To trace an Arbitrum transaction, start with the transaction hash, open it in a block explorer, record the sender, recipient, value, block and logs, then follow every outgoing transfer from the receiving wallet. Do this while you preserve raw evidence, because the trail is only useful if it can be verified later. Below, we walk through each step the way a forensic analyst would, and we say plainly what tracing can and cannot do.
TL;DR
- Every Arbitrum transaction has a unique hash. Search it in a block explorer to see the sender, recipient, value, fee, block and status.
- Arbitrum has no public mempool, so you trace what was finalized and ordered, not what was pending. Start from the confirmed transaction.
- Top-level fields are not enough. Internal-call traces, logs and approvals often show where funds actually went.
- Save raw data, not just screenshots, and report in the US through the FBI’s IC3 while the details are fresh.
- No one can reverse a confirmed transaction. Be wary of anyone who asks for an upfront fee to “recover” it.
Table of Contents
- How a transaction moves through Arbitrum
- Step 1: Find the transaction from a hash or a wallet address
- Step 2: Read the details that matter
- Step 3: Follow the funds from wallet to wallet
- What a trace can and cannot tell you
- Preserve the evidence before you do anything else
- Reporting an Arbitrum scam in the United States
- Beware of the second scam
- Get a forensic trace of your Arbitrum case
- FAQ
- Sources
How a transaction moves through Arbitrum
Tracing is easier when you know what the chain does with a transaction. Arbitrum is a layer 2 network that runs on top of Ethereum. It executes transactions offchain while Ethereum provides settlement and data availability, and the Sequencer orders transactions and posts compressed batches to Ethereum.
In practice, a user signs a transaction and sends it to the Sequencer. The Sequencer orders it, and a deterministic state-transition function executes it and produces a receipt. That receipt is what you read in an explorer: status, gas used, logs.
Two details matter for victims:
- No public mempool. Arbitrum’s documentation states that transactions go directly to the Sequencer’s private in-memory structures, unlike Ethereum. You cannot watch a scam transaction sit in a public queue. Your trace begins once it is included in a block.
- A second path exists. The parent-chain Delayed Inbox is an alternative submission route that provides censorship resistance. Most activity you will see goes through the Sequencer, but a transaction that arrived another way can look different in the records.
The practical upshot: the explorer’s record of the finalized transaction is your starting point, and everything else is built from it.
Step 1: Find the transaction from a hash or a wallet address
You usually have one of two things: a transaction hash from your wallet history or exchange withdrawal record, or the scammer’s wallet address from a chat or website.
If you have the hash. Arbiscan’s guide says that searching a hash opens the transaction page, where the overview lists the hash, status, block, timestamp, sender, recipient, value, transaction fee and gas price. A transaction hash is a unique 66-character identifier, so if what you copied is shorter or longer, it is probably an address or something else.
If you only have an address. Paste it into the same explorer search. You will see the wallet’s transaction list. Find the transfer that matches the date and amount you lost, then open that transaction.
If you are unsure which chain. The same address format works across many EVM networks, so a wallet that looks right on Arbitrum may have its activity on another chain. Confirm the network in your wallet history before concluding that nothing happened. If your funds moved on Ethereum itself, our guide on how to trace Ethereum transactions to an exchange covers that path.
Step 2: Read the details that matter
A transaction page can look like a wall of data. These are the fields a forensic analyst records first. OWASP’s evidence guidance lists the transaction hash, block number and hash, from and to addresses, value, gas data, calldata, receipt logs and internal-call traces as useful evidence.
| Field | What it tells you | Why it matters after a scam |
|---|---|---|
| Transaction hash | The unique ID of the transfer | The anchor for every report and every later reference |
| Status | Whether execution succeeded | Confirms the funds actually moved |
| Block and timestamp | When the transaction was included | Builds the timeline |
| From / To | Sender and direct recipient | The recipient may be a contract, not the scammer’s wallet |
| Value | Native ETH moved | Token transfers often show as zero here |
| Logs | Token transfer and approval events | Show where tokens went |
| Internal traces | Calls between contracts | Reveal activity that top-level fields hide |
Two habits save time.
