How to Trace a Crypto Wallet Using Public Blockchain Explorers

Every transfer on a public blockchain is recorded for anyone to read, forever. Bitcoin’s own site calls it “probably the most transparent payment network in the world.” That makes it possible, with nothing but free explorers and patience, to follow money from one address to the next: where a payment went, whether stolen funds moved, which exchange they reached.

It does not make it possible to know who someone is. The chain records addresses, amounts and times. It does not record names, emails or IP addresses. This guide covers the method that works on every chain, the details that differ on Ethereum and other EVM chains, Robinhood Chain, Solana and Bitcoin, how to follow funds across bridges, what two of the largest public cases showed, and where honest tracing stops.

Pick the right explorer

A transaction or address only exists on its own chain. Start on the explorer for the network the funds were sent on. (How to read a transaction page covers each field.)

An EVM address is the same on every EVM chain, but its history is not. On Etherscan, the Multichain button opens Blockscan, which “shows the other chains where this address is present.” Check it early: funds that went quiet on Ethereum may be active on Base or Arbitrum.

The method: follow value, write everything down

Tracing is building a graph, one hop at a time. The steps are the same on every chain.

1. Start from something certain. A transaction hash you sent, an address you were paid from, an address published by an exchange or the police.
2. Open the address and read every tab. On Etherscan, the Transactions tab “shows all the ingoing and outgoing transactions involving the address sorted in a chronological order.” Tokens are under a separate tab, and ETH moved by contracts appears under Internal Transactions. A wallet that looks idle in one tab can be busy in another.
3. Follow the value, not every address. Match amounts and times. If 50 ETH arrives and 49.98 ETH leaves ten minutes later, that is your next hop. Funds are often split into smaller amounts or merged with other funds; note both.
4. Record each hop. For every step: time, chain, transaction hash, from, to, asset, amount, any label, and how confident you are. Etherscan exports transactions, internal transactions, token transfers and NFT transfers as CSV, though “the earliest 5,000 records within the selected range” only. Solscan’s export returns only the latest 1,000 records. For busy addresses, narrow the date range.
5. Stop at a boundary and say so. The trail changes character at four kinds of address, below.

Labels are leads

Explorers tag well-known addresses: “This label shows the sector/industry/service that the address is in.” Etherscan “will only display Name Tags for individuals when they have publicly declared their ownership of an address.” Analytics platforms add their own labels, often inferred. Dune’s curated dataset, for example, infers exchange deposit addresses from how funds consolidate into exchange wallets. A label tells you where to look next. It is not evidence on its own.

Chain by chain

EVM chains (Ethereum, Base, BNB Chain, Arbitrum, Robinhood Chain). A token transfer is a call to the token’s contract, so the transaction’s To field shows the contract, not the recipient; the recipient is in the token transfer list. Swaps, aggregators and bridges produce one transaction with many internal movements. Follow the account that signed the transaction and the tokens that reached addresses it controls.

Solana. Wallets do not hold tokens directly. “A Token Account tracks individual ownership of tokens for a specific mint account for a specific owner,” and “a wallet needs a token account for each token (mint) it wants to hold.” Transfers move tokens “from one token account to another token account,” so a trace means reading which token accounts changed and then their owner field, which identifies “who has authority over the Token Account.” Solscan’s Transfers tab lists every token transfer of the wallet, newest first.

Bitcoin. There are no account balances, only outputs that later transactions spend. Tracers rely on heuristics documented on the Bitcoin wiki:

The wiki’s own caveat applies to all of them: “those are only assumptions which can be wrong.” On mempool.space, search any address in the box at the top right; its API returns an address’s history newest first.

Following funds across bridges

Bridges are where most amateur traces end, and most of them can be followed, because each bridge leaves a matching record on both sides.

Two traps:

• The wallet that finishes a withdrawal may not be the owner. Base’s docs: “The relayer doesn’t need to be the same entity that initiated the withdrawal on L2.” Follow the withdrawal itself, not whoever paid gas to complete it.
• Third-party bridges and swaps change the asset. ETH in, BTC out is common. Use the bridge’s own explorer, and expect the trail to move to a chain with a different model.

What public tracing found: two cases

Bybit, February 2025

On February 21, 2025, about $1.5 billion was stolen from the exchange Bybit. Five days later the FBI attributed it to North Korea, an activity it calls “TraderTraitor”, and published Ethereum addresses that “are holding or have held assets from the theft”, asking exchanges and services to block transactions with them. The thieves had “converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses.”

Analytics firms traced the laundering in public as it happened, and their accounts differ in detail:

Bybit offered a bounty of up to 10% of recovered funds. The case shows both sides of tracing: the money could be followed hop by hop across chains, and it was only stopped where it touched a service able and willing to freeze it.

Bitfinex, recovered six years later

In 2016, 119,754 bitcoin were stolen from Bitfinex. In February 2022 the US Department of Justice announced it had seized more than 94,000 of them, valued at over $3.6 billion. The laundering it alleged included “fictitious identities,” “computer programs to automate transactions,” and “chain hopping.” The DOJ’s summary of the method was simple: “we can follow money through the blockchain.”

The lesson is time. The record does not expire. Bitcoin’s own privacy page warns that “something not traceable currently may become trivial to trace in the future.”

Where tracing stops

Clustering is a probability. Grouping addresses under one owner “is inherently probabilistic, so every cluster comes with a confidence level,” and “over-eager clustering can wrongly merge unrelated actors.” A 2025 peer-reviewed study of Chainalysis’s clustering found it “produces very few false positives (less than 0.5 percent)” while describing its clusters as “a reliable lower bound”, between 24.54% and 94.85% accurate across the cases studied.

Attribution is a lead, not proof. “Treat on-chain attribution as a lead, not courtroom proof.” Tools label differently, so “corroborate high-stakes conclusions across sources.” TRM’s guidance is to use “precise confidence language” and to document “the original data sources, the heuristics or methods applied.”

Some tools break the trail. “Mixers, cross-chain bridges, privacy coins, and chain hopping all obscure or sever the link between source and destination.” TRM notes that mixers are “major hurdles for most investigators,” especially those relying on free online tools. Using one is not proof of a crime either: Chainalysis notes that “many use mixers out of a preference or need for privacy.”

Names come from outside the chain. “Blockchains do not store personal identifiers such as names, email addresses, phone numbers, or IP logs.” “Linking wallets to people often requires KYC data from exchanges,” which exchanges share with law enforcement, not with the public.

Ethics. A trace about money is not a licence to name a person. Do not publish a private individual’s identity on the strength of an inferred link, and do not contact or confront someone you think is behind an address. If you are a victim, take your hop-by-hop record to the police and to the exchanges where funds landed; they are the ones who can freeze and identify.

Workflow checklist