You trace an Optimism transaction by pasting its 66-character hash into a block explorer, reading the From, To, value and event logs, and then following each outgoing transfer, swap or bridge call to the next address. Optimism (OP Mainnet) is an Ethereum Layer 2, so the trail is public and permanent, but it often leaves OP Mainnet through a bridge, and that is where most amateur tracing stops. This guide shows what to look at, how to follow funds across the bridge, what tracing can and cannot prove, and how to protect your evidence if you were scammed.
TL;DR
- Every OP Mainnet transaction has a public hash. Search it in a block explorer, then follow the From, To, value and event logs hop by hop.
- Funds usually leave OP Mainnet through the Standard Bridge or a third-party bridge. Bridge events link the L2 transaction to its Ethereum counterpart.
- Tracing shows where assets moved. It does not, by itself, prove who controls an address.
- If you were scammed, report to IC3, keep original evidence, and be wary of anyone who asks for an up-front fee to recover your money.
- Speed matters: the sooner the hashes and addresses are documented, the more options you keep.
Table of Contents
- How OP Mainnet relates to Ethereum
- Step 1: Find the transaction
- Step 2: Read the details that matter
- Step 3: Follow the funds, hop by hop
- Step 4: Cross the bridge to Ethereum or another network
- What tracing can and cannot prove
- Preserve your evidence before you do anything else
- After tracing: what a U.S. victim should do
- Our perspective
- When to bring in a forensic investigator
- FAQ
- Sources
How OP Mainnet relates to Ethereum
Optimism is an optimistic rollup. It executes transactions off-chain, then uses Ethereum for data availability and settlement, which is why fees are lower and confirmations faster than on Ethereum itself. For a tracer, the practical consequence is that two ledgers describe the same activity: the OP Mainnet chain that shows what happened, and Ethereum, which anchors it.
Finality has two levels. Soft finality comes from the sequencer and relies on trust. Hard finality is anchored by Ethereum, and Optimism documents it as typically arriving within 15 to 30 minutes of submission. Optimism’s documentation notes that hard finality is the definitive state for high-value transactions, so a report built for a legal matter should rely on transactions that have reached it.
One more detail matters for investigations. OP Mainnet state commitments are treated as pending during a challenge window and can be disputed through a fault-proof process, per the protocol overview. That window is why withdrawals to Ethereum are not instant, and it shapes how you read a withdrawal trail later in this article.
Step 1: Find the transaction
Start with whatever the scammer or the scam platform gave you, or whatever your own wallet history shows. You usually have one of three things:
- A transaction hash. This is the cleanest starting point. Searching the 66-character hash in Optimistic Etherscan opens the transaction details page.
- A wallet address. Paste it into the explorer to see its full history of transfers, token movements and contract calls.
- A screenshot or chat message. Pull the address or hash out of it, then verify it on-chain. Never trust a screenshot as proof that a transfer happened.
Optimism’s documentation lists several options for inspection. Optimistic Etherscan, Blockscout and Superscan all offer detailed transaction information, and the same page notes that Tenderly gives developers fully decoded traces and debugging tools. Cross-checking the same hash in two explorers is a cheap way to catch display errors and is good practice before anything goes into a report.
A common mistake is searching the hash on the wrong network. The same address format exists on Ethereum, OP Mainnet and many other chains. If a hash returns nothing, check the network before assuming the transaction is fake.
Step 2: Read the details that matter
Opening the transaction page, focus on a short list of fields. Optimism’s own transaction-tracing tutorial points to the From and To addresses, the value transferred, the event logs and the receipt.
| Field | What it tells you | Why it matters in a fraud case |
|---|---|---|
| From | The address that signed the transaction | Identifies your wallet or the sender you are tracking |
| To | The receiving address or contract | May be a wallet, a token contract, a router or a bridge |
| Value | Native ETH moved | Token transfers often show zero here, so do not stop at this field |
| Status (receipt) | Whether the call succeeded | A failed transaction moved nothing, even if it looks suspicious |
| Event logs | Token transfers, swaps, bridge messages | Show where tokens actually went |
| Timestamp and block | When it was included | Anchors your timeline |
The event logs are the most underused part. When the “To” address is a contract, the real movement is recorded in the logs. A single swap can show your tokens leaving one address, a different token arriving, and a fee going elsewhere. Read all of them. The tutorial notes that logs can be parsed to reveal bridged assets and contract interactions, and the receipt tells you whether the interaction succeeded.
The underlying logic is simple. A blockchain works as a public ledger recording dates, times, addresses and amounts, which is exactly what a tracer needs. The skill is in connecting those records into a story.
