To trace a Polkadot transaction, open a Polkadot explorer, select the right network, and paste the wallet address or extrinsic identifier. Then read the transfer history, follow each outgoing transfer to the next address, and check cross-chain (XCM) transfers if the funds left the relay chain. If the money was stolen, you also need to export and save what you see, because the trail is only useful if you can prove it later.
This guide walks through each step, explains what an explorer can and cannot tell you, and shows where a do-it-yourself trace ends and a forensic investigation begins.
TL;DR
- Paste a public address into a Polkadot explorer such as Subscan or Statescan and use the Transfers view to see incoming and outgoing movements.
- Polkadot transaction identifiers differ from Bitcoin or Ethereum: the block-number-and-index format (for example 23298706-2) is often the reliable identifier, so save both it and the hash.
- Funds that move between parachains appear in XCM transfer lists, so a trace that stops at the first hop can miss the real destination.
- Export the history as a CSV, take dated screenshots, and file a complaint at the FBI’s IC3 without waiting for a full trace.
- An explorer shows what happened on-chain. It does not show who controls an address, and it does not recover funds.
Table of Contents
- What Polkadot transaction tracing actually means
- Step 1: Find the transaction by address or hash
- Step 2: Follow the funds, hop by hop
- Step 3: Trace across parachains and chains
- What an explorer can show, and what it cannot prove
- Preserve evidence while you trace
- Report the scam in the United States
- Can tracing help recover stolen crypto?
- Our perspective: where DIY tracing stops
- When to bring in a forensic investigator
- FAQ
- Sources
What Polkadot transaction tracing actually means
Polkadot is a public ledger. Every transfer from one account to another is recorded, timestamped and visible to anyone. Tracing is the act of reading that record in order: where did the funds leave your wallet, where did they land, and where did they go next.
The Polkadot Developer Docs describe block explorers as platforms that give access to on-chain data and analytics. That is the key point for a victim. An explorer is a window onto data. It is not an investigator. It will show you a chain of addresses, but it will not tell you that address number four belongs to a particular exchange customer, or that addresses six and nine are run by the same person.
Tracing a Polkadot transaction comes down to three layers of work:
- Locating the transaction or account in an explorer.
- Following the funds hop by hop, including across parachains.
- Attributing and documenting: linking addresses to real-world entities and preserving the result in a form a lawyer, bank or court can use.
You can do the first layer yourself in minutes. The second takes patience. The third is where specialist forensics comes in.
Step 1: Find the transaction by address or hash
The Polkadot Wiki explains that you can find the history of a Polkadot or Kusama account on explorers such as Subscan or Statescan. You select the network, paste the public address, and open the account page. On Subscan, the Transfers tab separates incoming and outgoing transfers from other extrinsics, which makes it the best place to start.
Here is a simple routine:
- Copy your own wallet address (the public one, never a seed phrase or private key).
- Open the explorer and confirm you are on the Polkadot relay chain, not Kusama or a parachain. Choosing the wrong network is the most common reason people think a transaction “doesn’t exist.”
- Paste the address and open the Transfers tab.
- Find the outgoing transfer that matches the date and amount of the scam payment.
- Open it and note the recipient address, amount, timestamp, block number and extrinsic index.
A note on Polkadot transaction IDs
Polkadot does not behave exactly like Bitcoin or Ethereum when it comes to identifiers. Blockdaemon’s documentation states that for Polkadot (DOT) the transaction hash is not a unique identifier, and that you should use the block-number-and-index format, such as 23298706-2. Explorers list this as the extrinsic index, alongside the hash. Subscan’s extrinsic list shows both columns side by side.
In practice: record both. When you later give a report to an exchange, a bank or law enforcement, the index removes any ambiguity about which transfer you mean.
Step 2: Follow the funds, hop by hop
Once you have the first recipient address, click through to its own account page and read its transfer history. You are looking for what happened right after your funds arrived.
Common patterns in scam flows:
- Immediate forwarding. Funds arrive and leave within minutes to a second address, often in one or several equal pieces.
- Splitting. The amount is divided across many addresses to make each movement look small.
- Consolidation. Several addresses send to one collector address, which may be a sign that multiple victims’ funds are being pooled.
- Exit to a service. Funds are sent to an address that receives deposits from many unrelated users, which usually points to an exchange or payment service.
- Dormancy. Funds sit untouched for weeks, then move again.
The U.S. Department of Justice gives a sense of how far this can go. A 2025 forfeiture complaint filed in the District of Columbia describes investigators tracing victim funds through intermediary addresses and exchange accounts, and shows that complex cases can involve hundreds of thousands of transactions. Your own case will probably be smaller, but the logic is the same: each hop is a lead, and the most useful hops are the ones that touch a regulated platform.
