Exchange-to-exchange tracing is the forensic work of following stolen cryptocurrency as it moves from one exchange account or platform to another, until it reaches a place where a real identity sits behind the account. If you landed here looking for the Microsoft Exchange “message trace” tool for email, that is a different subject. This guide is about crypto: how funds are tracked across exchanges, what a victim needs to document, and what a usable forensic report looks like.
TL;DR
- Stolen crypto rarely goes straight from the victim to one exchange. It usually passes through intermediary wallets, and sometimes several exchanges, before cash-out.
- The key moment is when funds reach a centralized exchange deposit address. That is where subpoenas or discovery requests can identify the account holder through KYC records.
- Speed and accuracy matter. Collect transaction hashes, addresses, amounts and timestamps, and report to the FBI’s IC3.
- Be wary of anyone who asks for an upfront fee to “recover” funds. The FBI warns that these are often secondary scams.
- A forensic report only helps if it is documented, repeatable and written so that lawyers and investigators can rely on it.
Table of Contents
- What exchange-to-exchange tracing actually means
- Why the exchange is the pressure point
- How a trace from exchange to exchange works
- What you can do in the first 72 hours
- What exchanges can and cannot do
- Where trails get complicated
- What makes a tracing report usable
- Our perspective
- How Recovera Forensics can help
- Red flags in recovery offers
- FAQ
- Sources
What exchange-to-exchange tracing actually means
A blockchain is a public ledger. Every transfer of Bitcoin, Ethereum or a token such as USDT leaves a permanent record of the sending address, the receiving address, the amount and the time. What the ledger does not show is who owns an address.
That gap is why exchanges matter. A centralized exchange (the kind where customers verify their identity to open an account) holds records that a private wallet does not. When stolen funds are traced to a deposit address controlled by such a platform, there is finally a party that may know the person on the other end.
Exchange-to-exchange tracing covers three situations:
- Your funds left an exchange you used. You sent crypto from your own exchange account to an address a scammer gave you. Tracing starts at your withdrawal.
- The scammer moved funds between exchanges. Criminals often deposit into one platform, convert or withdraw, and deposit again somewhere else to break the trail.
- The funds were split across wallets first. The path runs from the victim’s wallet to a scam wallet, through intermediary wallets, then to an exchange deposit address.
In all three, the goal is the same: identify the last point where the money can be tied to an account, and prove that the chain of transfers from your loss to that point is real.
Why the exchange is the pressure point
The FBI’s IC3 explains that a crypto transfer can occur anywhere and only requires the private key tied to the sending address. Transactions are also irrevocable. There is no chargeback desk. Once funds leave, the practical levers are tracing, legal process and speed.
Those levers converge on exchanges. In a 2025 federal case brought by the CFTC, authorities traced stolen digital assets to a specific deposit wallet at an exchange, and the court ordered the tokens transferred to the victim. Legal counsel and law enforcement can use traced exchange addresses to support subpoenas or discovery requests that identify the account owner through KYC records.
The U.S. Attorney’s Office for New Jersey also describes how a virtual currency exchange typically acts as a trading platform and a storage platform, which explains why so many fraud trails end there: that is where crypto meets dollars and other currencies.
How a trace from exchange to exchange works
A careful investigation follows a sequence. Shortcuts at any step produce a report that falls apart under questioning.
Step 1: Fix the starting point
Everything begins with your own loss. You need the transaction hash, the receiving address, the asset, the exact amount and the date and time. The FBI lists the same items when it asks victims to file a complaint: the crypto address, type of asset, amount, transaction ID and the date and time of the event.
Format matters, because small errors send an investigator down the wrong path. Transaction hashes on Bitcoin and Ethereum are typically 64-character hexadecimal strings. Ethereum addresses are 42 characters including the 0x prefix. Copy and paste; never retype.
Step 2: Follow the first hops
The investigator maps where the funds went next. Scammers commonly use one of these patterns:
- Consolidation: many victims’ funds gather in one wallet.
- Peeling: a large amount is split into smaller pieces sent to fresh addresses.
