A wallet emptied in a single signature. Or a P2P payment came in, and an hour later the exchange froze your account. The first reaction is panic and googling "how to get it back." But while you read forum threads, the funds keep flowing further down the chain. The faster you trace the path and find where they went, the higher the chance the exchange or investigators can still freeze them. The good news: you can do the basic tracing yourself in 5 minutes, for free, without connecting any wallet. Here is the step-by-step plan.
01The first hours: why you can't stall
Stolen funds rarely stay on one address. The attacker usually splits the sum fast, runs it through a mixer or a bridge, and moves it to an exchange to cash out into fiat. You have a window while the money hasn't yet turned into cash: if you find the point where it touched an exchange, that's where you can direct a freeze request. Later it gets harder — the trail blurs and the funds get cashed out.
You don't need paid enterprise subscriptions and you don't need to wait for a "specialist." All you need to trace is a public explorer (Etherscan and its analogs) and one free address screening. Let's go step by step.
02Step 1 — take the destination address
First you need to understand where exactly the funds went. That is the recipient address in the transaction that cleaned you out (or the counterparty address in a suspicious deal).
- Open the explorer for your network: Etherscan (Ethereum), BscScan (BNB), Polygonscan, Tronscan (TRON), Basescan (Base), and so on.
- Paste your wallet address into the search — you'll see the list of transactions.
- Find the outgoing transaction that moved the funds out (by time/amount). Open it.
- The To field (or "Interacted With" / "Transfer") is the destination address. Copy it in full.
If the theft went through approve/permit (someone else's contract drained the wallet), check the token transfers tab (ERC-20/BEP-20) — it shows which address specific coins leaked to. Collect every recipient address: there may be several.
03Step 2 — run the address through a free screening
Now you have the destination address. Paste it into a free check — it takes 10 seconds and shows what kind of address it is. There are three things to look at in the verdict:
- Sanctions (OFAC / EU / UN) — a direct legal match against the lists. Binary: on it or not.
- Labels — is the address known as a drainer, a scam contract, phishing, or as a deposit address of a specific exchange.
- Exposure — how tightly and through how many transfers the address is linked to a dirty cluster (mixer, darknet).
In the example above the address is formally not under sanctions, but it's flagged as a drainer and almost directly (1 hop) linked to a mixer at 84%. That combination is no longer a coincidence: you've found the attacker's wallet or its first transit node. Save a screenshot of the verdict — it goes into the freeze package (Step 5).
04Step 3 — read the connection graph
Labels tell you what the address is. The graph shows where the money flows next. That's critical: if funds leave a drainer address for an exchange — you can file a request there. If into a mixer — the trail gets cut, and you have to catch it before it enters the mixer.
How to read the graph: nodes are addresses/clusters (exchange, mixer, bridge, ordinary wallet), edges are transfers between them with an arrow (direction) and an amount.
(cross-chain)moved to Arbitrum
destination addressknown drainer
deposithot address
Tornado-type84% exposure
What to look at first:
- An exchange nearby (deposit/hot address) — the best outcome for you: the exchange has KYC and can freeze. Record the address and the amount.
- Mixer/private protocol — the trail cuts off beyond this. So the hook has to be found before this point.
- Bridge — the money moved to another network; keep tracing in the explorer for that network.
05Step 4 — exposure % and number of hops
This is where it's easy to slip up and scare yourself (or, conversely, relax for no reason). Two numbers decide everything: the exposure percentage and the number of hops (transfers) to the dirty cluster.
- 1–2 hops + a high % to an exchange or a mixer — a strong signal. This is almost certainly part of the scheme, not a random touch.
- 4–5 hops — that's already noise. At that distance almost any address on the blockchain "touches" something. Don't panic over distant links.
06Step 5 — if it went to an exchange: file for a freeze
You found that the funds touched an exchange (Step 3). This is your chance. The exchange runs KYC and, on a well-founded request, can block the recipient's deposit or account. Act before the money is withdrawn.
84% · 1 hop
Assemble a package and file it to two places in parallel:
07Honest limits: what tracing won't do
So you don't build up false hopes and don't fall for a second scam — plainly, about the limits.
A fresh attacker address doesn't show up
Labels are retroactive: a drainer address created just now is still clean across every database at the moment of the theft. Attribution appears after it leaves a trail. That's why the verdict on the destination address will sometimes be "empty" — that's normal, keep tracing along the graph by hand (where it went next).
Nobody can promise the funds come back
Tracing raises the chance of a freeze, but it doesn't deliver a return. Whether the money goes into a mixer, whether the exchange acts in time, whether a case is opened — not all of it depends on you. Honestly: this is risk reduction and a faster response, not a guarantee.
"Recovery specialists" asking for prepayment are a second scam
Bottom line: you can find the destination address yourself, in 5 minutes and without spending a cent, understand what kind of address it is, see the path of the funds, and assemble a freeze package. That's the maximum that depends on you — and it's worth doing fast.
Screen an address in 10 seconds
Sanctions, drainers, exposure and the connection graph — free, without connecting a wallet.
Open @amlconsensus_botAMLConsensus is a risk-reduction and tracing tool, not a guarantee that funds will be returned. A freshly created address with no history won't be flagged by any AML tool; a freeze and a return depend on the exchange and law enforcement, not on the service. Service and company names (Etherscan, Binance, Chainalysis, TRM, MistTrack, etc.) are trademarks of their respective owners; AMLConsensus is not affiliated with them and mentions them for illustration.