To trace a Bitcoin transaction, enter its transaction hash (TXID) into a block explorer, read the outputs to see where the coins went, then follow each subsequent address forward until the funds reach an identifiable exchange. Because Bitcoin uses a transparent UTXO ledger, this trail is permanent and public.
Understanding the Bitcoin trail
Every Bitcoin payment consumes previous outputs (inputs) and creates new ones (outputs). Following the chain of outputs is how you track where stolen BTC travels. Scammers frequently use "peel chains" — moving a large amount forward while peeling off small amounts — but each step is still recorded.
Step 1: Locate the TXID
The TXID is a 64-character hexadecimal string. Your wallet or exchange lists it for every transaction. If you only have an address, search it on a block explorer to find associated transactions.
Step 2: Read inputs and outputs
Open the transaction and note the output address that received your funds and the amount. That address is your next lead. Ignore the "change" output that returns to the sender's own wallet.
Step 3: Follow the chain forward
Click into the receiving address to see where it sent funds next. Repeat this process hop by hop. Consolidation transactions — where many inputs merge into one address — often indicate a deposit into an exchange.
Step 4: Spot the exchange deposit
Professional analytics label the deposit addresses of major exchanges. When your trace reaches one, you have found the off-ramp. That exchange can freeze the funds and reveal the account holder to law enforcement.
What to do next
Document each hop with screenshots and the corresponding TXIDs, then report to your cybercrime unit and the exchange. If the trail is complex, request a professional Bitcoin trace. You can also check any suspicious platform with our scam site checker and browse reported scams in our scam database.