Follow the Money: How Stolen Crypto Disappears On-Chain

The call is made at four in the morning and the person on the other end is breathing as if they haven't exhaled for nine hours. Six hours previously, a multi-signature wallet belonging to a mid-sized exchange had roughly four million dollars in USDT withdrawn from it, and the individual who signed the fraudulent transactions — let's refer to him as M — is currently in a rented apartment with the windows shut, watching his own crime being played back on a blockchain explorer. Anyone with a browser can see every transaction, every transfer and each decimal place. His girlfriend could carry out an audit of him, his barber could do the same, and more alarmingly, so could a pseudonymous internet detective who has brought down teams much more professional than his.

M isn't stupid, you see. He understood the smart contract that he took advantage of, he knew which hot wallet had excessive authority, and he timed the withdrawal to coincide with a period when the exchange's monitoring team was probably working with skeleton staff. The thing he didn't anticipate — something that almost all first-time thieves fail to realise — is that the actual act of stealing the money was the easy part. Between the seven addresses he used and leading a normal life there lies a system which exists entirely to ensure that people like him never get through.

The first mention of the incident appears on social media within ninety minutes; it doesn't come from the exchange — since they are still preparing their apology — rather it's posted by an on-chain investigator who has a big following and, it seems, doesn't need to sleep. This person provides the address labels, carries out a timing analysis and puts forward a plausible explanation of the attack. M reads this twice and works out for himself what would happen in his own future. He has no contacts among the bankers and wouldn't be able to fly to Dubai with a phone that contains hot wallets. All he needs is a specialist, and by dawn he has contacted one.

The aspect of that thread which troubles M more than the analysis itself is that the investigator not only tagged the exchange but also included the addresses themselves as an afterthought. In the old days, a bank robbery would take weeks before it produced a suspect sketch. In this case, though, the sketch was published before the vault had even finished closing. Since the exchange was panicking and conscious of its public image, it will very likely declare a bounty — a share of whatever is recovered, to be paid out to anyone who supplies information that leads to frozen funds. After its billion-dollar breach, Bybit did precisely that, offering a ten percent reward which caused the whole internet to turn into a deputized stakeout. Now, every bounty hunter with a laptop has a financial incentive to recognise M's money before M can spend it. His stolen millions have not only made him a fugitive but has also turned him into the target of an open-ended, self-funding manhunt in which the wanted poster is updated in real time.

The specialist — that is, the fixer — doesn't carry out any hacking, and it is this very fact that makes him so valuable. What he produces is not theft but rather forgetting. He commits to getting the money out of the blockchain's visible economy and then having it reappear in a plain form: as fiat currency in a jurisdiction which no one keeps an eye on, as a consultancy invoice, or as a business with apparently legitimate income. His fee begins at ten per cent and increases as the situation becomes more complicated. And although M had thought that ten per cent was extortionate, he will soon realise that it is in fact only the lowest rate of what is about to be done to him.

Glass Blockchain

The paradox which causes M's night to be so lengthy is this: crypto was presented to the world as a form of privacy technology, whereas it is in fact the most unprivate kind of money that has ever been invented. Cash leaves behind almost no trace — when a bill changes hands, it forgets all the people it has come into contact with. A blockchain, on the other hand, remembers everything and keeps a record of everyone it meets, together with timestamps, forever. Pseudonymity is not the same as anonymity; it is anonymity on a timer, waiting for one moment of carelessness to expose someone.

The investigators make use of a small number of inherent structural flaws, and it is important to understand them since these flaws explain why money laundering has to be so complicated. If two addresses are funded as part of the same transaction, they most likely belong to the same controller — this is known as the co-spend heuristic and is by far the most effective rule in on-chain forensics. The patterns seen in change addresses reveal habits: a wallet that consistently splits its outputs in the same odd ratios repeatedly is in effect signing its own behaviour. The fact that deposits are made to an exchange at 3 a.m. local time shows a person's time zone just as footprints show what kind of shoe it is. All of this can be done without the need for a warrant; all that is required is patience, since the ledger records every transaction.

That is the reason why the fixer cannot just transfer the money to a new wallet and then feel satisfied. A new address is like a costume rather than a new identity. The funds have to break all the inferential chains — those connecting the theft with the first hop, the chains linking the hops with one another, and the chains connecting the hops with people. Each of these breaks entails either money, time, or both, and the fixer's entire skill consists in knowing which of the breaks are load-bearing.

M also overlooks the human side of the issue. The blockchain is not only kept under watch by the police but also by hobbyists, journalists, victim groups, and bounty hunters, all of whom have various ethical standards. Indeed, the most famous of these individuals have built up a career for themselves and gained a reputation worth millions of dollars in terms of goodwill by coming to light exactly the kind of arrangement that M is at present trying to buy. The fixer is aware of this; part of his fee is due to the fact that he too is being watched and that his own operational security has to withstand scrutiny from people who, to be honest, are better at it than his client.

