How to trace funds after a scam
A practical, evidence-first guide to following stolen crypto: what to secure in the first hours, how a trace is actually built hop by hop, where it ends, and how it becomes evidence a court or investigator can use. Tracing establishes facts; it does not guarantee recovery.
What tracing funds after a scam means
Tracing funds after a scam is the process of reconstructing, from public blockchain records, where money went after it left your control — hop by hop, from the first transaction you signed to the exchange deposit, service or wallet holding it now. It produces a documented flow of funds, not an automatic refund.
Two things determine how useful that reconstruction becomes: how quickly the surrounding evidence is preserved, and whether the analysis is documented to a standard someone else can reproduce. Our forensic methodology sets out the confidence tiers and chain-of-custody controls behind every step below, and our investigation services describe where a trace fits into a wider case.
The seven steps of a defensible trace.
- 01
Stop the loss and secure what remains
Disconnect the compromised wallet from every dApp, revoke outstanding token approvals, and move any remaining balance to a newly generated wallet whose seed phrase has never been typed into a website. If a custodial account was involved, freeze withdrawals and enable a fresh second factor.
- 02
Preserve the evidence before it disappears
Capture full-page screenshots with visible URLs and timestamps, export chat logs, save the original emails with headers intact, and record every transaction hash, wallet address, chain, amount and date. Platforms delete accounts and channels quickly; what you save in the first days is often the only record that survives.
- 03
Establish the starting point on-chain
Every trace begins with a confirmed transaction hash and the address that received your funds. Verify the hash on a block explorer for the correct network. An address that looks familiar is not enough — character-for-character verification prevents tracing an address-poisoning lookalike.
- 04
Follow the flow of funds hop by hop
Funds are moved through intermediary wallets, swapped between assets, routed across bridges and sometimes through mixing services. Each hop is documented with its hash, timestamp, value and the reasoning that connects it to the previous hop, so the chain of inference is visible rather than assumed.
- 05
Cluster addresses and attribute endpoints
Co-spending and behavioural heuristics group addresses under common control. The objective is the endpoint: a deposit address at a centralised exchange, a payment processor or another regulated service that holds identity records behind it.
- 06
Report to law enforcement and the receiving platform
File with IC3 and your state authorities, and notify the receiving exchange with the hashes and addresses attached. Exchanges act on legal process, not on victim requests alone — but a documented, timely notice puts the account on record and supports any later subpoena.
- 07
Convert the trace into usable evidence
A trace only helps if counsel and investigators can rely on it. That means a written report with reproducible methodology, cited sources, stated confidence levels, chain-of-custody notes and exhibits an opposing expert could re-run.
Four mistakes that end traces early.
Paying an upfront recovery fee
Anyone guaranteeing recovery for a fee paid in crypto is running a second scam on the same victim. Tracing and recovery are different activities, and no one can guarantee the second.
Waiting weeks before acting
Stolen funds usually reach an exchange within hours to days. Evidence preservation and platform notice are far more effective early than after the trail has been laundered and the account emptied.
Tracing the wrong address
Copying an address from a chat message or a poisoned transaction history sends the whole analysis down a false branch. Confirm from the block explorer record of your own transaction.
Screenshots without context
An image with no URL, no timestamp and no device record is weak evidence. Metadata and provenance are what make an exhibit defensible.
If the loss is recent, work through our case process and start the intake checklist while the evidence is still live.
Questions people ask before starting a trace.
Can stolen crypto actually be traced?
On public chains such as Bitcoin, Ethereum and most EVM networks, every transfer is permanently recorded, so the movement of funds can be followed. Privacy coins and mixing services reduce visibility, and tracing establishes where funds went — not automatically who controls them.
How long does a trace take?
A focused trace on a single flow of funds is typically a matter of days. Cases with many victims, cross-chain bridging or dozens of hops take longer because each inference has to be documented rather than assumed.
Does tracing mean I get my money back?
No. Tracing produces evidence. Any return of funds depends on law enforcement action, civil proceedings, or a platform freezing an account under legal process. We never promise recovery.
Is it too late if the scam happened months ago?
Older cases are harder but not pointless. Blockchain records do not expire, so the trail still exists — what fades is off-chain evidence, platform logs and the balance sitting in the receiving account.
More answers sit on our FAQ. Reporting routes differ by state — see the state-by-state reporting guides — and recent case commentary is published on the blog. Nothing here is legal advice, and no outcome is promised; see our disclaimer.
Have a transaction hash? That's enough to begin.
Send the hashes, addresses and timeline you have. We respond within one business day with a candid assessment of what a trace can and cannot establish in your case.