1. Identify the network
Start by establishing which network carried the transfer. The asset name alone is not enough: USDT, for example, can move on Tron, Ethereum, Solana and several other networks. The sending wallet or exchange withdrawal record should name the network used.
Using the wrong explorer often produces a false 'not found' result. Check the withdrawal record for labels such as ERC-20, TRC-20, BEP-20 or Solana before assuming the transaction is missing.
2. Find the transaction hash
Copy the transaction hash — sometimes called a transaction ID or txid — from the wallet history or exchange withdrawal confirmation. A hash identifies one exact transfer. A wallet address identifies an account and may show many unrelated transfers, so the hash is the stronger starting point.
- Copy the hash as text rather than relying only on a screenshot.
- Keep the withdrawal confirmation showing the amount, time and destination.
- If you only have an address, match the amount and timestamp to locate the relevant transfer.
3. Open the correct block explorer
Paste the hash into a reputable explorer for that network. Common examples include mempool.space for Bitcoin, Etherscan for Ethereum, Tronscan for Tron and Solscan for Solana. The explorer should show the transaction status, block time, sending and receiving addresses, amount and fee.
Confirm that these details match your own record before following anything forward. A copied address can be altered by malware, and similarly named tokens can exist under different contract addresses.
4. Read what actually moved
On account-based networks such as Ethereum, inspect the token-transfer section as well as the top-level transaction. A transaction can show zero ETH while moving USDT or another token through a contract. On Bitcoin, identify which output represents the payment and which is change returned to the sender.
- Record the hash, timestamp, asset and amount.
- Record the sending and receiving addresses exactly.
- For tokens, record the token contract and network.
- Note whether the transfer succeeded, failed or remains pending.
5. Follow the funds forward
Open the receiving address and locate the next outgoing transfer involving the same value. Repeat this hop by hop. Funds may split into several branches, combine with other funds, pass through swaps or cross to another network through a bridge. Record each decision instead of jumping from the first transaction to a claimed endpoint.
When value splits, follow the material branches and keep a running balance. Similar amounts and close timing can support a cross-network link, but they do not prove one on their own; label the confidence level honestly.
6. Recognise the endpoint
A useful trace normally ends at a classified service deposit, a bridge, a privacy protocol or a wallet that has stopped moving. Reaching an exchange deposit can create a practical line of enquiry because the exchange may hold customer records, but those records are not public and are normally released only through legal or law-enforcement channels.
- Exchange or hosted-service deposit: preserve the address, hash and arrival time.
- Bridge or swap: identify the service and look for the corresponding transfer on the destination network.
- Privacy protocol: document the entry point and state that deterministic tracing may end there.
- Dormant wallet: record the current balance and continue monitoring rather than claiming an identity.
7. Save an evidence trail
A list of addresses is not enough. Save a chronological table containing each hash, network, asset, amount, timestamp, sending address, receiving address and the reason for any endpoint classification. Keep source links and screenshots, but use hashes as the primary references because anyone can verify them independently.
Tracing shows where funds moved; it does not reveal a person's name from an address, reverse a confirmed transfer or guarantee that funds will be returned. Those outcomes depend on evidence held outside the public record and on action by exchanges, law enforcement or a court.
If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.
Common questions
- Can I trace a crypto transaction for free?
- Yes. Public block explorers let you inspect individual transactions and follow addresses without payment. Specialist tools help with long paths, address clustering and service labels, but they do not make private identity records public.
- Can a crypto transaction be traced to a person?
- Not from the public record alone. The record identifies addresses. A person's identity normally comes from records held by an exchange or another service and released through an appropriate legal process.
- Why can I not find my transaction?
- The most common reasons are using an explorer for the wrong network, searching for an internal exchange reference rather than the onchain hash, or looking at the native-coin view when a token moved through a contract.
- Can a confirmed crypto transaction be reversed?
- No. Tracing documents the route and may identify a service that can assist, but it does not cancel or reverse the transfer.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the onchain data supports a traceable case.
Key terms in this guide
Plain-English definitions from the Wallsec glossary.