Stolen crypto sent to an exchange: deposits, freezes and how to ask

· 4 min read · KadenaTrace

An exchange is the one place on the path of stolen funds where someone can press pause. On chain, nobody can stop a transfer; inside an exchange, the operator controls the account. This guide explains what a deposit address is, what you can and cannot read from a deposit, and what to send the exchange. The example is case KT-7, the WAX Multi-Chain Bridge exploit of October 22, 2026, where the trace shows $38,116 deposited to HitBTC.

What an exchange deposit address is

When you deposit at an exchange, it gives you an address that belongs to the exchange, assigned to your account. Funds sent there are swept into the exchange's main wallets, and the exchange credits your account balance. From that moment the money is a number in the exchange's database, not a coin you can follow on chain.

For a thief this is the way out: deposit, sell for a stablecoin or withdraw to a new address, and the on-chain trail ends at the exchange's wall. For a victim it is the way in: the exchange knows which account owns that deposit address.

KadenaTrace labels deposit addresses it recognizes. In KT-7, four wallets received the loot; one of them sent $38,116 to an address labeled as a HitBTC deposit, and the case timeline recorded it with the transaction hash.

A deposit is not a freeze

This is the sentence to remember. Seeing "deposited to HitBTC" on a trace means the funds arrived at an address HitBTC controls. It does not mean:

  • that HitBTC noticed;
  • that the account was held;
  • that the funds are still there (the thief may have withdrawn within minutes);
  • that any of it will come back.

Nothing on an explorer can tell you whether an exchange froze an account. Only the exchange can. KadenaTrace shows a freeze only when it is read from an issuer's contract on chain (Tether and Circle can freeze USDT and USDC at the token level); an exchange account hold is never visible on chain, so the site never claims one.

What to send the exchange

Exchanges act on reports that let them verify the claim in minutes. Send:

  1. The deposit transaction hash and the deposit address, copied from the explorer. In KT-7 that is the HitBTC deposit on the case timeline.
  2. The theft transaction hashes, from the victim's address to the first attacker address.
  3. The path between them, hop by hop: the trace page link does this.
  4. The amount and token at each step.
  5. Who you are and your relationship to the funds (the victim, the project, counsel).
  6. A police or cybercrime report number if you have one, or a statement that one is being filed.

Ask for one thing: that the receiving account be placed on hold pending the report. Do not ask them to send you the funds; they will not, and the request looks like a scam.

Where to send it: the exchange's law-enforcement or compliance contact, usually listed on a "Law enforcement requests" page, and its support desk at the same time. Keep the ticket number.

How fast it needs to be

Thieves know the window. In many cases the withdrawal follows the deposit within an hour. A report sent the same day has a chance; one sent next week is for the record. This is why a case watch matters: KadenaTrace's alerts tell you the moment the funds reach an exchange, by email, Telegram or webhook, so the report can go out while the money is still there. Register the theft to turn that on.

What the exchange will and will not tell you

  • They will usually confirm they received the report and that it is "under review".
  • They will not confirm whether the account was frozen, who owns it, or the balance. That information goes to law enforcement, not to the victim.
  • A freeze, if it happens, is not a recovery. Returning the funds takes a legal process in the exchange's jurisdiction.

Mistakes to avoid

  • Assuming "deposited" means "safe". It means "in a place that can act", nothing more.
  • Sending a vague report. "My funds were stolen and I think they went to your exchange" is not actionable. Hashes are.
  • Contacting only support. Support desks route slowly; the compliance address exists for this.
  • Paying someone to "liaise" with the exchange. The exchange's process is free.

The case this guide follows

KT-7, WAX Multi-Chain Bridge: about $90,500 reported by DeFiLlama on October 22, 2026. The trace from the named exploiter address shows $75,837 moved out across four wallets; $38,116 was deposited to HitBTC and the rest swapped on KyberSwap, ParaSwap and a settlement contract. As of October 31, 2026, no freeze or return is reported; the case page has the current state.

More guides