Resources

DefCrypt Blog

Practical analysis of exchange restrictions, AML, theft, and access recovery — without noise or blanket guarantees.

A written recovery phrase and a laptop representing Bitcoin wallet access materials
Wallets

Wallet Empty After Seed Phrase Recovery: What to Check

Check the network, account, seed format, passphrase and address history after restoring an empty wallet. Distinguish a display problem, different keys and outgoing transfers.

A written recovery phrase and a laptop representing Bitcoin wallet access materials
Wallets

Bitcoin Core wallet.dat Recovery: Backups and Forgotten Passwords

How to assess a Bitcoin Core wallet.dat backup, distinguish corruption, encryption and watch-only data, preserve the original and evaluate a forgotten password.

A signed document, a case folder, and a printed address list on a dark desk, representing an NDA before a crypto investigation discussion
Legal

NDA in a Crypto Investigation: Why Sign Before Details

Why use an NDA before sharing crypto-case details: what a non-disclosure agreement does and does not do—and why it never replaces the rule against sending a seed phrase. Not a downloadable legal template.

A contract, a document stack, and a calculator on a dark desk, representing how to choose a crypto recovery or unfreeze firm
Theft

How to Choose a Crypto Recovery Company

How to choose a firm for exchange unfreezing or post-theft support and avoid a second scam: up-front miracles, seed-phrase requests, and promised success rates—without attacking named competitors.

A hardware wallet, a paper seed backup, and a phone wallet app on a dark desk, representing layers of crypto-wallet protection
Wallets

How to Protect a Crypto Wallet: Seed, Hardware, Phishing

How to protect a crypto wallet: seed storage, hardware versus a hot wallet, phishing, token approvals, and extensions—prevention, not a post-hack recovery guide.

Laptop with a checklist and a phone showing an address bar on a dark desk, representing exchange due diligence before a deposit
Exchanges

How to Check a Crypto Exchange Before Signing Up

A pre-deposit checklist for a crypto exchange: domain, licence claims, a withdrawal test, support, and “too good” yield—and how a real AML pause differs from a fake platform.

A report folder, a printed TxID list, and a map outline on a dark desk, illustrating where to report crypto loss in Belarus
Legal

Recovering Crypto in Belarus: Where to Report It

How to recover crypto in Belarus: where to file a report after theft or fraud, how an exchange hold differs from theft, and the limits of local police and courts—without a legal opinion or outcome guarantees.

A phone showing a Bybit account and KYC documents on a desk, representing an access check rather than an AML flag
Exchanges

Bybit access for users tied to Russia: geo and KYC, not an AML withdrawal hold

Bybit access restrictions for users tied to Russia: how geo and KYC differ from an AML withdrawal hold, what to check in the help center, and what not to do.

Several account-restriction notices on a laptop, representing a wave of freezes rather than a single headline figure
Exchanges

A wave of freezes for users from Russia and the CIS: not one cause

Crypto account freezes affecting users from Russia and the CIS in 2026: a mix of AML, SoF, geo, and P2P — how to classify the hold and what to do in the first 48 hours.

An address-chain diagram and a risk mark on a screen, representing sanctions-driven AML relabeling
AML

EU sanctions and AML wallet relabeling: why an old transfer looks risky

EU sanctions and crypto: how new packages can raise risk on certain services, and why AML vendors may relabel historical hops after the fact.

A folder of extra documents and a checklist, representing enhanced due diligence on a crypto exchange
AML

Enhanced due diligence on a crypto exchange: not KYC and not SoF

Enhanced due diligence on a crypto exchange: how EDD differs from KYC and Source of Funds, when it typically starts, and what to expect without treating a chat list as official policy.

A transaction graph on a monitor and a document folder, representing a vendor AML flag and an appeal package
AML

Chainalysis flagged a wallet: what to do next

An exchange cited Chainalysis or KYT: why you cannot delete a flag on-chain, what a Source of Funds and hop map can show, and what an appeal cannot do.

Pool-of-addresses diagram and risk labels on a monitor, representing how crypto mixers work and why AML traces them
Analytics

How Crypto Mixers Work—and Why They Are Still Traced

How crypto mixers and tumblers work: why AML systems flag those hops, why tracing is often still possible, and why depositing mixed funds to an exchange is a freeze risk. Not a how-to-mix guide.

Two explorer windows for different networks and a notebook of TxIDs, representing crypto stuck on a cross-chain bridge
Analytics

Crypto Stuck on a Bridge: Pending, Failed, and Waiting for Liquidity

Funds stuck on a blockchain bridge: how to tell pending from failed and from a liquidity wait, what to check in two explorers, and where DIY analysis ends.

