I was a federal prosecutor for a decade, and I focused on complex cyber and crypto cases. I will be the first to tell you that no matter how sophisticated investigators are, sometimes they get it wrong. Here is what to do if you are falsely accused of participating in a crypto scam.
Linked Is Not the Same as Guilty
You open your exchange app and your account is frozen. Or a letter arrives from a federal agency asking about a wallet you control. Or a civil complaint names you as a recipient of stolen funds. In each case, the message is the same: someone looked at the blockchain and drew a line from a crypto scam to you.
That line may be wrong. Blockchain records are permanent and public, but the conclusions people draw from them are not. Investigators, exchanges, and private analytics firms rely on software that groups wallets into clusters and assigns risk scores. That software makes assumptions. When those assumptions fail, innocent people end up flagged alongside the actual wrongdoers.
If you have been accused of involvement in a crypto scam you had nothing to do with, what you do in the first days matters. This article explains how innocent wallets get linked to fraud and the steps you should take to protect yourself.
How Innocent Wallets Get Linked to Crypto Fraud
Most crypto investigations start with blockchain analytics software. These tools trace funds from a known scam address forward, hop by hop, and group addresses into "clusters" that are presumed to belong to the same person or entity. Exchanges use the same kind of analytics to screen deposits and place holds on accounts.
The problem is that clustering is built on heuristics, not proof. Two of the most common:
Common-input ownership. On Bitcoin and similar blockchains, if several addresses are spent together in one transaction, the software infers that one person controls all of them. The researchers who popularized this heuristic acknowledged that wallet services control addresses holding funds "owned by a wide variety of distinct users."
Change-address detection. The software tries to identify which output of a transaction is "change" returning to the sender. In a foundational 2013 study, researchers using an early version of this heuristic identified 555,348 apparent false positives, many tied to gambling-site transaction patterns. They refined the method and reduced the estimated false-positive rate to 0.17%. The study shows both the risk of clustering on untested assumptions and why those assumptions must be tested before anyone relies on them.
Additional hops can add uncertainty, though the strength of any particular link depends on the transactions, the available attribution data, and the analyst's method. Exchanges and analytics vendors still flag funds that passed through one or more intermediary addresses before arriving. Once funds pass through several wallets, a service, or a mixer, the link to any particular person is an inference, not a fact.
Below are two of the most common ways innocent people end up on the wrong side of that estimate.
Scammers Send Crypto to Random Wallets to Throw Investigators Off
Sophisticated bad actors know their transactions are being watched. One way they muddy the trail is by sending small amounts of crypto to wallets they do not control. You never asked for it. You may never have noticed it. But your address now appears in the transaction history of a scam.
This happens in a few ways:
Layering. Launderers move funds through numerous intermediate addresses to make the trail harder to follow. An address that appears in that trail is not necessarily controlled by anyone involved in the scam.
Dusting. Attackers send small amounts of crypto to many wallet addresses, sometimes to study how recipients transact or to try to connect otherwise separate addresses. On Bitcoin, spending outputs together can create an apparent link under the common-input clustering heuristic. What that link means depends on the transaction structure and the analyst's assumptions. Receiving dust, by itself, does not establish common ownership or criminal involvement.
Address poisoning. Scammers send small transactions from addresses that look nearly identical to ones you have used before. The goal is to trick you into copying the lookalike from your transaction history and sending your funds to the attacker. Researchers measured about 270 million of these attacks against roughly 17 million victims on Ethereum and BNB Smart Chain over two years. A poisoning transaction in your history does not connect you to the scammer's funds in any meaningful sense, but it can show up in a trace.
You do not control who sends funds to your public address. An unsolicited deposit, standing alone, does not establish that you committed money laundering. The government must prove the elements of the particular offense charged. Under 18 U.S.C. § 1956(a)(1), for example, that means proof that you conducted a financial transaction knowing the property represented criminal proceeds, and that you either intended to promote the crime or knew the transaction was designed to conceal it. Knowledge can be established through willful blindness. To prove willful blindness, the government must demonstrate that you took deliberate steps to avoid confirming a high probability of wrongdoing. Negligence, or the fact that you should have known, is not enough.
How Casinos, Mining Pools, and Other Services Tie Innocent Wallets to Scams
To understand this risk, you need to understand UTXOs. On Bitcoin and similar blockchains, your balance is not one number. It is the sum of your "unspent transaction outputs," or UTXOs, each one a discrete chunk of crypto created by a prior transaction. Every transaction spends existing UTXOs as inputs and creates new ones as outputs. When a casino, exchange, or mining pool pays many customers in one batched transaction, the inputs fund all of the outputs collectively. The transaction itself does not show which input "paid" which customer.
That is where innocent users get caught. Wallet services control addresses holding funds "owned by a wide variety of distinct users." Mining pools combine payments into single transactions with many outputs to cut fees. If a scammer deposited stolen funds into the same service, an analytics tool may trace your payout back to the scammer's deposit. That trace does not, by itself, establish that you controlled the upstream addresses or knew anything about where the service's funds came from.
