Direct answer: tracing is not a count of an address’s transactions. It begins with a verified loss transaction and builds a continuous sender-recipient-asset-amount-time path through transfers and explainable asset conversions.
Anchor one: verify the actual loss transaction
The submitted hash must match the affected address, asset, amount, and time. An EVM case may require token-event and contract-call parsing. A TRON case requires the relevant contract type, owner, recipient, amount, and execution result. If the first loss edge is wrong, every downstream hop may follow the wrong party.
Common movement patterns
- Direct transfer: affected address to the first recipient;
- Dispersal: rapid splitting across several addresses, requiring a distinction between material paths and noise;
- Consolidation: several sources converging on one address, creating an association but not automatic proof of common control;
- Swap or DEX: assets exchanged through contract events that must link input and output;
- Cross-chain movement: bridge contract, source deposit, destination mint or release, adjusted for amount, fee, and time window;
- Mixer or privacy-enhancing service: a potential evidence break where entry and candidate exits may be recorded without inventing one-to-one attribution;
- Centralized service: an investigative value point only when a continuous fund path and a reliable entity label both exist.
Why a label is not an identity finding
Labels may come from published platform addresses, data providers, user submissions, or transaction patterns. They indicate a possible entity association; identifying an account holder normally requires platform records and lawful process. FATF likewise warns that transaction patterns must be interpreted in context.
What a professional report should show
- hash, network, asset, amount, time, and counterparty for every hop;
- functional roles such as swap, bridge, DEX, aggregator, exchange, or mixer;
- the evidence grade and source for every material node;
- the stop reason, including amount mismatch, non-unique bridge output, service boundary, or label conflict;
- why a value point matters, rather than a vague statement that an exchange was found.
Real-world reference
A 2023 U.S. Department of Justice release described investigators following victim deposits through dozens of addresses and several cryptocurrencies, a pattern called chain hopping. It demonstrates investigability, not a guarantee that every private case can be frozen or recovered. See anonymized scenarios in the Case Library.
Review and data scope
Data cutoff: 2 August 2026. Reviewed by the Crypto Forensics Lab Editorial Team for path continuity, functional-address interpretation, evidence grading, and restraint in attribution. This article explains a method and does not designate any specific address as criminal.