When a protocol gets drained, the panic is immediate but the blockchain is patient. Every movement the attacker makes is written to a public ledger that does not forget. A post-incident on-chain investigation is the discipline of reading that ledger in order, from the first unauthorized transfer to the moment funds touch a regulated exchange. This is a walkthrough of how that work actually unfolds, address by address.
Step 1: Fix the point of theft
Everything starts with a clean anchor. Before tracing anywhere, you pin down the exact transaction hash of the exploit, the victim contract or wallet, the assets moved, and the block timestamp. This is your ground truth. From here you can name the first attacker-controlled address: the account that received the stolen funds.
Get this wrong and the whole trace is poisoned, so resist the urge to chase the first suspicious flow. Confirm the theft transaction against the incident report, the protocol's own disclosure, and the token transfer logs. Note whether the exploit was a single call or a series (flash loan, reentrancy, signature abuse), because that shapes how many intermediate hops you should expect.
Step 2: Follow the hops
With a confirmed origin address, you walk forward through the transaction graph. Attackers rarely cash out from the address that received the theft. Instead they move funds through a chain of freshly created wallets, splitting and recombining balances to blur the trail.
Two patterns dominate:
- Peel chains. The attacker sends a large balance to a new address, then peels off a small amount to a destination and forwards the remainder to the next new address, repeating this dozens or hundreds of times. Each peel looks innocent in isolation, but the remainder wallet forms an obvious spine once you plot it. Investigators treat the peel chain as a signature pattern rather than a dead end (Hudson Intelligence).
- Fan-out and fan-in. Funds explode across many addresses, sit briefly, then reconverge. The reconvergence point is where the noise collapses back into signal.
The practical skill here is clustering: grouping addresses that are provably controlled by the same entity based on co-spending, timing, gas funding from a common source, and reused deposit patterns. Good clustering turns a thousand addresses into a handful of actors.
Step 3: Cross the chains
Modern laundering is rarely single-chain. Attackers route value through cross-chain bridges and swap services to break the link between an Ethereum theft and, say, a Bitcoin or Tron cash-out. When a trace goes cold at a bridge, you do not stop: you switch to the destination chain, match the amount and timing on the far side, and pick up the thread.
Bridges leave correlatable evidence. A deposit of a specific size at a specific minute usually maps to a matching mint or release on the other chain within a predictable window. The trace becomes a matching problem across ledgers rather than a continuous walk on one.
Step 4: The mixer problem
Sooner or later the funds often hit a mixer or privacy protocol whose whole purpose is to sever the input-output link by pooling deposits from many users (Chainalysis). This is the hardest wall in most investigations, and honesty matters here: a well-used mixer can genuinely break attribution.
But it is not always game over. Investigators lean on timing correlation, distinctive amounts, gas-payment fingerprints, and withdrawal behaviour to build probabilistic links across the pool. The output is a likelihood, not a certainty, and it must be labelled as such. A responsible report distinguishes clearly between what is proven on-chain and what is inferred.
Step 5: The cash-out
Stolen crypto has little value until it becomes spendable. That almost always means an off-ramp: a centralized exchange, an OTC desk, or a payment processor. The cash-out point is the most valuable moment in the entire trace, because it is where the pseudonymous world meets a regulated entity that holds identity data.
Under the FATF Travel Rule, virtual asset service providers must collect and pass originator and beneficiary information alongside transfers above a threshold (Elliptic). That is why the deposit address at an exchange is the hinge: it is the first place a lawful request can convert a hex string into a name.
Step 6: From trace to evidence
An investigation that cannot be reviewed is not an investigation. The deliverable is a documented chain of custody:
| Element | What it captures |
|---|---|
| Origin | Confirmed theft transaction and first attacker address |
| Path | Ordered hops, clusters, bridges and swaps with hashes |
| Break points | Mixers or gaps, flagged as inference not proof |
| Endpoint | Off-ramp deposit address and hosting VASP |
Every hop should be reproducible from a transaction hash so that a lawyer, a regulator, or a counterparty can verify it independently. Screenshots age badly; hashes do not.
Where tooling fits
Doing this by hand across chains is slow and error-prone, which is where continuous monitoring earns its place. Seqlense's blockchain monitoring watches flagged addresses, scores risk, and raises alerts when tainted funds move toward known off-ramps, while its investigation service handles the deeper forensic tracing and the evidence pack that follows. The blockchain remembers everything. The job is simply to read it in the right order, and to be precise about the line between what you can prove and what you can only suggest.