Please help me to track stolen funds

[Yggypop]

Hello, my wallets were hacked on March 3, 2026 (probably a hacking program downloaded here on the forum and my keys, which were not in cold storage at the time...). Could you help me track down the attacker? I need to file a complaint, and any documents or graphs that could help trace the funds (approximately $30,000, all my savings) would be a huge help!
This is clearly a theft that reveals much larger activities.

Thank you in advance!

Here is all the information I have gathered for some crypto that I need to track :

ADA
addr1qy5fepdwaemw455arefr0ltru47jy5m9xps5ttd68fj92qqaaf4r9g5pvlhxtlw07p220h29de ugqaw7ju0twdsu43gs6tcsf9
(general info : https://cardanoscan.io/address/01289c85aeee76ead29d1e5237fd63e57d225365306145adba3a6455001dea6a32a28167ee65fdcff054a7dd456e788075de971eb7361cac51)
out ouf staking and sent to stake1u92xaea8pvxthxda4rusr8ppxl59z48dh29skj74jqpy6eqkzdkda
[Wallet Victime ADA]
addr1qy5fepdwaemw455arefr0ltru47jy5m9xps5ttd68fj92qqaaf4r9g5pvlhxtlw07p220h29de ugqaw7ju0twdsu43gs6tcsf9
     │  536.639533 ADA (total input)
     ▼
TX fa22edd2
     │
     ├─ 535.223024 ADA → addr1q9vcym7aqdtnx2gxghr9500fza4c5fx8w9snzdutz785rj25dmn6wzcvhwvmm28eqxwzzdlg29 2wmw5tpd9atyqzf4jqfydcjx
     │   (Attacker Wallet #1)
     │
     ▼
TX c7428eff
     │
     ├─ 536.472932 ADA → addr1qxkmucqr7h3rqlzpstxzd2qwez76aw66th50hp3gpmq34zh79uruwj8vq53g98ldw983j7hwxt n9nqanhz4ppkn7htqq6gzhgw
     │   (Attacker Wallet #2)
     │
     ▼
TX suivante
     │
     ├─ 536.306347 ADA → DdzFFzCqrht43zgmdEWQLf8TvQ7XNhs9T4uzzCPYHGQ8VjB2YFUumQ663XAsAeYBxboFTjzdMT7UAFB npCdigdSN1BUC2rVkCEUar8ML
     │   (Adresse consolidation / probable exchange)
     │
     └─ 1,803.294593 ADA + dizaines de tokens natifs → DdzFFzCqrhskAZVqyqiLu7UhixMPS8EiJahfVQ7kQSoFZ4nxDB9CfnYcwMcDNMHfykiPH2c5vSJLAyg SeHxwcxaiDw1f28qiTMnZFqUc
         (Cluster final / probable hot wallet d’exchange)


SOL
BSfTYEq2WainV8L8ETHmTghrhsePpKtCJ2ztTbS2sXA9
to
hbyyoMvV4qArpMc5fFSr5ys42uBhH6osR6XhqTA9udB
0.018005 SOL stolen
hash https://solscan.io/tx/SzyMMU7YrTnD7VgFEgfEmA7vfqyVwJmmsq5CLG1fiVTgdkSQr9ZTNDJq9AuJRXRrKzZJojrKEXzCgYji8JTnBvF

SOL
BSfTYEq2WainV8L8ETHmTghrhsePpKtCJ2ztTbS2sXA9
to
hbyyoMvV4qArpMc5fFSr5ys42uBhH6osR6XhqTA9udB
0.120305 SOL
hash https://solscan.io/tx/5MjqN6QHq7b48i2kPiD5ct59LvRDxsAeqYDyrpaJZFFQ9tu8kxE79dJHwQXJdLTKGys6PZiJBsDu2G2ooYTbnvwo

BNC
0x99c8af26e6bc30288e633a61bb492e9bf08b4ccd
to
0x49563CE6314d1b3022330586e21003eC6c0a6bF7
0.00628336 BNC
hash https://bscscan.com/tx/0x6c148a063c9384b0d4d72d443d09d83ce9ad5264e0923b11a5ecb7791678b824

[joniboini]

This is the wrong sub-board to post this request. Maybe post this on the scam accusation or alt board. Have you tried submitting your case to someone who does chain analysis?

