Asset location
Tracing Cryptocurrency: A Walkthrough You Can Follow
No crypto knowledge needed. Every term here is explained the first time it appears, and every address is real — open the links and run the searches as you read.
- Cost
- Free
- Account needed
- None
- Proves
- Where money moved
- Harder part
- Attaching a name
Start here: what you are actually looking at
A blockchain is a public accounting ledger. Every payment ever made in that currency is written into it, permanently, and anyone can read the whole thing for free.
Think of a bank where every customer statement is nailed to the front door forever.
A wallet address is the account number. It looks like this:
1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa. There is no name attached to it anywhere.
A block explorer is just a website that lets you read the ledger. That is all the tools on this page are.
Read this before anything else. The ledger shows you the money with total certainty — how much, when, and which address it went to. Whose address it is, it doesn’t say. That is a separate question with its own methods, and several sections below are about answering it. Just keep the two apart: one is proved by the chain, the other by evidence you had to go and find.
1. Look up a wallet
Go to blockchain.com’s explorer and paste in that address above.
It is the most famous address in Bitcoin — the very first one, from January 2009. Because of a quirk in how the first block was written, the coins in it can never be spent, so people send small amounts to it as a tribute. When I checked, it had received about 65,000 payments totalling roughly 57 bitcoin, all of it stuck there forever.
Look at what you just got, free, with no login and no request to anybody: every payment in and out, the exact date and time of each, the amount, and the address on the other end.
2. Look up a single payment
Now paste in this instead. It is a transaction ID — the receipt number for one specific payment:
a1075db55d416d3ca199f55b6084e2115b9345e16c5cf302fc80e9d5fbf5d48d
22 May 2010. Ten thousand bitcoin for two pizzas — the first time anyone bought a real object with Bitcoin. Ignore the story and look at the shape of it:
131 inputs. One output.
“Inputs” are the wallets the money came out of. “Outputs” are where it went. He needed 10,000 bitcoin, he did not have it all in one place, so he pulled it from 131 of his own addresses at once.
3. The trick that does the real work
Why that matters:
To spend money from an address you need its password — the private key. Only the owner has it. So if a single payment pulls money out of 131 addresses, one person had to unlock all 131.
That proves all 131 addresses belong to the same person.
So the game is: find one payment where your subject’s known address appears alongside others, and you have just gone from knowing one address to seeing their whole wallet. Do it again on the new addresses and it keeps expanding.
This has a formal name — the common-input-ownership heuristic — and it is what the expensive commercial tracing software is built on. You can do it by hand for free.
It is a very strong assumption, not a certainty. There is one deliberate way to break it, covered further down.
4. Spotting money that came back to itself
Bitcoin cannot be split the way cash can. If you hold one whole bitcoin and want to send a tenth of it, the entire coin gets spent and the remaining nine tenths is sent back to a brand new address that you also own.
That returning money is called change, exactly like change from a twenty.
So a payment usually has two outputs, and one of them is not a payment at all — it is your subject’s own money landing in a fresh address of theirs. Follow the wrong one and you spend an hour tracing the pizza shop instead of the person.
How to tell them apart:
- Neat numbers are payments. Exactly 0.5 is somebody paying for something. 0.4913772 is change.
- Matching address style. Addresses start with
1,3orbc1depending on their age and type. If the money came out ofbc1addresses and one output isbc1while the other is1, the matching one is usually the change coming home. - Brand new, then spent again. An address never seen before that gets used again shortly afterwards by the same group is change.
5. Two wallets worth looking at
1FeexV6bAHb8ybZjqQMjJrcCrHGW9sb6uF
About 79,957 bitcoin sitting in it when I checked, and it has never moved a penny. This is widely reported to be money stolen in the 2016 hack of an exchange called Bitfinex. People watch it around the clock waiting for it to twitch.
1933phfhK3ZgFQNLGSDXvqCn32k2buXY8a
This one took in about 111,114 bitcoin over its life and is now empty. Reported to belong to Mt. Gox, a collapsed exchange, and drained as the bankruptcy paid out creditors.
Notice I said reported both times. The balances are facts — you just verified them yourself. The names attached to those wallets come from news reporting and court filings, not from the ledger. Keep those two things separate, especially in a written report.
6. Ethereum works differently
Bitcoin is not the only one. The second big one is Ethereum, and its explorer is Etherscan. Search this:
0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045
That belongs to Ethereum’s co-founder and it is public knowledge.
Ethereum addresses work like a normal bank account — one running balance that goes up and down. There is no change coming back, so the 131-addresses trick from step 3 does not work here. Clustering an Ethereum user is harder.
What you get instead is more detail. Etherscan shows every token and NFT the address holds,
everything it has interacted with, and ENS names — nicknames people
register for their address, like vitalik.eth, because typing the long version is
miserable. Anyone who has registered one has voluntarily attached a name to their wallet, and
that name is often the same handle they use everywhere else.
