Every blockchain transaction leaves a permanent, public record. This guide walks you through how to read that record - from a single transaction hash all the way to identifying whether funds reached a real-world entity.
Unlike a bank transfer, every crypto transaction is written permanently into a public record that anyone can read. Scammers cannot erase it. No one can alter it. Every move funds make, from wallet to wallet, is timestamped and permanent.
A unique fingerprint for every single transaction. It looks like a long string of letters and numbers. This is the starting point of any trace - if you have it, you have everything you need to begin.
Every crypto wallet has a public address - a destination that anyone can send funds to and that anyone can look up. Addresses don't reveal the owner's identity on their own, but their activity is fully visible.
A free, publicly accessible website that lets you search any transaction or wallet on a given blockchain. Think of it as Google for crypto activity. Etherscan is the most well-known for Ethereum.
Every movement of funds is "on-chain" - meaning it's recorded on the blockchain forever. Even if funds are split, mixed, or sent through multiple wallets, each hop is a data point in the trail.
Follow this sequence using any block explorer. No account needed, no software to install. All you need is your transaction hash.
The transaction hash (also called TXID) is your entry point. You can find it in your wallet's transaction history - look for "TXID", "TxHash", or "Transaction ID" next to the transfer. It will be a long alphanumeric string, usually starting with 0x for Ethereum-based chains or a long string for Bitcoin.
Different blockchains have different explorers. Using the wrong one will return no results. Match the blockchain to the right tool:
On the block explorer's homepage, paste your transaction hash into the search bar and press Enter. The transaction detail page will load and show you the core data. Here's what each field means:
Click the "To" address to open that wallet's full transaction history. This is where the trace continues. You're now looking for where that wallet sent your funds next. Watch for these patterns:
Funds moved to multiple wallets within minutes. This is deliberate layering to obscure the trail.
The address is tagged as "Binance", "Kraken", or another exchange. This is actionable - funds entered a regulated system.
Funds went to a contract address. This could be a DeFi protocol or a mixer - requires closer examination.
No further activity. Funds may be sitting, waiting to move when attention dies down. Note the address and monitor it.
As you follow the funds wallet by wallet, keep a log. For each address in the chain, note the wallet address, the amount and date of the outbound transfer, and any labels the explorer displays. After 3–5 hops, most traces either reach an exchange or go cold - both outcomes matter for your documentation.
Not all trace outcomes are equal. Where the funds ended up determines what, if anything, can be done next. Here's how to read the four most common outcomes.
This is the most actionable outcome. Block explorers often automatically label known exchange wallets. If you see tags like "Binance 14", "Coinbase Hot Wallet", or "Kraken Deposit", your funds entered a platform that holds verified identity data on its users.
What this means for you: File a formal fraud report with that exchange's compliance team, providing the wallet address and transaction hash. Simultaneously, file a police report and request they issue a legal freeze order to the exchange. Without a legal order, exchanges cannot act unilaterally - but a formal complaint on record is the first required step.
Mixers (also called tumblers) are services that pool crypto from many users and redistribute it, intentionally breaking the on-chain trail. Cross-chain bridges move funds to a different blockchain entirely, restarting the trace from zero.
This is the hardest outcome. The trace effectively ends at the mixer. However, the fact that funds were deliberately obscured is itself useful evidence - document it thoroughly. In some jurisdictions, law enforcement has tools and legal channels to work with mixer operators, particularly if the mixer itself is under investigation.
Sometimes funds don't move immediately after a theft. The receiving wallet may be dormant - no outbound transactions since your funds arrived. This is actually a window of opportunity.
Note the address and check it periodically. If funds are still there, a law enforcement freeze request to a relevant exchange (if the wallet is identified as exchange-owned) or a court order in the right jurisdiction may be able to prevent withdrawal. The longer funds sit unmoved, the better your chances of a legal intervention succeeding.
Decentralized finance protocols - lending platforms, liquidity pools, or token swaps - leave a detailed on-chain record but operate without any central party who can freeze or return funds.
This is a complex outcome, but not a dead end. All contract interactions are visible, including if and when funds are withdrawn. If the attacker eventually moves funds to an exchange to cash out, that final step creates a new actionable trace. Continue documenting and monitor for future exchange interactions.
Understanding the honest limits of blockchain tracing will help you make better decisions about where to invest your time and energy.
Tracing shows you wallet addresses, not names. On-chain data alone does not reveal who controls a wallet. Identity can only be uncovered if funds reach a regulated entity that holds KYC data - and only through legal channels, not by you independently.
Confirmed blockchain transactions are irreversible by design. No tool, service, or technical method can undo a transfer that has been written to the chain. Anyone claiming otherwise is running a scam.
Even if you identify that funds reached Binance or Coinbase, exchanges require a formal legal order - from law enforcement or a court - before they can freeze or disclose account information. Your report to them starts the process, but it doesn't end there.
Mixing services are specifically designed to break on-chain trails. If funds passed through a mixer, your independent trace will likely reach a dead end. This is where professional blockchain analysis or law enforcement tools may be needed.
Monero and Zcash are designed with built-in privacy features that obscure sender, receiver, and amounts. Tracing these using public tools is significantly more limited compared to Bitcoin or Ethereum.
Screenshots from a block explorer are a starting point, not conclusive legal proof. For formal proceedings, a professionally prepared trace report with clear methodology will carry far more weight than self-gathered data.
Enter your transaction hash and our tracing tool will walk you through what happened - where your funds went, whether they reached a known exchange, and what the findings suggest about your next steps.
No fee. No account required. Results delivered as a clear report.