Start from a confirmed transaction
Every trace begins with one verifiable fact: a transaction you can evidence from your own records. That means the transaction hash from your wallet history or the withdrawal confirmation issued by the exchange you sent from, not a screenshot supplied by the other party.
- Collect the transaction hash, the date and time, the amount, and the receiving address.
- Save the exchange withdrawal confirmation or wallet export as a file, not a screenshot of a screen.
- Note any second or third payment separately — later transfers frequently follow a different route.
Bitcoin moves in outputs, not balances
Bitcoin has no account balances. Each transaction consumes previous unspent outputs and creates new ones, so following the money means following outputs rather than an address balance. A single payment usually produces two outputs: the amount sent onward, and change returned to an address the sender controls.
Distinguishing payment from change is the core skill in a bitcoin trace. Get it wrong and the trail leads back into the victim's own wallet or off into an unrelated party's funds.
Clustering: grouping addresses under one controller
- Common-input ownership. When several addresses are spent together in one transaction, the same party almost always controls all of them.
- Change heuristics. Round-number outputs, freshly created addresses and matching script types indicate which output is change.
- Behavioural patterns. Consistent fee settings, wallet software fingerprints and repeated timing all support a cluster.
- Every clustering conclusion carries a confidence level. A trace that presents heuristics as certainties is not evidence.
Following the trail outward
From the first hop the work is mechanical but unforgiving: record each output, its amount, its timestamp and its transaction hash, and follow the dominant path of value while noting the branches that split away.
Operators deliberately complicate this. Value is peeled off in small amounts, consolidated with other funds, cycled through many addresses, or sent through a coinjoin. Volume alone does not defeat a trace; it changes how much of the result can be stated with confidence.
Where a bitcoin trace ends
- A centralised exchange or payment service deposit address. The public trail stops here; what happens next is held by that business and released only under legal process.
- A coinjoin or privacy tool. Statistical association may survive; deterministic linkage usually does not.
- A bridge or swap into another asset or network, where continuity must be evidenced by amount and timing correlation.
- A dormant address. Funds sitting still, which is more common than people assume and worth recording because it can change later.
What the result is actually useful for
A completed trace tells you where value went, how it was split, whether it merged with other reported losses, and which service or mechanism it reached. That is the material a bank fraud team, a solicitor or a reporting body can act on, and it is the material that turns a vague complaint into a specific one.
It does not name a person from onchain data alone and it cannot reverse a confirmed transaction. Attribution requires information held off-chain by regulated businesses, and that is obtained through legal process rather than analysis.
What to do before any tracing begins
- Stop sending further payments of any kind.
- Export wallet history, exchange statements and all correspondence while you still have access.
- Report the matter — in England, Wales and Northern Ireland to Action Fraud, in Scotland to Police Scotland on 101 — and keep the reference number.
- Tell the exchange or bank you funded the payment from; timing matters more than completeness at this stage.
If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.
Common questions
- Can stolen bitcoin be traced?
- Yes. Every bitcoin transaction is permanently recorded and publicly visible, so transfers can be followed hop by hop. Tracing establishes where value went and which service or mechanism it reached; it does not by itself identify who controls an address.
- Can a bitcoin transaction be reversed?
- No. Once a transaction is confirmed it cannot be cancelled, reversed or recalled by anyone, including miners, exchanges or investigators.
- How long does a bitcoin trace take?
- A focused trace on a single loss is usually completed within days. Cases with many payments, multiple networks or heavy layering take longer, and the scope is agreed in writing before work begins.
- Is it too late if the theft was months ago?
- Usually not for the trace itself, because onchain history is permanent. Off-chain material such as chat logs, platform websites and account access degrades much faster, so preserve whatever remains now.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the onchain data supports a traceable case.
Key terms in this guide
Plain-English definitions from the Wallsec glossary.