What is transaction tracing?

Transaction tracing is the process of following funds through the public record a network publishes — reading each transfer in turn to establish where value moved, how it was split, and what kind of endpoint it reached. Because the underlying data is public, the resulting path can be verified by anyone with the same hashes.

Can any cryptocurrency transaction be traced?

On public networks such as Bitcoin, Ethereum and Tron the transfers themselves are visible and permanent, so they can normally be followed. Whether the trace arrives somewhere useful depends on where the funds settled. Privacy-focused networks and mixing protocols can break the path, and we say so when they do.

How long does a trace take?

A first assessment of whether the record supports a traceable case is usually a few working days. A full trace and evidence report typically takes around two weeks, depending on the number of hops and how many networks are involved.

What do I receive at the end?

A structured forensic report: the methodology used, the transfer graph, the reasoning behind each judgement call, the endpoint classifications and the underlying data, in a form suitable for the police, a regulated service or a legal adviser.

Bitcoin · Ethereum · Tron

Onchain transaction tracing

Tracing is the core of every case we take. It answers one question with evidence: where did the value actually go? This page explains how a trace is built, what each network makes visible, and where the work honestly stops.

Request a case review Investigation services

How a trace is built

Establishing the starting point

A trace begins with a confirmed transaction, not a description. The hash of your first transfer fixes the amount, the destination and the moment it left your control, and everything that follows is anchored to it.

Following the transfer graph

Value rarely stays put. It is split at the first or second hop, with small amounts peeled off while the bulk continues along one dominant path. We follow each branch and record the hash, amount and timestamp behind every step so the route can be checked independently.

Crossing between networks

Funds frequently move through a bridge or a swap into another network. That is a break in continuity, not the end of a trace: it is picked up on the far side by matching amounts and timing, and we record the confidence level of that link rather than presenting it as certainty.

Classifying where value settled

Every branch ends at a deposit address held by a service, a privacy protocol, a bridge, or a wallet that has gone quiet. Naming which of those you have reached is the most useful thing a trace produces, because it determines what can realistically be done next.

Tracing by network and asset

Each network records value differently, and those differences change how a trace is built. These pages set out the specifics.

Bitcoin (BTC)

Bitcoin transaction tracing

How Bitcoin tracing works: UTXO following, clustering heuristics, change identification, and where a BTC trace realistically ends.

Read about Bitcoin tracing

Tron (TRC-20) and Ethereum (ERC-20)

USDT transaction tracing

How stolen USDT is traced across Tron and Ethereum, why token transfers differ from native transfers, and what a trace can realistically establish.

Read about USDT tracing

Ethereum and EVM networks

Ethereum transaction tracing

How Ethereum tracing works: internal transactions, token approvals, contract interactions, and what an ETH trace can and cannot establish.

Read about Ethereum tracing

Solana (SOL) and SPL tokens

Solana transaction tracing

How Solana tracing works: SPL token accounts, programme instructions, high transaction volume, and what a SOL trace can realistically establish.

Read about Solana tracing

What tracing cannot establish

A confirmed transfer cannot be reversed, cancelled or frozen by us or by anyone else.
Addresses are not identities. Attribution requires off-chain records, normally released only under legal process.
Once value reaches a custodial deposit address, the public record stops showing what happens internally.
Some paths end at a privacy protocol and cannot be followed further. Where that happens we report it plainly.

Common questions

What is transaction tracing?: Transaction tracing is the process of following funds through the public record a network publishes — reading each transfer in turn to establish where value moved, how it was split, and what kind of endpoint it reached. Because the underlying data is public, the resulting path can be verified by anyone with the same hashes.
Can any cryptocurrency transaction be traced?: On public networks such as Bitcoin, Ethereum and Tron the transfers themselves are visible and permanent, so they can normally be followed. Whether the trace arrives somewhere useful depends on where the funds settled. Privacy-focused networks and mixing protocols can break the path, and we say so when they do.
How long does a trace take?: A first assessment of whether the record supports a traceable case is usually a few working days. A full trace and evidence report typically takes around two weeks, depending on the number of hops and how many networks are involved.
What do I receive at the end?: A structured forensic report: the methodology used, the transfer graph, the reasoning behind each judgement call, the endpoint classifications and the underlying data, in a form suitable for the police, a regulated service or a legal adviser.

Wallsec does not hold, handle or return client funds, and no report can guarantee an outcome. This page is general information, not legal or financial advice.