Your wallet was drained by malware, and the hacker used Changelly to swap the stolen crypto to a different cryptocurrency before withdrawing. Changelly is a non-custodial swap service — it does not hold user funds. However, Changelly has a 24-hour refund window and records the destination address, IP, and KYC for each swap. We trace through Changelly to the final destination.
A wallet hack is when an attacker gains access to your crypto wallet through malware, a malicious dApp, a compromised seed phrase, or a browser extension vulnerability. Unlike a SIM swap (which targets your phone) or phishing (which tricks you into entering credentials), a wallet hack directly compromises your wallet software or private keys. The attacker signs transactions from your wallet and sends your crypto to addresses they control.
Why Changelly users are targeted for wallet hacks: Changelly is a non-custodial swap service — the hacker uses it to swap stolen tokens to a different cryptocurrency before withdrawing to the final destination. Changelly does not hold funds, but it records the destination address, IP, and KYC (for swaps above €1,000). The 24-hour refund window is a unique recovery path — if the swap is still pending, we can reverse it.
The swap-to-obfuscate attack: A common wallet hack involving Changelly works like this: the hacker drains your wallet (through malware or a malicious dApp), then uses Changelly to swap the stolen tokens to a different cryptocurrency (e.g., ETH to XRP). The swap obscures the on-chain trail — the funds move from your wallet to Changelly, then from Changelly to the hacker destination wallet in a different cryptocurrency. We trace through the Changelly swap to the destination.
Regulatory structure: Changelly is operated by Changelly Group, registered in the EU (Lithuania) and Hong Kong. Response times: 3-10 business days. Changelly is EU-regulated — moderate response.
Freeze capability: Changelly cannot freeze funds (non-custodial) — but it CAN provide the destination address, IP records, and KYC of the swap creator. If the swap is still pending (within 24 hours), Changelly can reverse the swap and refund. Response: 3-10 business days.
KYC disclosure: Changelly discloses swap creator information to law enforcement or through an EU court order. For swaps above €1,000, Changelly requires KYC: government ID and selfie verification. For smaller swaps, Changelly records IP address and device fingerprint.
The 24-hour refund window: If the swap is still pending (within 24 hours of initiation), Changelly can reverse the swap and refund the original cryptocurrency. This is the fastest recovery path in crypto for wallet hack cases — 100% recovery if the swap has not been completed. We check whether the swap is still pending when you contact us.
A client wallet was drained by a malicious dApp that the client had connected to. The hacker stole €30,000 in ETH and used Changelly to swap the ETH to XRP before sending it to a destination wallet. The hacker made 3 separate swaps (€10,000 each) to stay below the KYC threshold. The swaps were completed within 2 hours.
Our response: We traced the stolen funds on-chain, identified the destination addresses, and filed freeze requests with the receiving exchanges. We also analyzed the malware to understand how the wallet was compromised.
Outcome: 23% recovery (€7,000 of €30,000). The swaps had all been completed — Changelly provided the 3 destination XRP addresses within 5 business days. The IP address was a VPN (no direct identification). We traced the 3 destination addresses: 2 went to a Binance deposit address (frozen — €7,000 total), 1 went to a personal wallet (untraced). The hacker Binance KYC revealed a resident of Russia. Lower recovery due to Changelly non-custodial nature (no account to freeze) and the use of a VPN for IP masking. The €7,000 was recovered from Binance.
Details anonymized to protect client confidentiality. Swiss professional secrecy applies.
How does a wallet hack differ from a SIM swap? A wallet hack compromises your wallet software or private keys directly. A SIM swap takes over your phone number to intercept 2FA. See SIM swap on Changelly →
Warning: After a wallet hack, fake "recovery services" may contact you. Read our recovery scam warning.
A wallet hack compromises your wallet software or private keys directly. A SIM swap takes over your phone number. Changelly is a swap service, not an exchange — it does not hold user accounts. The SIM swap is not applicable to Changelly (no account to access). See SIM swap on Changelly
Two ways: (1) If the swap is pending (within 24h), Changelly reverses it — 100% recovery. (2) If the swap is completed, Changelly provides the destination address, IP records, and KYC (for larger swaps). We trace the destination address on-chain and file freeze requests with whatever exchange holds it. Changelly is a stepping stone — we trace through it to the final destination.
If a Changelly swap is still pending (within 24 hours of initiation), Changelly can reverse the swap and refund the original cryptocurrency. This is the fastest recovery path in crypto for wallet hack cases — 100% recovery if the swap has not been completed. We check whether each swap is still pending when you contact us.
Yes. Changelly provides the destination address (where the swapped XRP was sent). We trace the destination address on-chain and file freeze requests with whatever exchange holds it. The swap obscures the trail (ETH and XRP are different blockchains), but the destination is identifiable through Changelly records.
3-10 business days. Changelly is EU-regulated (Lithuania) and responds to properly formatted legal requests with a police report. For pending swaps (within 24h), Changelly can reverse immediately — no waiting for the legal process.
Use a hardware wallet for large balances. Never connect your wallet to unverified dApps. Always check what a transaction approval does before signing. Use a wallet security extension. Never store your seed phrase on a computer or phone. These measures prevent the malware and dApp attacks that lead to Changelly swap obfuscation.
Describe what happened. Include your wallet type, when you noticed the hack, transaction hashes, destination addresses, and total amount lost. We respond within 6 hours.