Tracing through decentralised exchanges (DEXs)

On-chain, stolen funds can move through a decentralised exchange in seconds. The transaction is public, permanent, and – if you act quickly – traceable to a point where legal process can intercept the proceeds.

Tracing through decentralised exchanges (DEXs) is technically harder than tracing through a centralised venue, but it is not a dead end. Public blockchains record every swap, every liquidity-pool interaction, and every wallet-to-wallet transfer. The challenge is converting that raw data into a legally useful attribution chain that can support a freezing order, a disclosure order against a virtual-asset service provider (VASP), or a stablecoin freeze. This guide explains how that is done.

The sections below follow the recovery pathway in sequence: understanding why DEXs create a tracing challenge, gathering on-chain evidence, building attribution, identifying the choke points where legal process can still reach the proceeds, and applying the right instruments under the right conditions.

Why do decentralised exchanges make on-chain tracing harder?

A DEX removes the single counterparty that makes a centralised exchange a usable choke point. There is no exchange-operated know-your-customer (KYC) database, no customer account to freeze, and no compliance team to serve with a disclosure order. Swaps execute automatically through smart contracts, often in a single transaction that converts one token to another and deposits the result to a wallet the attacker controls.

The absence of a custodian does not erase the evidence – it changes where the evidence sits. Every swap records the input wallet, the output wallet, the tokens involved, the pool address, and the block timestamp. That data is immutable and public. What it lacks is an identity layer; the person behind the wallet is not declared. Building that identity layer is the core of DEX-tracing work.

Liquidity-pool mechanics add a further complication. When proceeds enter a pool, they are mixed with the capital of other liquidity providers. Withdrawing the proceeds later produces a different token balance than the one deposited. In our experience, this pool-mixing step is the one that most often leads investigators to conclude – incorrectly – that the trail has gone cold.

It has not. The pool contract records the attacker's position. Withdrawals from that position are traceable forward. The path is indirect, but it is there.

What on-chain evidence should you collect first?

Speed matters here. The first practical step is preserving a complete on-chain record of the theft transaction and every subsequent hop, before the attacker converts to a less traceable asset or bridges to a chain with lower blockchain-analytics coverage.

Begin with the originating transaction hash. That hash links to the sending wallet, the receiving wallet, the token transferred, and the block time – all of which anchor the rest of the tracing tree. From there, work forward through each subsequent transaction: DEX swaps, bridge interactions, liquidity-pool deposits and withdrawals, and any transfers to externally-owned wallets.

Preserve a timestamped export of each transaction record at the time of collection. Courts and tribunals in common-law jurisdictions have accepted blockchain-analytics outputs as evidence, but the integrity of the record matters. A screenshot taken weeks after the event is harder to authenticate than a contemporaneous export from a blockchain-analytics tool with a verifiable methodology.

Document the token types involved at each step. A swap from a volatile token into a stablecoin is particularly significant: stablecoin issuers can, on appropriate legal process, freeze specific token balances. That option closes if the attacker converts further into a non-custodied asset or bridges to a chain the issuer does not control.

If you are an insolvency practitioner or a referring lawyer, this evidence-gathering step feeds directly into the affidavit materials needed for an urgent without-notice application. We regularly advise on the minimum viable evidence package at this stage.

How does wallet clustering and attribution work across DEX hops?

Wallet clustering is the discipline of inferring that multiple on-chain addresses are controlled by the same person or entity. On centralised exchanges, a single deposit address often ties back to a named account. On a DEX, the attribution has to be built from behavioural and transactional patterns alone.

Several heuristics are reliable. Gas wallets that fund multiple operating addresses tend to cluster. Common-input-ownership patterns – where two addresses fund the same transaction – indicate shared control. Timing correlations across chains, when bridge transactions occur in rapid sequence from the same wallet cluster, narrow the attribution further.

