How to Trace Stolen Crypto: Follow the Money Beyond the Wallet

Your crypto has disappeared.

You have a transaction hash. Maybe you have the wallet that received the funds. A blockchain explorer can show where the asset went next, but tracing the money, identifying its controller, and recovering it are separate jobs.

Here is how to follow the trail.

 1. Record the Transaction

Start with the transaction itself, not a theory about who did it.

Save the transaction hash, sending and receiving addresses, cryptocurrency, amount, blockchain, date, and time. Preserve screenshots, links to relevant transactions, and records connected to the transfer.

A transaction hash, also called a transaction ID or TXID, is the unique identifier for a blockchain transaction.

The FBI's Internet Crime Complaint Center, or IC3, asks cryptocurrency victims to provide addresses, asset types and amounts, transaction hashes, and dates and times when reporting a cryptocurrency crime.

One wrong character in a wallet address can send an investigation down the wrong road.

2. Follow Every Hop

Use the blockchain explorer for the network carrying the asset. Bitcoin transactions can be inspected through mempool.space. Ethereum transactions and token transfers can be examined through Etherscan. Other assets require explorers for their respective chains, including Tron or Solana.

At every step, ask one question:

Where did the stolen asset go next?

Consider a hypothetical trail: Wallet A sends ETH to Wallet B. Wallet B swaps the ETH for USDT through a decentralized exchange, or DEX. The USDT is then moved through a bridge to another blockchain and eventually sent to a deposit address at an exchange.

Record the transaction hash for each hop, the input and output assets, the bridge transaction, destination chain, and destination address. Record why each transaction belongs to the same trail.

Swaps change the asset. Bridges change the chain. Mixers, peeling transactions that split value into successive smaller sends, and rapid chain-hopping can make a trail harder to follow. They do not turn a transaction into an identity.

If stolen funds enter a wallet that already contains legitimate assets, the problem becomes harder. An incoming transfer does not prove that every later outflow came from the theft. Different tracing methods can produce different results, so the methodology should be documented rather than assumed.

3. Find the Institution

This is where an on-chain trail can become an off-chain lead.

Wallets are generally pseudonymous. An address can show where money went without revealing who controls it.

The useful destination may be an exchange or another virtual asset service provider that maintains customer information or custody.

In guidance for investigators, TRM Labs describes tracing funds to a third party that holds identifying information or custody of assets, followed by legal process to obtain relevant records. An exchange may hold KYC, or Know Your Customer, information associated with an account.

That does not mean a victim can call an exchange and demand the customer's name. Access depends on the company, jurisdiction, and applicable legal process.

The exchange is a lead. It is not proof of who stole the money.

Analytics platforms can help map that lead. Arkham Intelligence and TRM Labs can label entities, cluster addresses, and visualize transaction flows. Treat those labels as leads, not identity documents. An address marked "hacker" is not, by itself, proof that a particular person controls it.

4. Build the File and Report It

Some assets have issuer-controlled freeze mechanisms.

Tether has worked with law enforcement to restrict USDT linked to illicit activity. Circle's USDC terms allow it to block certain addresses and, in specified cases, freeze associated USDC, including when a legal order requires it. These mechanisms do not guarantee recovery, and they are not equivalent to a civilian sending an email and getting funds frozen. Bitcoin has no comparable issuer-controlled blacklist.

Speed can matter when a freeze may be possible. It does not replace evidence.

Build a file containing:

• The original transaction hash

• Relevant addresses, assets, amounts, and timestamps

• Material downstream transactions

• Swap and bridge records

• Exchange or service exposure

• Relevant emails, messages, and websites

Separate what you observed on-chain from what you inferred and what has been independently established.

Then report the theft to the relevant exchange or service and the appropriate law-enforcement or fraud-reporting authority. U.S. victims can file with IC3. People elsewhere should use the applicable national or local reporting channel.

And be careful with anyone promising to recover the funds. IC3 warns cryptocurrency victims to be wary of recovery services, especially those charging an up-front fee.

A private recovery company cannot issue a seizure order.

This is evidence-gathering guidance, not legal advice. Recovery is not assured.

The chain gives you a trail. That is not a name, and it is not the money back.