How I trace DigiByte thefts
By Mark McNiel (JohnnyLaw), Around The Block LLC, Stillwater, Oklahoma. Last updated Oct 12, 2026.
When DigiByte (DGB) is stolen or sent to a fraudulent site, the blockchain keeps a permanent public record of where it went. I follow that record and write down only what it proves. This page explains how I do that, how I label what I find, what I will never claim, and what to do if you have lost funds.
I am not a law enforcement officer, a lawyer, or a licensed investigator, and nothing here is legal or financial advice.
Who I am
- Founder of Around The Block LLC, which publishes HoldFast Wallet (formerly DigiByte Mobile) and runs the DigiScope explorer.
- DigiByte Core contributor (JohnnyLawDGB on GitHub): 16 pull requests, 10 merged, including fixes for an oracle consensus deadlock and a Dandelion++ deadlock. My pull requests
- DigiDollar oracle operator: oracle 8 of 35 in the mainnet oracle roster hard-coded in DigiByte Core, from v9.26.2 on, live and signing. Source
- DNS seed operator: seed.aroundtheblock.app has been one of DigiByte Core's hard-coded mainnet DNS seeds since 8.22.0, added in pull request #131. Source
- Published a signed Guix build attestation for DigiByte Core 8.22.0-rc1. Attestation
The short version
- I trace funds one hop at a time and record the evidence for every hop.
- Every number I publish carries a label that says how solid it is.
- I say what moved. I never say why someone moved it.
- Nothing goes public until it has been checked against the chain and reviewed.
- I never publish anything that identifies a victim.
- Tracing is free for now, and I never promise recovery.
1. The hop-by-hop approach
A trace starts from something confirmed: a transaction the victim made or the transaction that took their funds. From there I follow the money forward.
- Start from an anchor. The first hop must be a transaction that is confirmed on-chain and that the victim or other evidence ties to the case.
- Follow every output. When funds split, I follow each branch. When they merge with other money, I keep following them instead of stopping.
- Share the taint fairly when funds mix. When stolen funds are combined with other funds in one transaction, I use proportional tracing by default. Each output is treated as carrying its proportional share of the stolen amount. I also check the result with a second, first-in-first-out convention. Any figure that depends on how mixed funds are divided names the convention it used.
- Record each hop. Every hop gets its block height and time, the amount, and a plain label for what happened there, such as a split, a consolidation, a holding wallet, or an exchange.
- Stop where the funds stop. A branch ends when it reaches an exchange, or when the funds are sitting unspent. Unspent funds are listed with their current balance so the total is accounted for, not just the part that reached an exchange.
- Check for mixing first. Before I treat two addresses as having the same owner, I check whether the transaction looks like a CoinJoin, a mixer, or an exchange batching deposits. Those patterns break the usual ownership signals.
- Keep exchanges out of suspect clusters. When I group addresses that appear to share an owner, I never merge through an exchange wallet. A cluster that would include an exchange is marked contaminated and set aside.
- Label exchanges carefully. An address is labeled as an exchange deposit address only after repeated, consistent forwarding into a wallet already verified as belonging to that exchange. Every exchange label carries its basis, because the exchange will ask how it was identified.
I test my own tracing against cases where the answer is already known from a careful manual ledger. When the automated trace and the manual ledger disagree, I fix the tracing before I rely on it.
2. How each figure is labeled
Every number in a report carries one of four labels:
| Label | What it means | How I use it |
|---|---|---|
| Certified | Itemized transaction by transaction and checked on-chain | Can be stated as a fact |
| Floor | Certified, but only part of the picture. The real figure is at least this much and may be more | Always written as "at least" |
| Sampled | Based on a sample of transactions, not every one | Never presented as a total |
| Contaminated | Mixed with funds that are not part of the case, such as an exchange's own liquidity | Never presented as a loss or a theft figure |
A sampled or contaminated number is never published as a theft total. If a large figure has not been itemized, it stays out of public copy, however tempting it is.
