Tracing Bitcoin Transactions and Addresses

Yes, Bitcoin can be traced. Every payment ever made sits on a public ledger that anyone can read. What the ledger hides is the name behind each address. So tracing is the work of following coins from one address to the next until they reach a service that knows who its customer is.

Is Bitcoin anonymous?

No. It is pseudonymous. The ledger holds addresses and amounts and no names, so an address is a mask that stays on for as long as nobody links it to a person. Once one link is made, every payment that address ever sent or received is open to view.

What makes Bitcoin traceable?

Volume is no cover. The chain confirmed about 20.9 million transactions in September 2026, up from about 9.4 million per month in 2020, and all of them are public.

The names come from the services people use to buy, sell and store coins: exchanges, wallets and custodians. The Financial Action Task Force calls them virtual asset service providers, or VASPs. Most of them run know-your-customer checks when an account is opened. A trace that ends at an exchange deposit address has reached a place where a real name is on file, and a court or the police can ask for it.

Three ways to trace a Bitcoin address

1. Ask an AI

The quickest route today is the Bitquery MCP server. You connect it to Claude, ChatGPT or Cursor, sign in once, and ask a question in plain English. The AI calls Bitquery's tracing tools and lists the transfers behind each step, so you can check its work. Prompts to try:

• "Where did the funds from this address go? Stop at the first exchange."
• "Which other addresses were spent together with this one?" The tool behind this, btc_related_addresses, groups addresses that were used as inputs in the same payments.
• "Is this an exchange deposit address, a mixer or a known scam?" This one reads Bitquery's address labels.

Tracing sits on the AI Investigation plan at $149 per month, and a trial comes with 100 free credits. The install guide covers each client.

2. Use the money flow graph

The Bitquery explorer is open to anyone. Search for an address, open its Money Flow tab, and you get a graph of what came in and what went out. It suits a first look, when you want to see the shape of the flows before you count anything.

3. Query the Coinpath API

Developers who want the same data in their own tools can call the Coinpath API. One query returns every address that sent funds to a wallet or took funds from it, several steps deep. The Bitcoin Coinpath docs show the queries.

A worked example: the Twitter hack address

In July 2020, hacked Twitter accounts told their followers to send coins to one address and promised to send back double.

The address is bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh. We ran it through our Bitcoin index again on 2 October 2026. All times are UTC.

What the ledger shows	Figure
First payment in	15 July 2020, 19:04
Received that day	12.81 BTC in 326 transactions
First payment out	15 July 2020, 21:02
Moved out in total	12.87 BTC in 13 transactions
Last payment out	28 July 2020
Received from 2021 to September 2026	3.89 BTC in 730 transactions

Two things stand out. The thief began to move coins about two hours after the first victim paid. And people still send money to this address: 730 payments have come in since 2021, one of them close to 2 BTC, and none of it has been spent.

Where did the first coins go? Our trace in 2020 listed the ten addresses that took the most from the thief's wallet.

One of them was a Binance wallet, reached after several hops through intermediate wallets. That is the point where a trace can turn into a name, because Binance knows who owns the account that was paid. By hand, in a block explorer, each of those hops fans out into more wallets and the job takes hours. A tracing tool returns the whole path in one request.

Tracing back the other way helps less here. The thief asked for coins in public, so the senders are hundreds of victims. The full story is in our Twitter hack investigation.

How addresses are grouped

Addresses are rarely labeled one at a time. Two methods do most of the work.

The first looks at inputs. When one payment spends coins from several addresses, the same wallet most likely holds the keys to all of them, so they are treated as one owner.

The second looks at habits. An exchange wallet handles thousands of payments per day in a wide range of sizes. A payment service looks different, and so does a custodian. Group addresses by those habits and the type of service shows itself, even before anyone knows its name.

Once a service is known, every address that deals with it is one legal request away from a real name, as long as that service checks its customers.

What makes tracing hard

• Extra wallets. Making a new wallet costs nothing, so a thief can pass coins through thousands of them to tire out whoever is following. Our piece on crypto money laundering shows the pattern.
• Mixers. These pool coins from many users and pay them back out, which breaks the direct link from sender to receiver.
• Services with weak checks. Some countries do not make exchanges verify their customers. Coins cashed out there reach a bank account with no name attached on the crypto side.

Who uses tracing

Police and tax offices use it to follow stolen funds and the proceeds of crime. Exchanges use it to screen deposits before they credit them. Victims and their lawyers use it to find which exchange the money reached, so they know where to send a freeze request. If that is your case, see our guide to recovering scammed bitcoin or ask the crypto investigation service.

To learn the craft, start with our list of crypto investigation certifications.

Privacy still matters

Privacy is a right. Article 12 of the Universal Declaration of Human Rights says no one shall face arbitrary interference with it. Most people who hold crypto have done nothing wrong, and a tracing tool in careless hands can expose them.

So the two aims have to live side by side. If the police cannot follow criminal money on a public ledger, the likely answer from lawmakers is a blunt ban that hurts everyone. If firms treat every customer as a suspect, people will move to tools that hide far more. Good practice sits between the two: trace where there is cause, and keep the rest private.

Related reading

• Cryptocurrency money laundering explained
• How to investigate an Ethereum address
• Blockchain analytics: what it is and how it works

First published in August 2020. Updated on 2 October 2026: the figures were worked out again from Bitquery's Bitcoin index, and AI tools helped run the queries and redraft the text. Bitquery sells the MCP server, the Coinpath API and the investigation service named above.