The FBI’s February 26, 2025 advisory on the Bybit hack shows the other side of the problem. Stolen assets there were converted and dispersed across thousands of addresses on multiple blockchains, and the FBI encouraged exchanges, bridges and analytics firms to block transactions linked to the identified laundering addresses. That is a state-level attacker, but the techniques it describes (conversion, dispersal, cross-chain movement) are the same ones smaller scammers copy.
What a manual trace looks like in a table
Keep a log as you go. A simple version looks like this:
| Hop | From | To | Amount (DOT) | Time (UTC) | Block-index | Notes |
|---|---|---|---|---|---|---|
| 1 | Your wallet | Address A | Amount sent | Date and time | Block-index | The scam payment |
| 2 | Address A | Address B | Amount | Date and time | Block-index | Forwarded within minutes |
| 3 | Address B | Addresses C, D, E | Split amounts | Date and time | Block-index | Splitting |
| 4 | Address D | Deposit address | Amount | Date and time | Block-index | Possible exchange deposit |
This log becomes the backbone of any later report. Our guide to exchange-to-exchange tracing explains why that last row, the point where funds reach an exchange, is often the one that matters most.
Step 3: Trace across parachains and chains
Polkadot is not one chain. It is a relay chain plus many parachains, and assets move between them using cross-consensus messaging (XCM). A trace that only watches the relay chain will lose the money the moment it is sent to a parachain.
Subscan’s XCM transfer list displays the cross-chain index, the origin and destination accounts, values, timestamps, the protocol used (such as HRMP or VMP/UMP) and the result of each transfer. Use it like this:
- Search for the address you are following inside the XCM transfer list.
- Note the destination chain and destination account. The address format may differ on the other chain even when the same key controls it.
- Switch to that parachain’s explorer view and continue the trace from the destination account.
- Check the result column. A failed or pending message means the funds did not arrive where it first appears they went.
The ecosystem also has dedicated cross-chain explorers. One of them, XCSCAN, says it tracks complete transfer paths including all intermediate steps, not only the source and destination. That kind of view helps when funds pass through several parachains in a row.
Bridges to other blockchains such as Ethereum add another layer. Once funds leave Polkadot through a bridge, you need to continue the trace on the other chain’s explorer, and then work out which bridge transaction on one side matches which on the other. This is the point where many self-run traces stall, and where tools that cluster addresses and link cross-chain activity are valuable.
What an explorer can show, and what it cannot prove
Being honest about limits will save you from false hope and from bad decisions.
An explorer can show you:
- That a transfer happened, when, and for how much.
- The sending and receiving addresses.
- The fees, the result and the events attached to the extrinsic.
- Related transfers in and out of any address.
- Cross-chain movements recorded in XCM lists.
An explorer cannot show you:
- Who owns or controls an address. A public address is pseudonymous.
- Whether two addresses belong to the same person. That is an inference, and it needs supporting evidence.
- Whether a deposit address is an exchange, and which customer account it belongs to. Only the exchange knows its customers.
- Whether the transfer was fraudulent. The ledger records that a transfer was authorized, not why.
- Any way to reverse the payment. Blockchain transfers are final.
This matters for legal use. A screenshot of an explorer page shows what the page displayed at a moment in time. It is a lead, not an expert report. Our guide to wallet activity analysis covers the checks analysts run before the work can be put in front of a court.
Preserve evidence while you trace
A trace is only as useful as the record you keep. Do this as you go, not afterward.
- Export the history. The Polkadot Wiki’s instructions for viewing transaction history include saving the complete history as a CSV export. Do it for your wallet and for each address in the trail.
- Capture the identifiers. The FBI asks for cryptocurrency addresses, the amount and type, the date and time, and the transaction ID or hash, as listed in its guidance for reporting crypto scams.
- Take dated screenshots of each explorer page, with the URL and time visible.
- Keep every communication with the scammer: chats, emails, profile links, website and app addresses, and any payment instructions.
- Write a timeline: first contact, each payment, the moment you realized it was a scam.
- Do not edit or delete wallets, chats or browser history. Back them up first.
For a fuller checklist, see our guides on saving crypto evidence in the first 72 hours and on digital evidence preservation.
Report the scam in the United States
Do not wait for a finished trace before you report. The FBI’s guidance for victims tells people in the United States to file a complaint at IC3.gov promptly, with addresses, cryptocurrency type and amount, dates and times, transaction IDs or hashes, communications, websites or apps, exchange information and the scam timeline. It also says to submit a report even if transaction information is unavailable.
The FBI’s cryptocurrency page adds a warning that matters here: be wary of recovery services, especially any that demand an upfront fee. Check any firm, including us, on what it will actually deliver. A legitimate investigator describes the work (tracing, attribution, a report) and does not promise a guaranteed refund.