3. Confidence levels
Attributions and other claims also carry a confidence level:
| Level | What it takes |
|---|---|
| Confirmed | Publicly disclosed and independently verifiable, for example an exchange's own published wallet list |
| High | Several independent data points that agree |
| Medium | One strong indicator, or several weak ones |
| Low | A working hypothesis that needs more evidence |
Only confirmed and high-confidence findings go into a public write-up as findings. Medium and low items are written down as open questions or left out.
4. Facts and observations are kept apart
I keep two separate lists for every case.
- Facts are things anyone can check: on-chain transactions and balances, domain registration records, and whether a link loads or returns an error. Each fact carries its evidence.
- Observations are things that look meaningful but are not proven, such as a timing coincidence or a pattern that suggests a motive. Observations stay internal. They do not appear on a public page.
5. What I never claim
- Intent. The chain shows what moved, not what anyone meant. I do not say why anyone did anything.
- Identity without an anchored link. I do not say two sites or wallets have the same operator unless there is concrete shared evidence, such as the same key signing for both.
- Recovery. I never promise or imply that funds will come back. Most stolen crypto is not recovered. In one wallet theft I traced in 2025, the funds were not recovered. The value of that work was a clear, checkable trace and fixes that made my tracing more accurate.
- Exchange action. An exchange decides for itself what to do. A report from someone who is not the account holder usually is not enough for a lasting hold. That generally needs an official case.
- Anything I cannot show. A dead download link proves nothing about malware. An un-itemized figure is not a theft figure.
6. Verification before anything is published
Before a finding goes public, it has to pass these checks:
- Every claim is specific and could be proven wrong.
- Every claim is tied to evidence someone else can check.
- Other explanations have been considered and written down, including innocent ones.
- Every figure is labeled, and any figure that depends on mixed funds names its tracing convention.
- Links, domains, and claimed downloads have been checked live, not assumed.
- Limitations are stated: what the evidence does not show.
- A person reviews it. Automated tools, including AI assistants, can suggest evidence, but they cannot publish anything on their own.
In the dgbpool.com case study, these checks overturned three plausible first conclusions before anything went out.
7. Victim privacy
- I do not publish victims' names, transaction IDs, wallet addresses, amounts, or dates.
- A floor figure is left out if publishing it would reveal one person's loss.
- I do not share a victim's case material with any exchange, network, or organization without their written consent. Anything I share with networks is anonymized, and raw case files are never shared.
- I will never ask for your seed phrase, private keys, or remote access to your device.
8. Fees and recovery
Tracing is free for now. I am building a public record first, and I will never charge upfront fees or promise recovery. I cannot promise that your DGB will come back, and I will tell you plainly when recovery is unlikely.
9. Warning: recovery scams
People who lose crypto are often targeted a second time by "recovery" scammers.
- No legitimate service asks for an upfront fee to recover stolen funds.
- Treat anyone who contacts you first promising recovery, including people who claim to be a "blockchain recovery expert," a lawyer, an exchange employee, or a government agent, as a scammer until proven otherwise.
- Real law enforcement and real exchanges do not ask for payment to return stolen funds.
- Never pay a fee "to unlock" or "to release" funds. That is the scam continuing.
- Never share your seed phrase or give anyone remote access to your device.
10. If you lost funds: how to file
Do these yourself. A first-person report from the person who lost the funds carries weight that a report from anyone else cannot.
- Preserve your evidence now. Save your transaction IDs, dates, and amounts, and take screenshots of the site, your account page, any failed withdrawal messages, and all messages with the other party.
- Report to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov if you are in the United States. Outside the US, use your country's national fraud reporting service, for example Action Fraud in the UK.
- File a report with your local police and ask for a report or case number. Exchanges generally need an official case before they can hold funds for any length of time.
- Contact the exchange only through its official channels. Go to the exchange's own website by typing the address yourself, and use its official support or fraud reporting page. Never use a support contact that reaches out to you first by direct message, email, or phone. If you have a police or IC3 case number, include it.
- If a bank transfer or card payment was involved at any point, tell your bank right away.
- Report the site or addresses publicly on Chainabuse (chainabuse.com) so others are warned.
Questions about this method: mark@aroundtheblock.us.