How Blockchain Tracing Actually Works: Following Stolen Crypto On-Chain

The Blockchain Is Public. So Why Is Tracing Still Hard?

Open Etherscan, paste in the scammer's address, and you can watch the theft happen in real time: the incoming transfer, the timestamp, the next hop the funds took an hour later. Every step is right there. And yet the vast majority of theft victims who do exactly this end up no closer to their money. The gap between "I can see the transaction" and "I know who has my money and can do something about it" is where blockchain forensics actually lives, and it's a much wider gap than most people assume.

For what happens after tracing, including a section on Bitcoin, read how to recover stolen Bitcoin and crypto.

The core misunderstanding is about what a wallet address actually is. It is not anonymous. It is pseudonymous, which is a very different thing. The string 0xABC...123 tells you nothing about the person behind it on its own, but it is not disposable either: every transaction it has ever made, and will ever make, is permanently attached to it. The moment that address touches a service that performs identity verification, an exchange, an on-ramp, an OTC desk, a bridge with KYC, the pseudonym gets a name attached to it somewhere in a compliance or forensics database. From that single point of contact, the identity can propagate backward and forward through the entire cluster of addresses that address has ever transacted with.

This is the actual engine behind blockchain tracing, and it means two things that surprise most people. First, an address does not need to be directly identified for it to be traceable. It only needs to be a few hops away from one that is. Second, distance in time doesn't erase the record the way it does with, say, a cash withdrawal from an ATM with no camera. A transaction from three years ago is exactly as visible today as it was the moment it confirmed. What changes over time isn't the visibility of the data, it's whether anyone still has an economic reason to analyze it.

Inside a Transaction: What the Ledger Actually Records

To understand what an analyst can extract from a chain of transactions, it helps to know what a blockchain actually stores, because the two dominant designs behave quite differently under analysis.

Bitcoin, Litecoin, and Bitcoin Cash use the UTXO model. There is no such thing as a running "balance" on an address in the way a bank account has one. Instead, funds exist as discrete unspent outputs, essentially individual coins of specific denominations, and a transaction consumes one or more of these outputs whole and creates new ones. This sounds like a technical detail, but it is the single biggest gift UTXO chains give to forensic analysts: when a transaction pulls in several inputs at once, there is a strong statistical likelihood that all of those inputs are controlled by the same wallet software, and therefore the same owner. That inference is the seed of almost every clustering technique described below.

Ethereum, BSC, Tron, Polygon, and most newer chains use the account model instead, where addresses hold balances much like a bank ledger. This is easier to read at a glance, a balance is just a number, but it is harder to cluster, because there's no equivalent moment where multiple addresses reveal joint ownership by co-signing a single transaction. Account-model chains compensate for this with something UTXO chains mostly lack: an input data field attached to every transaction. This field is what turns a bare transfer into a legible action, a swap on Uniswap, a deposit into a lending pool, a call to a bridge contract, an interaction with Tornado Cash. Reading input data correctly is often what separates a real trace from a guess.

Clustering: Turning Thousands of Addresses Into One Wallet

A real theft investigation rarely deals with a single address. The funds fan out across dozens or hundreds of them within days. What makes a chain traceable at all is that most of those addresses can be mathematically grouped back into the handful of wallets that actually control them, a process called clustering. Clustering is one of the core techniques behind blockchain tracing as a whole.

The oldest and still most reliable heuristic is common-input-ownership: if two or more addresses appear together as inputs to the same transaction, the software that built that transaction had to hold the private keys for all of them, so they belong to the same entity. This single rule, applied recursively across the entire history of a chain, is how a single Bitcoin wallet with a habit of consolidating funds can be shown to actually control tens of thousands of individual addresses.

A second technique, change address detection, exploits the fact that most wallet software creates a fresh "change" address automatically whenever a transaction doesn't spend an entire UTXO. That change output has behavioral fingerprints, its position in the transaction, its denomination relative to the round numbers a human would choose, that let analysts flag it as belonging to the sender rather than the recipient. Then there's behavioral clustering, which looks at softer signals: the timing pattern of activity (does this address always transact at the same hour, suggesting a script or a specific time zone), typical fee choices, and transaction sizing, all of which tend to be consistent within a single wallet's usage even across many addresses. Finally, peel chain detection catches a specific laundering pattern where a large balance is walked through a sequence of transactions, peeling off a small amount at each step while the bulk continues to the next address, a pattern that is mechanically distinctive once you know to look for it.

None of these heuristics are proof in isolation. What makes commercial forensics tools like Chainalysis Reactor, TRM Forensics, and Elliptic Investigator valuable is that they run dozens of these heuristics simultaneously, cross-check them against each other, and assign confidence scores, something a free block explorer simply does not attempt.