The FTC’s ReportFraud.ftc.gov is a complementary channel. Reports there are shared with law-enforcement partners and entered into Consumer Sentinel, but the FTC does not resolve individual consumer reports. Filing still helps spot patterns across victims.
For the step-by-step, see our 7-step IC3 complaint guide, and for what to expect afterward, whether police will investigate crypto scams.
Can tracing help recover stolen crypto?
Sometimes, but tracing alone does not return anything. It produces the evidence that other actions depend on: a freeze request to an exchange, a law-enforcement referral, a civil claim or a forfeiture action.
The Department of Justice announced on June 18, 2025 a civil forfeiture complaint involving more than $225.3 million linked to cryptocurrency investment fraud. Investigators used blockchain analysis and other techniques, and the action sought to recover assets that may compensate victims. It shows that tracing can support recovery at scale. It does not mean any individual victim will get money back, and outcomes depend on where the funds end up, how fast action is taken and who holds them.
What tends to help:
- Speed. Funds that have not yet reached an exchange are the easiest to flag. Our 24-hour action steps lay out the first day.
- A clear endpoint. A deposit at a regulated platform gives lawyers or police someone to send a request to.
- A usable report. Clean documentation lets counsel move faster. See our overview of legal options for crypto fraud victims.
Our perspective: where DIY tracing stops
We see the same pattern in Polkadot cases. A victim does the first two hops correctly, then hits a wall: a parachain transfer, a bridge, a swap, or an address that suddenly fans out into dozens of others. At that point the explorer keeps showing data, but the data no longer answers the question that matters, which is who ends up with the money.
Our view is that three things separate a useful investigation from a screenshot collection. First, the trace has to follow value through the whole path, including cross-chain steps, mixers and bridges, rather than stopping at wallet-level views. Second, links between addresses have to be tied to evidence, so each statement in the report can be defended. Third, the output has to be written for the reader who will use it: a lawyer, an exchange compliance team or a court.
We also think victims deserve plain talk. A trace can establish where funds went. It cannot guarantee recovery, and anyone who says it can is selling something else. What it can do is turn “I think I was robbed” into a documented timeline that others can act on.
— cristian
When to bring in a forensic investigator
Consider a professional trace if:
- The amount is significant relative to the cost of an investigation.
- Funds crossed parachains, bridges or were swapped between assets.
- You or your attorney need a report for a court, a bank dispute or an insurance claim.
- The trail splits into many addresses and you cannot tell which branch matters.
- The scam involved a trading platform, a gambling site or a fake investment app, where identifying the operators matters as much as tracking the funds.
At Recovera Forensics, we analyze transaction patterns on public blockchains, trace the flow of lost assets, and prepare technical reports built for legal proceedings. Our cryptocurrency scam investigation and evidence preservation services are for individuals who have been scammed, and our services for law firms cover technical analysis and documentation for attorneys. We don’t publish fixed prices because each engagement depends on the case, so the first step is to describe what happened. You can also read how blockchain forensics proves crypto fraud before you decide.
FAQ
How do I look up a Polkadot transaction?
Open a Polkadot explorer such as Subscan or Statescan, select the Polkadot network and paste your public wallet address. Use the Transfers tab to see incoming and outgoing movements, then open the transfer you want. Note both the hash and the block-index identifier.
Can I find out who owns a Polkadot address?
Not from the explorer alone. Addresses are pseudonymous, and some carry an optional on-chain identity, but a scammer will rarely set one. Linking an address to a real person usually requires exchange records, which law enforcement or a court order can obtain, plus supporting investigative evidence.
Can stolen DOT be reversed or frozen?
A confirmed blockchain transfer cannot be reversed. In some cases a regulated exchange that receives the funds can freeze them after a valid request, which is why a fast report and a clean trace matter. Nothing is guaranteed, and the FBI warns against recovery services that demand upfront fees.
Why does my trace stop at a parachain?
The funds probably moved by XCM to another chain. Search the address in the XCM transfer list, find the destination account and chain, then continue in that chain’s explorer view. If the funds went through a bridge, the trace continues on the other blockchain.
Should I file a report before I finish tracing?
Yes. The FBI advises victims in the United States not to wait and to file at IC3.gov even when transaction details are incomplete. You can add the results of your trace later.
Sources
- Polkadot Wiki: viewing transaction history
- Blockdaemon documentation: get a transaction by hash
- Subscan: Polkadot extrinsic list
- Subscan: Polkadot XCM transfer list
- Polkadot Developer Docs: block explorers
- U.S. District Court for D.C.: forfeiture complaint (DOJ)
- FBI IC3: Bybit hack advisory, February 2025
- FBI IC3: guidance for reporting crypto scams
- FBI IC3: cryptocurrency
- FTC ReportFraud
- DOJ: civil forfeiture complaint, $225.3 million
