Official Wallsec emails only ever come from an @wallsec.co.uk address.

Tron (TRC-20) and Ethereum (ERC-20)

USDT tracing and evidence reporting

Most cryptocurrency fraud losses reported to us are denominated in USDT, and most move on Tron or Ethereum. Both networks publish every transfer, but a stablecoin trace works differently from a native-asset trace, and missing that difference means missing the case entirely.

Is USDT traceable?

Yes. Every USDT transfer on Tron (TRC-20) and Ethereum (ERC-20) is recorded publicly and permanently by the token contract, so the funds can be followed from the address you sent to until they reach an exchange deposit address, a bridge or a dormant wallet. Tracing shows where value went; it does not reverse the transfer.

  • The evidence sits in the token contract's transfer records, not in the wallet's native TRX or ETH balance.
  • Tron traces usually run far longer than Ethereum ones because fees are negligible and hops are cheap.
  • The issuer can freeze balances at specific addresses, but that decision is theirs and normally follows legal process. No investigator can promise it.
  • Once value reaches a custodial deposit address, further movement is internal to that service and no longer visible.

How an USDT trace is built

Reading token transfers, not balances

USDT is a contract. A wallet can hold six figures in USDT while showing a native balance worth a few pounds of gas, so any trace that looks only at native transfers sees nothing. The evidence lives in the contract's Transfer events.

Following the graph across hops

Each hop records a source, a destination, an amount, a timestamp and a transaction hash. Value is normally split at the first or second hop, with small amounts peeled off as noise while the bulk stays on one dominant path.

Why Tron behaves differently

Tron's low fees make far more hops affordable, so a Tron trace often runs three to five times longer than the Ethereum equivalent for the same loss. Sponsor addresses that quietly fund activation costs for dozens of receiving wallets are often more informative than the transfers themselves.

Documenting the endpoint

The report names, for each branch, whether value reached a service deposit address, a bridge, a privacy protocol or a dormant wallet, with the reasoning and confidence stated.

What an USDT trace cannot do

  • A confirmed TRC-20 or ERC-20 transfer is final and cannot be reversed through ordinary means.
  • Freezing decisions rest entirely with the token issuer and the services involved, not with us. We do not promise them.
  • The ledger records addresses, never names, passports or locations.
  • Cross-chain bridges break single-transaction continuity; linkage has to be evidenced by amount and timing correlation.

The deliverable is described in full in our guide on what an onchain evidence pack contains, and the stage-by-stage timings are on our investigation process page.

Common questions

Can USDT be frozen after a scam?
Issuers can freeze balances at specific addresses, but that decision is theirs alone and typically follows law enforcement or legal process. No investigator can promise it. What evidence does is make the request credible and specific.
Does it matter whether the USDT was on Tron or Ethereum?
Yes, for the shape of the work. Tron traces tend to have far more hops because fees are negligible. The method and the honesty of the conclusions are the same.
Can you trace USDT sent to an exchange?
The trail can be followed to the deposit address. Everything after that is held internally by the service and released only under legal process.
Wallsec does not hold, handle or return client funds, and no report can guarantee an outcome. This page is general information, not legal or financial advice.