How to trace stolen crypto

The blockchain is a public, permanent ledger

Unlike the banking system, the blockchain is an open ledger: anyone can see every transaction on Bitcoin, Ethereum and most networks. You don't need permission or a court order to read it, and nothing is erased — the record is permanent.

That's exactly what makes tracing possible. The scammer moved your money, but doing so left a trail written in stone. Tracing stolen crypto is, at its core, reading that trail with the right tools and judgment.

How the money is followed: hop by hop

Tracing starts at your transaction — the one that left your wallet or the exchange — and follows the funds forward. Each time the money moves to a new address is a “hop.” Scammers chain many hops to try to throw you off, but every one is recorded.

The work is to reconstruct that chain until you reach the destination: where the money stopped or which service it entered. Along the way you spot patterns — amounts that split, regroup or get swapped into another token — that help you keep the thread.

Wallet clustering and heuristics

An attacker rarely uses a single address. Wallet clustering uses heuristics — like several addresses co-signing the same transaction — to infer which wallets belong to the same owner. That way dozens of distinct addresses are revealed as a single operation.

Over those clusters you overlay known intelligence: addresses already labeled as belonging to an exchange, a service, or reported scam campaigns. That turns a list of anonymous hashes into a map with names and behaviors.

Spotting the destination: exchange, mixer, bridge or private wallet

The end of the trail is what defines your options. Not all destinations are equal:

• Exchange with KYC (Binance, OKX, Coinbase, etc.): the best case. The platform knows who controls that account, so there's a place to submit the evidence and ask for action.
• Mixer or tumbler: a service that blends funds from many users to break the trail. The deposit is documented, but the output usually can't be traced with certainty.
• Cross-chain bridge: the money jumps from one network to another (for example from Ethereum to another chain). It can be followed, but you have to pick up the trail on the other side.
• Private wallets: the money is sitting still in non-custodial addresses. It's documented and flagged, waiting for it to move toward a service.

What you need to get started

Less than you'd think. A single transaction hash or the destination address is enough to start tracing; the more you add (your wallet, screenshots, the scam URL), the more complete the analysis.

We never need your seed phrase or private keys: we work only with public blockchain data. You can paste a hash or an address into the free checker and we'll tell you in seconds whether the case is traceable.

What a professional adds over a block explorer

A block explorer (like Etherscan) shows you one transaction at a time. It's fine for looking at a single hop, but it becomes unmanageable when the money branches across dozens of addresses and hops.

Forensic analysis adds wallet clustering, databases of labeled addresses, tracking across bridges and token swaps, and — above all — a structured, readable report that documents the trail with judgment. That's what an exchange or an authority can read and act on.

The honest limits of tracing

Tracing is not recovering, and the limits have to be clear. Well-used mixers can cut the trail with certainty. Privacy coins (like Monero) are designed so transactions aren't public and generally can't be traced. Cross-chain hops complicate the follow-through, though they don't always stop it.

When the trail goes cold, we say so honestly and explain how far it got. Serious tracing is worth what it documents with certainty, not promises it can't keep.

From trace to action: the report

A trace matters when it becomes something you can use. Documented in a clear report, the money's path opens concrete options — and a legal complaint is only one of them:

• Submit it yourself to an exchange's fraud desk if the money reached their platform.
• Report and flag the receiving wallets so they get marked in the ecosystem's databases.
• Back a police report or a filing with a regulator, if you decide to make one.