- Chain hopping: funds are swapped to another asset or moved across a bridge to another blockchain.
- Mixing: funds are pooled with other users’ funds to obscure the link between sender and receiver.
Each of these needs a judgment call, not just a click on a block explorer. Basic wallet tracking shows you that money moved. Forensic tracing explains why you can say that the money arriving at the end is the same money that left you.
Step 3: Recognize the exchange
Not every address at the end of a trail is an exchange. Investigators look at behavior: an address that receives deposits from many unrelated wallets and then consolidates into a small set of internal addresses looks very different from an individual’s wallet. Labeled address clusters and flow patterns help confirm it. A claim that “this is an exchange deposit address” should be backed by more than one indicator, and the report should say how confident the conclusion is.
Step 4: Trace across exchanges
When funds enter an exchange and come out again, the on-chain trail can look like it stops. It does not always. Exchanges usually move customer funds through internal hot wallets, and later withdrawals may be linked by timing, amounts and the destination. An investigator documents the deposit, the likely withdrawal and the reasoning connecting them, and states what is certain versus what is inference. Only the exchange can confirm what happened inside its own systems, which is why legal process comes next.
Step 5: Package it for action
The output is a report that a lawyer, a regulator or an agent can read without a blockchain background: a timeline, a flow diagram, the addresses involved, the hashes, the method used and the limits of the findings.
What you can do in the first 72 hours
The early window matters because funds that sit in a traceable place can sometimes be addressed, while funds that have been layered through several services become harder to follow. Without promising any outcome, here is a sensible order of actions:
- Stop sending money. If anyone contacts you promising recovery for a fee, treat it as suspect.
- Capture the evidence. Save transaction hashes, wallet addresses, screenshots of chats, emails, websites and exchange confirmations. For emails, keep the original file, not a screenshot. Our guide on saving the .eml file to trace scam emails explains why.
- Report to the FBI. File at ic3.gov and include the transaction details above. The FBI says its ability to help depends on the accuracy and completeness of what you provide.
- Contact your own exchange. If you sent funds from an exchange account, tell its support and fraud team the transaction details promptly and keep a record of every reply.
- Talk to a lawyer. An attorney experienced in fraud or digital asset cases can advise on civil claims and on how to obtain exchange records through the courts.
- Get the trace done properly. A forensic report is the document that turns your story into something an exchange compliance team, a court or an agent can use. Our 24 to 72 hour investigator checklist lays out the sequence.
If you want to understand what police will and will not do with your report, read what to report to trigger police crypto investigations.
What exchanges can and cannot do
It helps to have honest expectations.
| Question | Realistic answer |
|---|---|
| Will an exchange hand me the scammer’s name? | Generally no, not on a victim’s request alone. Identity is usually released through legal process such as a subpoena or court order. |
| Can funds be frozen? | Sometimes, when the exchange or law enforcement acts while funds are still on the platform, or when a court orders it. There is no guarantee. |
| Does tracing prove fraud? | Tracing shows where assets went. Proving fraud also needs the story, messages and context that show how you were induced to send them. |
| Is the trail ever permanent? | The blockchain record is permanent. The ability to link it to a person is what varies. |
The CFTC case above shows the best-case path: trace to a specific deposit wallet, then a court order. It is one case, not a promise about yours.
Where trails get complicated
Mixers and bridges
Mixers and cross-chain bridges are designed, or at least used, to break simple tracking. Bridges are smart contracts that move value between blockchains. The FTC’s complaint about the Nomad hack describes how users generally interacted with the Nomad Token Bridge through a web interface backed by smart contracts, a useful illustration of what a bridge is. Tracing through one means reading the contract events on both chains and matching deposits to releases. It takes more than a wallet lookup, and it should be documented step by step.
Several exchanges in a row
When a scammer deposits at exchange A, withdraws, and deposits at exchange B, each platform holds a separate piece of the record. A single report can identify both, but each exchange needs its own legal request. That is why the report should list every deposit address by platform and in order.
