Every Bitcoin and Ethereum transaction ever made is public, permanent, and searchable by anyone. That fact makes crypto investigation sound easy, and it is the reason most crypto investigations fail. The ledger is not anonymous — it is pseudonymous, and the entire discipline consists of closing the gap between those two words.
An address is a pseudonym. Tracing money between addresses is trivial and tells you almost nothing on its own. The work is attribution: establishing which real-world entity controls an address, and that evidence almost never lives on the blockchain.
The one distinction that changes everything: UTXO vs account
Bitcoin and Ethereum need different techniques, and most guides skip this.
Bitcoin is a UTXO chain. A transaction consumes previous outputs and produces new ones, and a wallet typically holds hundreds of addresses. This is what makes Bitcoin more traceable than people expect, because it exposes the common-input-ownership heuristic: when several addresses are spent together as inputs to one transaction, the same wallet almost certainly controls all of them. Applied recursively across the chain, that clusters thousands of addresses into a single entity. It is the foundation every commercial tracing product is built on.
Ethereum is an account chain. Balances sit at persistent addresses, so there is no input-clustering to do. Attribution instead comes from behaviour: funding patterns, contract interactions, ENS names, NFT holdings, and the timing fingerprints of an address that reuses the same gas settings.
Applying Bitcoin thinking to Ethereum, or the reverse, produces confident nonsense. Establish which model you are on before anything else.
The four families of tool
1. Block explorers — read the ledger. Blockchair covers Bitcoin and most major chains with genuinely good filtering; Etherscan is the reference for Ethereum and EVM chains, and its labelling of known contracts and exchange wallets is the most useful free attribution data available. Bitnodes maps the network's reachable nodes. Explorers answer what happened. They do not answer who.
2. Clustering and attribution — group addresses into entities and attach names. Arkham Intel publishes entity labels for a large set of exchange, institutional and named-individual addresses, and it is the single most useful free attribution source. MetaSleuth and Breadcrumbs both build visual flow graphs across hops, which is how you keep a multi-hop trace legible. Bitcoin Whoswho searches addresses against scam reports and public mentions — genuinely useful for the common case where the address you are handed is a fraud address.
3. Analytics and datasets — Dune lets you query indexed blockchain data with SQL and read thousands of community dashboards; Bitquery exposes similar data through an API when you need it programmatically. This family is where you go when the question is a pattern across many transactions rather than the story of one.
4. Off-chain corroboration — the family with no tools in it, and the one that closes most cases. An address becomes a person because it was posted in a forum signature, tied to a KYC'd exchange account, pasted into a ransom note, or indexed by a search engine. Search the address as a plain string everywhere before you trace anything.
The heuristics, and exactly where they break
Clustering is inference, not proof, and the failure modes are well understood.
CoinJoin and mixers deliberately break common-input-ownership. A CoinJoin combines inputs from many unrelated wallets in one transaction, so the heuristic that normally clusters correctly now clusters people who have never met. Treat any cluster containing a CoinJoin as unreliable until proven otherwise.
Exchange addresses cluster into meaningless super-entities. Custodial wallets hold funds for millions of users, so clustering merges them all into one node. When a trace arrives at a large exchange cluster, it has not arrived at a person — it has arrived at the boundary of what OSINT can do.
Change-address detection is a guess. Identifying which output is change is usually right and sometimes badly wrong, and errors compound at every hop. Confidence should decay as the hop count grows, and a trace of more than a few hops without off-chain corroboration is a hypothesis, not a finding.
Where the trace ends
Almost every honest crypto investigation ends in the same place: funds reach a custodial exchange with KYC obligations, and the identity behind the account sits behind a subpoena or a law-enforcement request. Reaching that point is a real result — it is what a referral needs. Claiming to have identified the person is where credible work turns into overreach.
A workflow that holds up
- Establish the chain and the model. UTXO or account. Choose the technique accordingly.
- Search the address as a string — search engines, GitHub, paste sites, social platforms, scam databases. The cheapest step and often the decisive one.
- Check known labels. Arkham and Etherscan's tags will tell you immediately if you are looking at an exchange, a bridge, or a contract.
- Read the transaction graph in an explorer before automating anything. Note first funding, largest counterparties, and dormancy patterns.
- Cluster carefully, then check the cluster for CoinJoins and exchange addresses before trusting it.
- Trace forward to the off-ramp, recording each hop and the reason you believe it.
- Write down your confidence per link, and label attribution as assessment unless off-chain evidence makes it fact.
What costs money
The free tier is unusually strong here. Explorers are free and always will be — the data is public. Arkham's labels, Dune's dashboards, MetaSleuth's and Breadcrumbs' basic graphs are usable without paying. What you pay for is coverage and defensibility: Chainalysis, TRM Labs and Elliptic sell curated attribution with an evidentiary standard that holds up in court, plus sanctions screening. For journalism, research and triage, the free tier genuinely suffices. For litigation or compliance, it does not.