First Seventy-Two Hours

The timing is essential in this game, since the clock is completely unforgiving. The day after a big theft is the most hazardous time for the money, as it has to come into contact with the real world at some point. Exchanges are the main points of weakness: when stolen coins are deposited on a custodial platform, they end up in a building where compliance officers, the threat of subpoenas, and a strong motivation to cooperate all exist, since it is less expensive to assist the victim than to end up connected with the crime. Stablecoin issuers also have an even more direct option — a freeze feature which is built directly into the token contract. Tether has frozen hundreds of millions of dollars' worth of suspect USDT over the years, sometimes freezing the funds just hours after a hack has been reported.

From the very beginning, the launderer's aim is to get out of the controlled area before the freeze orders are put in place. The first step should be to focus on any address that contains tokenized dollars, since the issuer has a remote facility which can make them disappear — there is no need for a court order or for any negotiation, simply a transaction that renders the balance inactive regardless of where it is. The next priority is to move off the chains that are most thoroughly monitored by analysts, onto those that have heavy trading volume, and then into jurisdictions in which the local counterparties consider paperwork to be a matter of religion for other people. The greater the delay, the fewer exit possibilities there will be.

It is against this background that the industrial approach to the craft comes into view, the most recent case study being the largest crypto theft on record. In February 2025 attackers associated with North Korea's Lazarus Group withdrew approximately one and a half billion dollars from the Bybit exchange – a sum which, as soon as it had been taken, ceased to be merely a robbery and became a logistics operation. The money was divided among thousands of new addresses within hours, converted from Ethereum to Bitcoin using cross-chain services, routed through no-KYC instant exchangers whose owners later clearly stated that they had only processed a small amount, and then forwarded to over-the-counter brokers whose entire business model is based on asking no questions. The investigators, including those who remain pseudonymous, tracked the money in real time, tweet by tweet, and it still worked – mostly. Tether's freeze mechanism blocked a considerable amount of the funds, various exchanges seized small amounts here and there, one of the intermediate exchangers collapsed as a result of damage to its reputation and closed down, but the main part of the money vanished into the normal global money supply, thus confirming a harsh truth: when the team is well-funded, patient, and indifferent to fees, speed is more important than scrutiny. Notably, the operation did not slow down to deal with paperwork; it went on continuously, including on weekends and during holidays – because the state apparatus it was trying to avoid only works during business hours.

If you look at what the amateurs did, a moral lesson becomes clear. The couple accused of laundering the money stolen in the 2016 Bitfinex hack held on to a large part of the stolen Bitcoin for many years, moving it around by using mixers and darknet accounts, but never fully cutting themselves off from it — on the other hand, when the federal agents finally broke in and entered their premises in 2022, the state was able to seize billions of dollars' worth of cryptocurrency simply by making a few court filings. It's the same blockchain and the same degree of transparency, yet the outcomes were opposite. The issue wasn't with the tools; it was with their discipline and, to be honest, with their patience. Lazarus sees laundering as a supply chain; the people involved in the Bitfinex case see it as simply storage. Storage is the way that leads to you being arrested.

The playbook the fixer runs for M is a scaled-down version of the same sequence, and it is worth laying out plainly, because each step exists to break one specific investigative method:

1. Split the stolen money among dozens of addresses, ensuring that there is no connection between the addresses in terms of funding, so as to evade the co-spend and clustering heuristics. 2. Either introduce a mixer or one based on CoinJoin, or else use a modern alternative that involves a cross-chain swap deliberately constructed to hide the trail. 3. Transfer blockchain assets using bridges and instant exchanges, which means the investigator has to start again and reconstruct the context within a new environment that offers different analytics. 4. Use Bitcoin for depth and stablecoins for speed, and hold the value for a period of time matching the length of the news cycle. 5. Use the outlets that have low compliance requirements — such as the over-the-counter desks, private brokers, and the method of using cash in countries where the local counterparties are not members of any watchdog club.

All stages involve a cost, a delay, and there is the risk of leakage, which is the reason why the fixer charges the amount he does. The peel chains — this being the older method of sending money through hundreds of successive addresses, each of which takes a small cut — are almost free but generate the most striking forensic diagrams in the industry. Although mixers do provide a real level of confusion, they have now become prohibited areas from a legal point of view; the developers of one well-known Bitcoin mixer were arrested in 2024, and Tornado Cash stayed under American sanctions for many years before the courts forced a partial reversal in 2025. The tools may change their names; the economics stay the same. Anonymity is a commodity which has a price, and that price rises every time a government sanctions someone.

