How to trace an Ethereum transaction

Start from a known point

A trace needs a fixed starting position: the transaction hash of your own payment, or the address you sent funds to. If the funds came from an exchange withdrawal, the withdrawal record on your account gives you the exact address and hash. Without one of these, the work is guesswork, so preserve your records first.

Read the transaction properly

A simple ETH transfer shows four facts: sender, recipient, amount and time. But most fraud-related transfers are not simple. The Ethereum Virtual Machine records contract calls, and a single transaction can move value through several contracts before it settles anywhere.

• An internal transaction is a value transfer made by a contract, not the sender — it appears in the trace but not in the top-level transaction.
• ERC-20 token movements (USDT, USDC and others) are recorded as Transfer events inside the transaction receipt, not as the main transfer.
• Gas is paid in ETH by the sender, and the fee level can hint at whether the wallet is automated or human-operated.
• Timestamps matter: funds moved within seconds of arrival, repeatedly, indicate programmed forwarding.

Follow the value, not the noise

From the first hop, the trace follows outgoing transfers, recording source, destination, amount, timestamp and transaction hash at each step. Value is often split at the first or second hop to make manual following harder. In practice the bulk of value tends to stay on one dominant path while smaller amounts are peeled off as decoys.

Where several addresses behave as one operation — funded by a single address, sweeping to the same destination within minutes of each other — the trace groups them as likely common control. That grouping is an assessment, and a careful report states the evidence for it rather than presenting it as fact.

Where an Ethereum trace ends

• A deposit address at a centralised exchange. The onchain trail stops there; the account behind it is held by the service and only released under legal process.
• A bridge to another network. Continuity continues on the destination chain and has to be evidenced by amount and timing correlation.
• A mixer or privacy protocol. Statistical association sometimes survives; deterministic linkage usually does not, and we say which case applies.
• A dormant address. Funds are simply sitting still — common, and worth documenting because the position can change later.

What the ledger does not tell you

The ledger records addresses, not people. No amount of tracing produces a name, a passport or a location by itself. Attribution comes from linking an address to off-chain information — a published deposit address, a service's known address set, a disclosure made under legal process — and that step is either evidenced or it is speculation.