The last address the client still controlled. Everything after this is the trail. The network will not reverse this point.
Forensics
Follow the value,
hop by hop.
Tracing here is a written file: amounts, timestamps, both sides of a bridge, and the services that show up. It is built for victims, counsel, and compliance teams. It is not a promise that a chain will rewind.
Sample file · CRC-DEMO
Five hops, one story.
An illustrative trace. The names are fictional. Select a hop. The shape is the one we write down on a real theft file.
Value leaves in pieces so no single hop carries the full amount. The parent transaction stays attached, which is how the pieces get summed later.
A common second move. The file records the debit on the source chain and the credit on the destination. Miss either side and the trail looks finished when it is not.
The asset changes. The amount out and the pool stay in the note, so the next hop is still the same value under a new name.
A clustered deposit at a service is often the first place a person can ask for a review. We prepare the hop list and the timestamps. The service, and sometimes a lawyer or the police, decide what happens next.
Toolkit
What the analyst actually produces.
01
Hop tracer
Starts from a transaction or address you give us and lists the next movements, with amounts and timestamps kept on the same line.
- 01Incident wallet
- 02Fan-out, four outputs
- 03Bridge debit and credit
02
Source of funds
Walks inbound history back toward a named service, a contract, or a point where the trail goes quiet. Depth is the number of those steps.
- Harbor deposit
- Bridge credit
- Fan-out
- Origin wallet
- Fan-out
- Bridge credit
Fictional names. Read from the outside in.
03
Use of funds
The outbound twin of the source map. Where value left, including splits that have to be added back together.
- Origin wallet
- Fan-out
- Bridge
- Service deposit
- Bridge
- Fan-out
04
Exposure score
A number from 0 to 100 built from entity, source, use, and address exposure. It sorts the file. It is not a legal finding.
Sample reading · Critical band
05
Counterparty review
Names the exchanges, bridges, and pools in the path, including public sanctions context when a named party is already on a public list.
- Harbor Exchangedeposit · fictional
- North Bridgecross-chain · fictional
- Private poolswap · fictional
06
Case timeline
One docket from intake to the written file, so the dates on the chain and the dates in the correspondence sit together.
- Day 0Intake and first hop map
- Day 1Bridge matched on the far chain
- Day 3Written file, ready to share
A sample theft file. A real schedule depends on the chains.
Exposure model
Four inputs. One number to sort the file.
Higher-risk inputs weigh more than quiet ones. A named sanctioned counterparty can raise the score on a thin slice of funds. Bands: 0–33 contained, 34–66 elevated, 67–100 critical.
- 0–33 Contained
- 34–66 Elevated
- 67–100 Critical
Sample reading for the demo file. A live score is produced on an opened case.
Monitoring
The first map is not the end of the file.
A large share of stolen value in the 2025 research was still unspent when it was reviewed. A watch looks for the day it moves: a new split, a bridge, or a deposit into a service.
The grid is a sample of eighteen weeks. Gold cells are movement days. It is not a live feed.
Field record
Patterns from the public research.
Global Ledger’s published hack research, not CryptoRecovery Cloud case numbers. We cite it because it changes how a theft file should be opened.
Bridges first
BeInCrypto’s report on the 2025 study said nearly half of stolen funds moved through bridges, while direct cash-outs to exchanges fell. The H1 2026 update still found bridges to be the usual way value leaves the victim chain before a mixer or a centralized service.
Slower after the first hop
The 2025 report put average laundering time near 8 days in the first half and 10.6 days in the second. Smaller pieces, more intermediaries. The first seconds are fast. The cleanup is often staged.
Value left sitting
That write-up said about 49% of stolen value was still unspent when it was reviewed. Global Ledger also counted 224 hacks and $1.32 billion in H1 2026, with three incidents making up 63.9% of the loss.
Sources: BeInCrypto on the 2025 study, Laundering Race PDF, H1 2026 hacks.
Open a trace
A hash or an address is enough to start.
Theft files are read first. The first reply says whether the public references you have are enough for a map.
Open a case