Case study: tracing fraud proceeds through Malta – crypto tracing

A payment clears your account on a Tuesday. By Wednesday morning, the funds have passed through a Malta-registered virtual-asset service provider and scattered across three on-chain wallets. The victim's first instinct is that the money is simply gone. In our experience, that instinct is wrong – and acting on it quickly is what separates a recoverable matter from a closed file.

Crypto fraud proceeds traced through Malta are often recoverable, provided the victim moves within days rather than weeks. Public blockchains are transparent: on-chain movements leave a permanent trail, even when the people behind the wallets are unknown. The instruments available – on-chain tracing, disclosure orders against virtual-asset service providers, and coordinated freezing applications – can reach assets that have already crossed a border, so long as there is still something to reach.

This anonymised case study sets out how a matter of that kind was handled: the situation, the strategy chosen, the process that followed, and the lessons that apply to similar fact patterns.

Situation: proceeds moved on-chain through a Malta-licensed VASP

The client – a mid-size European investment firm – became aware, in the spring of 2025, that an employee with payment authority had diverted funds over several months. A portion of the diverted amount had been converted into cryptocurrency and routed through a centralised exchange operating under a Malta licence. From there, the funds had moved on-chain to a cluster of self-custody wallets, with onward transfers to a second exchange in a non-EU jurisdiction.

The total diverted figure sat in the high six figures in euro equivalent. The internal discovery came on a Friday afternoon. By that evening, the client's referring lawyer had contacted us.

Two facts made early intervention possible. First, the Malta-licensed exchange was a regulated virtual-asset service provider subject to EU anti-money-laundering rules, which meant it held verified customer records. Second, the public blockchain record was intact – every transfer was visible and timestamped, even though the receiving wallets had no immediately obvious owner.

The core risk was the second exchange. If the stolen funds reached a cash-out point in a jurisdiction without cooperative legal process, the window for freezing would close. As of spring 2025, that window was measured in days, not weeks.

Strategy: on-chain tracing first, then coordinated disclosure

The immediate priority was not an application to court. It was tracing.

Before any freezing application can succeed, you need to know what to freeze and where it is. We deployed blockchain-analytics tools to map the full transaction graph from the point of diversion: wallet clustering, attribution signals, and the identification of the exchange addresses where the on-chain trail terminated. That work ran overnight into Saturday.

By Saturday afternoon, we had identified two on-chain choke points: the Malta exchange (which had received the initial conversion) and a second centralised exchange where a significant portion of the funds had been deposited but not yet withdrawn. Both exchanges were regulated entities subject to legal process.

The strategy then became a two-track approach. Track one: a disclosure order against the Malta-licensed VASP, to obtain the verified identity behind the deposit address. Track two: an urgent communication – in parallel with allied counsel in the second jurisdiction – to flag the suspicious deposits and preserve the account pending formal process.

For Malta specifically, we coordinated closely with admitted local counsel in Malta, because local procedure governs the filing of any disclosure or freezing application. Malta's position as an EU member state, and its regulated-VASP environment, meant the legal architecture for compelling disclosure was well established. See our Malta jurisdiction guide for the general framework.

Process: disclosure, identification, and interim preservation

The disclosure application against the Malta VASP was filed on Monday morning. The exchange had received and processed the initial conversion; its know-your-customer records would identify the account holder who had deposited the stolen funds.

Malta's regulated-VASP environment – a product of its early adoption of a formal licensing regime for crypto businesses – made the legal basis for disclosure clear. The application was supported by the blockchain-analytics report, the internal audit trail documenting the fraud, and an affidavit from the client's appointed representative. The without-notice nature of the application was critical: alerting the account holder at this stage would have accelerated dissipation.

Within the first week, the disclosure order produced account-holder details for the Malta leg. That identity connected to the second exchange via shared deposit addresses, which the blockchain record had already flagged. Coordinated contact with allied counsel in the second jurisdiction produced an account hold at that exchange while formal process was commenced locally.

On-chain tracing had also identified a third wallet cluster holding a smaller portion of the funds in a stablecoin. We explored whether a direct approach to the stablecoin issuer – who can, on appropriate legal process, freeze specific token balances – was viable. In this instance, the issuer's threshold for intervention was not met for the remaining amount, so that avenue was noted but not pursued.

The process from first contact to account hold at the second exchange took eleven working days. Not every matter moves that quickly; this one did because the on-chain trail was clean and the Malta exchange responded to legal process without delay.

Explore further detail on the tracing methods used in this type of matter at our crypto asset recovery hub.

Transferable lessons for similar fact patterns

Several things decided this matter. They recur across similar cases.

Speed of internal detection matters more than the sophistication of the fraud. The client discovered the diversion within a week of the final transfer. That meant the funds were still on exchange – illiquid, traceable, and subject to process – rather than converted to cash or moved to a non-cooperative forum.

Regulated choke points are where recovery becomes possible. A self-custody wallet in isolation is hard to reach. But most fraudsters eventually move funds through a regulated exchange, because that is where cryptocurrency converts to spendable value. Malta's licensed-VASP environment is one of the better-developed in the EU, which made the disclosure avenue reliable here. Other EU jurisdictions present similar choke points; some non-EU forums present significantly more friction.

On-chain tracing must precede any application. An application to court without a clear, documented trail of the funds is weaker and slower. We regularly advise clients to commission the blockchain analysis before the first call to counsel, not after. The record never disappears – but the assets can.

What about the myth that crypto is untraceable? It is the most common reason victims delay. Public blockchains record every transfer permanently. The challenge is not visibility; it is attribution – connecting a wallet address to a person. That attribution happens either through exchange records (via disclosure orders) or through clustering and behavioural analysis. Neither method is instant, but both are well-developed. If you have recently experienced a similar loss, see our note on NFT theft and recovery for related context on on-chain recovery pathways.

Finally: the second-stage scam risk is real. In the weeks after a crypto loss, victims are often approached by operators claiming to offer recovery services, sometimes presenting fabricated "recovery reports" as proof of capability. A genuine recovery specialist does not cold-call you after a loss, does not demand upfront fees without a documented engagement, and does not promise a percentage return. The case described here involved none of those features.

If you are assessing a similar matter – funds moved on-chain, a regulated exchange in the chain, a jurisdiction with legal process available – a confidential case review can tell you what is realistic. Contact info@axiomtracel.com to discuss.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In our experience, the quality of the blockchain-analytics work in the first 48 hours frequently determines whether a matter is pursuable. We have traced crypto fraud proceeds through multiple EU and non-EU jurisdictions, and we approach each matter by first asking whether recovery is realistic before recommending any step. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace coordinates closely with admitted local counsel in Malta; local procedure governs the filing of any application. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.