How to Trace Bitcoin Transactions and Addresses

Yes, Bitcoin can be traced. Every payment ever made sits on a public ledger that anyone can read. What the ledger hides is the name behind each address. So tracing is the work of following coins from one address to the next until they reach a service that knows who its customer is.

Is Bitcoin anonymous?

No. It is pseudonymous. The ledger holds addresses and amounts and no names, so an address is a mask that stays on for as long as nobody links it to a person. Once one link is made, every payment that address ever sent or received is open to view.

What makes Bitcoin traceable?

Volume is no cover. The chain confirmed about 20.9 million transactions in September 2026, up from about 9.4 million per month in 2020, and all of them are public.

The names come from the services people use to buy, sell and store coins: exchanges, wallets and custodians. The Financial Action Task Force calls them virtual asset service providers, or VASPs. Most of them run know-your-customer checks when an account is opened. A trace that ends at an exchange deposit address has reached a place where a real name is on file, and a court or the police can ask for it.

Two ways to trace a Bitcoin address

1. Ask an AI

The quickest route today is the Bitquery MCP server. You connect it to Claude, ChatGPT or Cursor, sign in once, and ask a question in plain English. The AI calls Bitquery's tracing tools and lists the transfers behind each step, so you can check its work. Prompts to try:

• "Where did the funds from this address go? Stop at the first exchange."
• "Which other addresses were spent together with this one?" The tool behind this, btc_related_addresses, groups addresses that were used as inputs in the same payments.
• "Is this an exchange deposit address, a mixer or a known scam?" This one reads Bitquery's address labels.

Tracing sits on the AI Investigation plan at $149 per month, listed on our pricing page. The setup guide covers each client.

Connecting takes one URL. Add https://mcp.bitquery.io as a connector or MCP server, then approve the sign-in in the browser:

Client	How to connect
Claude Desktop / Claude web	Settings, Connectors, add custom connector https://mcp.bitquery.io
ChatGPT	Settings, Connectors, add a connector with the same URL
Cursor	Settings, MCP, Add new MCP server
VS Code, Windsurf	Add MCP server with URL https://mcp.bitquery.io
Claude Code	claude mcp add --transport http bitquery https://mcp.bitquery.io
Codex	codex mcp add bitquery --url https://mcp.bitquery.io

On Bitcoin, the tools that carry a trace:

Tool	What it returns
money_flow (prompt)	The fund flow across hops, with an edge table
risk_screen (prompt)	A LOW / MEDIUM / HIGH verdict for an address
btc_tx_flow	The inputs and outputs of one transaction, change outputs flagged
btc_related_addresses	The same-owner cluster: addresses spent together with this one
address_labels, labels_for_addresses	Exchange, mixer, gambling, dark web, scam and sanctions labels
chain_capabilities	Which tool covers which chain

Behind the prompts sit per-chain tool families: *_address_flow_summary for inflows, outflows and an address role, *_flow_edges for every address one hop away, *_trace_next_hop and *_trace_dominant_path for following the funds, *_transfers_in and *_transfers_out for full transfer lists. The EVM chains take the full set. The UTXO chains, Bitcoin among them, walk hops with *_tx_flow and group owners with *_related_addresses.

2. Use the money flow graph

The Bitquery explorer is open to anyone. Search for an address, open its Money Flow tab, and you get a graph of what came in and what went out. It suits a first look, when you want to see the shape of the flows before you count anything.

A worked example: the Twitter hack address

In July 2020, hacked Twitter accounts told their followers to send coins to one address and promised to send back double.

The address is bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh. We ran it through our Bitcoin index again on 2 October 2026. All times are UTC.

What the ledger shows	Figure
First payment in	15 July 2020, 19:04
Received that day	12.81 BTC in 326 transactions, 0.45 of it moved in from the hackers' two other scam addresses
First payment out	15 July 2020, 21:02
Moved out in total	12.87 BTC in 13 transactions
Last payment out	28 July 2020
Received from 2021 to September 2026	3.89 BTC in 730 transactions

Two things stand out. The thief began to move coins about two hours after the first victim paid. And people still send money to this address: 730 payments have come in since 2021, one of them close to 2 BTC, and none of it has been spent.

