Wallet-Tracer

This tool surfaces patterns in public blockchain data. Patterns are leads, not verdicts. The points below were learned the hard way tracing a real theft — each one is a mistake that wastes days or, worse, puts a wrong name in a report. Read them before you trust a result.

1. An exchange wallet is a wall, not a hub — never read its depositors as victims.

When money reaches a centralized exchange (Bybit, Gate.io, Coinbase…), the on-chain trail ends. Thousands of unrelated people deposit into the same exchange wallet, so they all look like "sent money in, got nothing back" — the same shape as a victim. If you scan an exchange wallet expecting victims, you'll get hundreds of false ones. The tool now warns you when you start on a known exchange, but tagging isn't perfect: if a wallet has thousands of counterparties and heavy two-way flow, treat it as an exchange or service, not a scammer. To learn who's behind an exchange deposit, law enforcement must send the exchange a legal request — the blockchain can't tell you.

2. A busy hub is not a victim — check before you accuse.

A wallet that received a lot and also sent a lot onward, or that has hundreds or thousands of counterparties, is infrastructure — a mule, a mixer, a relay, or a service — not a person who lost money. A real victim usually deposits once or a few times and stops. A coincidental match on amount (someone who lost "about what you lost") means nothing until you confirm it's the same token and the wallet actually behaves like a victim. The victim census now filters these out automatically, but when you're clicking around manually, this is the easiest and most damaging mistake to make.

3. Start from the thief's wallet if you know it — not just your own.

Your own drained wallet mostly shows one thing: the path your money took out. The scammer's collection wallet shows the whole operation — every victim feeding in, the relays, and the exits toward exchanges. Scan the hub first, then follow the interesting wallets it reveals. Use your own wallet as a cross-check that the theft transaction connects where you expect.

4. The numbers are relative scale, not dollars.

Value figures shown here are unit-less and mix different tokens. A "bigger" number moved more of something, but it is not a dollar amount and not necessarily the token you care about. Always open the transaction on the block explorer (every address links out) to confirm which token, how much, and the real value before putting a figure in any report.

5. Verify every address independently before you act on it.

A category label here is the tool's guess from a pattern. Before you report, accuse, or file anything, open each key address at its public block explorer and confirm it with your own eyes. This is investigative assistance — it does not confirm guilt, freeze funds, or take any action for you, and it is not legal or financial advice.

6. Chain-of-custody tracing follows money. It will not find who's in charge of a contract — that takes a separate, deliberate step.

The instinct on a known phishing act is to trace the stolen funds and run Contract Intel on the deployer of the vault/drainer contract — and that's correct, but it's not the whole picture. Every contract sitting on an edge of that custody chain — every wallet the funds merely passed through, not just the original trap — can itself have an owner or admin, and ownership almost never shows up as a transaction. It's often set once at deployment, stored silently in the contract's internal state, with no transfer to see. Money-tracing will never surface it, no matter how thoroughly you scan — it's a fundamentally different question ("who controls this?") from the one transaction graphs answer ("where did the money go?"). Run Contract Intel on every contract-type node touching your custody chain, not only the one that looks like the obvious center of the case — a "boring" secondary contract can turn out to be the one with the real owner behind it.

7. A custody chain moves forward in time. A hop dated before the theft doesn't belong in it, no matter how real the transaction is.

A wallet can be a genuine, active part of a criminal operation's infrastructure and STILL be the wrong hop for one specific case — if the dated evidence you have for it predates the theft, it's necessarily some other batch of funds moving through the same pipeline, not this one. This tool's own amount-anchored tracing (the theft anchor's token/amount/date, set from the auto-trace panel) already filters this out automatically when following stolen value hop by hop. That protection does NOT extend to manual work — hand-picking an edge's sample transactions, building a report by inspecting raw data directly, or citing a "representative hash" for a busy pipeline. Every single date used as evidence for a specific theft must be individually checked against that theft's date before it goes in front of anyone else, especially in anything meant for a filing or referral.

Getting Started

This tool helps you trace where stolen or suspicious crypto went, by mapping out which wallets sent money to which other wallets — the same basic idea professional investigators use, running entirely on your own device.

Start with one address. If you know the thief's wallet, start there — scanning the hub reveals the whole operation (victims feeding in, relays and exchanges leading out), while your own wallet mainly shows the theft path. Enter it in the box above and click Investigate. The tool pulls that wallet's real transaction history from a public blockchain explorer and draws every wallet it has ever dealt with.

Click around. Tap any dot in the network to see its details — how much moved, when, and (when available) whether it's a known exchange, a contract, or shows a suspicious pattern like a relay or funnel.

Mark what you find. If you're confident a wallet is part of the scheme, set its category to Suspected Scam. This isn't automatic — it's your judgment, recorded — but it powers the next step.

Keep tracing. Click "Trace this wallet →" on any connected wallet to expand the map one hop further, following the money.

Have a transaction file already? Use Bulk Scan to upload a CSV or JSON export and automatically flag every wallet connected to something you've already marked Suspected Scam.

Save your work. Click Download backup regularly — this is the only copy of your research; nothing is stored anywhere except your own device.

When you're ready to report it, click Generate Exhibit — Flagged Only to produce a small, clean report (a labeled flow-chart diagram + wallet table, just the wallets that matter) you can send to law enforcement, an exchange, or anyone else who needs to see your findings. Use "Full Network" only for a complete visual overview — it can get large and slow to open on big networks.

⚠ Important: this tool surfaces patterns and public information — it does not confirm guilt, freeze funds, or take any action for you. Always independently verify anything before acting on it, especially before accusing a specific person or organization of wrongdoing. This is investigative assistance, not legal or financial advice.