Bitcoin is often described as anonymous, but that description is wrong in an important way. It is pseudonymous, meaning every transaction is permanently recorded on a public ledger under wallet addresses rather than names. That distinction is the entire basis for how stolen Bitcoin gets traced. This guide explains the actual mechanics, in plain language, without oversimplifying the parts that matter.
Understanding the UTXO Model First
Bitcoin does not work like a bank account with a running balance. It uses what is called the unspent transaction output model, or UTXO model. Every bitcoin you own exists as a discrete output from a previous transaction, sitting unspent until you spend it. When you make a payment, your wallet software selects one or more of these UTXOs as inputs, and the transaction creates new outputs, one going to the recipient, and often a second one, called change, going back to a new address you control.
This matters for tracing because every transaction leaves a visible, permanent link between its inputs and its outputs. A stolen Bitcoin does not disappear into a black box, it moves from one specific UTXO to specific new UTXOs, and that chain of custody is recorded forever, whether the person involved wants it to be or not.
It helps to think of each UTXO as a distinct, uniquely identifiable coin rather than a number in an account balance. If a thief steals 1.5 BTC that existed as three separate UTXOs of 0.5 BTC each, sitting at three different addresses because of how the victim's wallet had previously received funds, tracing has to follow all three of those discrete units, not a single abstract balance. This is a meaningfully different problem from tracing a bank account balance, and it is also what makes clustering, described below, both necessary and possible.
The Starting Point: The Theft Transaction
Every trace begins from the confirmed transaction that moved the stolen funds out of the victim's wallet. This transaction has a unique identifier, and it shows exactly which address the funds moved to next. From there, an investigator is essentially playing a very disciplined game of following the money, transaction by transaction, hop by hop.
Clustering: Turning Addresses Into Entities
The address the stolen funds land on is rarely the end of the story, and it is rarely the only address controlled by that person or service. This is where clustering heuristics come in, techniques that group multiple addresses together as very likely belonging to the same entity, even though nothing in the blockchain explicitly labels them that way.
The co-spend heuristic
The most important and reliable of these is known as the co-spend or common input ownership heuristic. When a transaction has multiple inputs, meaning it spends more than one UTXO at once, all of those inputs must have been signed by whoever controls the corresponding private keys. In practice, that almost always means all of those input addresses are controlled by the same wallet, and therefore the same person or service. A thief who consolidates funds from several addresses into one transaction, something that happens constantly for convenience, inadvertently reveals that all of those addresses belong to them.
The change address heuristic
The second key technique identifies which output in a transaction is the change returning to the sender, as opposed to the actual payment. Change outputs tend to have identifiable characteristics, such as being a newly used address, or having an amount that does not match any round number a recipient would expect. Correctly identifying the change output lets an investigator keep following the same actor's funds through what would otherwise look like a dead end, rather than mistakenly following the money to an unrelated recipient.
Together, these heuristics let a single starting address expand into a cluster, sometimes dozens or hundreds of addresses, that can be attributed with high confidence to one wallet or service. Commercial blockchain intelligence platforms automate this clustering across the entire blockchain, combined with behavioral fingerprinting and known address labels, but the underlying logic is the same reasoning described above.
Peel chains and behavioral fingerprinting
Stolen funds are frequently moved through what investigators call a peel chain, a sequence of transactions where a large UTXO is repeatedly split, sending a small amount to a destination address while peeling off the remainder as change to a new address controlled by the same actor, over and over across many hops. This pattern is extremely common in laundering attempts because it superficially resembles ordinary wallet activity, but it has a recognizable signature: a long sequence of transactions each with two outputs, one shrinking balance carried forward as change, and small amounts branching off along the way. Recognizing a peel chain lets an investigator follow the primary balance through dozens of hops without getting lost in the smaller branching amounts, most of which eventually terminate at spending destinations like exchanges or merchants.
Investigators also rely on behavioral fingerprinting, patterns like consistent transaction timing tied to a particular time zone, a preference for round number amounts, reused fee rates, or a tendency to consolidate funds after a certain number of hops. None of these signals is conclusive on its own, but combined with the co-spend and change heuristics they build a probabilistic picture that is often strong enough to support a legal referral.
Finding the Chokepoint
Tracing addresses is only useful if it eventually leads somewhere actionable. That somewhere is usually a chokepoint, a point in the fund flow where the anonymous blockchain world touches a service that keeps records tied to real identities. The most common chokepoint is a centralized exchange, which by regulation typically requires identity verification for its customers.
- Centralized exchanges, which generally hold know your customer records that can be disclosed to law enforcement or through valid legal process
- Payment processors and on ramp or off ramp services that convert crypto to fiat currency, which often carry similar compliance obligations
- Hosted or custodial wallet providers, which control the private keys on behalf of a user and can act on legal requests
- NFT marketplaces and other platforms where laundered funds are sometimes spent or converted
Once a cluster of addresses can be tied to a deposit at one of these services, an investigator can prepare a report identifying the deposit, the timing, and the transaction path connecting it back to the theft, ready to support a subpoena, a law enforcement referral, or a direct request to the exchange's compliance team.
