English (US)
$210,000 in Stolen Crypto Seized with Romanian Law Enforcement and ChangeNOW
After malware stole a victim’s seed phrases and drained their wallets, ChangeNOW froze part of the stolen funds and cooperated with Romanian law enforcement to return assets worth $210,000. Here’s how the recovery unfolded.
Crypto theft rarely gives second chances. Once seed phrases are compromised, funds can disappear within minutes. In this case, however, rapid response and cooperation with law enforcement made recovery possible.
Incident Overview
A victim’s crypto wallets were compromised after malicious software gained access to a storage location containing their seed phrases. The attacker transferred approximately 190 ETH to various addresses, attempting to disguise the source of the funds.
Early Detection and Internal Action
We received intelligence about the theft from a trusted source shortly after the incident occurred. Based on the blockchain data provided, as well as the risk factors identified, we were able to:
- Identify the associated malicious addresses
- Add them to our internal blocklist
- Begin monitoring for incoming transactions
As a result of these measures, we intercepted and held more than 50% of the stolen funds in various assets while they were attempting to pass through our systems.
Cooperation with Romanian Police
After securing part of the funds, we informed the reporting source that assets had been frozen pending further action.
Shortly afterward, Romanian authorities contacted us and provided official documentation for the seizure of the assets. Their quick and professional handling of the case made the process fast and efficient.
After receiving the documentation, we:
- Immediately complied with the seizure order
- Cooperated fully with the authorities
- Facilitated the return of the held funds to the victim
The entire process was handled in accordance with applicable AML procedures and legal requirements.
How to Prevent the Loss of Funds
Several key lessons can be drawn from this case:
- The security of the seed phrase is vital, and once it is compromised, the control of the wallet is gone.
- Rapid intelligence sharing significantly increases the chances of freezing stolen assets.
- Collaboration between crypto service providers and law enforcement can lead to tangible recovery results.
Crypto transactions are irreversible by design. But coordinated AML response, timely reporting, and lawful cooperation can still change the outcome.
For more insights on crypto security, explore our related articles:
