Police Get Help Turning Crypto Traces Into Freeze Requests

Key Takeaways

• Verified law enforcement agencies can request support without an existing TRM license.
• TRM reports more than $35 million frozen across 15 cases involving 14 agencies in 10 countries.
• The available intervention depends on who controls the token or holds the funds.

The November 12 announcement targets a gap between locating stolen funds and securing them: investigators need to package their evidence and reach an institution able to act before the money moves again.

From a transaction trail to an institutional decision

After verification, an agency makes one submission covering participating issuers and supported chains. TRM investigators trace funds, assemble evidence, flag addresses in the existing Beacon Network and route the request to the issuer. TRM supports the case through the issuer’s decision.

The announcement also includes exchanges in the service’s scope, although its submission workflow describes issuer routing. It does not name all participating institutions or specify service pricing; access without a software license does not establish that assistance is free.

For investigators, preparing the request means connecting particular transactions to the alleged theft and identifying the action sought. The recipient must then assess whether its controls and the legal basis for the request allow it to intervene.

Who can restrict the funds?

A blockchain address can hold several assets subject to different controls. Finding the address therefore does not identify a single institution capable of stopping everything in it.

Issuer-controlled stablecoins
The issuer may restrict its token at an address. Other assets held there remain outside that restriction.

Funds at a cooperating exchange
The exchange may restrict funds in its custody. Its account controls do not extend to external self-hosted wallets.

Self-hosted assets without issuer freeze controls
Investigators need another route to obtain control. Flagging an address alone does not prevent spending.

Circle’s blocklisting policy illustrates the issuer route. It reviews requests under its policy and applicable law, including valid legal orders and certain urgent government requests. A restriction can prevent an address from sending or receiving USDC or EURC, but cannot reverse a completed transfer.

On the custody side, Coinbase’s guidance identifies court or other competent-authority orders and sanctions obligations as grounds for freezing customer funds. These examples explain the mechanisms; they do not establish either company’s participation in Concierge.

The $35 million figure leaves recovery outcomes open

TRM’s total measures frozen assets. The release does not give the cases’ reporting period, the number of unsuccessful requests or amounts returned to victims. Without those figures, readers cannot calculate a request success rate or a repayment rate.

Its speed claim is narrower: average action takes minutes once flagged funds reach a Beacon member. That clock does not measure the interval from a victim’s report to a freeze.

XRP Ledger Turns Over RLUSD 19×: Ethereum Manages 11×

What can happen after a freeze

A separate U.S. case, cited here as a procedural example rather than a Concierge result, shows the steps that can follow. The U.S. Attorney’s Office for the Northern District of Ohio documented this sequence:

• December 31, 2024: Tether froze 325,060 USDT held at a blockchain address.
• March 20, 2025: A federal seizure warrant was issued. Tether subsequently transferred the tokens to a law enforcement-controlled wallet.
• August 27, 2025: Prosecutors filed a civil forfeiture complaint, asking the court to forfeit the assets to the government.

At that announcement, returning stolen funds to victims remained conditional on a successful forfeiture action. The release neither established completed repayment nor explained the intervals between steps. It documents a sequence, not a typical recovery timetable.

The gap between frozen crypto and repayment can also involve disputes over who is entitled to receive the assets. A movement restriction preserves the balance while those questions are resolved.

Reporting a crypto theft

Victims should contact law enforcement promptly and preserve the blockchain and asset name, sending and receiving addresses, transaction hashes, amounts, dates and times, plus correspondence related to the theft.

The FBI warns that private recovery companies cannot issue seizure orders. Do not send money or financial or identifying information to an unknown person who contacts you promising recovery.

The next useful disclosure from TRM would connect its frozen-assets total to subsequent outcomes: how much remained secured, how much entered seizure proceedings and how much reached victims.