A public blockchain records every transfer of value in the open. That transparency is a gift to investigators: unlike a bank wire buried in a private ledger, an on-chain payment leaves a permanent, verifiable trace that anyone can follow. The skill of "reading the money trail" is knowing how to turn that raw record into a story about who paid whom, through which services, and with what risk attached. This guide walks through the core ideas: hops, clusters, services and the heuristics that tie them together.
The raw material: addresses and transactions
On most chains, funds sit at an address, a string of characters that acts like an account number. A transaction moves value from one or more addresses to one or more others. In the Bitcoin model, transactions consume earlier outputs (the coins you received) and create new ones, a bit like handing over notes and receiving change. In the Ethereum model, an address holds a running balance and simply sends part of it.
Two properties make tracing possible:
- Permanence. Once confirmed, a transaction cannot be edited or deleted.
- Pseudonymity, not anonymity. An address does not carry a name, but its entire history is visible, and behaviour over time often reveals the owner.
The investigator's job is to attach meaning to those anonymous strings.
Following the hops
A hop is a single move of funds from one address to the next. Tracing "downstream" means following the money forward from a known source (say, a scam deposit address) toward where it ends up. Tracing "upstream" means walking backwards to find where funds originated.
The challenge is fan-out. One address can split funds across dozens of outputs, each of which splits again, so after a handful of hops the tree explodes into thousands of branches. Analysts manage this by following value, not just links: they weight the largest flows, ignore dust, and use the fact that laundering usually has to reconcile at a cash-out point. Peel chains, where a large amount moves along a line of addresses while shaving off small payments at each step, are a classic pattern worth recognising.
Clustering: from addresses to entities
Chasing individual addresses does not scale, so analysts group addresses that appear to share an owner into a single cluster or entity. The best known technique is the common-input-ownership heuristic: when several addresses are spent together as inputs to the same transaction, they are usually controlled by the same party, because signing the transaction required all their private keys.
Other signals refine the picture:
- Change detection, identifying which output returns leftover funds to the sender.
- Address reuse and reused deposit addresses.
- Behavioural fingerprints such as fixed fee settings, timing patterns or wallet software quirks.
These are heuristics, not proofs. They are powerful in aggregate but can be wrong in individual cases, so academic work stresses validating them rather than trusting them blindly (IET Blockchain, 2022). Good practice records the confidence level behind every attribution.
Naming the services
A cluster becomes actionable once you know what it is. Attribution links clusters to real-world services: exchanges, mixers, gambling sites, marketplaces, bridges and sanctioned entities. That knowledge comes from many places, including test transactions, public disclosures, leaked data, and web scraping of donation or deposit addresses.
Service type changes how you read a flow. A few patterns to keep in mind:
| Service | What it means for the trail |
|---|---|
| Centralised exchange | A likely off-ramp; a real identity may sit behind it, reachable by legal request |
| Mixer or tumbler | Deliberate break in the trail; funds are pooled and re-issued |
| Bridge | Value crosses to another chain; tracing must continue on the destination ledger |
| DeFi protocol | Funds may be swapped or pooled, changing the asset while ownership persists |
When funds reach a regulated exchange, the trail often meets the traditional compliance system. Under the FATF Travel Rule, transfers above a set threshold require the sending and receiving institutions to exchange originator and beneficiary information, which can turn a pseudonymous address into a named customer (Elliptic).
Where trails go cold (and warm again)
Not every path stays readable. Mixers, privacy coins, chain-hopping through bridges and high-volume exchange wallets all obscure the link between input and output. But cold trails frequently warm up again: mixed funds still have to exit somewhere, bridges expose matching amounts and timings on the other side, and consolidation before a cash-out reunites what was split. Patience and the value-weighted view usually pay off.
Turning a trail into evidence
For compliance and investigation teams, the output has to survive scrutiny. That means:
- Stating assumptions and the heuristics used, with a confidence level.
- Preserving transaction hashes, timestamps and screenshots so the work is reproducible.
- Separating fact (an on-chain transfer occurred) from inference (this cluster probably belongs to X).
- Checking counterparties against sanctions and known illicit clusters.
Where Seqlense fits
Reading a trail by hand is a good way to build intuition, but production work needs continuous coverage. Seqlense Monitoring watches blockchain addresses on an ongoing basis, applying risk scoring and raising alerts when a watched address touches a flagged counterparty, so the first hop of a suspicious flow reaches you as a notification rather than a post-mortem. For the cases that need a human to reconstruct the full path, the Investigation service pairs that surveillance with expert-led blockchain analysis. The goal is the same one this guide started with: turning an open ledger into a clear, defensible account of where the money went.