How to trace a Bitcoin transaction

Step 1: find the transaction ID

A trace starts from something you can evidence yourself. That is normally the transaction ID (txid) shown in your own wallet history or in the withdrawal confirmation from the exchange you sent from. Save the confirmation email or screenshot as well as the txid — the record of where the payment originated is part of the evidence, not just the hash.

If you only have the receiving address, that works too: a public explorer will list every transaction paying into it. It is a weaker starting point, because you then have to demonstrate which of those payments was yours.

Step 2: read the inputs and outputs

Bitcoin does not have account balances. Each transaction consumes previous outputs as inputs and creates new outputs, so a payment usually produces two outputs: the amount sent, and change returning to the sender.

• Match the amount you sent to the correct output; the other is normally change.
• Note the confirmation timestamp — timing patterns are often more informative than amounts.
• Record the fee paid. Consistently high fees suggest automated, time-sensitive movement.
• Where several inputs are spent together, the same party almost certainly controls all of them.

Step 3: follow the value forward

Open the output that carries your funds and look at the transaction that spends it. Repeat. Each step is one hop, and a usable record of the trace lists the txid, timestamp, amount and addresses for every hop rather than just the start and the end.

Value rarely travels in a straight line. It is split across outputs, recombined with unrelated funds, and moved through addresses that are used once and never again. Following the dominant share of value, rather than every branch, keeps the work proportionate.

Step 4: recognise where the trace ends

• A deposit address at a centralised service — the public trail stops there and anything further sits with that service.
• A coin swap or bridge into another asset, where continuity has to be argued from amount and timing rather than a single hash.
• A privacy tool, after which deterministic linkage usually is not available.
• A dormant address still holding the funds, which is worth documenting because it can change later.

What a trace does not do

Following a transaction identifies addresses and their relationships. It does not reveal a name, and it cannot reverse a confirmed payment. Connecting an address to a person requires information held off the ledger, normally by a regulated business and released only under legal process. Any service claiming to do more than this is describing something the technology does not allow.

Turning a trace into something usable

A trace only has value if someone else can act on it. That means each hop recorded with its hash so a bank, adviser or reporting body can verify it independently, the terminal point classified honestly, and uncertainty stated rather than smoothed over. That is the structure of the evidence pack we produce at the end of an investigation.