How to Trace a Bitcoin Transaction

Every Bitcoin transaction that has ever happened is permanently visible to anyone. That's the starting point for tracing — but "visible" doesn't automatically mean "identifiable" or "recoverable." Here's how the tracing actually works, and where its real limits are.

Bitcoin's ledger: public, but pseudonymous

Bitcoin doesn't have accounts with balances in the way a bank does. Instead it uses the UTXO model — Unspent Transaction Output. Every transaction consumes one or more previous outputs as inputs and creates new outputs. An address's "balance" is really just the sum of whatever unspent outputs currently point to it.

Addresses themselves are just cryptographic identifiers — they carry no name, no registration, nothing that inherently ties them to a real person. That's what "pseudonymous" means here: the ledger is completely transparent about what moved where, while staying silent about who controls either end, unless something outside the blockchain itself connects the dots.

Reading a single transaction

A block explorer (a website that reads and displays the public blockchain — this site's Trace tool uses one under the hood) will show you, for any transaction ID:

Inputs — which previous outputs are being spent, and from which addresses
Outputs — the new outputs being created, their amounts, and their destination addresses
Fee — the difference between total input value and total output value, paid to miners
Confirmation status — how many blocks have been mined on top of it, which is what makes it practically irreversible

A transaction very often has more than one output. If someone sends 0.01 BTC but their input was a 0.05 BTC output, the transaction will typically include a second, "change" output sending the remaining ~0.04 BTC (minus fee) back to an address the sender still controls — usually a brand-new address, not the original one. Recognizing likely change outputs is one of the basic building blocks of following a chain of funds further.

Following funds across hops

Tracing rarely stops at one transaction. The usual process is:

Start from a known transaction ID or address.
Look at where its outputs went — the next transaction(s) those outputs were later spent in.
Repeat, building out a graph of addresses and transactions connected by the flow of value.
Watch for fan-out (funds split across many small outputs, often to obscure the trail) and fan-in (many small amounts consolidated into one, often at an exchange deposit address).

This is exactly what a fund-flow graph is — a visual map of that hop-by-hop expansion, which is much easier to reason about than reading raw transaction lists once a trail spans more than two or three hops.

Attribution is inference, not proof

Some addresses are publicly known to belong to specific entities — exchange hot wallets, well-known services — because third-party analytics providers have tagged them, usually based on patterns observed when that entity's own customers deposit or withdraw. This is genuinely useful information, but it's important to be precise about what it is: a third party's inference, not a fact verified by the blockchain itself.

There's a real difference between:

A confirmed fact — directly observable on-chain, like "this output paid this address this amount."
A third-party attribution — a claim, from an outside source, that a given address belongs to a named entity. Usually reliable for well-established exchange wallets, but still a claim, not a cryptographic guarantee.
Unknown — no attribution available at all, which is the most common state for the vast majority of addresses.

Any tracing tool or report worth trusting should distinguish between these clearly rather than presenting an inferred label as an established fact.

What tracing can't do

This is the part that matters most if you're tracing funds after theft or a scam:

Tracing doesn't move money. Following funds to an exchange's known deposit address tells you where they went, not how to get them back. Only that exchange, acting on its own compliance process (often triggered by a police report or legal request), can freeze or return funds — and only if they haven't already been withdrawn.
Pseudonymous isn't anonymous, but it isn't automatically identified either. Real-world identification usually requires something outside the chain itself: an exchange's KYC records tied to a deposit, a reused address linked elsewhere, an investigative subpoena. Tracing on its own gets you the addresses and amounts, not necessarily a name.
Mixers, CoinJoins, and cross-chain swaps can break the trail. Techniques designed specifically to obscure fund flow, or moving value to a different blockchain entirely, can make a trace go cold at that point. A trace ending doesn't always mean the funds vanished — it can mean they left the part of the ledger you can observe.

A practical starting checklist

If you're tracing a transaction related to a theft or scam, for your own understanding or to support a report to law enforcement or an exchange:

Get the exact transaction ID(s) and/or address(es) involved.
Use a public block explorer or a graph-based tracing tool to follow the outputs forward.
Note any address that's attributed (even tentatively) to a known exchange — that's a realistic point of contact for reporting.
Document everything as you go: transaction IDs, addresses, amounts, timestamps, and screenshots. This record is exactly what a police report or exchange fraud team will ask for.

If that's the situation you're in, see our guide on what to do after a crypto scam for the full set of next steps — tracing is one part of a larger process, not a recovery method on its own.