According to published research from blockchain intelligence firm TRM Labs, structured tracing investigations that start from a confirmed theft reach an identifiable exchange deposit in a large majority of cases within around fifteen transaction hops, provided the funds are not routed through privacy enhancing tools along the way.
A Worked Example: Following a Theft Step by Step
Suppose a victim's wallet is drained of 2 BTC in a single transaction to an address controlled by the thief. That address holds the 2 BTC briefly, then the thief combines it with 0.3 BTC from an unrelated address in a new transaction, an action that, under the co-spend heuristic, reveals both addresses are controlled by the same wallet. The transaction sends 2.1 BTC to a new address and returns 0.2 BTC as change to a freshly generated address, identifiable as change because it has never been used before and receives an amount that does not match any round number a recipient would expect.
From there, the 2.1 BTC is split again across several hops in a peel chain pattern, small amounts branching off at each step while the bulk of the balance carries forward. Eventually, the remaining balance, now perhaps 1.6 BTC after several small peels, is deposited into an address that a blockchain intelligence platform has already labeled as belonging to a known centralized exchange, based on that exchange's publicly observed deposit and withdrawal patterns. At that point, the trace has reached its chokepoint. An investigator documents the full path, the original theft transaction, every intermediate hop, the peel chain structure, and the final deposit, and that documentation becomes the basis for a report to the exchange or a law enforcement referral.
Common Misconception: Mixing Services Make Funds Completely Untraceable
It is worth directly addressing a belief that shows up constantly in online discussions of crypto theft: that running stolen funds through a mixer makes them permanently and completely untraceable. This overstates what a mixer actually does. A mixing service pools funds from many depositors and pays out from that shared pool, which breaks the simple one to one link between a specific deposit and a specific withdrawal, and that is a genuine obstacle. But it does not erase the transactions themselves from the blockchain, and it does not guarantee that timing, amount, and behavioral analysis cannot still connect a depositor to a later withdrawal with meaningful confidence, particularly for mixers with smaller user pools or predictable payout patterns. Several major mixing services have also been sanctioned or taken offline by law enforcement in recent years, and funds that passed through them before the shutdown have, in some documented cases, still been connected to their destination through records seized during those actions.
What Makes Tracing Harder
Not every case resolves this cleanly. Thieves increasingly use techniques specifically designed to break these heuristics, including running funds through mixing services that pool and redistribute coins to obscure their origin, converting to privacy focused coins like Monero that do not use a transparent ledger in the same way, and bridging funds across multiple blockchains, which our companion guide on how investigators trace funds across multiple blockchains covers in depth. Each of these techniques adds friction and cost to a trace without making it impossible, but they meaningfully reduce the odds of reaching a clean chokepoint.
- CoinJoin style transactions, which combine multiple users' inputs and outputs into a single transaction specifically to obscure which input corresponds to which output
- Cross chain bridging, moving funds to a different blockchain entirely partway through the laundering process, covered in our dedicated guide on cross chain tracing
- Chain peeling combined with rapid, high volume splitting across dozens of addresses in a short window, designed to overwhelm manual review
- Use of swap services with no identity verification and peer to peer marketplaces that do not require compliance checks before converting funds
Why This Matters Even Without a Guaranteed Recovery
It is worth being direct: tracing stolen Bitcoin does not, by itself, return the funds to their owner. What it produces is a documented, defensible account of where the funds went, which is the foundation required for any recovery effort through law enforcement or legal channels, discussed further in our guide on whether stolen cryptocurrency can be recovered. Without that documented trail, there is no case to bring to an exchange or a court in the first place.
Frequently asked questions
No. Bitcoin is pseudonymous, meaning transactions are tied to wallet addresses rather than names, but every transaction is permanently visible on a public ledger. Clustering techniques and exchange records can often connect addresses to real identities, which is the opposite of true anonymity.
Yes, in many cases. Converting Bitcoin to another asset, whether through an exchange or a decentralized swap, typically leaves its own on chain or off chain record. Investigators follow the trail across that conversion using techniques covered in our cross chain tracing guide, though each conversion adds complexity to the investigation.
No. Tracing relies entirely on the permanent, public record of transactions on the blockchain and does not require any cooperation from the person who stole the funds. What tracing cannot do on its own is force the return of funds, that requires reaching a chokepoint like an exchange and pursuing legal action.
Professional investigators typically use commercial blockchain intelligence platforms that automate address clustering, apply known entity labels, and visualize fund flows across millions of transactions, combined with manual analysis to verify and document findings for legal or law enforcement use.
A peel chain is a sequence of transactions where a large balance is repeatedly split, sending a small amount to a destination while the remainder carries forward as change across many hops. It is a common laundering pattern, and recognizing it lets investigators follow the primary balance through many transactions rather than losing the trail in the smaller branching amounts.
Sources and further reading
- The Fundamentals of Cryptocurrency Transaction Tracing · TRM Labs
- Analyzing Hack Subnetworks in the Bitcoin Transaction Graph · arXiv
- Cryptocurrency Crime Information · Internet Crime Complaint Center, Federal Bureau of Investigation