Detectives and the Burden of Proof

At the same time, on the other side of the glass, an unusual hum can be heard coming from an industry. Companies that provide tracing software are able to automatically reconstruct these chains, grouping millions of addresses into named entities. The firms serve a number of different customers, including exchanges, which want to keep tainted money out; regulators, who require statistics; and law enforcement agencies, who are looking for defendants. There are also the independent individuals — for example, ZachXBT, who has exposed theft rings amounting to hundreds of millions of dollars, works mostly without getting paid, and has in effect become a private detective as well as a public conscience. Their means of influence is not legal power but narrative power: a well-documented trail can result in a mule's exchange account being frozen before any prosecutor has even taken action.

The lack of balance has an impact on every part of the situation. Although the investigators can observe the flow of money almost in real time, the state only finds out about it later, in an indirect way. In order for law enforcement to take any action — for example, to seize bank accounts, homes, or personal freedom — a tracing report by itself is not enough. Further evidence is needed: this consists of KYC records which link an address to a passport, server logs which connect a passport to a laptop, and witness statements which associate the laptop with a specific decision. Attribution has to satisfy the standard that applies in a court of law, and the process of going from observations on the blockchain to evidence that can be admitted in court is lengthy, varies according to jurisdiction, and is slow. A tracer can identify the full network of the fixer within a week; a prosecutor, by contrast, might take a whole year to act on the map, by which time the mules will have changed phones.

The fixer is just as well acquainted with the procedural timetable as any lawyer. The processing of mutual legal assistance treaties takes place at a speed comparable to that of geological processes. Seizure warrants apply only to things that are accessible, and the accessible items are merely all the items that are inside a compliant exchange at the moment the documentation arrives. His strategy is therefore not to try and overtake the blockchain — no one could do that — but to beat the bureaucracy by keeping his value in the gaps between different jurisdictions until the system has turned to something else. In this context, crime is not mainly a violation of the rules but rather an exploitation of their slowest weaknesses.

A psychological element is rarely featured in official reports. The tracers are motivated by something stronger than their salary — namely by a genuine obsession, often rooted in anger towards scammers that is related to trauma, and at times because of the addictive pleasure derived from being the first to detect the fraud. The launderers, by contrast, are driven by something weaker than greed: they are simply acted upon by the momentum of their regular professional routine. Most fixers do not consider themselves to be criminals any more than most people see themselves as pension administrators; they are just transferring value and the moral responsibilities associated with that value belong to someone else. This way of seeing themselves — describing themselves as neutral, technical and respectable — is the key foundation of the entire laundering economy, and prosecutors are now addressing it directly by bringing action against the developers of mixers and the exchange operators rather than against the ghosts who hold the private keys.

Why the Machine Never Stops

When you step back and consider M's story as a whole, it appears not so much like a criminal scenario as rather like an ecosystem undergoing a metabolic process. Each increase in security makes theft more difficult, which in turn raises the skill level needed by thieves, which in turn raises the standard of quality required of the fixers, which then calls for better analytics, which itself requires better laundering, and the cycle goes on. North Korea has adopted this pattern and turned it into official state policy by funding its regime using exactly the payment methods that its international audience favours. Amateur groups continue to show that the human factors — impatience, greed, and the wish to spend — remain the cheapest possible attack surface. Furthermore, the privacy tools available in one decade become the objects of sanctions in the next.

TRON holds a rather unusual position within this system since it has more USDT than any other network, which means that it is used for both the most active legitimate trading and also some of the most intensive laundering activity in the world. Because carrying out thousands of USDT transfers on the network is expensive if you have to burn TRX for each one, the large-scale transfer operators — such as exchanges, payment processors, and yes, launderers who operate peel chains — have all come up with the same solution: they rent TRON Energy. Since buying TRON Energy costs only a small fraction of the amount you would pay to burn TRX, or by obtaining TRON Energy that has been delegated for an hour while a few hundred transfers are being processed, it is sound engineering on the legitimate side of the market — and it is precisely this cheap TRON Energy that makes a hundred-address laundering scheme affordable on the other side, which is why serious Energy service providers now check who they are serving. This is where Netts draws a line that the rest of the rental market does not: using its own TRON analytics infrastructure, it has established a compliance perimeter that includes over 28 million blocked addresses — sanctioned entities, phishing infrastructure, and wallets linked to hacks and stolen funds — and each Energy delegation request is checked against this list in real time, with an independent Elliptic layer running behind its own monitoring system. The reason given is simple: the resources that end up feeding the laundering economy should not come from infrastructure that claims to be unaware of what laundering looks like.

For any of the people who fall on the honest side of that line — that is to say, traders, exchanges, and payment services — the practical conclusion is simple: if you want to transfer USDT on TRON without having to spend TRX, the Netts TRON Energy Market brings together the entire rental industry in real time and always shows the best market rate available, allowing you to rent Energy at the lowest price the market is currently providing — and this is possible through a platform which is already able to tell the difference between a busy trader and a busy peel chain.