# Stolen Crypto Tracker: Where Hacked Funds Went

> Stolen crypto tracker: follow hacked funds hop by hop through bridges, swap protocols, mixers and exchange deposits, and see what attacker wallets still hold.

Markdown copy of https://voltfincrypto.com/apps/stolen-crypto-tracker

**Question:** Where did the funds from a given hack go: into bridges, mixers or exchanges, or do they still sit in attacker wallets?

- Kind: Dashboard in Voltfin Vantage
- Topic: [Security and risk](https://voltfincrypto.com/topics/security)
- Chains: Multi-chain
- Status: Planned. The data is not published yet, so this page states no figure; each figure will open its receipt when it is.

After a hack, the stolen funds rarely stay put. This dashboard follows one incident at a time from the attacker's first addresses, hop by hop, into swap protocols, bridges, mixers and exchange deposit addresses, and shows what still sits in attacker wallets at the latest block.

Each hop is a transaction with a block and a hash, and a trail stops where it reaches a labelled service or splits too widely to follow honestly. Frozen and returned funds count as their own destination, so the dashboard answers the two questions people ask after an attack: where did the money go, and how much of it is still in addresses the attacker controls.

## Blueprint

### Trail

Where one incident's funds are now and the hops that took them there.

- **Value taken** (USD): Value taken in the selected incident, valued at the attack block.
- **Still in attacker wallets** (USD): Value still held by addresses on the incident's trails at the latest block.
- **Moved into services** (USD): Value that left the trails into bridges, swap protocols, mixers or exchange deposit addresses.
- **Frozen or returned** (USD): Value frozen by issuers or exchanges or returned by the attacker, from those transactions.
- **Where the funds are now** (USD): The incident's stolen value split by where it sits now: attacker wallets, bridged, mixed, at exchanges, frozen or returned.
- **Attacker balance since the attack** (USD): Value held by attacker addresses since the attack, so each wave of laundering shows as a step down.
- **Every hop**: Every hop with its time, from and to addresses, asset, amount, destination label and transaction.

### Destinations

How much each kind of service received from attacker trails, across incidents.

- **Sent to bridges** (USD): Value sent from attacker trails into bridges and cross-chain swap protocols over the period, across incidents.
- **Sent to mixers** (USD): Value deposited into mixers from attacker trails over the period, across incidents.
- **Destinations by month** (USD): Value received per month by each kind of destination, across every tracked incident.

Filters: Incident (Every incident in the registry with named attacker addresses); Period (Since the attack, last 7 days or last 30 days).

## How it will be measured

- Each incident starts from the attacker addresses named in its public post-mortems, with the source stored beside them.
- Outgoing Transfer logs and native-value traces are followed hop by hop; a hop is kept when the funds, or a clearly separable part of them, move to a single next address.
- A trail stops at a labelled destination (a bridge, swap router, mixer, exchange deposit address or issuer freeze), which becomes the recorded destination of those funds.
- Cross-chain hops are matched from bridge and swap protocol deposit events on the source chain to the release on the destination chain.
- Remaining balances are read at the latest block for every address still on a trail and valued at the latest day-end price.

## Data it needs

- `security_incidents` (to build): A registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- `address_labels` (to build): Labels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- `stablecoin_freezes` (to build): Addresses frozen or blacklisted by stablecoin issuers, the balances frozen, and later unfreezes or destroyed funds, per stablecoin and chain.
- `native_prices_daily` (to build): Reference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- Source: Seed attacker addresses per incident from public post-mortems, with their source
- Source: Transfer logs and internal traces followed hop by hop, with block and transaction hash
- Source: THORChain router Deposit events, canonical bridge deposit events and Tornado Cash Deposit logs
- Source: Release and withdrawal events on destination chains, matched to each bridge deposit
- Source: Balances of every address on a trail at the latest block

## Questions

### Can you track stolen crypto?

Yes, because every transfer on a public chain is recorded. Following it is harder: attackers split funds across many addresses, swap them into other assets and move them across chains. This dashboard follows each hop it can attribute with confidence and says where each trail stops.

### Where do hackers send stolen crypto?

Usually first into a liquid asset through DEX swaps, then across chains through bridges or cross-chain swap protocols, sometimes through mixers and finally to exchanges or brokers that can pay out. The destinations page shows how much each path carried.

### Can stolen crypto be frozen?

Some of it. Stablecoin issuers can freeze tokens at an attacker's address, exchanges can freeze deposits and some bridges and chains can pause transfers. Native assets such as ETH and BTC cannot be frozen by an issuer, which is why attackers often swap into them early.

### What is a crypto mixer?

A mixer pools deposits from many users and lets each withdraw to a new address, breaking the visible link between a deposit and a withdrawal. The dashboard records funds entering a mixer as a destination and does not guess which withdrawals belong to the attacker.

### What does it mean when funds are still in attacker wallets?

Funds still held by attacker addresses have not yet been swapped, bridged or cashed out, so they remain visible and, for freezable tokens, still within reach of an issuer or an exchange. The still-held figure is read at the latest block.

## Glossary

- **Hop**: One transfer of stolen funds from one address to the next, recorded with its transaction hash and block.
- **Cross-chain swap protocol**: A protocol that takes an asset on one chain and pays out a different asset on another, such as THORChain.
- **Deposit address**: An address an exchange gives one customer for incoming funds, which the exchange then sweeps into its own wallets.

## Related apps

- [Crypto Hack Tracker: Exploits and Losses This Year](https://voltfincrypto.com/apps/crypto-hack-tracker)
- [North Korea Crypto Hacks: Lazarus Group Theft Tracker](https://voltfincrypto.com/apps/north-korea-crypto-hacks-tracker)
- [Biggest Crypto Hacks of All Time, Ranked](https://voltfincrypto.com/apps/biggest-crypto-hacks)
- [Crypto Address Checker: Flagged, Sanctioned or Hacked](https://voltfincrypto.com/apps/crypto-address-checker)
- [Privacy Protocols Ranked by Shielded Value](https://voltfincrypto.com/apps/privacy-protocols-ranking)
- [Bitcoin Quantum Risk: BTC in Exposed Public Key Addresses](https://voltfincrypto.com/apps/bitcoin-quantum-risk-exposed-keys)

Build it in Voltfin Studio: https://app.voltfincrypto.com/signup?next=%2F