has to be reproducible: every hop identified by its transaction hash, so that anyone can verify the path independently. It has to be honest about confidence, separating what the ledger shows from what attribution software infers — the first is fact, the second is an opinion that a defence lawyer will test. And it has to be timely, because the window in which the money is still sitting at an identifiable service is measured in days. The report that arrives after the balance has moved is an archaeological document.
If you are reading this while it is still happening — while the platform still shows a balance it will not let you withdraw — the useful thing you can do today is not to hire a tracer. It is to save the deposit addresses, the transaction hashes and the correspondence, and to get the complaint filed. The trace is more valuable attached to it than sold to you on its own.