Attribution: Naming the Owner Behind the Cluster

Clustering answers "which addresses belong together." Attribution answers the more valuable question: "who are they." This is where the paid forensics platforms diverge most sharply from anything a hobbyist could replicate. Chainalysis alone claims well over a billion labeled addresses in its database, built from a mix of public sources, court filings, sanctions lists, and direct data-sharing partnerships with exchanges that voluntarily identify their own deposit and hot wallet addresses to forensics vendors in exchange for better fraud detection on incoming funds.

The categories in these databases are granular. Not just "exchange" but which exchange and often which specific deposit address; not just "mixer" but which mixer and which pool size within it; plus dedicated tags for OTC desks, darknet markets, ransomware payment addresses, known scam contracts, and addresses tied to sanctioned entities such as OFAC-designated wallets or groups like North Korea's Lazarus. An address that shows up as an unlabeled string on Etherscan might carry a dozen data points in one of these systems: first-seen date, associated case numbers, risk category, and a confidence score for the attribution itself.

This is also the layer that makes real-time interception possible. Exchanges and forensics vendors run continuous monitoring feeds, so when a flagged address sends funds toward a compliance-integrated exchange, an alert can fire before the deposit even finishes confirming, not after a support ticket gets read three days later.

For a closer look at the four-stage methodology analysts follow once clustering and attribution are done, see how cryptocurrency tracing works in practice.

Tracing Illegal Crypto Transactions: Who Does It and How

Everything described above, clustering and attribution, is the mechanism. But it's worth stepping back and answering a more practical question: who actually sits down and runs this process on a real case, and what makes a transaction "illegal" in the first place from a tracing standpoint.

Tracing illegal crypto transactions in practice falls to four overlapping groups. Specialized forensics firms, KarCrypto among them, are usually the first call for an individual victim: they hold commercial licenses for Chainalysis Reactor, TRM Forensics, or Elliptic Investigator, and they build the case, from clustering the scammer's wallet through attribution to a named exchange account, on behalf of a client who has no access to those tools themselves. Exchanges run their own internal compliance teams doing the same kind of analysis from the other direction: watching incoming deposits against sanctions lists and known-bad address databases, and reacting when a forensics report or a law enforcement request lands on their desk. Law enforcement units, cybercrime divisions within the police, financial intelligence units, Interpol's cyber liaison offices, increasingly run in-house blockchain analysts or contract directly with the same vendors, particularly once a case crosses into a formal criminal investigation. And the blockchain analytics vendors themselves, Chainalysis, TRM Labs, Elliptic, sit underneath all three of the groups above, since almost nobody outside a handful of governments builds this kind of address-attribution database from scratch.

What actually makes a transaction "illegal" for tracing purposes isn't a single flag, it's usually one of three things. The most common is that the funds are stolen: a phishing signature, a hacked exchange account, or a compromised private key moved value without the owner's consent, and the theft itself is what triggers the trace. The second is that the receiving address is sanctioned or otherwise flagged, an OFAC-designated wallet, a known Lazarus Group cluster, an address tied to a darknet market, in which case interacting with it at all can carry legal exposure for anyone downstream, exchange or individual. The third is that the funds are proceeds of a specific underlying crime even when the transaction itself looks ordinary on-chain, a ransomware payment, a romance-scam transfer, a Ponzi-style investment platform's payout to early investors funded by later victims' deposits. In every one of these cases, the transaction data on the ledger looks identical to a legitimate transfer. What makes it illegal is context that lives off-chain, a police report, a victim's account, a sanctions designation, and tracing is the process of connecting that context to the specific addresses and hops the funds actually took.

This is why clustering and attribution matter so much in practice, not as abstract techniques but as the actual mechanism that turns "someone somewhere has my stolen money" into a named account a compliance department or a prosecutor can act on. A cluster with no attribution is just a set of addresses. An attribution with no documented chain of custody back to the theft is not evidence a court or an exchange will accept. Tracing illegal crypto transactions means doing both, correctly, and being able to show the work.

Anatomy of a Transaction Map

What does all of this actually look like on paper? A finished trace is presented as a graph: nodes are addresses or named services, edges are transactions, and the whole thing reads left to right from the theft to wherever the funds currently sit. Here's a real pattern from one of our cases, simplified for clarity.

Every finished map carries the same components regardless of the case: attribution labels on every significant node (not "0xABC..." but "Binance deposit address, verified account" or "Tornado Cash 0.1 ETH pool"), a risk score per hop (mixer or sanctioned address is high risk, an unidentified high-volume wallet is medium, a KYC exchange is low), a list of every current or historical end point with timestamps, and an exportable version in CSV and PDF suitable for attaching to a compliance request, a police report, or a court filing. Building one properly runs 20 to 40 analyst hours depending on how many chains and obfuscation layers are involved.