Where did the first coins go? The largest share, 5.70 BTC, went to a cash-out wallet the hackers never tweeted, which had been in use since May 2020. From there the coins moved through chains of fresh addresses, each used once or twice, over the next five days.

We checked every address the two wallets paid, 41 in all, against Bitquery's labels on 15 October 2026. None is marked as an exchange, and neither is any address on the largest branches four steps further out. An earlier version of this guide said one of the top recipients was a Binance wallet. That came from a 2020 query that added up every path, and we could not confirm it.

This is where many traces stop. The end of a path is an address with no name, and only a legal request to the right service can put a name on it. Each step out also fans into more wallets, which is why a tool that walks the steps for you saves hours over a block explorer.

Tracing back the other way helps less here. The thief asked for coins in public, so the senders are hundreds of victims. The full story is in our Twitter hack investigation.

How addresses are grouped

Addresses are rarely labeled one at a time. Two methods do most of the work.

The first looks at inputs. When one payment spends coins from several addresses, the same wallet most likely holds the keys to all of them, so they are treated as one owner.

The second looks at habits. An exchange wallet handles thousands of payments per day in a wide range of sizes. A payment service looks different, and so does a custodian. Group addresses by those habits and the type of service shows itself, even before anyone knows its name.

Once a service is known, every address that deals with it is one legal request away from a real name, as long as that service checks its customers.

What makes tracing hard

• Extra wallets. Making a new wallet costs nothing, so a thief can pass coins through thousands of them to tire out whoever is following. Our piece on crypto money laundering shows the pattern.
• Mixers. These pool coins from many users and pay them back out, which breaks the direct link from sender to receiver.
• Services with weak checks. Some countries do not make exchanges verify their customers. Coins cashed out there reach a bank account with no name attached on the crypto side.

Who uses tracing

Police and tax offices use it to follow stolen funds and the proceeds of crime. Exchanges use it to screen deposits before they credit them. Victims and their lawyers use it to find which exchange the money reached, so they know where to send a freeze request. If that is your case, see our guide to recovering scammed bitcoin or ask the crypto investigation service.

To learn the craft, start with our list of crypto investigation certifications.

Privacy still matters

Privacy is a right. Article 12 of the Universal Declaration of Human Rights says no one shall face arbitrary interference with it. Most people who hold crypto have done nothing wrong, and a tracing tool in careless hands can expose them.

So the two aims have to live side by side. If the police cannot follow criminal money on a public ledger, the likely answer from lawmakers is a blunt ban that hurts everyone. If firms treat every customer as a suspect, people will move to tools that hide far more. Good practice sits between the two: trace where there is cause, and keep the rest private.

Frequently asked questions

Can Bitcoin be traced?

Yes. Every payment sits on the public ledger, and the trace links addresses to each other. Linking an address to a person needs an identity anchor, such as an exchange with KYC records.

Can you find out who owns a Bitcoin address?

Sometimes. Ownership shows up when the address transacts with a regulated exchange, appears in a leak, or is published by its owner. Labels and clustering narrow the search; they do not replace the identity link.

Can you recover stolen Bitcoin?

Sometimes, when the funds reach a regulated exchange before they are mixed. The trace finds the deposit address, and the exchange can freeze the account. See our guide to recovering scammed bitcoin.

What is an MCP server?

A service that exposes tools to an AI agent over the Model Context Protocol. The Bitquery MCP server turns plain-English questions into read-only queries over 19 chains.

How much does the Bitquery MCP server cost?

The Trading plan costs $19 per month with 32 tools. The AI Investigation plan, with tracing, costs $149 per month and opens all 314 tools.

Related reading

• Cryptocurrency money laundering explained
• How to investigate an Ethereum address
• 10 blockchain analysis tools compared

First published in August 2020. Updated on 2 October 2026: the figures were worked out again from Bitquery's Bitcoin index, and AI tools helped run the queries and redraft the text. Updated on 14 October 2026: keyword-first title, MCP setup and tool tables, and an FAQ. Updated on 15 October 2026: the Coinpath method was removed, and the unconfirmed Binance-wallet claim was replaced with a fresh label check of every address the hackers' two main wallets paid. Bitquery sells the MCP server and the investigation service named above.