Check the “To” address type. If the recipient is a contract, the real destination may be in the logs or traces, not in the headline field. OWASP notes that traces can reveal activity not visible in top-level transaction fields.
Look at token transfers and approvals. Many Arbitrum thefts involve tokens, not native ETH. A victim signs an approval, and the scammer later pulls tokens out. Ethereum.org explains that a legitimate ERC-20 approval from an externally owned account should originate from that account and target the token contract directly, and that other patterns may be suspicious. An approval to an unknown address that you do not remember granting is a lead worth recording.
Also beware of fake tokens. Ethereum.org warns that a token can imitate a legitimate asset and recommends getting the real token address from the issuing organization. If the asset you think you lost looks odd in the explorer, verify the contract before you assume anything about its value.
Step 3: Follow the funds from wallet to wallet
Once you know where your transfer landed, the work becomes a graph problem. Stolen funds rarely stay put. They are split, moved through intermediate wallets and contracts, swapped, and sent on.
A practical routine:
- Open the receiving wallet and sort its activity by time. Find the first outgoing transaction after your funds arrived.
- Open that transaction and read the full set of transfers inside it, not just the first line.
- Note every destination. Funds may be divided across several addresses within minutes.
- Repeat for each branch, recording the hash of each hop in a spreadsheet: hash, timestamp, from, to, asset, amount.
- Stop at a meaningful endpoint: an address that holds the funds, a deposit address at a service that identifies its customers, or a point where the funds leave Arbitrum.
Visualization helps. Ethereum.org’s scam guidance points victims to block explorers to look up a hash or address, to a community database of reported addresses, and to a visualization tool for fund flows. Graph tools that display a complete trace tree and a money-flow diagram of token movement between addresses can show in one picture what takes hours to read line by line. A diagram is a map for you, though, not evidence by itself. The record underneath it is what counts.
When funds leave Arbitrum
A common endpoint is a bridge or an exchange deposit. A bridge transfer is not the end of a trace. It is a hop to another chain, where you continue the same method on that network’s explorer. If the funds land at an exchange, the trail often changes character, because the exchange holds records about its customer. Our pieces on exchange-to-exchange tracing and on why the first 72 hours matter explain what happens at that stage and why speed counts.
If your scam involved other networks, we also publish tracing guides for Avalanche C-Chain, Cardano and Polkadot.
What a trace can and cannot tell you
Expectations matter here, so we want to be exact.
A trace can show the path of funds, the timing, the amounts, the clusters of wallets that behave as one operation, and the points where funds touch services that keep customer records. It can turn a vague story (“I got scammed”) into a documented sequence a bank, platform, law enforcement agency or attorney can act on.
A trace does not, on its own, name a person. A wallet address is not an identity. Linking it to a real individual or a fraud network takes additional work, such as open-source intelligence and connecting wallet behavior to other known activity.
A trace does not reverse anything. Ethereum.org states that a central authority cannot reverse confirmed transactions because Ethereum is decentralized, and the same is true of transactions on Arbitrum as a network built on it. What reporting and investigation can do is support inquiries and warn other users. Any recovery depends on the facts: where the funds ended up, who holds them, and whether a legal process can reach that party.
Preserve the evidence before you do anything else
One of the most common mistakes is relying on a few screenshots. Explorers change their interface, labels get updated, and a screenshot only proves what a screen displayed.
What to save right away:
- Transaction hashes, wallet addresses, screenshots and all communications with the scammer, including chat exports, emails, website URLs and payment instructions.
- The transaction “envelope” and the receipt. OWASP explains the envelope holds fields such as from, to, value, gas, nonce and calldata, while the receipt holds execution status, gas used, any contract address and logs.
- Raw node data. OWASP recommends preserving raw JSON-RPC responses for eth_getTransactionByHash and eth_getTransactionReceipt, full traces, decoded logs, verified source and ABI or bytecode, and raw storage reads with their block hash.
