How to Trace Stolen Crypto: The Complete 2026 Walkthrough
Learn how to trace stolen crypto yourself using public blockchain data — the addresses to record, the tools that work, the hop patterns thieves use, and how to turn a trace into evidence a bank, exchange or investigator will act on.
The Money Is Traceable. The Person Is Not.
What a blockchain trace actually produces — and why that is still worth far more than doing nothing.
What this guide says in 5 lines
- Every crypto transfer is permanently recorded and publicly readable — that is the whole basis of tracing.
- A trace produces movement: addresses, amounts, timestamps and hops. It does not produce a name.
- The critical window is when funds sit at an exchange or custodian that has to comply with a freeze order.
- Record receiving addresses and transaction hashes before you lose access to any account.
- A trace becomes useful only when it is written down and attached to a report — screenshots alone are weak evidence.
Stolen crypto is traceable in a way that stolen cash never is. Every movement is written into a public ledger, permanently, with a timestamp. What that ledger does not contain is a name — and the gap between "we can see exactly where the money went" and "we know who took it" is where almost every victim’s expectation breaks. This guide closes that gap honestly: it shows you exactly what you can establish yourself, the routes thieves use to break a trace, and the two points in the chain where a trace stops being a curiosity and starts being leverage.
What a blockchain actually records, and what it does not
A blockchain is an accounting log. When you send funds, the network writes one row: this address sent this amount to that address at this block height. That row is public, permanent and verifiable by anyone. Nothing about it can be edited afterwards — not by you, not by the network, not by a court.
The consequence is worth stating plainly, because it is the single most misunderstood fact in this entire subject: the trail never goes cold. Two years later, the same rows are still there, still readable, and still connected to whatever happened next.
What the log does not contain is identity. An address is a pseudonym, created without registration, without a name and without a home address. So tracing answers "where did it go" with extraordinary precision, and "who took it" almost never.
Anyone who tells you they can put a name, a face, a home address or a police station against an address for a fee is lying. Identity requires a subpoena to a regulated intermediary — not a tool.
The seven things to record before you do anything else
A trace you cannot reconstruct in writing is worth very little. Investigators, banks and exchange compliance teams all work from documents, not from your recollection. Extract these seven items first, while you still have access.
If you can only manage two, manage the transaction hash and the receiving address — everything else can be derived from those later.
| # | What to record | Where to find it | Why it matters |
|---|---|---|---|
| 1 | Transaction hash (txid) | Your wallet activity, or the block explorer search by address | The single unique reference that proves the transfer exists on-chain |
| 2 | Receiving address | The detail view of that transaction | The starting point of every downstream hop in the trace |
| 3 | Exact amount and asset | Same transaction detail | Matches your transfer to the trace and sizes the loss precisely |
| 4 | Date and time (with timezone) | Transaction timestamp | Establishes chronology, which institutions use to test credibility |
| 5 | The chain (ETH, BSC, BTC, SOL…) | Where the funds left from | A trace on the wrong chain falsifies the whole report |
| 6 | Your own sending address | Your wallet or exchange withdrawal record | Proves the funds were yours and links the loss to you |
| 7 | Any platform artefact | Screenshots of the site, chat, deposit page, "support" replies | Shows intent and connects an on-chain event to a real-world fraud |
How to run a trace yourself, step by step
You do not need special software to do the basics, and the basics are what most reports actually require. Three steps take about fifteen minutes and produce something an investigator can verify independently.
Work on a desktop browser where you can keep several tabs open, and keep a plain text file for the addresses — not screenshots, because addresses are meant to be copied exactly.
- 01Open a public block explorer for the correct chain and search the receiving address you recorded. The page that loads is the address’s entire public history.
- 02Identify the transfer that matches your amount and timestamp. That is your entry point into the graph; everything else is downstream of it.
- 03Walk forward one hop at a time: for each outgoing transfer, note the destination, the amount and how long it sat before moving. Speed tells you whether it was automated or manual.
- 04Flag every destination that looks like a deposit into a centralised service — those are the only points where a lawful freeze is technically possible.
- 05Write the result as a numbered list with dates, amounts and addresses. This list, not the explorer screenshots, is what you will attach to a complaint.
The five laundering routes that end a trace
Thieves are not trying to hide from the ledger, which is impossible. They are trying to break the link between the ledger and a regulated institution that could be ordered to act. Understanding these five routes tells you how much time realistically remains.
This chart shows, in relative terms, how quickly each route removes your ability to reach the funds through an institution that can be compelled to respond.
How each laundering route reduces your practical leverage
Relative share of the recovery route remaining after the money passes through, by technique
Reading: The top row is the one that matters. Funds sitting at a regulated exchange are the only scenario in which a properly documented trace has a realistic chance of producing a freeze, and that window is usually measured in days.
Where a trace becomes real leverage
A trace by itself recovers nothing. It becomes leverage at exactly two points, and knowing them changes how you spend your time.
The first is a regulated intermediary holding the funds. That institution has compliance obligations, a named contact and a legal reason to respond to a documented request. The second is an official report with enough detail that your case can be joined to others against the same addresses — which is how clusters get built and operations get shut down.
Everything else — the charts, the hop diagrams, the PDF reports — is preparation for those two moments.
One well-documented freeze request to the right exchange compliance desk outperforms a hundred pages of tracing diagrams sent to nobody.
Doing it now, in order
The sequence matters because the fastest-moving deadlines are financial, not legal.
- 01If any part of the loss came from a card or a bank transfer, contact that issuer the same day — those deadlines are the shortest of anything in this process.
- 02Run the trace and write down the seven evidence items. Do not wait for a perfect diagram.
- 03Send a freeze request to any exchange the funds reached, citing the txid and the receiving address.
- 04File at IC3.gov and ReportFraud.ftc.gov with the written trace attached, not described.
- 05Stop. Do not respond to anyone who contacts you offering to recover the funds — that approach is the second scam.
Common questions
Run the trace in your browser, free
Paste the receiving address into the tracer: it reads the public ledger, builds the hop record and exports a dated evidence file you can attach to a report.
Primary sources and further reading
- FBI IC3 — Internet Crime Report www.ic3.gov
- Chainalysis — Crypto Crime Report www.chainalysis.com
- FTC — Consumer Advice: Cryptocurrency Scams consumer.ftc.gov
External links open in a new tab and are provided so you can verify the underlying material yourself. TrueMoneyTalk is not affiliated with these organisations.
Keep reading
Someone you know may be in this situation right now.
Disclaimer: this guide is general information, not legal, financial or recovery advice, and it is not a substitute for advice from a licensed professional in your jurisdiction. Individual outcomes vary and are never guaranteed.