Bitcoin (BTC)
Bitcoin tracing and evidence reporting
Bitcoin publishes every transaction permanently, which is why a trace is possible at all. It also uses a transaction model unlike any other major network, and that model shapes both what a Bitcoin trace can establish and where it stops.
Is Bitcoin traceable?
Yes. Every Bitcoin transaction is published permanently, so a payment can be followed from the address you sent to, hop by hop, until the funds reach an exchange deposit address, a mixing service or an address that has stopped moving. What tracing cannot do is reverse a confirmed payment or name the person holding an address.
- Public and permanent: anyone can verify each hop from the transaction ID, with no special access.
- Traceable does not mean reversible — no party can undo a confirmed Bitcoin transaction.
- Traceable does not mean identifiable — a name only comes from records held off the ledger and released under legal process.
- Coinjoin and similar tools can end deterministic linkage, and an honest report says so rather than presenting association as proof.
How a Bitcoin trace is built
Following unspent outputs
Bitcoin has no account balances. Each transaction consumes earlier outputs and creates new ones, so a trace follows outputs rather than addresses. This makes value flow unusually explicit — you can see precisely which prior coins funded a payment.
Separating payment from change
Most transactions produce two outputs: the payment and the change returning to the sender. Distinguishing them correctly is the single most important judgement in a Bitcoin trace, and an error here sends the entire path in the wrong direction. We record the reasoning behind each call rather than presenting it as fact.
Common-input clustering
When several outputs are spent together in one transaction, they were normally controlled by the same party. Applied carefully this groups addresses into entities; applied carelessly, in the presence of coinjoins or payment batching, it produces confident nonsense.
Classifying the endpoint
Every branch ends somewhere: a deposit address at a regulated service, a mixing protocol, a bridge to another network, or a wallet that has simply gone quiet. Naming which one you have reached is the most useful output of the work.
What a Bitcoin trace cannot do
- A confirmed Bitcoin transaction cannot be reversed, cancelled or frozen by us or by anyone else.
- Addresses are not identities. Attribution requires off-chain information, normally released only under legal process.
- Coinjoin and similar protocols can break deterministic linkage. Where that happens we say so instead of presenting statistical association as proof.
- Exchange-internal movements are invisible: once value reaches a custodial deposit address, the ledger stops recording what happens next.
The deliverable is described in full in our guide on what an onchain evidence pack contains, and the stage-by-stage timings are on our investigation process page.
Common questions
- Can stolen Bitcoin be traced?
- Usually the transfers themselves can be followed, because every Bitcoin transaction is public and permanent. Whether that trace reaches a useful endpoint is a separate question, and depends on where the funds settle.
- Can Bitcoin be recovered once sent?
- Not by reversing the transfer — that is not possible on any public network. Funds are returned in practice only through legal or regulated processes acting on evidence of where value ended up.
- How long does a Bitcoin trace take?
- A first assessment is normally a few working days. A full trace and evidence report typically takes around two weeks, depending on hop count and whether the path crosses into other networks.