A typical path looks like this:
A scammer deposits stolen crypto into an online casino.
The casino combines that deposit with funds from many other players in its hot wallet.
You cash out legitimate winnings. The casino pays you in a batched transaction funded by pooled UTXOs.
Analytics software may flag your wallet as having "exposure" to the scam, because the scammer's funds are one or two hops upstream.
Mining pools create a similar problem. One study found pool payout transactions "often characterized by a large number of output addresses," with some pools paying a few hundred recipients in a single transaction. If a pool or a participant is later linked to illicit activity, every other recipient of that batch can show up in the same trace.
Casinos deserve special mention. Online casinos are a recognized channel for laundering crypto, and blockchain intelligence firm TRM Labs has reported that organized crime networks move funds through online gambling accounts, betting balances, and crypto transfers. Ordinary players who withdraw from those platforms can inherit a risk score they did nothing to earn.
The bottom line: "exposure" in a blockchain report describes how funds moved. It says nothing about who knew what. Even compliance vendors acknowledge that a high risk score "does not automatically mean the funds are illegal."
What to Do If You Are Falsely Accused of Involvement in a Crypto Scam
Stop and call a lawyer before you respond to anyone. That includes federal agents, state investigators, exchange compliance teams, and lawyers for alleged victims. What you say early is hard to take back.
Preserve everything. Do not delete wallets, apps, emails, chats, or browser history. Export your transaction history from every exchange and wallet you use. Destroying or altering records with the intent to impede or influence a federal investigation, including one that is only contemplated, is a separate felony carrying up to 20 years. Even innocent deletions can be hard to explain later.
Gather proof of where your funds came from. Pull bank statements showing fiat purchases, exchange account records, casino or pool payout records, mining logs, and tax filings. Exchanges reviewing a flagged deposit routinely request source-of-funds information, and investigators will want the same.
Identify the specific transactions at issue. Ask, through counsel, which addresses and transaction hashes the accusation rests on. Vague claims of "exposure" are hard to rebut. Specific transactions can be tested.
Document unsolicited deposits. If you received dust, poisoning transactions, or transfers you never asked for, note when you first noticed them and whether you spent or moved them. On Bitcoin, spending dust together with your own funds can create an apparent link between addresses, so leave it alone until you have spoken with counsel.
Let counsel handle exchange freezes. An exchange may restrict trading or withdrawals while a compliance review is pending. Policies and timelines vary. A well-documented submission from counsel moves that process forward.
Get an independent blockchain analysis. Your lawyer can retain a forensic expert to review the trace and identify where the government's or the exchange's analysis made assumptions.
What Not to Do
Do not move or spend flagged funds without advice. Moving funds is not automatically a crime, and the right course depends on the restriction and your circumstances. But federal law separately punishes transactions designed to "conceal or disguise" the source or ownership of criminal proceeds, and a transfer made after you learn of an accusation can invite that characterization. Talk to counsel first.
Do not send the funds back to the sender on your own. It feels like the honest thing to do. It can create new problems, especially if the sender is the scammer. In some cases, returning funds through the exchange or another documented process is appropriate. Let your lawyer make that call.
Do not talk to investigators "just to clear things up." Innocent people get into trouble by guessing, misremembering, or overexplaining. A materially false statement to a federal agent is a separate crime punishable by up to five years, even if you did nothing else wrong.
Do not post about it. Social media posts, Discord messages, and Telegram chats can be collected and used as evidence.
Do not assume it will go away. Exchange freezes, subpoenas, and civil claims tend to escalate when ignored.
How a Crypto Defense Attorney Challenges a Bad Trace
Blockchain evidence looks scientific. It is not beyond challenge. An experienced crypto defense lawyer will press on the weak points:
The heuristics. Which clustering rules did the analyst apply? Do those rules hold for batched casino payouts, pool distributions, or shared custody wallets? The academic work behind these rules shows they produced significant false positives until researchers tested and refined them.
The hop count. How many transactions separate you from the scam, and what attribution data supports each step? Additional hops can add uncertainty.
The service in the middle. If funds passed through a casino, exchange, pool, or mixer, the trace likely assumes something about how that service commingled funds. That assumption can be tested.
The software. Commercial analytics tools use proprietary methods, and the reliability of a given analysis depends on its assumptions, inputs, and application. In United States v. Sterlingov, the D.C. Circuit held in September 2026 that the trial court did not abuse its discretion by admitting expert testimony about Chainalysis Reactor, even though the tool was not peer-reviewed and the experts did not know its error rate. That is an appellate ruling on admissibility, not a finding that every analytics conclusion is correct. Defense counsel can still examine the methodology, the assumptions, any error-rate evidence, and whether the expert's conclusions are supported by the underlying transactions.
Knowledge and intent. Even a perfect trace shows only that funds moved. It does not show what you knew or intended. Your source-of-funds records, communications, and conduct often tell a very different story.
The goal is to stop a false accusation early: before charges, before a forfeiture action, or before a frozen account becomes a closed one.
Frequently Asked Questions
Can I be charged just because scam funds ended up in my wallet?
