To trace crypto transactions, you follow the money from one address to the next on a public blockchain. You look at who sent funds to a wallet, then at who sent funds to that sender, and so on. Each step back is called a hop. Learning how to trace crypto transactions is less about technical skill and more about knowing what to look for: where the money passed through, and whether any of those places are linked to mixers, scams, stolen funds or sanctioned addresses. The result is a risk signal, not proof. And tracing does not reverse or recover anything.
What does it mean to trace a crypto transaction?
Think of a blockchain as a shared notebook that everyone can read. Every transfer is written down: which address sent it, which address received it, how much, and when. Nobody can erase a line.
Names are not in the notebook. Only addresses are. So tracing does not tell you “this belongs to John”. It tells you “this money came from here, and before that, from there”.
That is enough to answer a very practical question. If someone sends you USDT, is that money clean, or did it pass through places you should worry about? This kind of work is often called blockchain analysis: reading the public record and grouping addresses by what they are known to be, such as an exchange, a mixer or a scam.
How do funds move between addresses on TRON and BNB Smart Chain?
USDT is a token. On TRON it uses the TRC20 standard. On BNB Smart Chain it uses BEP20. The idea is the same on both.
A simple example helps. Imagine you sell USDT to a buyer on a P2P platform:
- Hop 0: your wallet. You receive 1,000 USDT.
- Hop 1: the buyer’s wallet that sent it to you.
- Hop 2: the wallets that funded the buyer.
- Hop 3 and beyond: the wallets that funded those wallets.
It is like a parcel that went through several post offices. Each post office stamp is a hop. Tracing means reading the stamps in reverse order.
Real chains are messier. One wallet can receive from dozens of senders and pay out to dozens more. Money gets split, merged and moved quickly. That is why manual tracing gets hard after two or three hops, and why tools are used to follow many branches at once.
Why does a counterparty two hops away still matter?
There are two kinds of exposure.
| Type | What it means | Example |
|---|---|---|
| Direct exposure | The wallet sent to or received from a risky address itself. | The buyer’s wallet received USDT straight from a known scam address. |
| Indirect exposure | The risky address sits one or more hops further away. | The buyer was funded by a wallet that was funded by a mixer. |
Direct exposure is usually the stronger signal. But indirect exposure is not harmless. People who move dirty money often add a few “clean-looking” wallets in between, hoping nobody looks further back. A short chain of fresh wallets between a scam and your counterparty is a pattern, not a coincidence.
The further away a risky source is, and the smaller its share of the funds, the weaker the link. We explain this balance in more detail in direct vs. indirect risk in on-chain analysis.
Red flags when tracing USDT
When you follow USDT back through its hops, these are the sources that should make you slow down:
- Mixers. Services that pool and shuffle funds to hide where they came from. A mixer in the history breaks the trail on purpose. See how mixers affect source-of-funds tracing.
- Scam clusters. Groups of addresses tied to fraud, fake investment schemes or phishing.
- Stolen funds. Money linked to hacks or thefts, often split into many small transfers soon after.
- Darknet markets. Addresses linked to illegal marketplaces.
- Sanctioned addresses. The US Treasury’s OFAC can add digital currency addresses to its sanctions list, the SDN List. Its guidance on virtual currency notes that these listings may not cover every address a blocked person uses.
- Frozen USDT. Tether can freeze USDT held at an address, and a frozen address can no longer send USDT. A counterparty address that is frozen, or funds that came through addresses that were later frozen, are serious warning signs.
Some patterns are red flags even without a known bad source. Examples include a brand-new wallet that suddenly moves large amounts, funds that arrive and leave within minutes, or many round-number transfers split across fresh addresses. Our list of signs of a high-risk crypto address goes through more of them.
What can blockchain analysis tell you, and what can it not?
Blockchain analysis is useful, but it has limits. It helps to be clear about both.
| It can tell you | It cannot tell you |
|---|---|
| Where funds came from, hop by hop | The real identity of the person behind a wallet |
| Whether a wallet touched known risky sources | Whether the current owner knew about that history |
| Roughly how much of the money is linked to each source | Every bad address. Labels are never complete |
| Whether an address is sanctioned or frozen, as far as known lists show | What a regulator, exchange or court will decide |
So read a trace like a weather forecast. A high chance of rain means take an umbrella. It does not mean it will rain. A high risk score means be careful and ask questions. It is not a verdict on the person.
One more limit matters a lot. Tracing does not move money. It cannot reverse a transaction, unfreeze USDT or get stolen funds back. If you are a victim of theft or a scam, contact the platform involved and your local law enforcement. They are the ones who can act.
How to check where a wallet’s funds came from before you accept them
You do not need to read raw transaction data by hand. Here is a simple routine for P2P traders, OTC desks and anyone accepting USDT:
- Get the exact address that will send you the funds. Check the network too: TRC20 and BEP20 addresses look different.
- Screen it before the trade, not after. Once funds land in your wallet, their history comes with them.
- Look at the reasons, not only the score. Is the risk direct or indirect? Which source is it: a mixer, a scam, a sanctioned address?
- Check freeze status. Make sure the counterparty’s address is not frozen or blacklisted, and that its recent sources are not frozen addresses either.
- Decide and keep a record. If the result is high risk, you can ask the counterparty for another wallet or decline the trade. Save the report either way.
SafeON does this in one step. You paste a wallet address and get a risk score from 0 to 100 with the reasons behind it. It checks exposure to OFAC-sanctioned addresses and USDT freeze status, and traces where funds came from across several hops: mixers, darknet, scams, stolen funds and exchanges, plus behavioural risk patterns. It covers TRON and BNB Smart Chain fully, and Ethereum for freeze status. You can download the report as a PDF and add wallets to a watchlist with alerts. For more on how the screening works, see our AML wallet check.
Check a wallet’s risk on SafeON
FAQ
Can you trace a USDT transaction on TRON?
Yes. TRON is a public blockchain, so every TRC20 USDT transfer is recorded and visible. You can follow funds from address to address and check where they came from. The same applies to BEP20 USDT on BNB Smart Chain.
What is blockchain analysis used for?
It is used to follow funds across addresses and judge risk. Exchanges and compliance teams use it to screen deposits. Traders use it to check counterparties. Investigators use it to follow stolen or illicit money.
Can a traced transaction be reversed or the funds recovered?
No. Tracing only shows where money went. Blockchain transactions cannot be undone by tracing them. If you lost funds, contact the platform involved and law enforcement. SafeON does not recover, release or unfreeze funds.
How many hops back should you look when checking a wallet?
There is no single right number. The first hop is the most important, but risky money is often passed through a few wallets first. Looking several hops back catches these patterns. Closer sources and larger shares of the funds count for more.