Address-cluster diagram on a monitor and a notebook of hashes, representing investigation of an exchange or protocol hack
Analytics

How Exchange and Protocol Hacks Are Investigated

How investigators cluster addresses and follow cross-chain hops after an exchange or protocol hack—educational limits, no tool marketing, and no freeze promises.

A stamp, a case file, and printed addresses on a dark desk, representing crypto treated as property versus AML and issuer blacklist
Legal

Crypto Seizure and Arrest in Russia: Three Different Mechanisms

Crypto seizure and arrest in Russia: how a criminal freeze of property differs from an exchange AML pause and an issuer blacklist—orientation, not legal advice.

Three stacks of documents and a notebook of TxIDs on a dark desk, representing the choice among police, a lawyer, and analytics after crypto theft
Legal

Who to Contact After Crypto Theft: Police, Lawyer, or Forensics

Who to contact after crypto theft: what police, a lawyer, and blockchain analytics can and cannot do. Protect remaining assets first—not a dogma to file immediately.

Two phones and a notebook with a timeline on a dark desk, representing help after a relative's crypto theft
Theft

Help Someone After Crypto Theft: First Steps for a Relative

A relative lost crypto to theft or a scam: what to say, what not to do together, how to avoid a second scam, and when to involve a specialist—without taking their seed phrase.

A document folder and a hardware wallet on a dark desk, representing access to crypto after the owner's death
Wallets

Crypto Inheritance After Death: First Steps Without a Seed Phrase

Crypto inheritance after the owner's death: a will does not open the wallet, when recovery is realistic, and why a seed phrase must not be sent to "inheritance services."

Laptop with recruiter chat and a phone showing a fake work dashboard on a dark desk, representing a crypto job scam
Theft

Fake Crypto Job Scam: First Steps After a Deposit

Fake crypto job scam: a remote "role" with a training wallet, deposits, and unpaid tasks—stop sending, what to preserve, and where not to pay an up-front recovery fee.

Smartphone on a video call and a notebook with addresses on a dark desk, representing a deepfake check before a crypto transfer
Theft

Deepfake and AI Crypto Scams: First Steps After a Transfer

Deepfake and AI crypto scams: how to recognize a familiar voice or video pushing a transfer, what evidence to keep, and why you should not "verify" on the same channel.

Laptop showing a browser extensions panel and a hardware wallet on a dark desk, representing isolation after an extension theft
Theft

Crypto Stolen Through a Browser Extension: First-Hour Steps

Crypto stolen through a browser extension: how address swapping and injected scripts differ from seed phishing, and what to do in the first hour without using the same profile.

An airdrop quest screen requesting a token approval beside a wallet warning
Theft

Airdrop and Quest Scams: Malicious Approval After a Lure

A fake airdrop or quest asks you to connect a wallet: how a malicious approval empties the balance, and what to do in the first hour after you sign.

A smartphone showing a trading-bot chat and a withdrawal freeze message
Exchanges

A Crypto Bot Froze the Account: First Steps Without Extra Payments

A crypto bot froze withdrawals: how to tell a scam bot from a real OTC bot and from an exchange hold, and why extra unlock payments are not support.

A deposit form with an empty memo field beside a confirmed TxID in a blockchain explorer
Exchanges

Forgot a Crypto Memo or Destination Tag: Where the Funds Sit

A transfer sent without a MEMO or destination tag on XRP, XLM, TON, and similar deposits: why funds often sit on an exchange omnibus address, and how to file a ticket with the TxID.

An exchanger screen showing a transfer under review with a high-risk label
Exchanges

Exchanger Hold for a High-Risk Transaction: What It Means

A fiat/crypto exchanger such as Onix paused a transfer as high risk: how that differs from CEX AML, and first steps that do not invent the venue's policy.

An office desk with a laptop, printed TxIDs, and a corporate crypto-incident checklist
Theft

Company Lost Crypto: What Businesses Should Do

A company lost crypto: how a treasury incident differs from private theft, the first 24 hours, communications, and freeze requests.

A written recovery phrase and a laptop representing Bitcoin wallet access materials
Wallets

How to Recover a Bitcoin Wallet: Seed Phrase, wallet.dat or Old Device

Choose a Bitcoin wallet recovery route using a seed phrase, wallet.dat, backup or old device. Understand the limits of address-only and watch-only recovery.

A lawyer's desk with a case file, a printed TxID, and a laptop showing a crypto theft timeline
Legal

When to Involve a Lawyer After Crypto Theft

When to involve a lawyer after crypto theft, at what stage, and what to prepare—without recovery guarantees or neglecting the urgent protection of remaining assets.

Laptop with a blurred trading screen and a payment request on a dark desk, representing a fake exchange withdrawal-fee scam
Theft

Fake Crypto Exchange Will Not Let You Withdraw: Fees and Extra Payments

A fake crypto exchange will not let you withdraw: how fee, tax, and withdrawal-deposit traps work, and how they differ from an AML hold at a real exchange.

