How to trace stolen crypto (USDT, USDC, ETH, BTC)

Public blockchains record transfers. Tracing is the disciplined reading of that record: start from a victim-controlled source event, walk forward (and sometimes backward when origin matters), and document each hop with amount, time, hash, and a label only when the label can be defended.

For victims, the useful output is usually not a screenshot of an explorer. It is a path you can attach to a letter: which addresses moved value, where confidence is high or low, and whether a custodial cash-out appears.

• BTC: UTXO model. Peels, change outputs, and cluster heuristics matter. Mixers and CoinJoin-like patterns can collapse confidence.
• ETH and other EVM chains: account model. Approvals, contract calls, DEX swaps, and bridges are common. Token transfers (ERC-20) sit beside native ETH moves.
• USDT / USDC: stablecoins on multiple networks (Ethereum, Tron, Solana, and others). Always specify the network; the same ticker is not the same ledger.
• Cross-chain bridges: value may leave one chain and appear on another. Bridging does not erase the trail, but it adds hops and labeling risk.

MBTrace’s standard scope includes Bitcoin, Ethereum and major EVM chains (Arbitrum, Base, Polygon, BNB Chain), Tron, and Solana. Outside that list, scope is discussed before work starts.

1. Scope: network, source hash or address, time window, and what is being claimed.
2. Graph: follow value forward; keep or drop branches with reasons.
3. Attribution: apply service labels only where evidence supports them (known hot wallets, contracts, public clusters).
4. Document: state findings and boundaries side by side — including dead ends.

Honest labeling includes confidence. “Known exchange hot wallet” is not the same as “named person.” A report that invents a named account from a hot wallet is not defensible.

When stolen value lands in a custodial service that collects identity under local rules, that service is often the only practical letter recipient on the observed path. Tracing looks for that point. It does not force the exchange to act, and it does not identify the account holder from public data alone.

If funds enter mixers, privacy pools, or long chains of unlabeled wallets, the defensible conclusion may be: no letter recipient on the observed hops.

• Cannot reverse or recall confirmed transfers.
• Cannot see off-chain deals, cash handovers, or private messages.
• Cannot always pierce mixers or poorly labeled bridges.
• Cannot promise that police or an exchange will freeze anything.
• Cannot turn a hot-wallet label into a personal identity without additional process outside the public chain.

Any service that promises guaranteed recovery from tracing alone is selling an outcome it does not control.

Explorers are excellent primary sources. For counsel or police, you still need a coherent narrative: ordered hops, amounts, times, hashes, and explicit gaps. That packaging is what a paid investigation PDF is for.

At MBTrace, an analyst reviews the case before any payment. If the case cannot be taken, it is declined and you pay nothing. Accepted cases are quoted from $50+, with typical delivery 24–48 hours after payment. A sample anonymized report format is available on the site.

When you review hops yourself, separate facts from inference. A hash, amount, and timestamp are facts. “This must be the scammer’s personal Binance account” is usually an inference you cannot defend from public data. Prefer: “value entered a deposit cluster consistent with Exchange X.”

• Check that token contracts are the real USDT/USDC for that network — spoof tokens exist.
• Watch for change outputs on Bitcoin that are still yours.
• Treat bridge deposit and withdrawal txs as a pair when documenting cross-chain movement.
• Record when confidence drops (mixers, fresh wallets funded from unknown sources).

Good documentation helps even if you never hire anyone: future you, future counsel, and future compliance tickets all need the same primary identifiers.

Tracing quality depends on a usable starting event. If you still lack the source hash, spend time finding it before paying for analysis. If funds are mid-bridge, waiting a few hours for the destination leg to appear can clarify the graph.

Simple single-rail peels may resolve quickly; multi-chain splits with weak labels take longer. Typical paid turnaround after acceptance is measured in hours to a couple of days for standard scopes — not because the chain is slow, but because attribution and write-up must stay defensible.