How to trace stolen crypto, hop by hop

· 4 min read · KadenaTrace

Every transfer on Ethereum, TRON, Bitcoin, Solana and the other public chains is written in the open. Tracing stolen crypto is reading those records in order: from the drained address, to where the money went, to where it went next. This guide uses the x100global exploit of October 24, 2026, about $4.75M on Ethereum, which KadenaTrace traced automatically and recorded as case KT-6.

Start from the right address

A trace starts at the address the funds left, not at the victim's. In a hack of a protocol, that is usually the attacker's first wallet, named by a security firm or the project. In x100global, the address 0x7ec2af…fd63 was named by Blockaid and later by CertiK and PeckShield; the trace starts there. For a personal theft, it is your own drained wallet.

Open Trace, paste the address, pick the network, and set the start date to just before the theft. Everything that left the address after that date is followed.

Follow the outflows

The tracer reads every outgoing transfer from the start address, then every outgoing transfer from each address that received funds, and so on. Each step is a hop. Hop 1 is where the money went first; hop 2 is where it went from there.

In KT-6 the first hop was a swap: about $4.7M of the stolen tokens were swapped on Uniswap into ETH in two transactions. Swaps do not change who holds the money, only what it is; the tracer follows the ETH that came out. From there, the ETH went to Tornado Cash in many deposits.

Three things to read at every hop:

  • Splits. Funds divided into many wallets in minutes are a sign the attacker is spreading them to avoid a single freeze. The tracer groups a split so the page stays readable.
  • Timing. A wallet that forwards funds within minutes of receiving them is a pass-through, not a holder.
  • Labels. When an address is a known exchange deposit, a bridge or a mixer, the tracer says so. Those labels decide what you can do next.

Where the trail stops

A trace ends at four kinds of places:

  • An exchange deposit address. The money is now inside an exchange's custody. This is the one place a freeze request can work: see exchange deposits and freezes.
  • A mixer. Tornado Cash and similar contracts pool deposits and let them be withdrawn to fresh addresses. On-chain, the link between deposit and withdrawal is gone. In KT-6, about $4.85M, almost all of the loot, went into Tornado Cash; the trace stops there.
  • A bridge. The funds moved to another chain. KadenaTrace matches the deposit on one chain to the landing on the other for the bridges it knows; where it cannot, it says the destination is not matched, and the page's coverage line counts it as an open bridge.
  • A wallet that still holds. Nothing has left yet. The case watch alerts you when something does.

What a trace does not tell you

  • Who. An address is not a person. KadenaTrace names an address as the attacker's only when a source (a security firm, the project, a court filing) attributes it. A transfer to an address does not make that address the attacker's; it may be an exchange, a service, or a victim's own recovery wallet.
  • Everything. The tracer reads a limited number of addresses per trace, largest amounts first, up to a hop limit. Where it stopped reading, the page says how much went to addresses it did not follow. Totals marked "at least" or "so far" are lower bounds, not final numbers.
  • Prices from the day. Dollar values use the price on the day of the trace unless the page says otherwise.

Common mistakes

  • Tracing the wrong address. Starting from a protocol's contract instead of the attacker's wallet gives you the protocol's normal traffic, not the theft.
  • Counting swaps as outflows. A swap returns the proceeds to the same address. Counting the swap and the later transfer doubles the amount.
  • Treating "deposited to an exchange" as "frozen". It is not. The exchange decides, and only after a report.
  • Reading a mixer withdrawal as the same money. It may be anyone's.

The case this guide follows

KT-6, x100global: about $4.75M reported by Phalcon and listed by DeFiLlama on October 24, 2026; CertiK and PeckShield described a flash-loan governance attack. KadenaTrace's trace shows about $4.85M leaving the named address, swapped on Uniswap, then deposited to Tornado Cash, with about $1,100 left in traced wallets. Figures are as traced on October 31, 2026; the case page has the current state.

More guides