Introduction
If you have fallen victim to a crypto scam, your first instinct is likely panic. While blockchain transactions are irreversible, the public nature of the ledger means you can track exactly where your funds went. This guide explains how to use Etherscan to trace your stolen assets and gather evidence for law enforcement.
Step 1: Locate Your Transaction Hash (Txn Hash)
Every blockchain transaction has a unique ID called a Transaction Hash (or Txn Hash). You need this to start tracking.
- Open your wallet (MetaMask, Trust Wallet, Coinbase Wallet, etc.).
- Find the transaction where the funds were sent to the scammer.
- Click on the transaction details and look for "View on Explorer" or "Copy Transaction ID".
- If you only have your wallet address, paste your address into Etherscan search bar, scroll down to the Transactions (for ETH) or Token Transfers (ERC-20) tab (for USDT/USDC), and find the "OUT" transaction.
Step 2: Analyze the Scammer’s Wallet on Etherscan
Once you have the Txn Hash, paste it into Etherscan. You will see a page with details like From, To, and Value.
Identifying the Destination
Click on the address in the To field to view the scammer’s wallet. Look for these signs:
- Contract Address: If the icon next to the address is a document, it might be a smart contract (e.g., a fake mining pool or drainer contract).
- Centralized Exchange (CEX): If the address has a label like Binance 14, OKX, or FixedFloat, it means funds were sent to an exchange. This is good news. Exchanges verify user identity (KYC) and can freeze funds if served with a warrant.
- Tornado Cash / Mixer: If you see funds going to Tornado Cash Router, the trail effectively ends there as the funds are mixed.
Step 3: How to Report an Address on Etherscan
Etherscan allows community members to flag suspicious addresses. This helps warn others.
- Go to the scammer’s address page on Etherscan.
- Click the More Info dropdown button (usually near the top right of the profile summary section).
- Select Report/Flag Address.
- Fill out the form with details of the scam (Phishing, Fake Support, etc.) and provide your Txn Hash as proof.
Note: Flagging an address does not freeze the funds. It simply adds a warning label (e.g., "Phishing/Hack") to the address page.
Disclaimer: Tracking vs. Recovery
Tracking is NOT recovery. Seeing your funds in a wallet does not give you the power to withdraw them. The blockchain is immutable. Only the owner of the private keys can move those funds.
Warning: Do not trust anyone claiming they can "hack back" or "force a reversal." These are Recovery Scammers trying to steal more money from you.
Next Steps: Reporting to Authorities
Once you have traced the funds, you should file a formal report. Use the data you gathered (Txn Hash, Scammer Address, Destination Exchange) as evidence.
- USA: FBI IC3 (Internet Crime Complaint Center)
- Global: Local police cybercrime unit.
If the funds moved to a compliant Centralized Exchange (like Coinbase or Binance), law enforcement can subpoena the exchange for the account holder’s identity.
