RU
Danger · High risk

Stolen funds in an AML report

Coins taken in hacks of exchanges, protocols or personal wallets.

What it means

Stolen-funds labels mark coins taken in hacks: exchange breaches, DeFi exploits, compromised private keys. Analytics firms follow those coins as thieves split and move them.

Why it is a risk for you as the recipient

Large hacks are watched closely by exchanges, issuers and law enforcement. Stolen coins that reach an exchange are frequently frozen, and the exchange may ask the recipient detailed questions.

  • The FBI attributed the theft of about USD 1.5 billion from the exchange Bybit on 21 February 2025 to North Korea.[1]

Example situation

Illustrative scenario, not a real case. A week after a major exchange hack, someone offers you ETH below market price. The address history shows funds that left the hacked exchange and passed through several new wallets. The discount is the warning.

What to do if it shows up in a report

  1. Decline: discounted coins from fresh, multi-hop chains are a classic laundering pattern.
  2. If you already received them, keep them where they are and contact your exchange or a lawyer.
  3. Never pay a “fee” to unlock frozen funds — that is a scam.
A high risk score is a reason to look closer, not proof of a crime. A low score does not guarantee that an exchange or issuer will not freeze funds.

FAQ

How long do stolen-funds labels stay?

Indefinitely in most datasets. The coins’ history does not change, although their share in a wallet shrinks as other funds arrive.

Compare checkersFree checks

Sources

  1. FBI Internet Crime Complaint Center (IC3) — North Korea Responsible for $1.5 Billion Bybit Hack (PSA250226) (26 Feb 2025). Checked 4 Nov 2026.