Hop by hop

A trace starts from a known transaction, usually one you sent. The investigator follows each onward transfer: a hop. Funds often split, merge and move quickly, so a trace can involve dozens of hops across several chains.

Attribution

Addresses don't carry names, but many can be linked to services: exchanges, payment processors, mixers, or wallets already flagged for fraud. Each attribution should come with a source and a confidence level. Good investigators check the ones that matter most before they rely on them.

Mixers and bridges

Mixers pool funds from many users to break the link between deposits and withdrawals. Bridges move value between chains. Both slow a trace down. Neither makes it impossible, and an honest investigator will say how far the trace is likely to go.

Where funds are now

The useful output of a trace is not "we found your money". It's a clear breakdown: how much reached a regulated exchange, how much sits in unhosted wallets, and how much hasn't been traced yet. Regulated exchanges can freeze funds when police or a court asks them to.

Documenting the evidence

Every hop, address, amount and attribution goes into an evidence report, with sources and timestamps, so someone who wasn't involved can check it. That report is what police, prosecutors, lawyers and exchanges act on.

What to do next