How can I identify likely cash-out points for stolen cryptocurrency?
Trace the stolen funds forward from the original drain wallet by mapping each counterparty one or two hops out, then flag any address that resolves to a known exchange, fiat off-ramp, or labeled service. OnChainRisk's 510K+ entity label database includes major centralized exchanges and known mixers, so addresses that touch those entities surface as likely cash-out candidates. This is methodology for investigators and compliance teams — it produces leads and documentation, not legal proof of attribution to a specific person or actor. Cash-out leads are starting points, not seizure orders: coordinate with the receiving exchange's compliance team or your local law-enforcement liaison for any operational follow-up, and keep the chain of evidence intact.
How to do it
- Start from the wallet that received the stolen funds (the drain address) and identify the chain it operates on.
- List the most recent outbound counterparties one to two hops away from the drain wallet.
- Cross-reference each counterparty against OnChainRisk's entity label index for known exchanges, mixers, or services.
- Flag any counterparty that resolves to a known exchange, fiat on/off-ramp, or labeled service as a likely cash-out candidate.
- Document the chain of hops and entity labels, and export a PDF report for follow-up with the relevant exchange or law-enforcement contact.
What OnChainRisk can help with
- Mapping the next-hop counterparties of a drain wallet
- Cross-referencing against 510K+ labeled entities (exchanges, mixers, services)
- Identifying exchange-touch candidates as likely cash-out endpoints
- Producing an exportable PDF for case files
What it does not claim
- Guaranteed attribution to a real-world person or entity
- Coverage of every exchange or every chain
- Real-time blocking or seizure capability
- Deep forensic claims on every supported chain