Frequently Asked Questions

Short, plain answers. If we missed one, email hi@phended.com.

Watch Out for the Second Scam

Once you've been scammed once, you become a target for what comes next. The same group, or a new one that bought your information, will reach out claiming they can recover your money if you pay them an upfront fee, a tax, a deposit, or a “processing charge”. They might say they're a law firm, a blockchain investigator, a government recovery agent, or a hacker who can “reverse” the transaction.

All of those are scams. Every single one.

Legitimate recovery only happens through law enforcement and the exchange's compliance team. It doesn't cost you money.
Crypto transactions cannot be “reversed”. Anyone promising that is lying.
Don't pay anyone, send any more crypto, share your screen, install any software, or hand over any ID to a stranger who contacted you about your loss.

If someone contacts you offering recovery, report them too. In Canada, Canadian Anti-Fraud Centre. In the US, IC3.

The Basics

What does this tool actually do?

You paste a wallet address the scammer told you to send money to. We pull the public on-chain record from that address and walk the money one wallet to the next, until the trail lands at a known exchange, hits a bridge to another chain, or runs out of forward edges. The output is a graph of where the funds went and a PDF report formatted for police and exchange compliance teams.

Is this free?

Yes. There is nothing to buy, sign up for, or download.

Will you ask for my wallet password or seed phrase?

Never. Anyone who asks for your seed phrase or password is a scammer. We only read public blockchain data. We cannot move money and we do not want to.

Someone messaged me saying they can recover my crypto. Should I pay them?

No. That is the next scam.The moment you become a known victim, you go on a list that gets sold around. The same group (or a new one) will reach out claiming they're a law firm, a blockchain investigator, a recovery agent, or a hacker who can “reverse” the transaction. They will ask for an upfront fee, a tax, a deposit, or a processing charge. Every single one of these is a scam. Crypto transactions cannot be reversed. Real recovery only happens through police and exchange compliance, and it doesn't cost you anything.

Can you get my money back?

No. Nobody legitimate can promise that. What we can do is point at the place the scammer cashed out so the police or the exchange has something concrete to work with. Most recovery happens through law enforcement and exchange compliance teams, not through tools.

Reading the Graph

How do I follow the money in the graph?

The graph starts small, showing just the scam wallet and the first wallets it sent money to. Click See where it wenton any wallet and the next stop opens up. Keep clicking to walk the money as far as it goes. You only ever see the part you're looking at, so it stays readable no matter how big the trace is. Drag any wallet to move it, tap a wallet to see its full history on the right, and use the annotation tools on the left rail to draw boxes, circles, arrows, or labels for anything you want to flag in the report.

What is a hop?

A hop is one stop along the path the money took. Scammers move stolen crypto through several wallets before cashing out. Each one of those wallets is a hop.

What is the red "Scam Wallet"?

The wallet address you typed in. The trace starts here.

What is a blue "Exchange" node?

A wallet owned by a centralized exchange. Whether police can actually subpoena that exchange depends on where it's based: a regulated exchange (Coinbase, Kraken, Gemini, NDAX in Canada) must verify its customers by law and answers law enforcement; an offshore exchange (HTX, OKX, Bybit, KuCoin) rarely responds to Canadian or US requests. The Where the Money Went panel on the right grades each landing by cooperation tier so you know what you're looking at.

What is a "Mixer"?

A service designed to hide where money is going by blending it with other people's funds. If the trail lands at a mixer it usually goes cold there. Tornado Cash is the most common one. Mixed funds are very hard to recover.

What does "Cash-Out" mean?

The point where the scammer turned crypto into regular money (or into another currency the exchange can track). That is the moment they had to identify themselves to someone.

Why does the trail just stop sometimes?

Check that you've opened it all the way: a wallet with a See where it wentbutton still has more trail to show. If a wallet has no button, the trail genuinely ends there for one of a few reasons. The money may still be sitting in that wallet. It may have moved through a mixer. It may have been bridged to another chain — in that case the wallet card shows a coral “Bridged out” badge with the destination chain and address. Or it may have gone deeper than this trace went, in which case the wallet shows a Trace further button you can click to keep going.

Using the Report

What do I do with the result?

Save the PDF. Attach it to your fraud report. In Canada, file with the Canadian Anti-Fraud Centre. In the US, file with IC3. Then call your local police non-emergency line and email the PDF to whoever takes the case.

Should I contact the exchange myself?

You can, and it doesn't hurt to try, but their compliance team usually only acts on a request from law enforcement. File the police report first, then forward the case number to the exchange.

Is it worth filing if my case is small? What are the realistic odds of recovery?

Yes, file anyway. Here's the honest framing:

Filing a single report rarely leads to direct recovery of your specific case. Police don't open a one-off investigation for one victim's deposit. What filing does is put you on the victim listfor whatever scam ring you're tied into.

Pig-butchering rings are run by large operations that scam thousands of people through the same wallets. When law enforcement eventually busts one (it happens regularly, not rarely), prosecutors pull the case file's known destination wallets and cross-reference them against every victim report on file. Victims tied to those wallets get included in the restitution process — the court divides any recovered crypto proportionally among them.

Recent precedent that actually happened:

July 2025: U.S. Secret Service seized $225M USDT from pig-butchering rings — the largest crypto seizure in their history, with restitution proceedings now distributing to filed victims.
February 2026: DOJ seized $61M in Tether tied to pig-butchering.
February 2025: $73M laundering operation indicted — victims tied to the network are eligible for proceeds.

If you never filed, you're invisible to that process. Even when “your” scammer's wallet gets seized, the court has no way to return your share. Filing is a 30-minute ask in exchange for being eligible if a bust ever lines up with your case.

Don't expect a quick or guaranteed result. Do expect that you're one of many, that the busts are real and frequent, and that the only way onto the eligibility list is the police report you file today.

Where else can I get help with the filing process?

For US victims, the Crypto Fraud Recovery Toolkit by Cara Brown is a free, step-by-step guide built specifically for pig-butchering victims. It walks you through evidence preservation, pre-written complaint letters, and the filing sequence across FBI/IC3, FTC, CFTC, SEC, and state regulators. It's a good companion to the PDF this tool produces. The toolkit explicitly notes that no one should ever charge you to use it — same principle as everything we say about recovery scams.

Limits

What coins do you support?

Bitcoin (BTC); Ethereum mainnet including native ETH, USDC, USDT, DAI, WBTC, WETH, USDe, and FRAX (plus exotic ERC-20s auto-discovered when they show up as swap outputs at known DEXes); Base (Coinbase L2); and USDT on Tron (TRC20). USDT on Tron is where most pig-butchering money cashes out, so it gets its own chain module. Bridged transfers between chains are detected when the bridge contract emits a destination — we don't auto-continue the trace across chains yet, but the destination chain and address are surfaced on the source wallet's card.

Why didn't you find any exchange in my trace?

Sometimes the money is still moving. Sometimes it went through a wallet we don't yet know belongs to an exchange. Sometimes it was mixed. Try a wider scope. If you have a suspect exchange in mind, send us the address.

I see a wallet labelled as an exchange but the scam was on a different platform. Why?

The labels mean which exchange's wallet the money landed at, not where the original scam happened. Scammers usually move stolen funds to one of the big exchanges to cash out, regardless of where the scam took place.

Ready to Run a Trace?

You only need the wallet address the scammer told you to send money to.

Open the Trace Tool