Stablecoins and issuer freezes
Some token issuers can freeze tokens at specific addresses. Whether they will act depends on legal process and their own policies, so tracing a stablecoin quickly can matter. Treat this as a possibility to raise with counsel, not an expectation.
What makes a tracing report usable
The SEC staff memo summarizing a meeting with a blockchain analytics firm shows that regulators are interested in how blockchain data can strengthen oversight. For a victim, the practical lesson is that analytics tools are strongest when guided by a clear timeline and documented method.
A report built for legal use should have:
- A documented timeline from your first transfer to the last traced address.
- A flow diagram a non-technical reader can follow.
- Full identifiers: hashes, addresses, block heights and timestamps with time zones.
- A method statement describing tools, data sources and any heuristics used.
- Confidence levels that separate confirmed links from inferences.
- Preserved evidence with a clear chain of custody. See our guides on crypto chain of custody and admitting blockchain evidence in U.S. court.
Law firms preparing filings may also want our guide to forensic affidavits for crypto cases.
Our perspective
Most people who come to us have already tried the obvious things. They pasted a wallet address into a block explorer, saw a long list of transfers and could not tell what mattered. The data was never the problem. The problem was turning it into an argument.
We approach exchange-to-exchange tracing as evidence work first. We analyze transaction patterns on public blockchains, connect wallet activity to wider fraud networks where the data supports it, and write findings so that a lawyer can use them in legal proceedings. We say plainly what is established and what is not, because an overstated report can hurt a case more than a modest one.
We also reconstruct flows through mixers and bridges rather than stopping when a trail looks like it goes cold, and we work directly with law firms. We will not promise that funds will come back. Nobody honest can. What we can promise is a transparent process and a report built to be used.
— cristian
How Recovera Forensics can help
If your funds have moved through one or more exchanges, our cryptocurrency scam investigation and related services cover stolen crypto tracing, OSINT and digital attribution, preservation of evidence, and support for Forex, online trading and gambling fraud cases. Law firms can look at our services for professional offices, which include technical analysis and documentation for client cases. Fees depend on the engagement, so we discuss scope with you before work begins.
For a deeper look at method, start with how blockchain forensics traces and proves crypto fraud.
Red flags in recovery offers
People who have lost money are targeted again. The FBI warns victims to be careful with recovery services, and fees charged upfront for guaranteed results are a classic warning sign, as described in the IC3 public service announcement. Before you hire anyone, ask:
- Will they describe their method, and will the report name its limits?
- Do they promise a result? An honest firm cannot.
- Will they work with your attorney and with law enforcement?
- Do they explain what they will deliver, in writing, before you pay?
FAQ
Can an exchange freeze stolen crypto if I report it?
Sometimes, but not automatically. Exchanges generally act on legal process or clear indications of fraud, and only while the funds are still on the platform. Reporting quickly, with transaction hashes and a traced deposit address, gives you the best chance of getting attention.
Is tracing between exchanges legal for a private person to hire?
Yes. Blockchain data is public, and analyzing it is lawful. Identifying the account holder behind an exchange deposit is different: that normally requires a subpoena or court order obtained through a lawyer or law enforcement.
What information do I need before starting a trace?
Gather the transaction hash, the receiving address, the asset, the exact amount and the date and time. The FBI asks for the same details. Add any messages, emails and website addresses connected to the scam.
Does a forensic report guarantee I will get my money back?
No. A report improves the quality of the evidence available to your lawyer, an exchange or an investigator. Recovery depends on where the funds are, how fast legal action is taken and what the courts or agencies decide.
Is this the same as Microsoft Exchange message tracing?
No. Message trace in Microsoft Exchange follows email through a mail system. This article covers tracing cryptocurrency across crypto exchanges.
Sources
- FBI IC3: guidance for cryptocurrency scam victims
- FBI IC3: cryptocurrency crime information
- CFTC court order in the Debiex case, March 2025
- U.S. Attorney’s Office, District of New Jersey: virtual currency exchange description
- FTC complaint on the Nomad Token Bridge
- SEC Crypto Task Force staff memo on blockchain analytics
