Public ledgers make tracing possible, and the practical work of following stolen funds is more methodical than dramatic.
The starting point
The address that received the stolen funds.
Which is generally known immediately from the incident transaction.
From there, every subsequent movement is public and permanent.
Clustering
Identifying which addresses are controlled by the same entity.
Which uses common-input ownership, change-address identification and behavioural patterns.
Clustering converts a scatter of addresses into a picture of one actor's activity.
Attribution
Linking clusters to real-world entities.
Which comes from exchange deposit addresses, public disclosures, previous cases and information sharing.
Attribution is what makes tracing actionable rather than merely descriptive.
Where funds go
Mixing services, cross-chain bridges, decentralised exchanges and eventually a venue where they can be converted.
Which is where the trail is either broken or closed.
Conversion to conventional currency almost always requires a regulated venue, which is the choke point.
Mixing services
Break the direct link between deposits and withdrawals.
Which is effective in proportion to how many other users are mixing at the same time.
Statistical techniques can sometimes link deposits and withdrawals where usage is low or timing is distinctive.
Cross-chain movement
Bridges and swap services complicate tracing across networks.
Which has become a standard part of laundering patterns.
Analytics providers have built cross-chain tracing capability in response.
Dormancy
Holding stolen funds for extended periods before moving them.
Which tests the persistence of monitoring.
Funds from incidents years old have been traced when finally moved.
The recovery process
Notifying venues, obtaining legal orders and coordinating with law enforcement.
Which is slow and has produced substantial recoveries in some cases.
Speed matters enormously, since funds move faster than legal process.
The general point
Public ledgers are considerably more traceable than their reputation suggests, which is a fact worth knowing in both directions.
Information sharing
Venues, firms and law enforcement share indicators through established channels.
Which speeds identification when funds reach a compliant service.
Formal frameworks for this sharing exist in several jurisdictions.
Privacy protocol interaction
Protocol-level privacy makes tracing substantially harder than mixing services do.
Which is a genuine limit rather than a temporary one.
Analysis of these protocols has produced results in specific circumstances and not generally.
False attribution risk
Incorrectly linking an address to an entity has real consequences.
Which is why confidence levels accompany attributions and why appeal processes exist.
Errors have affected individuals with no connection to any wrongdoing.
Court admissibility
Blockchain analysis has been accepted as evidence in proceedings in several jurisdictions.
Which required establishing methodology and reliability.
Challenges to methodology have been raised by defence counsel.
The practical reality
Tracing is routine, attribution is probabilistic, and recovery depends on funds reaching a cooperative venue.
Peel chains
Moving funds through long sequences of addresses, splitting small amounts at each step.
Which is a recognisable pattern rather than effective obfuscation.
Automated analysis follows these routinely.
Chain hopping
Converting between assets and networks repeatedly.
Which adds complexity and leaves records at each conversion point.
Services performing conversions increasingly apply their own screening.
Timing analysis
Correlating deposits and withdrawals by amount and timing where volume is low.
Which has produced attributions through privacy services during quiet periods.
Anonymity depends on the size of the crowd you are hiding in.
Open source tools
Public explorers and analysis tools allow anyone to follow simple cases.
Which is worth knowing for anyone affected by a theft.
Documenting the trail early supports any subsequent investigation.
Realistic expectations
Tracing is usually possible; recovery frequently is not.
What to do if affected
Record the transaction hashes, report to the platform and to law enforcement, and notify analytics firms.
Which supports tracing and is worth doing immediately.
Be aware that recovery services contacting you afterwards are almost certainly fraudulent.
The two-sided lesson
The traceability that helps investigators is the same traceability that exposes ordinary users' entire financial history to anyone who links one address to their identity.
Which is worth holding in mind, since discussion of this usually picks one side and ignores the other.
Limits worth stating
Tracing shows where funds went, not who controls them.
Which is a distinction that matters enormously in any legal context.
Attribution to an individual generally requires evidence from outside the ledger.
The prevention framing
All of this is downstream of a loss that has already happened.
The measures that prevent losses cost far less than the ones that chase them.
A last note
The common belief that these ledgers are anonymous has cost people money in both directions — those who assumed privacy they did not have, and those who assumed stolen funds were untraceable and gave up too early.
Summary
Cluster, attribute, follow, and wait for funds to reach a venue that will respond.
Which is the whole method, applied patiently and sometimes over years.