Wallet clustering does not prove identity on its own; it proves that a set of addresses behaves as a single economic unit. The identity step requires a choke point: a VASP, a centralised exchange, or an on-ramp where the attacker's cluster intersects with a KYC-gated system. That intersection is where a Norwich Pharmal order or a disclosure order against a VASP becomes the operative instrument.

Cross-chain bridges complicate attribution but do not defeat it. Most bridge protocols record the source address on the origin chain and the destination address on the receiving chain. The link is on-chain and permanent. What changes is the chain-analytics tooling needed to follow the hop: coverage varies by chain, and some chains have substantially less public analytics infrastructure than others.

In a matter we handled in southeast Asia in early 2025 – proceeds in the high six figures, routed through three DEXs and two bridge protocols – the key attribution came not from the bridges themselves but from a gas-funding wallet that reappeared on the destination chain. That single address intersection produced the cluster attribution that anchored the subsequent disclosure application.

Where are the legal choke points after a DEX swap?

The practical question, once the on-chain trail is mapped, is: where can legal process actually reach the proceeds? DEXs themselves are not viable respondents in most proceedings – they are smart contracts, not legal entities. The choke points sit upstream and downstream of the DEX.

Downstream, the most important choke point is the centralised exchange or VASP where the attacker eventually converts proceeds to fiat or to a custodied asset. Most crypto-to-fiat conversions pass through at least one KYC-gated venue. A disclosure order against that VASP, supported by the on-chain attribution chain, can produce the identity information needed to name the defendant and obtain a freezing order.

Stablecoin issuers are a second downstream choke point. If proceeds rest in a stablecoin, the issuer may have the technical ability to freeze the specific token balance on receipt of appropriate legal process. This option is time-sensitive: it closes the moment the attacker moves the stablecoin to a different asset or to a non-custodied wallet. Hours matter here.

Upstream, if the original theft came from a known wallet, the originating exchange may hold KYC data on the attacker's deposit account even if that account was never used for the specific theft. A Bankers Trust order, or its functional equivalent in the relevant forum, can compel disclosure of that account information. That creates an alternative attribution path that bypasses the DEX hops entirely.

The choice of choke point depends on where the proceeds currently sit, which jurisdiction has supervisory authority over the VASP, and how quickly the application can be made. A worldwide freezing order, obtained without notice to avoid tipping off the defendant, can cover multiple choke points simultaneously.

For a broader view of the instruments available in crypto recovery, the Crypto Asset Recovery insight section sets out the full range of tools and when each applies.

The steps above map the typical pattern. Each matter turns on specific facts – which chain, which VASP, how much time has passed. A confidential case review gives you a realistic read on whether the proceeds are still reachable. Contact us at info@axiomtracel.com.

How do cross-border considerations affect a DEX-tracing case?

A DEX swap takes milliseconds. The legal process needed to freeze the resulting proceeds can take days to weeks. That gap is where most recoveries fail – not because the money is untraceable, but because the jurisdictional question was not resolved quickly enough.

Which court should you approach first? The answer depends on where the actionable choke point sits. If the target VASP is regulated in a common-law jurisdiction with a well-developed interim relief system – England and Wales, Singapore, Hong Kong, or the British Virgin Islands, for example – the disclosure and freezing applications can often be made within days of briefing local counsel. A proprietary injunction against "persons unknown" can, in appropriate cases, cover wallets whose owners have not yet been identified.

When the choke point is a VASP regulated in a different jurisdiction from the victim's home forum, two applications may be needed: one to freeze the asset in the VASP's jurisdiction, and one to compel disclosure in the forum that has supervisory authority over the exchange. These are not sequential steps – they are often run in parallel to cut the window during which the attacker can move the proceeds again.

Letters of request and mutual legal-assistance mechanisms are available for criminal matters, but they are too slow for civil urgent relief. The civil route – directly briefing local counsel in the VASP's jurisdiction – is almost always faster where the evidence threshold can be met.

Cross-chain bridges add an extra jurisdictional dimension: the origin chain, the bridge protocol's governing law (if identifiable), and the destination chain may each point to a different forum. In our experience, the better approach is to focus on the current resting point of the proceeds rather than trying to litigate every hop simultaneously.