Step 3: Follow the funds, hop by hop
Once you understand the first transaction, work forward in time. For each outgoing movement, ask the same questions.
- Where did the asset go next? Open the receiving address and look for the first transaction after your funds arrived.
- Was it split? Scammers often divide a payment among several addresses to make the trail harder to follow. Track every branch, not just the largest.
- Was it swapped? A swap on a decentralized exchange changes the token but not the owner. Follow the output token, not the input.
- Did it pause? An address that receives funds and sits still for days may be a collection point.
- Did it reach a service? Deposits to a centralized exchange are often the point where an investigation can actually produce a response, because the exchange knows its customer. We cover that stage in more detail in our guide to exchange-to-exchange tracing.
Write each hop down as you go: hash, time, from, to, asset, amount. A spreadsheet is enough for a short trail. For a long one, a visual graph is much easier to check, which is the subject of our overview of transaction graph analysis.
A quick worked example. Suppose you signed a malicious approval on a fake airdrop site and a token drained from your wallet on OP Mainnet. The hash from your wallet history shows a call to a token contract. The logs show a transfer from your address to an unknown address, call it A. Address A has two outgoing transactions within the hour: one swaps the token for ETH on a decentralized exchange, another sends that ETH to the bridge. That is two hops and one branch to follow, and the bridge is where the story continues on Ethereum. Our playbook for phishing crypto recovery covers the first hours after a drain like this.
Step 4: Cross the bridge to Ethereum or another network
Bridges are where most OP Mainnet traces change chain. Transactions move between Ethereum (L1) and OP Mainnet (L2) as deposits or withdrawals, and withdrawals require a challenge period before finalization on L1.
For the official route, the Standard Bridge, the Optimism tutorial explains that assets can be traced by parsing event logs and using the SDK to check deposit or withdrawal message statuses. In practice that means:
- Find the bridge call on OP Mainnet and note its message and amount.
- Check the status of the message: initiated, proven or finalized.
- Look for the matching transaction on Ethereum, which may appear days later.
That delay is not a glitch. Optimism’s help center says that, using the official gateway, a withdrawal waits through a seven-day challenge period from when the transaction is published on Ethereum. Fast third-party bridges can skip the wait by fronting liquidity, which means the funds may reappear on Ethereum within minutes under a different address. When you cannot match a withdrawal to a specific L1 transaction, compare timing, amount (minus fees) and token rather than assuming the trail is lost.
For deposits in the other direction, the logs of the Ethereum-side bridge contract record the event. If you prefer to work with queries rather than clicking through pages, Google Cloud publishes an example BigQuery query that finds finalized deposit event logs for assets bridged to Optimism through the Standard Bridge. It is a developer tool, but it shows how large trails can be searched at scale.
Once funds are on another chain, the method repeats with that chain’s explorer. We take the same approach on other networks, for example in our guide to Avalanche C-Chain tracing.
What tracing can and cannot prove
Tracing establishes a sequence: this address sent this asset to that address at this time. In federal cases, investigators have used exactly this method. One affidavit describes tracing stolen funds through multiple accounts and platforms to accounts connected to the defendants.
Notice what made that possible: the trail reached accounts at platforms that hold identity records. On its own, the blockchain shows addresses, not people. A careful report therefore separates three levels of statement:
- Established by the chain: transfers, amounts, timestamps, contract calls.
- Strongly inferred: that two addresses share an operator, based on patterns such as funding source, timing and reuse.
- Requires outside evidence: who the person is, which usually comes from exchange records, legal process or other investigation, including open-source research.
This distinction is what makes a report credible to a lawyer or a court. Overclaiming, for instance saying “this wallet belongs to the scammer” when you only know it received your funds, weakens everything around it. We go deeper into the checks analysts apply in our article on wallet activity analysis and into how courts treat this material in blockchain evidence admissibility.
Preserve your evidence before you do anything else
On-chain data does not disappear, but the context around it does: chat messages get deleted, scam websites go offline, and exchange screenshots get lost with a phone. The FBI’s Internet Crime Complaint Center advises victims to keep original evidence, including cryptocurrency receipts, web pages, emails, chat transcripts and logs, in a safe location in case an agency requests it.
A practical checklist for an Optimism-related loss:
- Save every transaction hash and the wallet addresses involved, copied as text, not retyped.
- Export or screenshot the explorer pages with the date and time visible.
- Keep the original chat, email and website evidence, including URLs and any profile names.
- Record the sequence of events in your own words while you still remember it.
- Do not interact with the scammer’s address again, and revoke token approvals on your wallet from a clean device.
