How to Trace Stolen Funds on Solana

Short answer: the wallet that took your funds is a public address like any other, and every move it makes from here is recorded on-chain. You can follow the money hop-by-hop with Scout, Wallet Sleuth's fund-flow tracer, but tracing tells you where the funds went, not who's behind the address. It doesn't recover anything by itself. This guide covers the tracing process and what to do with the trail once you have it.

What tracing actually finds

A theft on Solana almost never ends with the funds sitting still. The attacker's wallet typically moves funds through several addresses, sometimes routing through a swap or a bridge, before landing somewhere it plans to cash out. Usually that's a centralized exchange deposit address, since that's where crypto converts to something spendable. Tracing follows that chain: the immediate destination where your funds landed right after leaving your wallet, every subsequent hop the funds pass through after that (splitting funds across fresh addresses is a common way attackers try to break a simple one-hop trace), and the point where the trail goes cold or surfaces again, either a wallet that stops moving funds or one that deposits into a known exchange. That last point is where a report to the exchange or to law enforcement actually becomes useful.

A theft, drawn as a rail yard. The funds leave the victim's wallet (the empty strongbox), pass hop by hop through fresh wallets (the stations), split across two paths and rejoin, while the dead-end sidings are the noise a trace learns to ignore. The line ends where it can be acted on: an exchange.

Tracing a theft with Scout

1. Start an investigation at walletsleuth.app/scout with the wallet address the funds left from (yours, or the one you're investigating on someone else's behalf).
2. Trace History. Select the wallet and press Trace History. Every wallet it moved funds with appears on the canvas as a connected node, so you never paste a downstream address by hand.
3. Follow the money a hop at a time. Select the wallet that received your funds and trace again, then repeat. The canvas lays hops out left to right; where the funds split across several wallets, a common laundering pattern, you'll see the branches. Filters hide spam, small transfers and program wallets, and known exchange wallets are labelled when the trail reaches one. A dead end means the trail currently stops there, not that the trace failed.
4. Flag what matters. Mark wallets as Suspicious, Exchange and so on as you go, so the story stays readable when you come back to it or hand it to someone else.
5. Share or export what you find. Investigations can be shared, useful if you're building a case to hand to an exchange, a community, or investigators rather than working it alone.

What tracing can't do

Tracing shows movement, not identity or recovery, and the difference matters. An address is an address; some wallets do get tied to a real identity through exchange KYC data, public statements, or reused addresses elsewhere, but tracing alone gives you a wallet graph, not a name. Watching a wallet also doesn't stop it from moving funds again on its own; nothing about a trace freezes or claws anything back, recovery (if it happens at all) goes through the exchange the funds landed on or through law enforcement, never through the tracing tool. And a trail isn't guaranteed to stay followable. Mixers, cross-chain bridges, and enough hops can make a trail genuinely hard to follow, on Solana or any chain, because a tool that reads public transaction data can't see through a bridge to a chain it isn't watching.

What to do with a trace

The trace itself is only useful if it leads somewhere. If the funds landed on a known exchange, that exchange has KYC data on the account and can freeze funds or flag the deposit given enough detail, so file a report with its support or compliance team directly, transaction signatures and wallet trail attached. If the amount is significant, file a report with law enforcement too (in the US, the FBI's IC3), since a documented on-chain trail makes that report far more actionable than "my wallet got drained." And if you're a token team or community investigating on someone else's behalf, a shared investigation is a way to show your work instead of asking people to just trust a conclusion.

FAQ

Is tracing a stolen wallet legal? Yes. Solana is a public ledger; reading and following its public transaction data doesn't require anyone's permission or private keys. What you do with the findings, like publishing accusations about a specific person's identity, is a separate question and worth being careful about without solid evidence.

Can Scout recover my funds? No. Scout maps where funds went; it has no ability to move, freeze, or reclaim anything. Recovery, if possible, happens through the exchange holding the funds or through law enforcement.

How is this different from a block explorer? A block explorer like Solscan shows one wallet's transactions at a time, and you'd manually copy each new address and search again to follow the money further. Scout draws every counterparty of a traced wallet on one canvas, so each next hop is a click away and the whole path stays in view as it grows.

What if the trail crosses to another chain? A bridge transaction is visible on Solana as funds leaving to a bridge contract; following the funds past that point requires tracing on the destination chain, which is outside what a Solana-only trace can show. Note this limitation explicitly if you're using a trace as evidence.