For a worked example of cross-border tracing across offshore corporate layers, the case study on tracing fraud proceeds through the British Virgin Islands illustrates how these threads come together under time pressure.

What are the limits of DEX tracing, and when is recovery realistic?

Honesty here matters. Not every DEX-tracing case produces a recoverable outcome. Some trails do go genuinely cold. Understanding when that is likely – before spending material sums on litigation – is part of responsible advising.

Recovery becomes harder when: the proceeds have been mixed through a privacy protocol that obscures the on-chain trail to a degree that defeats attribution; the amount in dispute is too small to justify the cost of multi-jurisdictional legal process; or the attacker has converted into a non-custodied asset on a chain with limited analytics coverage and no identifiable VASP intersection.

Recovery is more realistic when: the proceeds are still in a stablecoin or at a VASP with a KYC requirement; the on-chain trail reaches at least one exchange that is regulated in a common-law jurisdiction with a functioning freezing-order regime; or the amount in dispute justifies the cost of coordinated multi-forum proceedings. Time is the single most important variable: a case opened within hours of the theft faces a materially different set of options than one opened weeks later.

What distinguishes a legitimate recovery specialist from a recovery-scam operator? A legitimate specialist cannot promise a result, will not charge a large upfront fee without a clear scope of work, and will give you an honest assessment of the evidence before recommending proceedings. If someone approaches you after a DEX theft and promises a specific recovery percentage, that is a warning sign, not a credible offer.

Our asset-tracing service page explains the investigation methodology and the conditions under which we recommend proceeding to formal legal action.

We have traced proceeds through DEX swaps, bridge protocols, and liquidity pools to a point where a VASP disclosure application was viable. Not every matter reached that point. The assessment comes first.

To assess whether the proceeds in your matter are still reachable, request a confidential case review: info@axiomtracel.com.

Frequently asked questions about DEX tracing and crypto recovery

Q: Can stolen crypto really be traced and frozen?

A: Yes – in appropriate cases. Public blockchains record every transaction permanently and transparently. On-chain tracing tools can follow proceeds through decentralised exchanges, bridge protocols, and wallet hops to a point where legal process can intervene: typically a disclosure order against a virtual-asset service provider (VASP) or a freeze of a stablecoin balance. Whether that is achievable in a specific case depends on how much time has passed, which chains are involved, and where the proceeds currently rest.

Q: How quickly do I need to act after a crypto theft?

A: As quickly as possible – in hours, not days. Stablecoin freeze options close the moment the attacker converts or moves the balance. Disclosure applications to VASPs are most effective before the attacker withdraws the proceeds or closes the account. A without-notice freezing order application can sometimes be prepared and filed within one to two days of briefing counsel, but only if the on-chain evidence has already been collected and the choke point identified. Delay narrows the options materially.

Q: How is a real recovery specialist different from a recovery scam?

A: A legitimate recovery specialist will not promise a specific result, will not charge a large upfront fee without a clear and scoped mandate, and will provide an honest assessment of the evidence before recommending proceedings. Recovery scams – which specifically target people who have already lost funds to crypto fraud – typically promise high recovery rates, request fees before doing any traceable work, and disappear once payment is made. If you have been approached by someone offering guaranteed recovery after a DEX-related theft, treat that approach with serious caution before engaging.

Related resources

• Crypto Asset Recovery – insight hub: on-chain tracing, exchange choke points, and freezing digital assets across jurisdictions.
• Asset Tracing Service: how we reconstruct payment and on-chain trails to support urgent legal applications.
• Case Study – Tracing Fraud Proceeds through the British Virgin Islands: a worked example of cross-border on-chain tracing under time pressure.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. We have traced on-chain proceeds through decentralised exchanges to actionable choke points, and we have supported without-notice applications for disclosure orders against VASPs in multiple jurisdictions. Our starting point is always the same: an honest assessment of what is recoverable and at what cost. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.