What the Solana record contains
Each Solana transaction lists the accounts it touched, the instructions it executed and the token balance changes it caused. Tokens such as USDC and USDT on Solana are SPL tokens, and their movements are recorded as token balance changes inside the transaction, not as a single obvious transfer.
The practical consequence is that reading one transaction rarely tells the whole story. A single payment can touch several accounts in the same instant, and the useful output of a Solana trace is a sequence of balance changes across accounts and time, not a neat chain of payments.
Build the trace from balance changes
- Establish the starting transaction hash or address from your own wallet or exchange records.
- Follow each account's outgoing token changes, hop by hop, with transaction signatures and timestamps.
- Watch for sweep patterns: many wallets drained within minutes to a small set of collector addresses is a strong clustering signal on Solana.
- Note rent and fee funding — on Solana, an account must be funded to exist, so the address that pays a wallet's rent is often a useful clustering clue.
Where a Solana trace ends
- A deposit address at a centralised exchange, where the onchain trail stops and legal process takes over.
- A bridge or cross-chain swap, after which continuity has to be evidenced by amount and timing rather than a single transaction.
- A privacy tool or a dormant wallet, which the report states plainly rather than dressing up as a solved case.
The limits that apply everywhere
The public record identifies addresses, not people. Solana's speed does not change that. Attribution to a real person requires off-chain information, and no trace can reverse a confirmed transfer. Anyone promising to name the owner of an address from onchain data alone, or to undo a payment, is describing something the technology does not permit.
If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.
Common questions
- Can stolen SOL or USDC be traced on Solana?
- Yes. Transfers are publicly recorded and can be followed hop by hop. Tracing shows where the funds went and whether they reached a service able to act; it cannot reverse a transfer or identify a person from an address alone.
- Why is Solana fraud often harder to follow?
- Low fees and fast finality let operators create many wallets and route funds through several accounts within seconds. The record is complete, but the volume of movement makes careful clustering more important.
- Do I need to use an explorer myself?
- You can look up a transaction on a public explorer, but a trace is more than looking up one hash. If your loss is significant, keep your records and have the path documented properly.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the onchain data supports a traceable case.
Key terms in this guide
Plain-English definitions from the Wallsec glossary.