Where the Trail Gets Complicated: Bridges, Swaps and Mixers

Scammers rarely leave funds sitting still, and the tools they reach for to complicate tracing fall into a few recognizable categories, each of which forensics platforms handle with varying degrees of success.

Cross-chain bridges (Wormhole, Stargate, Thorchain) move value between networks by locking assets on one chain and minting or releasing equivalents on another. Each bridge hop is a natural place for weaker tracking tools to lose the thread entirely, since the sending and receiving chains have no native awareness of each other. Chainalysis and TRM can follow through most major bridges by matching the contract-level events on both sides, but it slows the analysis considerably and multiplies the number of chains that need separate attribution data.

DEX swaps on Uniswap, PancakeSwap, or Curve are frequently used not to actually trade but purely to muddy the water: USDT into ETH into WBTC and back into USDT, several times over, with no economic purpose except to make the map harder to read. The swaps are visible on-chain and forensics tools can follow the value through them, but each swap adds a node and an edge, and a determined scammer can add dozens of these in a single afternoon.

Mixers and CoinJoin are the most effective obfuscation available and the only one that can genuinely sever the chain rather than just complicate it. Tornado Cash pooled ETH deposits from many users and let them withdraw to a fresh address with no on-chain link to the deposit, at least until OFAC sanctioned it in 2022, after which most compliant exchanges began automatically blocking any deposit that had passed through a Tornado Cash pool, which severely blunted its usefulness for cash-out. Wasabi Wallet and Samourai Wallet implement CoinJoin for Bitcoin: multiple users combine inputs into one transaction and receive equal-denomination outputs, so which input paid for which output becomes genuinely probabilistic rather than merely obscured. Used cleanly, with a large enough anonymity set and no reused change addresses, this is one of the few techniques that actually breaks direct tracing rather than just adding noise to it.

The Hard Limits of On-Chain Analysis

Tracing is powerful, but it is not magic, and a forensics analyst who tells you otherwise is not being honest. A handful of scenarios exist where the chain physically breaks and no amount of clustering or attribution data can put it back together.

Privacy coins are the clearest case. Monero builds sender concealment, recipient concealment, and amount concealment directly into the protocol through ring signatures, stealth addresses, and RingCT, so there is no public ledger data to cluster in the first place. Academic attempts at probabilistic Monero analysis exist but only meaningfully apply to older protocol versions with weaker default settings. Zcash is a partial exception: its transparent t-addresses trace exactly like any other chain, but shielded z-address transactions are protected by zk-SNARKs and are, as far as current cryptography is concerned, opaque. Once a chain of funds enters Monero, or a properly shielded Zcash transaction, the trace effectively ends there. Anything after that point requires traditional investigative work, not blockchain analysis.

Off-chain layers like the Lightning Network present a milder version of the same problem: transactions routed inside payment channels never touch the base Bitcoin blockchain, only the channel's opening and closing transactions do. In practice this rarely matters for large theft cases, since Lightning channel sizes are typically capped in the low thousands of dollars, but it is a real blind spot worth knowing about.

Physical cash-out is the least technical and, in some ways, the hardest limit of all. If a scammer meets a buyer in person and trades crypto for cash with no exchange involved, the on-chain record simply stops at the final wallet-to-wallet transfer. No amount of clustering recovers what happens after the keys change hands in a coffee shop. This is common in regions with mature informal OTC networks, and once funds go this route, the case moves entirely into the domain of traditional investigation and law enforcement, not forensics software.

From Trace to Freeze: What Happens at the Exchange

A completed trace is not the end of the story, it's the point where the case moves from analysis to action, and this is the step most self-taught victims never reach. When a labeled trail terminates at a regulated exchange, the report gets submitted through the exchange's official law enforcement or compliance liaison channel, not through ordinary customer support, where a generic ticket about a "hack" routinely sits unread for days.

Compliance departments treat a formal tracing report differently because it gives them something a support ticket cannot: a documented, attributable chain of custody they can act on without exposing themselves to liability. In our own case data, a well-built report submitted directly to Binance compliance resulted in a freeze within 36 hours. Stablecoin issuers add another lever entirely: Tether can freeze USDT on any address at the request of law enforcement, and has frozen hundreds of millions of dollars this way over the past few years, something that simply has no equivalent for a stolen bank transfer.

None of this happens automatically just because a transaction is theoretically traceable. It happens because someone builds the documented case, routes it through the correct channel, and follows up, which is the actual work behind the phrase "we traced the funds."