Stolen Funds Exposure: How Wallets Inherit It

TL;DR — Stolen-funds exposure means value in your wallet traces back to a hack, exploit or scam. You can inherit it from a counterparty without doing anything, and exchanges act on it.

Every large crypto theft ends the same way: the proceeds have to become spendable. They move through swaps, bridges, mixers and intermediaries until they reach a venue that converts them into something useful — and along that path they touch ordinary wallets.

That is how a person who has never been hacked, never used a mixer and never dealt with a criminal ends up holding value that screens as stolen. This guide covers how that happens, how far it spreads, how to tell whether yours is material, and what to do about it.

What counts as stolen funds?

Value attributable to a specific theft event. The attribution is the important part — a screener is not guessing that funds look suspicious, it is matching against addresses that investigators tied to a named incident.

• Exchange breaches. Hot wallets drained, sometimes in the hundreds of millions. The addresses that received the proceeds are published within hours and tracked for years.
• Bridge exploits. Cross-chain bridges hold large pooled balances and have been the single most productive target class. Exposure to a hacked bridge reaches people who merely used it near the wrong time.
• Protocol exploits. A flaw in a contract drains a pool. Anyone who provided liquidity or traded through the affected pool can end up holding a share of the traced value.
• Individual theft at scale. SIM-swap drains, seed-phrase phishing, wallet-drainer contracts. Each one is small; the aggregated clusters are not.
• Fraud proceeds. Pig-butchering operations and investment scams, which move enormous volume and whose collection wallets are increasingly well attributed.

What unites them is that someone did the forensic work to say "these addresses received the proceeds of that event". Stolen-funds screening is that research, packaged.

How does it reach a wallet that did nothing?

Through payment. That is the whole mechanism, and it is unglamorous.

Thieves need to convert. Conversion means counterparties: an OTC desk, a P2P trader, a merchant, a freelancer, a gambling site, anyone who will take the coin. Each of those counterparties now holds traced value and pays it onward in the ordinary course of business. Two or three hops later it is in a wallet whose owner has no connection to the event at all.

The scenarios that catch ordinary people, in rough order of frequency:

1. You sold something. A P2P trade, a freelance invoice, an OTC sale. The buyer paid with traced value, knowingly or not.
2. You used a protocol that got exploited. Receiving crypto from a hacked protocol can mean a legitimate withdrawal that happened to be funded from the drained pool.
3. You were recruited without realising. "Payment processing" jobs and romance scams turn people into intermediaries — the money-mule problem, where the exposure is the least of the trouble.
4. You paid a recovery service. Recovery scams target people who were already victims, and the wallet you send the fee to is usually well attributed.
5. Unsolicited inbound. Someone sent you traced value you never asked for.

How far does it spread, and when does it stop mattering?

Stolen-funds exposure decays with distance through a haircut, like every other category. Direct receipt from an attributed address is severe. One hop is serious. Beyond three or four hops through high-volume services it is usually immaterial, because value passing through a commingled exchange pool carries no meaningful attribution forward.

Proportion matters as much as distance. A small inbound from a distant traced source is a different event from receiving most of your balance that way, and a screener that scores them identically is not modelling materiality.

There is a third variable people miss: time. Attribution improves after an incident. Funds that screened clean the week of a hack can screen badly six months later, because investigators finished mapping the laundering path in between. Nothing about your wallet changed; the data did.

The live count of labelled hack and exploit addresses Plastron matches against sits on the stolen-funds check page and refreshes with every deployment.

Does anyone actually get funds back?

Sometimes, and less often than the recovery industry implies.

Recovery happens when the funds reach a party that can freeze them. A centralised exchange can freeze a deposit. A stablecoin issuer can blacklist an address, which is the one case where a freeze works directly on-chain. Law enforcement can seize keys. None of those is the blockchain itself — no chain can freeze a wallet, and anyone who tells you otherwise is selling something.

And issuers do not always act. Circle declined to freeze in the Drift hack despite holding the technical ability, which is a useful corrective to the assumption that stablecoins are a safety net. The decision is discretionary and the criteria are not published.

For scam proceeds specifically the picture is worse. Police can often trace pig-butchering funds and rarely recover them, because the endpoint is usually a jurisdiction with no cooperation route. Tracing and recovering are different achievements.

How the proceeds actually move

Understanding the laundering path explains why exposure lands where it does, and why it lands on people who are several steps removed from anything criminal.

The first move after a theft is almost always dispersal — splitting the proceeds across many addresses to make the trail expensive to follow. Then conversion: swapping into assets that are harder to freeze, which usually means out of centralised stablecoins and into native chain assets, because an issuer can blacklist USDC and nobody can blacklist ETH.

Then the trace-breaking layer. A peel chain moves a large sum through a long sequence, shaving a small amount off at each step so that the bulk keeps moving while the fragments disperse. Chain hopping bridges value between networks to break single-chain visibility. Mixers cut the link outright where the operator is willing to take the volume.

Finally, the exit, which is where ordinary wallets come in. Value has to reach something spendable, and the exits are a small set: centralised exchanges with weak controls, OTC brokers, P2P markets, gambling platforms, and crypto ATMs. Every one of those exits is a transaction with a counterparty who is usually not a criminal — and that counterparty now carries the exposure forward into normal commerce.

