Value taken
USDValue taken in the selected incident, valued at the attack block.
Dashboard · VantagePlanned
Stolen Crypto Tracker: Where Hacked Funds Went
Where did the funds from a given hack go: into bridges, mixers or exchanges, or do they still sit in attacker wallets?
Follow a hack's stolen funds hop by hop into bridges, swap protocols, mixers and exchanges, or see what still sits in attacker wallets.
- Multi-chain
ShareEmail it
Blueprint
What the dashboard will show.
The dashboard as it will open in Vantage. Each figure is named here and arrives with its receipt; until its data is published, its place stays empty.
Trail
Where one incident's funds are now and the hops that took them there.
Still in attacker wallets
USDValue still held by addresses on the incident's trails at the latest block.
Moved into services
USDValue that left the trails into bridges, swap protocols, mixers or exchange deposit addresses.
Frozen or returned
USDValue frozen by issuers or exchanges or returned by the attacker, from those transactions.
Where the funds are now
USDThe incident's stolen value split by where it sits now: attacker wallets, bridged, mixed, at exchanges, frozen or returned.
Attacker balance since the attack
USDValue held by attacker addresses since the attack, so each wave of laundering shows as a step down.
Every hop
Every hop with its time, from and to addresses, asset, amount, destination label and transaction.
Destinations
How much each kind of service received from attacker trails, across incidents.
Sent to bridges
USDValue sent from attacker trails into bridges and cross-chain swap protocols over the period, across incidents.
Sent to mixers
USDValue deposited into mixers from attacker trails over the period, across incidents.
Destinations by month
USDValue received per month by each kind of destination, across every tracked incident.
- Incident
- Every incident in the registry with named attacker addresses
- Period
- Since the attack, last 7 days or last 30 days
About
What it answers, and for whom.
After a hack, the stolen funds rarely stay put. This dashboard follows one incident at a time from the attacker's first addresses, hop by hop, into swap protocols, bridges, mixers and exchange deposit addresses, and shows what still sits in attacker wallets at the latest block.
Each hop is a transaction with a block and a hash, and a trail stops where it reaches a labelled service or splits too widely to follow honestly. Frozen and returned funds count as their own destination, so the dashboard answers the two questions people ask after an attack: where did the money go, and how much of it is still in addresses the attacker controls.
Method
How it will be measured.
Every figure will be read at a block, kept with its source and its exact read, and open a receipt anyone can re-check.
How receipts work →- Each incident starts from the attacker addresses named in its public post-mortems, with the source stored beside them.
- Outgoing Transfer logs and native-value traces are followed hop by hop; a hop is kept when the funds, or a clearly separable part of them, move to a single next address.
- A trail stops at a labelled destination (a bridge, swap router, mixer, exchange deposit address or issuer freeze), which becomes the recorded destination of those funds.
- Cross-chain hops are matched from bridge and swap protocol deposit events on the source chain to the release on the destination chain.
- Remaining balances are read at the latest block for every address still on a trail and valued at the latest day-end price.
The data it needs
Chain data, with some off-chain sources
- security_incidentsTo buildHacks and exploitsA registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- address_labelsTo buildAddress labelsLabels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- stablecoin_freezesTo buildStablecoin freezes and blacklistsAddresses frozen or blacklisted by stablecoin issuers, the balances frozen, and later unfreezes or destroyed funds, per stablecoin and chain.
- native_prices_dailyTo buildOracle prices by dayReference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- Seed attacker addresses per incident from public post-mortems, with their source
- Transfer logs and internal traces followed hop by hop, with block and transaction hash
- THORChain router Deposit events, canonical bridge deposit events and Tornado Cash Deposit logs
- Release and withdrawal events on destination chains, matched to each bridge deposit
- Balances of every address on a trail at the latest block
Questions
Questions people ask.
Can you track stolen crypto?
Yes, because every transfer on a public chain is recorded. Following it is harder: attackers split funds across many addresses, swap them into other assets and move them across chains. This dashboard follows each hop it can attribute with confidence and says where each trail stops.
Where do hackers send stolen crypto?
Usually first into a liquid asset through DEX swaps, then across chains through bridges or cross-chain swap protocols, sometimes through mixers and finally to exchanges or brokers that can pay out. The destinations page shows how much each path carried.
Can stolen crypto be frozen?
Some of it. Stablecoin issuers can freeze tokens at an attacker's address, exchanges can freeze deposits and some bridges and chains can pause transfers. Native assets such as ETH and BTC cannot be frozen by an issuer, which is why attackers often swap into them early.
What is a crypto mixer?
A mixer pools deposits from many users and lets each withdraw to a new address, breaking the visible link between a deposit and a withdrawal. The dashboard records funds entering a mixer as a destination and does not guess which withdrawals belong to the attacker.
What does it mean when funds are still in attacker wallets?
Funds still held by attacker addresses have not yet been swapped, bridged or cashed out, so they remain visible and, for freezable tokens, still within reach of an issuer or an exchange. The still-held figure is read at the latest block.
- Hop
- One transfer of stolen funds from one address to the next, recorded with its transaction hash and block.
- Cross-chain swap protocol
- A protocol that takes an asset on one chain and pays out a different asset on another, such as THORChain.
- Deposit address
- An address an exchange gives one customer for incoming funds, which the exchange then sweeps into its own wallets.
Related
More apps like this.
Crypto Hack Tracker: Exploits and Losses This Year
Every major hack and exploit of the year with the amount taken, how the attackers got in and where the stolen funds sit now.
Multi-chainNorth Korea Crypto Hacks: Lazarus Group Theft Tracker
Thefts attributed to North Korea-linked groups, what their attributed wallets still hold and how the funds move across chains.
Multi-chainEthereumBitcoinBiggest Crypto Hacks of All Time, Ranked
The largest hacks and exploits on record, ranked by value taken at the time, with the attack type, the chain and how much came back.
Multi-chainCrypto Address Checker: Flagged, Sanctioned or Hacked
Check an address before you send or accept funds: direct flags and one-hop links to sanctioned, frozen, hacked or phishing addresses.
Multi-chainEthereumTron+1Privacy Protocols Ranked by Shielded Value
Privacy protocols and shielded pools compared by the value they hold, deposits and withdrawals, read from their contracts and chains.
Multi-chainEthereumZcashBitcoin Quantum Risk: BTC in Exposed Public Key Addresses
Bitcoin held in outputs whose public keys are already visible on-chain, split by script type and tracked day by day.
BitcoinBuild Stolen Crypto Tracker: Where Hacked Funds Went on verified data.
Start free in Voltfin Studio: boards, tables and reports where every number opens its receipt. Tell us which data you need first and we will build it next.