Hop by hop, and documented.
Following value across addresses, bridges and services — with every step referenced to a transaction anybody can verify, and every inference labelled as an inference.
What is crypto transaction tracing?
Crypto asset tracing follows a transaction from one address to the next across a blockchain, and where possible across bridges into other chains. It establishes the path funds took and which services received them. Traces go cold at mixers, at privacy tooling, and wherever a cross-chain transfer cannot be matched to its destination.
Five moves, repeated until the trail ends.
Anchor
Establish the starting transaction and confirm it on the network it claims to be on.
Expand
Resolve the counterparties of that transaction and the value each received.
Weight
Follow value by share, not by curiosity. Small dust branches are recorded, not chased.
Classify
Mark each counterparty: unattributed, attributed service, bridge, or high-risk category.
Terminate
Stop at an identified service, a construction that breaks the trace, or the configured depth — and say which.
A trace that never ends is a trace that means nothing.
| Condition | What happened | How it is reported |
|---|---|---|
| Identified service | Value reached an attributed exchange or custodian. | Reported as an intervention point. |
| Depth limit | The agreed hop depth was reached. | Reported with the depth stated, so it can be extended if it is worth extending. |
| Value floor | The remaining share fell below the materiality threshold. | Recorded, not chased. |
| Broken trace | Funds entered a pooling or mixing construction. | Reported as a break, never continued on assumption. |
| Unmatched bridge | A cross-chain transfer could not be matched with confidence. | Reported as ending at the bridge. |
A trace in a ChainwatchCrypto report is not a diagram with arrows on it. Every hop cites the transaction that produced it, on the network it occurred on, so a reviewer can verify the path independently without asking us for anything.
Where a step rests on a clustering heuristic rather than a direct transfer, the report says so, names the heuristic and states its confidence. A reader always knows which parts of a path are observed and which are inferred.
Before you pay anyone, report the theft.
Reporting is free, it takes minutes, and it is the step most likely to matter. Do it before you engage us or any other investigator. A tracing report is far more useful to an exchange or a prosecutor when a formal complaint already exists to attach it to.
FBI IC3
The FBI Internet Crime Complaint Center. The primary US route for crypto theft and fraud. File here even if the amount feels small — IC3 aggregates reports, and clusters get investigated.
FTC ReportFraud
The Federal Trade Commission’s fraud reporting service. Covers scams, impersonation and investment fraud, and feeds a database used by law enforcement across the US.
CFTC
The Commodity Futures Trading Commission. The right route where the loss involves crypto derivatives, leveraged trading or a fraudulent trading platform.
SEC
The Securities and Exchange Commission. Use this where the asset or scheme was presented as an investment, a token sale or a fund.
Your local police
File a report in your own jurisdiction and keep the reference number. Banks, exchanges and insurers frequently require it, and it is often the precondition for any formal request to a service.
Report to your national fraud or cybercrime body and to your local police. If a card or bank transfer was involved at any point, contact your bank immediately — that is the one channel where speed can still change the outcome.
Blockchain analysis establishes where funds went and whether an intervention point exists. Whether anything is recovered depends on where the funds landed, how quickly you acted, and whether a cooperating exchange or authority sits at the end of the path. Read exactly what we can and cannot do, and how to spot a recovery scam before you pay anybody.