Judge's gavel, scales, sealed documents, and a printed TxID on a dark desk, illustrating the legal route for cryptocurrency recovery
Legal

Recovering Cryptocurrency Through Court

Recovering cryptocurrency through court: when a civil claim or criminal process may help, and when the absence of a defendant, trace, or jurisdiction makes it unrealistic, with no guaranteed legal outcome.

Dark desk with a switched-off phone and a laptop, illustrating wallet access recovery after losing a phone
Wallets

How to Recover Crypto Wallet Access After Losing Your Phone

How to recover crypto wallet access after losing a phone: the role of a seed phrase, first steps, exchange 2FA, and why recovery bots are dangerous.

Dark desk with a laptop and notebook representing lost access to MetaMask
Wallets

Lost access to MetaMask: what to do

What to do after losing access to MetaMask: distinguish a software issue from actual loss, understand passwords and seed phrases, and avoid fake recovery sites.

Laptop with a blurred blockchain explorer interface on a dark desk, showing how to locate and read a transfer
Analytics

How to Read a Blockchain Explorer

How to read a blockchain explorer in practice: find a transfer by TxID and understand Status, From, To, and token transfers in Etherscan, Tronscan, and BscScan.

A phone showing a chat beside a trading chart on a dark desk, representing a long-term pig-butchering scam
Theft

Pig Butchering: A Long Con, Not a One-Off Scam

Pig-butchering crypto scams are long-term confidence schemes. Learn how the trap works, how to leave it, and what evidence to preserve after making transfers.

A laptop displaying a transaction hash beside a notebook on a dark desk, representing a TxID as a transfer receipt
Analytics

What Is a TXID? How to Find and Check a Transaction Hash

What is a TxID or transaction hash, how it differs from an address, where to find it in an exchange or wallet, and why you should preserve it for support.

Laptop showing an address map beside a notebook of transaction hashes on a dark desk
Analytics

How to trace a scammer's crypto wallet

How to trace a scammer's wallet yourself: follow a TxID through a blockchain explorer to a possible exchange deposit, and know where manual analysis ends without any promise of recovery.

A laptop showing a transaction-risk warning and a checklist, representing a Dangerous transaction label
AML

The Support Ticket Says “Dangerous Transaction”: What Does It Mean?

What a Dangerous transaction label means in an exchange ticket, how an incoming deposit may be flagged, and how to respond to support calmly.

A folder of documents and a checklist, representing an AML review package for an exchange
AML

Documents for a Crypto Exchange AML Check

Documents for a crypto exchange AML check: what a requested package should contain, what to attach to the case, and which files hinder the review.

A laptop showing a support ticket beside printed TxIDs for a request to freeze stolen crypto
Theft

Freezing Stolen Crypto on an Exchange: Requests and Evidence

How to request that an exchange freeze stolen crypto, what evidence to attach, and what to expect—without guarantees about the outcome or response time.

A stack of documents, a stamped form, and a printed TxID for a crypto theft police report
Legal

Filing a Police Report for Crypto Theft

What evidence to attach to a police report for crypto theft, why the registration receipt matters, and why filing does not guarantee an investigation or recovery.

Hardware wallet beside a sheet with blank seed phrase lines, illustrating Ledger access recovery
Wallets

Ledger Recovery: Lost Device, Forgotten PIN or Missing Recovery Phrase

What to check after losing a Ledger device, PIN or recovery phrase. Recovery scenarios, separate passphrases, existing backups and missing balances.

A laptop and keyboard on a dark desk, representing a forgotten crypto wallet password
Wallets

Forgot Your Crypto Wallet Password? When Recovery May Be Possible

What to do if you forgot a crypto wallet password, how a password differs from a seed phrase, when recovery may still be possible, and why password-cracking services can be a trap.

Transaction diagram and a laptop showing analytics on a desk, representing the risk source behind so-called dirty crypto
AML

What Is "Dirty" Crypto, and Why Is It Not a Verdict?

Dirty crypto explained: risky sources in an asset's history, such as mixers, scams, or sanctions, why a KYT flag is not a verdict, and what to check before an exchange deposit.

Laptop showing a token freeze notice beside a checklist, illustrating the difference between an issuer freeze and an exchange AML hold
Exchanges

USDT Frozen by the Issuer: How This Differs from an Exchange AML Review

USDT frozen by the issuer: a Tether or Circle token-contract blacklist versus an exchange AML hold, how to check an address, and what no one can promise.

A phone showing outgoing USDT transfers beside a notebook containing TxIDs on a dark desk, representing the first 24 hours after theft
Theft

Stolen USDT: What to Do in the First 24 Hours

What to do if USDT is stolen: identify the TRC-20 or ERC-20 network, preserve the TxIDs, move remaining assets, and request a freeze at the destination exchange without assuming recovery is guaranteed.