For how this material is handled in court, see our digital evidence preservation guide.
After tracing: what a U.S. victim should do
Start with a report. IC3 asks U.S. victims to provide cryptocurrency addresses, amounts and types, transaction hashes, and transaction dates and times, which is exactly what the steps above produce. Our walkthrough of filing an IC3 complaint takes you through it, and the 24-hour action list for stolen crypto covers what to do the same day. If you wonder what happens next, read what to report to trigger a police investigation.
Also contact the company you used to send the money. The FTC notes that a cryptocurrency payment usually cannot be reversed, but it advises asking the company that sent the money whether it can reverse the transaction. If the funds went through a centralized exchange, tell that exchange immediately, with the hashes in hand.
Warning signs of a second scam
Victims are targeted again. The FBI warns that private recovery services demanding up-front fees are often fraudulent and sometimes are the next stage of an existing scam. The FTC adds that no legitimate party will contact you out of the blue offering to recover lost money, and that only scammers tell you to pay in cryptocurrency.
Red flags worth treating as a stop sign:
- Someone contacts you first, on social media or by message, offering to get your funds back.
- A guaranteed recovery or a guaranteed percentage.
- Payment demanded in crypto or gift cards before any work is shown.
- Requests for your seed phrase or remote access to your device. No genuine investigator needs these.
We also explain why no honest provider can promise a number in our piece on recovery success rates, and how to judge a provider in Is a crypto recovery scam risk worth paid forensics?
Our perspective
Most failed traces we see do not fail because the blockchain hides anything. They fail because the person tracing stops at the first bridge, ignores token event logs, or treats an address cluster as a confirmed identity. Tracing on OP Mainnet is not exotic: the data is public, the explorers are good, and the Ethereum link is well documented. What takes experience is handling complexity, such as split payments, swaps, mixers and bridges, and writing it up so a lawyer, an exchange compliance team or a court can follow it without trusting us blindly.
Our approach is to document every hop with its hash, keep a clear line between what the chain proves and what we infer, and build reports for legal proceedings from the start. We work directly with law firms and with individual victims, and we explain the process openly, including the limits. Sometimes the honest answer is that the trail ends at an address nobody can identify. We would rather tell you that than sell you hope.
— cristian
When to bring in a forensic investigator
You can do a first pass yourself, and you should, mainly to preserve hashes and addresses. Consider professional help when:
- The trail splits into many branches or passes through several bridges and chains.
- You need a technical report for a lawyer, police agency or exchange.
- The amount lost makes a mistaken conclusion costly.
- You suspect the same operator is behind several wallets and need that supported by evidence.
Recovera Forensics investigates stolen cryptocurrency through blockchain forensics, wallet activity analysis, OSINT, and technical reports for legal proceedings. You can see our investigation services on the recovery scams services page, and law firms can look at our services for professional offices. We do not publish fixed prices, because the work depends on the case, so the first step is describing yours.
FAQ
Can I trace an Optimism transaction without technical skills?
Yes, for the basics. Paste the hash or address into a block explorer such as Optimistic Etherscan and read the From, To, value and logs. Following funds through swaps, splits and bridges takes more practice, and a professional is worth considering when large sums are involved.
Why does my Optimism withdrawal take days to show on Ethereum?
The official bridge uses a challenge period before a withdrawal can be finalized on Ethereum, which Optimism’s help center describes as seven days. Third-party bridges can be faster because they front the funds, so the same money may appear sooner at a different address.
Does a traced address prove who stole my crypto?
No. It shows where your funds went, not who controls the destination. Identity usually depends on additional evidence, such as exchange account records obtained through law enforcement or legal process, plus careful open-source research.
Should I pay someone to recover my stolen Optimism funds?
Be cautious. The FBI and FTC warn about recovery services that charge up front or contact you unprompted. Report to IC3 first, keep your evidence, and ask any investigator exactly what they will deliver and how the work is documented before you pay.
Sources
- What Is OP Mainnet? How It Works and How It Compares
- Optimism Documentation: Transaction finality
- Optimism Documentation: Protocol overview
- Optimism Documentation: Block explorers
- Optimistic Etherscan Information Center: Viewing transactions
- Optimism tutorial: Tracing transactions with the SDK
- Google Cloud: Optimism example queries
- U.S. DOJ (SDNY): public ledger description
- U.S. DOJ: Statement of facts, 2022
- IC3: Frequently asked questions
- IC3: 2023 Cryptocurrency Fraud Report
- FTC: Don’t pay for help recovering crypto exchange losses
- FTC: Did someone insist you pay them with cryptocurrency?