Investigators map this by clustering addresses that behave as one entity, following value through the dispersal layer, and identifying the exit points where the trail meets a regulated party who holds identity data. It is slow, which is why attribution keeps improving for years after an incident, and why a wallet's screening result is not a fixed property.

The practical implication for you is narrow but important: exposure that arrives near the exit layer is common, distant and usually explicable. Exposure that sits one hop from the theft itself is rare and is a different conversation entirely.

Stolen funds and sanctions overlap more than people expect

The largest thefts are increasingly state-linked, which converts a theft into a sanctions matter. Once an entity behind an exploit is designated, its proceeds are not merely traced — they are blocked property, and the strict-liability rules apply.

This is why several of the biggest recent designations were of organisations rather than individuals: Huione Group, Prince Group, Aeza Group. Exposure to any of them stopped being a risk score and became a legal status overnight, retroactively, for wallets that had done nothing new.

If your exposure traces to a designated entity, you are in the sanctions guide's territory rather than this one — the sanctions check is the right starting point, and the advice differs materially.

How do you tell whether yours is material?

Three questions, in order. They are the same three that a compliance reviewer will work through, so answering them first puts you a step ahead rather than on the back foot.

How direct? Did you receive from an attributed address, or is it three hops back? Direct receipt is a serious finding. Distant exposure through services is usually explicable.

How much? As a share of the wallet, not in absolute terms. Receiving a few dollars of traced value into a substantial balance is noise. Receiving most of your balance that way is not.

Which event? A protocol exploit from two years ago and a state-linked hack from last month carry very different weight, even at the same distance and value. The label tells you which, and the label is the thing worth reading rather than the score.

A screening result that answers those three is actionable. One that returns a colour and a number is not, which is the whole argument for tools that surface the driving category and the evidence behind it rather than a verdict alone.

What stolen-funds screening cannot tell you

It cannot tell you about thefts nobody has attributed yet. The gap between an incident happening and its addresses being mapped is measured in days for a large exchange breach and in months for a diffuse scam network. A clean result today is a statement about the labelled set, not about the funds.

It cannot tell you the counterparty's intent. The person who paid you may have been laundering deliberately or may have been two hops downstream themselves, and nothing on-chain distinguishes those.

It cannot tell you what a specific exchange will do. Their threshold is theirs, their data vendor may differ from yours, and their graph analysis usually goes deeper than a free check — so a clean result on your side and a hold on theirs is a difference of depth, not a contradiction.

And it cannot undo attribution. Once an address is tied to an incident, screening will keep saying so. What it can do is tell you which incident, how far away, and how much — which is the difference between a problem you can document and one you are guessing at.

What to do if you find stolen-funds exposure

1. Do not move the funds to a fresh wallet. The chain of custody is permanent, and a new hop reads as an attempt to obscure it. This converts a documentation problem into a conduct problem.
2. Establish how it arrived. Find the inbound transaction and the counterparty. If someone paid you, that is a very different story from having transacted with the attributed address yourself, and it is a story you can tell with evidence.
3. Assemble the paperwork early. Invoices, contracts, chat logs, the transaction hashes. Evidence is easy to gather now and hard to reconstruct after an account is restricted.
4. If you were the victim, say so loudly and early. Report to the venue and to law enforcement. A documented victim has a materially better position than someone who quietly moved funds and explained later.
5. Screen counterparties before you accept payment. Almost all of this arrives from someone else. Checking an address first is the only step that prevents the problem rather than explaining it.

The pattern running through every case: the exposure is rarely the user's doing, and it is always the user's problem. That asymmetry is unfair and it is also the operating reality, which makes a two-minute check before accepting value the cheapest insurance available.

FAQ

Someone sent me stolen crypto. Am I in trouble?

Receiving value you had no reason to suspect is not an offence in most jurisdictions. The exposure is still real and an exchange will still act on it, so the legal answer and the practical answer point different ways. Document how it arrived and do not spend it while you work that out.

Can I return stolen funds to the victim?

You can try, and it is worth attempting where the victim is identifiable, but it does not erase the record. The transaction history still shows the value passed through your wallet. Doing it through the venue or law enforcement handling the case is stronger than doing it directly.

How long does stolen-funds exposure last?

Permanently, because the ledger is permanent. Its weight decreases as the wallet accumulates ordinary activity and the exposure becomes a smaller share of the picture, but it does not expire.

Does exposure to a hack make my whole wallet dirty?

No. Screeners work in proportions, not binaries. A small traced inbound affects a small share of the wallet's risk. The "whole wallet is tainted" model is how crude tools behave and is not how a serious compliance team reasons.

Why did my wallet screen clean last year and badly now?

Attribution improved. Investigators finished mapping a laundering path and the addresses along it got labelled. Your wallet did not change; the data caught up with it.

Is stolen-funds exposure worse than mixer exposure?

Usually more arguable, because it has provenance. With stolen funds you can often show exactly who paid you and for what. Mixer exposure destroys precisely that evidence, which makes it harder to document your way out of even though it is legally lighter.

Should I tell the exchange before they ask?

If you know there is exposure and you have a clean explanation, volunteering it with documentation generally goes better than waiting. If you are unsure, find out what the exposure actually is first — a proactive disclosure of something immaterial invites a review you did not need.