A stolen-funds check traces whether a wallet received crypto linked to hacks, exploits or thefts; Plastron flags stolen-fund exposure free across seven EVM chains, showing the specific counterparties behind the link.

Cryptocurrency exchange and protocol hacks have produced billions of dollars in stolen assets that continue to circulate through the ecosystem years after the original theft. The Ronin bridge hack produced $625 million in stolen ETH and USDC in 2022; the Bybit hack in 2025 produced $1.5 billion; Mt. Gox, Bitfinex 2016, and dozens of DeFi protocol exploits add further billions to the total. Hackers move stolen funds through complex paths: multiple intermediary wallets, DEX swaps, bridge crossings, and mixing services are all employed to obscure the origin. These funds eventually reach ordinary wallets through liquidity pools, yield farming rewards, P2P trades, and token purchases. A wallet that received ETH from a pool where a hacker deposited funds may carry stolen fund exposure that appears in blockchain analytics — even though the recipient had no knowledge of the hack. This indirect exposure creates real compliance risk. Exchanges including Binance, Coinbase, and Kraken have frozen accounts with stolen fund exposure following major hacks as they work through the trace analysis. The Ronin hack in particular resulted in widespread account holds because Lazarus Group funds moved rapidly through mainstream DeFi protocols before exchanges could identify and block the addresses. Screening your wallet against known exploit and hack fund addresses is the essential step in understanding this exposure.