A cryptocurrency exchange returned 772.440 USDT and 182 SOL—about $791.252—to a Venezuelan victim after the Scientific, Criminal and Criminalistics Investigation Corps (CICPC) formally requested the seizure of those funds. The operation was described on September 23 by the ChangeNOW platform in its blog, and it also involved the Venezuelan exchange house CRIXTO and the forensic analysis firm AQ Forensics.
The case began with a robbery of an individual in Venezuela. The funds were then moved through several networks and services, the usual path when someone tries to erase the trail of money that, on the blockchain, is recorded forever.
ChangeNOW says that, after a warning from a trusted source, it included the compromised wallets in its blocklist. Its monitoring system later detected five exchange attempts initiated from those addresses and stopped them before the money could leave. That’s how 772,440.7575 USDT on the TRON network and 182,3057699 SOL were frozen.
How the stolen cryptocurrencies were traced in Venezuela
None of the companies involved solved the case on its own. CRIXTO, an exchange authorized to operate in Venezuela, provided information that helped trace the path of the stolen assets and connect transactions, wallets, and movements that, separately, wouldn’t have meant much.
AQ Forensics performed the external on-chain analysis and reconstructed the path of the money through several services. In that work, a wallet appeared that, until then, no one had attributed to anyone and that seemed to be connected to ChangeNOW. At first glance it led nowhere: it was inactive.
The team kept pulling on the thread anyway. “When the obvious path runs out, we don’t assume the lead ended,” the firm explained. “Sometimes the decisive clue comes from activity around the wallet, not from the wallet itself.” A quiet address can mean many things: that whoever controls it lost access, that the funds were already intercepted, or simply that it’s waiting.
With that information, ChangeNOW blocked the addresses as a precaution. The rest was done by automatic monitoring.
KYC, Interpol and the leads that truly matter
The CICPC joined the case and contacted the exchange about the stopped transactions. It requested information about the five exchanges and, after reviewing the evidence, formally requested the seizure. ChangeNOW says it applied its usual checks to the request and to the destination wallets before sending the money to the addresses the investigators identified as belonging to the victim.
The part that weighs the most for the case’s future isn’t the money that was returned, but the names. According to the lead investigator, the identity verification (KYC) data of those who claimed the stolen funds made it possible to coordinate additional actions through Interpol.
“A criminal investigation is like a puzzle, and every piece of information you provide helps complete it,” he said: emails, IP addresses, connection logs, browser session data, associated devices. Any detail that helps identify a person.
Not everything went smoothly at first. The investigators ran into fake domains, disposable emails, and fraudulent subscriber data tied to IP addresses—obstacles that forced them to look elsewhere.
Report quickly: the lesson for Venezuelan users
Of everything in the case, the most practical conclusion is also the simplest. “The biggest mistake is to let too much time pass after the incident,” the investigator said. “The faster the wallets are reported, the higher the chances of recovering the funds and returning them to the victim.”
This matters especially in Venezuela, where USDT stopped being, long ago, a speculative asset and instead became money used every day: it’s charged, saved, and paid with. Anyone who buys or sells USDT in the country manages—without thinking too much—amounts that, in another context, would be considered a fortune.
A blockchain transaction can’t be reversed. The only thing that can stop a theft is for someone to block the addresses before the money goes through another service, and that depends on how fast the report reaches the people who can act. Saving the transaction hashes, destination addresses, emails, and screenshots from the first minute isn’t bureaucratic red tape: it’s the raw material of the investigation.
A case that remains open
The investigation continues and there is still pending work, according to ChangeNOW itself. The victim’s identity, the date of the theft, and how it happened have not been made public.
It’s worth pointing out where this information comes from: the account comes from ChangeNOW’s corporate blog, one of the parties involved. At the time this note was published, CriptoTendencias hadn’t found an official statement from the CICPC or from the Ministry of Popular Power for Interior, Justice, and Peace regarding this specific case.
With that caveat, the episode leaves something unusual: a documented Venezuelan cryptocurrency theft case with numbers, actors, and method. Usually it’s the opposite—reports get lost without anyone ever explaining what happened to the money.