Bank card and laptop on a desk representing a P2P fiat transaction and account freeze
Exchanges

P2P account freeze: fiat disputes and evidence

What to do when a P2P fiat dispute or chargeback leads to an account freeze: collect order, bank, and chat evidence and respond through the official appeal process.

Phone showing messages and a notebook with addresses on a dark desk, representing first steps after a crypto scam
Theft

Crypto Scam: Where to Report It and What Not to Do

What to do after a crypto scam: stop further payments, preserve evidence, avoid up-front payments to recovery services, and set realistic expectations.

Laptop showing an abstract transaction list beside a notebook on a dark desk
Analytics

How to trace a USDT transaction on TRC-20

How to trace USDT on TRC-20 in Tronscan, from the TxID to an address that may be an exchange deposit, without promising recovery.

A smartphone showing a blurred trading chart on a dark desk, representing a fake crypto platform introduced through a chat
Theft

Crypto Exchange Scam: A Fake Platform After the Transfer

A crypto exchange scam may use a fake platform introduced in a chat. Learn how to distinguish it from a real exchange and what to do after a transfer without paying a “withdrawal fee” or relying on promises of recovery.

Passport and laptop on a light surface, representing preparation of documents for exchange KYC
Exchanges

Crypto Exchange Verification Failed: What to Fix in KYC

What to do when crypto exchange verification fails: common KYC rejections involving documents, lighting, framing, and mismatched data, and what to fix before contacting support.

Dark desk with a laptop and headphones, illustrating compromised access to a crypto wallet
Theft

Crypto Wallet Hacked: Where to Start

What to do after a crypto wallet compromise: distinguish a leaked seed phrase, phishing, or malware from a malicious approval and take the right first steps.

People working with laptops and diagrams on a desk, representing a pre-deposit crypto AML risk check
AML

How to Check Crypto for AML Risk

How to check crypto for AML risk before a deposit: screen an address and TxID, understand the risk of so-called dirty assets, and isolate risky incoming funds before sending them to an exchange.

A phone showing a transaction explorer beside a hardware wallet on a dark desk, representing evidence preservation after theft
Theft

Crypto Stolen From a Wallet: A Calm Response Plan

What to do after cryptocurrency is stolen from a wallet: preserve TxIDs and addresses, move the remaining assets, prepare an exchange report, and avoid recovery scams.

A laptop showing an account restriction beside a checklist for the first steps after a crypto account freeze
Exchanges

Crypto Account Frozen: A 48-Hour Checklist

What to do when a crypto account is frozen: a checklist for the first 48 hours, one coherent response to an AML request, and why duplicate tickets can be counterproductive.

Printed report and tablet representing AML screening of a wallet before an exchange deposit
AML

How to check a crypto wallet for AML risk

How to check a wallet for AML risk before an exchange deposit: interpret a risk score, distinguish direct from indirect exposure, and save a dated PDF report.

Dark desk with a monitor and keyboard, illustrating the first hours after an unauthorized wallet withdrawal
Theft

Unauthorized Crypto Withdrawal from a Wallet: The First Hours

What to do in the first hours after an unauthorized crypto wallet withdrawal: preserve TxIDs, move the remainder to a clean address, and stop funding the compromised wallet.

Financial charts on a laptop screen, representing exchange withdrawal restrictions
Exchanges

Bybit Withdrawal Under Review: What to Check and Send to Support

Distinguish a Bybit security lock from a withdrawal review or account review. First checks, document preparation and a sample support request.

A stack of documents and a pen on a desk, representing a Source of Funds evidence package for an exchange
AML

Source of Funds: What Exchanges Actually Ask For

What exchanges ask for in a Source of Funds review, how SoF differs from Source of Wealth, which evidence may be accepted, and where origin-of-funds submissions fail.

A laptop keyboard in dark lighting, representing a compromised crypto wallet
Theft

Malicious Token Approval: The First 60 Minutes After Funds Move

A drainer using token approval: how to distinguish malicious approval from seed-phrase theft, revoke permissions, protect remaining assets, and preserve evidence.

Open notebook and pen representing an incomplete written seed phrase
Wallets

Partial seed phrase: when recovery is realistic

When recovery from a partial seed phrase is realistic, which BIP39 details improve feasibility, and why you should never submit a complete seed phrase through a form.

Next step

Need an assessment of your situation?

Briefly describe what happened — without seed phrases or private keys. We will outline possible routes and assess their feasibility.

Request a free assessment
Free initial assessment

Describe what happened

Answer a few questions so we can assess the situation and suggest the next steps.

Do not send seed phrases, private keys, passwords, or 2FA codes. They are not needed for an initial assessment.

Do not send seed phrases, private keys, passwords, or 2FA codes.