Stolen-Funds Payment
Pronunciation: STOH-luhn fuhndz PAY-muhnt
Also known as: Payment Involving Stolen Crypto
Definition
A stolen-funds payment is a cryptocurrency payment that contains assets reasonably linked to theft, account compromise, fraud, ransomware, an exploit, or another unauthorized taking. The classification concerns the suspected origin or control history of the assets, not whether the blockchain transfer itself was technically valid. It differs from tainted funds, a broader and less precise label for assets associated with risky activity.
Overview
Meaning and scope
A stolen-funds payment is a cryptocurrency payment that contains assets reasonably linked to theft, account compromise, fraud, ransomware, an exploit, or another unauthorized taking. The classification concerns the suspected origin or control history of the assets, not whether the blockchain transfer itself was technically valid. It differs from tainted funds, a broader and less precise label for assets associated with risky activity.
Mechanism and operation
A merchant should document the data source, exposure path, timing, confidence, and applicable policy before deciding to hold, reject, report, or refund. A match is a reason for proportionate review, not automatic proof of criminal ownership, and decisions should follow applicable law and the merchant’s risk policy. Specific scope: a cryptocurrency payment that contains assets reasonably linked to theft, or another unauthorized taking. Governance should connect Stolen-Funds Payment to the original obligation, payment instructions, observed transaction, internal state, financial posting, and any fulfillment or refund. The decisive principle remains that a stolen-funds payment is a cryptocurrency payment that contains assets reasonably linked to theft, account compromise, fraud, ransomware, an exploit, or another unauthorized taking.
Practical payment example
A high-value payment is flagged by a risk-screening process as potentially linked to theft. The operator preserves evidence and follows the approved escalation policy instead of asserting guilt from one heuristic signal.
Operational checks
Preserve the originating transaction, network, screening explanation and relevant dates, including uncertainty. Only authorized reviewers should determine whether to freeze, return or escalate the transfer under applicable rules. Do not send a suspicious refund to an unverified new address suggested by an unknown claimant.
Distinctions and limits
It also differs from a fraudulent payment, where the payer may be deceiving the merchant even if the funds are not known to be stolen.
Related reading
Related definitions: Tainted-Funds Payment, Suspicious Crypto Payment.
Example
A high-value payment is flagged by a risk-screening process as potentially linked to theft. The operator preserves evidence and follows the approved escalation policy instead of asserting guilt from one heuristic signal.
Comparison
The classification concerns the suspected origin or control history of the assets, not whether the blockchain transfer itself was technically valid. It differs from tainted funds, a broader and less precise label for assets associated with risky activity.
Key Takeaway
A stolen-funds payment is a cryptocurrency payment that contains assets reasonably linked to theft, account compromise, fraud, ransomware, an exploit, or another unauthorized taking.
Sources
- Virtual Assets Red Flag Indicators of Money Laundering and Terrorist Financing — Financial Action Task Force (2026-08-02)
- Sanctions Compliance Guidance for the Virtual Currency Industry — U.S. Department of the Treasury, OFAC (2026-08-02)
- Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs — Financial Action Task Force (2026-08-02)