BlockCypher covers Bitcoin, Ethereum, Litecoin and Dash in one place, which saves time when someone moves between them.
7. Where crypto finally meets a real name
This is the part that actually closes cases.
An exchange is a company that swaps crypto for dollars — Coinbase, Kraken, Gemini and so on. In the United States they are regulated like a bank, which means before you can use one they have to collect and keep your legal name, home address, a photo ID and a bank account. The industry calls that KYC, for “know your customer.”
Almost everybody cashes out eventually. When they do, they send crypto to an address belonging to an exchange, and at that moment the money touches a company that knows exactly who they are.
So you are not trying to unmask an address. You are following the money until it lands at an exchange, and that exchange is who gets subpoenaed.
Exchange addresses are recognisable. They handle enormous numbers of payments, they sweep money into central wallets in a repeating pattern, and Etherscan and the other explorers publicly label a lot of them by name. When you see a big labelled wallet, you have found your target.
Without legal process you get an address. With it you get a person.
8. Other ways to put a name on a wallet
The exchange route needs a lawyer. These do not.
Search the address in quotes
Paste the address into Google or Bing inside quotation marks and search it. Do it in both — they index different things.
People publish their own wallet addresses constantly and forget. Donation buttons on websites, forum signatures, Reddit and X posts, GitHub pages, Telegram groups, YouTube descriptions, invoices, support tickets, fundraising pages. Every one of those is a page with a name or a username sitting next to the address.
Ten seconds, no cost, and hardly anybody does it. Run it before anything clever.
Search breach and leak data
Intelligence X indexes leaked databases, paste sites, archived pages and dark web material — and it treats a Bitcoin address as a searchable term in its own right.
That matters because an address sitting inside a leaked database is an address somebody typed into a form, next to their email, their username, sometimes their real name. Other services in this category, such as DeHashed, let you search almost any field rather than just an email address, which is what you need when your starting point is a wallet.
Two cautions. Coverage is patchy and a blank result proves nothing. And what you may lawfully do with breach data depends on your jurisdiction and your purpose — treat anything you find as a lead to verify elsewhere, not as evidence in itself.
Scam and abuse reports
Bitcoin Who’s Who lets you search any Bitcoin address and see scam reports filed by victims, websites the address has appeared on, and public tags.
If you are working a fraud, this is how you find the other victims — the address your client was told to pay usually turns up in somebody else’s report. It also works backwards: search a website or email address and see which wallets are linked to it.
Social media and usernames
An ENS name or a username found next to a wallet is a handle, and handles get reused. Run it through the X search builder and the Reddit search builder, and see verifying a profile belongs to your subject before you rely on a match.
9. When to stop, and why
Be straight with clients about this. Crypto tracing gets badly oversold.
Mixers (also called tumblers). A service that takes crypto from hundreds of people at once, throws it all into one pot, shuffles it, and hands each person back the same amount from somebody else’s coins. Imagine a hundred people each putting $500 cash into a pile and each taking $500 back out — the money is still there, but nobody can say which notes were whose. The trail does not go cold gradually. It stops.
CoinJoin. The same idea built into the payment itself. Dozens of unrelated people sign one transaction together, so it looks like one person spending from dozens of addresses — which is exactly the pattern from step 3. That is the point of it: it is designed to make the 131-addresses trick lie to you. A transaction with many inputs and many identical-sized outputs is the tell.
Monero. A different currency built so the ledger shows nothing useful. Sender, receiver and amount are all hidden at the design level. There is no explorer that will show you a Monero balance, because the information does not exist to show. If your subject converts to Monero, that is the end of the trail — not a harder trail, the end of it.
Chain hopping. Moving from Bitcoin to Ethereum to some other currency through services that keep no customer records. Each hop is another explorer, another format, and another chance to lose the thread.
Offshore exchanges. A subject who cashes out through a company with no US presence and no real identity checks is beyond a US subpoena, whatever your paperwork says.
Never cashing out. Coins that stay in a wallet the owner controls never touch a company that knows anybody’s name. See the 79,957 bitcoin above, untouched since 2016.
What this is actually worth on a case
- Proving the money exists. A debtor pleading poverty next to a wallet you can see is a dated, documented, verifiable fact.
- Showing a pattern. Regular payments into one address from an identifiable source is income, whatever anybody calls it.
- Finding the exchange. The most valuable result, because it is the subpoena target.
- Timing. The ledger is stamped to the minute. Money moved a week after a lawsuit was filed is something a judge will want to hear about.
Save the transaction ID for anything you rely on, and screenshot the page. Explorers get redesigned and third-party labels vanish, but the transaction ID is permanent — anyone can paste it in years later and confirm exactly what you saw.
Book
Judgment Recovery: The Complete Enforcement Guide
Finding an asset is the easy half. The book covers what happens next — discovery in aid of execution, turnover orders, garnishment and the enforcement steps that turn a located asset into money in hand.
See the book