It would be great if you could explain why you suspect you downloaded a hacking program from this forum. Which thread did you visit? Which app/links did you click? As far as my experience goes, it's very rare for a malware/crypto stealer to stay alive on this forum for long. Not to mention, most people know they shouldn't click and install app from random links.

[Yggypop]

I think from bot coin project, the files are under analysis, clearly a scam

[Bastketsrus]

This is the wrong sub-board to post this request. Maybe post this on the scam accusation or alt board. Have you tried submitting your case to someone who does chain analysis?

It would be great if you could explain why you suspect you downloaded a hacking program from this forum. Which thread did you visit? Which app/links did you click? As far as my experience goes, it's very rare for a malware/crypto stealer to stay alive on this forum for long. Not to mention, most people know they shouldn't click and install app from random links.

Yeah, posting this in the scam accusation board would probably help more. Also, sharing the exact thread or link you clicked would make it easier for others to understand what actually happened.

[Nathrixxx]

As you have been suggested already, try to make it on the scam accusation board or better still, the technical board.

Besides, what is the end result of tracing all these addresses when there is no guaranteed to recovering what is on them, I don't know your intention for trying to make some verifications and trace these addresses, but just be reminded that you can only see where the landed or how the destination goes but not for a recovery back.

[OmegaStarScream]

So these two addresses belong to the hacker?

https://intel.arkm.com/explorer/address/0x49563CE6314d1b3022330586e21003eC6c0a6bF7
https://intel.arkm.com/explorer/address/hbyyoMvV4qArpMc5fFSr5ys42uBhH6osR6XhqTA9udB

If so, you can you check the "Outflows". You can see that the EVM address sent funds to CoinEx before while the SOL one deposited into Bitget. These CEXes transactions happened before you lost the funds, but still... it could help identify the person if KYCed.

Not sure about the ADA transactions. Although probably the most useful ones if you could track them, given that ADA don't not really have any decentralized exchanges (AFAIK) for the hacker to work with.

[NotATether]

I don't know if your country will give you this kind of letter, but try to get a court order or a mandate from the police for CoinEx to hand over identification details for the address.

It will help you find out who was moving funds, even if it was just a money mule or part of a mixer.

[Yggypop]

Hello, thank you all for your answers, I will post in the scam board, sorry for that. Maybe an admin can delete this subject, I think I will try to track (I hope with the help of bitcointalk forum) BTC and ETH with hig priority because it concerns the highest amounts (about 27 000 € at the time of the hack).

[OmegaStarScream]

Hello, thank you all for your answers, I will post in the scam board, sorry for that. Maybe an admin can delete this subject, I think I will try to track (I hope with the help of bitcointalk forum) BTC and ETH with hig priority because it concerns the highest amounts (about 27 000 € at the time of the hack).

No need to delete the subject.

You haven't posted the BTC transactions. But like I said, you can use Arkham intelligence, it should hopefully show if the hacker's address have transacted with exchange's before.

As mentioned above though, law enforcement should probably be the one contacting the exchange's and not you. They're not going to simply hand you the hacker's identity based on some TXIDs. And the sooner you do that, the better.

[PX-Z]

Hello, thank you all for your answers, I will post in the scam board, sorry for that. Maybe an admin can delete this subject, I think I will try to track (I hope with the help of bitcointalk forum) BTC and ETH with hig priority because it concerns the highest amounts (about 27 000 € at the time of the hack).

You can move the thread instead, how to do it? The command is in the lower left of the this thread "move topic" then choose "Economy -- Scam Accusations" and click the Move Topic button. It should be enough without deleting this thread or making a new one.