- OWASP advises preferring raw RPC JSON over a live explorer page or screenshot, since raw output is machine-verifiable. Keep screenshots as a supplement, not a substitute.
If you may need the material in court, how you store it matters too. Our guides on digital evidence preservation and U.S. admissibility and on using crypto forensics in court go through the details.
Reporting an Arbitrum scam in the United States
If you are in the US, file a report with the FBI’s Internet Crime Complaint Center (IC3) and keep a copy of what you submit. A report that includes transaction hashes, wallet addresses, dates, amounts and the scammer’s communications is far more usable than a narrative alone. We lay out the process in filing an IC3 complaint in 7 steps and the first-day checklist in what to do in the first 24 hours after a theft. For what to expect from local police, see whether police will investigate crypto scams.
Also tell the exchange or platform you used to send funds, and any platform where the scammer contacted you. If the scam started with a SIM swap, preserve carrier logs alongside your hashes.
Beware of the second scam
After a loss, victims are targeted again. Ethereum.org warns that recovery scammers may promise to trace and recover funds for an upfront fee, then disappear, and that no legitimate service can reverse blockchain transactions. The same page is clear that you should never share seed phrases or private keys.
A sound way to judge any investigator: they should explain what they will actually do (trace, analyze, document), describe the deliverable (a report), and never ask for your seed phrase or promise a guaranteed return of funds.
Our perspective
Most victims arrive with the same story: they have a hash, a screenshot and a sense that the money is gone. What they usually lack is a structured account of what happened on-chain. We believe the value of an Arbitrum trace is in that account.
At Recovera Forensics, our approach is to analyze transaction patterns on the public blockchain, follow the flow of assets across wallets and contracts, and connect wallet activity to wider fraud networks where the evidence supports it. Our process is designed to go beyond basic wallet tracking, including reconstructing complex flows through mixers and bridges.
We build reports intended for legal proceedings and work directly with law firms. That is why we insist on preserving evidence properly from day one: a clear, verifiable trail strengthens every option a victim has, whether that is a platform complaint, a police report or a civil case. Our process is transparent and victim-centered, and we never ask for your keys.
cristian
Get a forensic trace of your Arbitrum case
If you would rather have an investigator follow the funds and document them, our cryptocurrency scam investigation and evidence preservation services cover tracing, OSINT attribution and technical reports. Law firms can see how we support client matters on our professional offices page. For a sense of what a usable report contains, read our guide to crypto tracing for law firms.
FAQ
Can I trace an Arbitrum transaction for free?
Yes, the basic lookup is free. Search the transaction hash or wallet address in a public block explorer and you can see the sender, recipient, value, fee, block and status. Following funds across many wallets takes more time and skill, but the public data is open to anyone.
Why can’t I find my Arbitrum transaction?
The most common reasons are searching the wrong network, copying an incomplete hash, or using an address instead of a hash. A transaction hash is a 66-character identifier, so check its length. Confirm in your wallet which network the transfer used before searching again.
Does tracing a transaction reveal who the scammer is?
Not by itself. A trace shows addresses and the movement of funds, not names. Identifying the person or network behind a wallet requires further investigation, such as open-source intelligence and linking wallet behavior to other activity.
Can stolen Arbitrum funds be reversed?
No central authority can reverse a confirmed transaction. What you can do is document the trail, report it, and notify any exchange or platform that received funds. Be cautious with anyone who guarantees recovery or asks for an upfront fee.
What should I save first?
Save the transaction hashes, wallet addresses, and every message with the scammer. Then capture raw transaction and receipt data from a node rather than relying only on screenshots, so the record can be verified later.
Sources
- Arbitrum introduction
- Inside Arbitrum Nitro
- Sequencer architecture and transaction flow
- Transaction lifecycle on Arbitrum
- Arbiscan Information Center: Viewing Transactions
- OWASP: Evidence Collection and Preservation
- Ethereum.org: Some tricks used by scam tokens and how to detect them
- Ethereum.org: Scam help and reporting
- Bitquery: Tracing Transactions on Explorer
