Ethereum and EVM networks
Ethereum tracing and evidence reporting
Ethereum records more than transfers. Contract calls, approvals and internal transactions all leave a trace, which means an Ethereum investigation can often explain how a loss happened as well as where the value went.
Is Ethereum traceable?
Yes. Ethereum records every transfer, contract call and token approval permanently, so an ETH or ERC-20 loss can usually be reconstructed in detail — both where the funds went and how the wallet was emptied. It cannot be undone: a confirmed transfer is final, and addresses are not identities.
- Approvals and the later transferFrom calls are on the record, so drainer losses can be explained as well as followed.
- Value moved by a contract during execution appears as an internal transaction and is missed by naive traces.
- Funds often cross to Arbitrum, Base, Polygon or BNB Chain; continuity there is evidenced by amount and timing, with a stated confidence level.
- Revoking approvals protects what is left; it does not recover transfers that already happened.
How an Ethereum trace is built
Surfacing internal transactions
Value moved by a contract during execution does not appear as an ordinary transaction. Traces that ignore internal transfers routinely lose the path at the first contract interaction.
Reading approvals and drainer signatures
Many losses are not transfers the victim made, but approvals they signed. The approval, the spender address and the subsequent transferFrom calls are all on the record, and together they show exactly how the wallet was emptied.
Following value across EVM networks
Funds frequently cross to Arbitrum, Base, Polygon or BNB Chain. Continuity across a bridge is evidenced by amount and timing correlation rather than a single transaction, and the report states the confidence level for each crossing.
Classifying where it settled
Each branch is closed out as a service deposit, a bridge, a privacy protocol or a dormant address, with the supporting reasoning recorded.
What an Ethereum trace cannot do
- Confirmed transfers cannot be reversed; revoking an approval prevents future draining but does not undo past transfers.
- Contract addresses and wallet addresses are not identities.
- Privacy protocols can end deterministic linkage, and we say so rather than overstating what remains.
- Deep bridge chains reduce confidence with each crossing; the report shows where that happens.
The deliverable is described in full in our guide on what an onchain evidence pack contains, and the stage-by-stage timings are on our investigation process page.
Common questions
- My wallet was drained after signing something. Can that be traced?
- The approval, the spender and the resulting transfers are all publicly recorded, so the mechanism can normally be reconstructed in detail. Whether the destination is useful depends on where the value settles.
- Should I revoke approvals now?
- Yes, and move any remaining assets to a newly created wallet with a fresh seed phrase. Revoking protects the future; it does not recover what has already gone.
- Do you trace tokens on Layer 2 networks?
- Yes. Arbitrum, Base, Optimism, Polygon and BNB Chain are all publicly recorded and can be followed with the same method.