Tracing

Can stolen crypto be traced? How to follow the trail yourself

Yes, in most cases the movement of stolen crypto can be followed: public blockchains record every transfer, and anyone can read them for free. What the blockchain does not show is who controls an address. Here is how to walk the chain in a block explorer, what an exchange deposit address means, where tracing gets hard, and how to write it up for the police and an exchange.

Updated 17 October 2026 · about 9 minutes to read

What the blockchain shows and what it does not

Bitcoin, Ethereum, TRON, BNB Chain and most other networks are public ledgers. For every transaction you can see the sending address, the receiving address, the amount, the token and the time.

What you do not see is a name. An address is a string of characters, not a person. The link between an address and a real identity usually exists only in the records of a service that checked its customers — most often a centralised exchange. That is why tracing is not about “finding the thief” on the blockchain; it is about finding the point where the funds touched a company that knows who its customer is.

• Visible: every hop, amounts, timing, token swaps on public protocols, deposits into known service addresses.
• Not visible: the owner’s identity, what happened inside an exchange after a deposit, private off-chain deals.

Before you start: what you need

• The transaction hash (TXID) of each transfer out of your wallet. You will find it in your wallet’s history or the exchange’s withdrawal record.
• The network. USDT exists on several networks; a TRON address starts with “T”, Ethereum and BNB Chain addresses start with “0x”, Bitcoin addresses usually start with “1”, “3” or “bc1”.
• Your own address and the first receiving address.
• A simple spreadsheet: hop number, from, to, amount, token, date and time (with time zone), TXID, notes.

Following the chain in a block explorer

A block explorer is a free website that shows the blockchain in readable form. Use the one that matches the network:

• Ethereum: Etherscan. BNB Chain: BscScan. TRON: Tronscan.
• Bitcoin: mempool.space or Blockchair (Blockchair also covers several other networks).

Step by step

1. Paste your TXID into the search box. Confirm the amount, the token and the receiving address match what you lost.
2. Open the receiving address. On Ethereum-style networks look at the “Token transfers” tab (for USDT, USDC and other tokens), not only the main transactions list. On Tronscan check the TRC-20 transfers.
3. Find the outgoing transfer of your funds. Look for transfers out shortly after yours arrived, with a similar amount.
4. Record the hop in your spreadsheet and repeat from the next address.
5. Watch for splits. If the amount is divided, follow the largest parts first and note the others.
6. Stop when you hit a labelled service — an exchange, a bridge, a swap protocol — or when the trail becomes unclear.

Bitcoin is different

Bitcoin transactions combine several inputs and produce several outputs, one of which is usually “change” returned to the sender. You cannot always tell which output is the payment and which is the change. Note every output and its amount.

Free tools that label addresses

Explorers attach public labels to some addresses — “Binance: Hot Wallet”, a known bridge, a reported scam. Several publicly available tools go further and show the flow visually. Two that many people use for free:

• Arkham — an intelligence platform with entity labels and a visual graph of transfers, with a free tier.
• MetaSleuth — a fund-flow visualisation tool with a free version, where you enter an address or a transaction and expand the graph hop by hop.

We mention them as publicly available tools only; they are not our partners. Treat any label as a lead, not proof: labels can be wrong or outdated, and a scam label added by another user is not a finding of fact. Confirm important points in the explorer itself.

“It reached an exchange deposit address”

This is the most important moment in a trace. Centralised exchanges give each customer their own deposit addresses. Funds that land there are typically swept into the exchange’s larger hot wallets soon afterwards — which is why the trail seems to “disappear” at that point.

What it means in practice:

• The exchange can usually see which account the deposit address belongs to, and that account normally passed identity checks.
• The exchange may be able to freeze the balance if it is still there — but it will normally do so on a request from law enforcement or a court, not on a private email.
• You still should alert the exchange’s compliance or security team quickly with the TXID, the deposit address and the amount. An early report can lead to the account being reviewed, and the file is ready when the police request arrives. See the first 48 hours.

How to recognise a deposit address: a label in the explorer or a labelling tool, or a pattern where many small, unrelated deposits arrive and are regularly forwarded in one transfer to a known exchange wallet. Without a label, describe it as “likely”, not certain.

Mixers, bridges and swaps

• Swaps. Exchanging one token for another on a decentralised exchange is visible on-chain; the explorer shows the token in and the token out. The trail continues.
• Bridges. Moving funds from one network to another (for example Ethereum to TRON) means the trail continues on a different explorer. Note the bridge transaction and look for the matching transfer on the other network by time and amount. This is often where self-tracing stalls.
• Mixers and privacy tools. These are designed to break the link between deposits and withdrawals. Following funds through them is sometimes possible with specialist analysis and sometimes not. If funds went into a mixer, a home trace usually ends there.
• Instant swap services and OTC desks. Some know their customers, some do not. They are still worth noting in your report.

What you cannot do yourself

You can find where the money went. You cannot make anyone reveal who owns the account. Exchanges and other services protect customer data, and they disclose it to law enforcement or under a court order, not to a victim who asks. The same applies to freezing: a private request is useful as an alert, but the binding request normally comes from the police, a prosecutor or a court.

That is why your trace is a tool for others to act on. To check quickly whether your situation has a realistic route, try the short test Can the funds be traced and frozen?, and file a report with the police — see how to report crypto theft.

Turning findings into a report

One clear page works better than fifty screenshots.

• Summary: what happened, the date, the total lost, the network and token.
• Table of hops: hop number, from address, to address, amount, token, UTC time, TXID, explorer link.
• End point: the address where the trail reaches a service, the service name if labelled, and how sure you are.
• Request: what you are asking for — a freeze request to the named exchange, a data request about the account holder.
• Attachments: wallet history, chats with the scammer, website addresses, payment records.

Label assumptions as assumptions; a report that says “likely an exchange deposit address, per a public label” is more credible than one that claims a name it cannot prove. For larger amounts or complex trails, a professional tracing report prepared for court can carry more weight — and that is a decision worth discussing with a lawyer.

The “crypto tracer” trap

Soon after a theft, victims are often contacted by “blockchain investigators”, “ethical hackers” or “recovery agents” who say they have already traced the funds and can return them for a fee. Some pose as lawyers or police. Typical signs: an upfront payment in crypto, a promise of guaranteed recovery, pressure to act now, a request for the seed phrase or remote access, “hacking the scammer’s wallet”.

No one can hack a blockchain to send funds back. This is very often the second scam aimed at the same victim — compare with the warning signs or run the recovery scam check.

If you have traced the funds to an exchange, or got stuck at a bridge or a split, describe your case. We will tell you plainly whether there is a realistic route — a freeze request, police involvement, a claim — and when there is not.