People are charged in cases that begin with funds arriving in their accounts, which is why you should take any inquiry seriously. In a single 2019 sweep, the Justice Department took action against more than 600 "money mules" and criminally charged more than 30 for receiving fraud victims' money and passing it along. The Attorney General described those mules as acting "wittingly and unwittingly." In July 2026, a former Defense Department employee pleaded guilty to concealment money laundering after converting fraud proceeds into cryptocurrency. He had first been a romance-scam victim himself.
That case involved far more than passive receipt of an unexpected transfer. According to the Justice Department, he moved money for the same fraud group for more than two years, lied to banks and law enforcement, sent fraudulent invoices, and kept going after FBI agents told him the money was stolen. Those facts distinguish his conduct from simply receiving a payment you did not ask for.
For money laundering and many fraud charges, knowledge is what separates a defendant from an innocent recipient. Under § 1956(a)(1), the government must prove you knew the funds were criminal proceeds, or were willfully blind to that fact, along with the other elements of the offense. Other crimes have different elements. If you received funds you did not ask for and did nothing to further a scheme, that is a defense worth building early, with counsel.
Why did my exchange freeze my account?
Exchanges screen deposits with blockchain analytics. If a deposit traces back to an address flagged for fraud, even through intermediary addresses, the exchange may hold the funds and ask for source-of-funds documentation.
What is a crypto dusting attack?
Dusting is when someone sends small amounts of crypto to many wallet addresses, sometimes to study how recipients transact or to try to connect separate addresses. Receiving dust does not, by itself, establish common ownership or wrongdoing. It is different from address poisoning, where lookalike addresses are used to trick you into sending funds to an attacker.
What is a UTXO and why does it matter?
A UTXO, or unspent transaction output, is a discrete unit of crypto on Bitcoin and similar blockchains. When a casino, pool, or exchange pays you in a batched transaction, the transaction's inputs fund all of its outputs collectively. Analytics may trace your payout back to upstream addresses, including ones linked to a scam. That trace does not show that you controlled those addresses or knew where the service's funds came from.
I won money at a crypto casino and now my wallet is flagged. What should I do?
Preserve your casino account history, deposit records, and withdrawal records. Then speak with a lawyer before responding to the exchange or any investigator. Records showing legitimate play and payouts are often the key to clearing the flag.
Should I talk to the FBI or another agency if they contact me?
Not without a lawyer. The Fifth Amendment protects you from being "compelled in any criminal case to be a witness against himself," and a false statement to a federal agent is its own crime. A lawyer can often learn what the government is looking for and respond in a way that protects you.
Brooke Watson is a partner in the Miami office of Dynamis LLP. She spent a decade as a federal prosecutor in the U.S. Attorney's Office for the Southern District of Florida, most recently as the district's Deputy Criminal Chief. She served as the office's Digital Asset Coordinator and its Computer Hacking and Intellectual Property (CHIP) Coordinator, and she prosecuted cyber cases in its National Security Section
Today Brooke represents individuals and companies in cryptocurrency investigations and litigation, white-collar and cyber criminal matters, and sanctions enforcement. She knows how the government builds these cases because she built them.
If your wallet has been linked to a crypto scam you had nothing to do with, contact Brooke or any of our experienced attorneys for a confidential consultation. The sooner you get cousel involved, the more options you have.
This article is for general informational purposes only and is not legal advice. Reading it does not create an attorney-client relationship. Every situation is different; consult a lawyer about your specific facts.
Additional Reading:
18 U.S.C. § 1001 (false statements) (Cornell Legal Information Institute)
18 U.S.C. § 1519 (destruction or falsification of records in federal investigations) (Cornell Legal Information Institute)
18 U.S.C. § 1956 (laundering of monetary instruments; see subsections (a)(1) and (a)(1)(B)(i)) (Cornell Legal Information Institute)
U.S. Const. amend. V (Cornell Legal Information Institute)
Global-Tech Appliances, Inc. v. SEB S.A., 563 U.S. 754 (2011) (Justia)
United States v. Sterlingov, No. 24-3161 (D.C. Cir. Sept. 25, 2026) (Justia)
Justice Department Announces Landmark Money Mule Initiative (U.S. Department of Justice, Dec. 4, 2019)
Press release on guilty plea of former Defense Department employee Samuel D. Marcus (U.S. Attorney's Office, E.D. Pa., July 7, 2026)
Sarah Meiklejohn et al., A Fistful of Bitcoins: Characterizing Payments Among Men with No Names (Internet Measurement Conference, 2013)
Taro Tsuchiya et al., Blockchain Address Poisoning (34th USENIX Security Symposium, 2025)
A Deep Dive into Bitcoin Mining Pools: An Empirical Analysis of Mining Shares (arXiv)
What Is a Dusting Attack? (Binance Academy)
Outputs (Learn Me a Bitcoin)
Why Crypto Exchanges Freeze Deposits After AML Checks (AMLBot)
Layering (Hudson Intelligence)
Coverage of TRM Labs report on crypto casinos and money laundering (iGaming Business, Aug. 12, 2025)