How to Track Where Stolen Funds Go After a Known Hack
The basic method is to follow the movement of tokens from the compromised address step by step on a block explorer, using transaction history, internal transactions, and token transfers to see where funds are sent, swapped, or bridged. You do not need special tools, though they help at scale.
Step 1: Identify the Initial Victim Address
You need the exact wallet address that was drained. If the hack was public, this is usually reported in security alerts, social media posts, or on-chain monitoring accounts. If you are investigating your own loss, you already have it. Copy the address.
Step 2: Open the Explorer and Check the Address Page
Paste the victim address into a block explorer for the chain where the hack occurred. Look at the Transactions tab (for native coin moves) and the Token Transfers tab (for ERC-20, BEP-20, or similar tokens). Most explorers show these separately. Also check the Internal Transactions tab - some hacks use contract calls that move funds without showing on the regular transaction list.
Scan for the first outgoing transaction after the hack timestamp. This is often a bulk transfer to a temporary address, or a series of small test transactions followed by a large one.
Step 3: follow each major outgoing transaction
Click into each suspicious transaction hash. The explorer shows the sender, receiver, and amount sent. For token transfers, you may need to check the ERC-20 Transfers section within the transaction page, not just the top-level value.
- If the receiver is an exchange deposit address (often labeled by the explorer, e.g., "Binance 14" or "Coinbase Hot Wallet"), the funds may be frozen if the exchange cooperates. Note the address.
- If the receiver is a fresh, unlabeled address, that address is likely a "hop" or intermediate wallet. Copy it and repeat step 2 with that new address.
Step 4: Check for Swaps and Bridges
Hackers frequently swap stolen tokens for a different asset or bridge them to another chain to hide the trail.
- Swaps: Look for transactions to known decentralized exchange routers (Uniswap, PancakeSwap, Curve). The input data or internal transactions will show the swap path. The output token and amount appear in the same transaction's token transfers.
- Bridges: Look for transactions to bridge contracts (e.g., Wormhole, Multichain, Synapse). The bridge transaction will show a deposit to the bridge, and you will need to find the corresponding mint on the destination chain. Use the destination chain's explorer and search for the bridge contract's address or the transaction hash if the bridge provides a cross-chain explorer.
Step 5: Use a Multi-Chain Explorer Tool
If funds cross chains, a single explorer is not enough. Tools like DexScreener, Arkham Intelligence, or Etherscan's "Token Approvals" can show the same address across multiple chains. Paste the address into a multi-chain search or use a block explorer that supports multiple chains (e.g., Solscan for Solana, BscScan for BSC) to see if the same address appears elsewhere.
Step 6: Look for Mixers or Privacy Tools
A common next step after several hops is sending funds to a mixer (e.g., Tornado Cash on Ethereum) or a privacy chain (e.g., Monero via a bridge). On an explorer:
- A deposit to a mixer contract shows as a transaction to a well-known address. The mixer will not reveal the withdrawal address on-chain (that is the point), but the deposit itself is visible.
- For privacy chains, the trail stops on the public ledger. You can still see the bridge-out transaction, but the destination chain's transactions are opaque.
Step 7: Record the Chain of Addresses
Keep a list in a text file or spreadsheet: each address, the transaction hash, the amount, the token, and the timestamp. This chain is your evidence. If you report the hack to an exchange or law enforcement, they will ask for this.
Practical Limitations
- Time matters: Hackers often move funds within minutes or hours. If you start tracking days later, the trail may be cold.
- Mixing: Once funds enter a mixer, public tracking effectively ends. You cannot prove which withdrawal belongs to the deposit.
- Cross-chain complexity: Each chain has its own explorer, and bridges do not always expose the destination transaction hash on the source chain. You may need to search the destination chain by the bridge contract's event logs.
When to use automated tools
If you are tracking a large-scale hack (e.g., a DeFi protocol exploit with hundreds of victim addresses), manual following is impractical. Services like Chainalysis, Elliptic, or free tools like Etherscan's "Token Honey Pot" or "DexScreener" can aggregate flows. But for a single address, the block explorer method works and gives you full control over what you see.
What you cannot do
You cannot reverse a transaction. You cannot freeze funds yourself unless you contact an exchange that holds the receiving address. The most you can do is document the path and report it to the chain's community or law enforcement. The explorer shows you where funds went, not how to get them back.
Not financial advice. sonnyonsol.xyz publishes market data and general information about staring robot. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.
Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.