To trace stolen Ethereum, open your wallet address on an Ethereum block explorer and follow the ETH and ERC-20 token transfers outward, accounting for smart-contract "internal transactions," DEX swaps, and bridges until the funds reach an exchange. Ethereum's account-based ledger makes every movement visible.
ETH tracing vs Bitcoin tracing
Ethereum uses accounts and balances rather than Bitcoin's UTXOs, and it supports smart contracts. This means stolen funds are often routed through drainer contracts, decentralized exchanges (DEXs), and token swaps — all of which are still recorded on-chain.
Step 1: Inspect your address
Search your wallet address on an explorer. Review both normal transactions and the "internal transactions" and "ERC-20 token transfers" tabs — wallet-drainer attacks and swaps show up there, not in the main list.
Step 2: Follow token transfers
If USDT, USDC, or another ERC-20 token was taken, follow the token-transfer events to the receiving address. Note whether the tokens were swapped for ETH or another asset via a DEX.
Step 3: Watch for bridges
Thieves often move funds across chains using bridges (for example, from Ethereum to another network). Identify the bridge contract, then continue the trace on the destination chain.
Step 4: Reach the exchange
Eventually funds are deposited to a centralized exchange to be cashed out. That deposit is the actionable endpoint for a freeze request and identity disclosure.
Get expert tracing
Ethereum traces through drainers and bridges can get complex fast. Open a free case review for professional help, and use the scam checker before connecting your wallet to any site.