Blockchain tracing is often described either as trivial, because the ledger is public, or as a dark art. It is neither. It is a structured process with well-understood techniques and equally well-understood limits, and knowing where those limits fall is what separates a useful assessment from an expensive one.
Start with the fact that the ledger does not forget
Every transfer on a public blockchain is recorded permanently and readably. Given one transaction hash, anyone can see the sending address, the receiving address, the amount and the time. From the receiving address, the next transfer is equally visible, and so on indefinitely.
This is genuinely different from traditional financial investigation, where each hop requires a legal instrument served on a different institution in a different jurisdiction. On-chain, the ledger is already served.
What the ledger does not contain is identity. It records that value moved between two strings. Establishing who controls a string is the actual work.
Clustering: from addresses to actors
The first problem is volume. A fraudulent operation may move funds through hundreds of addresses to make following them impractical. Clustering collapses that back down.
Common-input ownership. On Bitcoin and similar chains, when a transaction spends from several addresses at once, all of them are normally controlled by the same party, because signing requires all their keys. This single heuristic resolves large numbers of addresses into single entities.
Change detection. Bitcoin transactions typically return change to a new address controlled by the sender. Identifying which output is change extends a cluster forward.
Behavioural patterns. Timing, round-number amounts, gas settings, consistent fee strategy, reuse of a specific bridge or swap route. Individually weak, collectively distinguishing.
Deposit-address correlation. Exchanges issue a unique deposit address per customer. Funds arriving at one and being swept into the exchange's main wallet identify the service and, critically, mean a specific customer account exists on the other side of it.
Clustering is inference, not proof. A well-built cluster is highly reliable; an aggressive one produces false attribution. This matters, because a wrong cluster in a report handed to police names the wrong person.
Following value across chains
Modern fraud does not stay on one network. Funds are bridged, swapped through decentralised exchanges, converted into stablecoins and moved again. Each transition breaks a naive trace, which is where most amateur analysis stops.
Continuity is re-established by matching on the other side. A bridge takes value on chain A and releases it on chain B, usually within a predictable window and in a matching or fee-adjusted amount. Correlating the two by amount, timing and the bridge's own contract records reconnects the trail. Swap protocols leave equivalent records. It is painstaking rather than clever, and it is most of the work.
Attribution: connecting a cluster to the world
A cluster becomes actionable only when it connects to something outside the chain.
Service identification is the most valuable outcome. If funds reached a deposit address at a regulated exchange, there is a customer account behind it with identity documents attached. Nobody hands those to a private firm. They are obtainable through law enforcement or a court order, which is precisely why the reporting step matters so much.
Infrastructure correlation links addresses to the platform that published them: domain registration, hosting, TLS certificates, analytics identifiers, payment endpoints. Operators reuse infrastructure, and reuse is what turns one site into a visible group of them.
Open-source intelligence covers the rest: addresses posted publicly, reused usernames, leaked data, forum activity, prior advisories.
Where tracing stops
Being straightforward about this is the difference between an assessment and a sales pitch.
Mixing services and privacy protocols. These exist to break the link between input and output. Post-mixing analysis is probabilistic at best. If a meaningful volume entered a mixer, the honest position is usually that the trail ends there.
Privacy coins. Monero in particular is designed so that the analysis above does not apply. Conversion into Monero is generally a terminal event for a trace.
Uncooperative off-ramps. Some exchanges and peer-to-peer desks will not respond to legal process from any jurisdiction likely to be involved. Knowing exactly where funds went is of limited comfort when the destination is beyond reach.
Time. Not because records expire, they do not, but because the practical options narrow. A freeze is possible while funds sit at a cooperative service. Once withdrawn, that route closes.
Proportionality. Below a certain loss, the cost of civil action exceeds the amount at issue. This is not a technical limit, but it determines the outcome as firmly as one.
What a good trace produces
Even when recovery is not achievable, competent tracing produces things with value: a documented account of what happened, admissible for insurance, tax loss claims and civil proceedings; a law enforcement referral that can be acted on rather than filed; identification of terminal services for freeze requests; and consolidation with other victims of the same operation, which is frequently what makes any of it viable.
The right question to ask before engaging anyone is not "can you trace it". Almost anyone can trace it. The question is what the trace will let you do afterwards, and a firm that cannot answer that specifically has not thought past the invoice.