Crypto Tracing Software for Forensic Accountants

This guide is for forensic accountants, litigation support teams and fraud examiners who have been handed a Bitcoin question: where did the coins go, what did this person hold on a given date, and is a transfer a dissipation of assets or an internal move. Divorce matters with an undisclosed wallet, a bankruptcy trustee chasing a debtor's coins, an embezzlement case where treasury funds went on-chain. The work is the same tracing and reconciliation you already do with bank records, on a ledger that is public but not labeled.

We sell Bitcoin on-chain data, so weigh that. Where an investigations platform or a free explorer is the better buy, we say so.

What software do forensic accountants use to trace cryptocurrency?

Three kinds. Investigation platforms such as Chainalysis Reactor, TRM Labs and Elliptic draw the transaction graph and overlay their own attribution of addresses to exchanges, services and sanctioned entities, with case management built for law enforcement and large compliance teams. Visual tracers such as MetaSleuth let one analyst follow funds across chains on a canvas. Underneath both sits the raw ledger, which you can read through a free block explorer one address at a time, or query in bulk through a data API or SQL index when the matter has hundreds of addresses and a report has to reconcile.

Most engagements use more than one. The platform suggests who an address belongs to. The raw data is what you cite, because an expert report has to show its work, and "the vendor labeled it" is a weaker answer on the stand than a list of transaction IDs anyone can check.

Crypto tracing software compared

If you need an attribution you can quote as a vendor's opinion, buy an investigation platform. If you need to prove what moved, when, and whether it left the owner's control, you need the ledger itself in a form you can query and reconcile, and that is the layer we sell. Our Chainalysis alternative page sets out that split in more detail.

How do forensic accountants trace cryptocurrency?

The same way they trace cash through bank accounts: start from a known point, follow each transfer, and reconcile balances at every step. On Bitcoin the known point is usually an address or a transaction ID from an exchange statement, a subpoena return or a device. From there you follow outputs forward to where they were spent and inputs backward to where they came from, and at each hop you decide whether the next address still belongs to the same person.

That decision is where tracing goes right or wrong. Two published heuristics carry most of the weight. The common-input heuristic says that addresses spent together as inputs to one transaction are controlled by one signer. It dates back to Meiklejohn and colleagues, "A Fistful of Bitcoins", presented at IMC 2013. The change heuristic says that when a payment has two outputs, the leftover usually goes back to the payer at a fresh address. Moeser and Narayanan revisited both in "Resurrecting Address Clustering in Bitcoin" at Financial Cryptography 2022. Both are strong evidence and neither is proof, and a good report says which one it relied on at each hop. Our Bitcoin address clustering page covers the method.

A 24,828 BTC outflow that never left

We track five cold addresses belonging to one large exchange and read their balances every few days on two independent explorers. On 26 September 2026, at block 968,700, the five held 685,431.54334626 BTC, down 24,828.50612726 BTC from the reading four days earlier. Any chart built on that address list shows a withdrawal of nearly 25,000 BTC.

We traced it. The drop is exactly two transactions, eight minutes apart on 22 September. The first, in block 968,173, sent 4,000 BTC straight to the exchange's own hot wallet and 2,306.9040038 BTC to a brand-new address. The second, in block 968,175, spent 45 inputs and sent a round 10,000 BTC to an intermediate address and 8,521.60204577 BTC to another brand-new address. Over the next 381 blocks the intermediate forwarded 2,000, 4,000 and 4,000 BTC to the same hot wallet and was left holding 0.49999939 BTC.

Two details settle ownership. Both transactions also spent 546-satoshi dust sitting at two other addresses, which means one signer controlled all of them. And the two new addresses received the non-round remainders, the classic change pattern, and have not moved since. Read with the heuristics above, 14,000 BTC went to the exchange's own hot wallet and 10,828.5 BTC went to its own change addresses. By that reading none of it left.

Swap the exchange for a divorcing spouse or a debtor and the lesson is the same. A fixed list of known addresses turns internal reshuffles into apparent dissipation, and it hides new holdings the moment change lands somewhere new. Tracing software that stops at the edge of your address list will overstate transfers out and understate what the person still holds. The full reading is on our Bitcoin exchange reserves page.

Can you trace Bitcoin hidden in a divorce?

Often, yes, if you have a starting point. Every Bitcoin transaction is public, so once one address or transaction tied to the spouse is known, from an exchange account, a bank transfer to an exchange or a wallet on a device, you can follow the coins forward and backward through the chain. What you cannot do from the chain alone is name the owner of an address nobody has linked yet. That link comes from discovery, exchange records or the attribution an investigation platform supplies.

How much does crypto tracing cost?

Two costs, and they are easy to confuse. Software ranges from free explorers to enterprise platforms that do not publish a price. On the data side, a SQL index over Bitcoin starts at $199 a month on our Growth plan, and BigQuery charges $6.25 per TiB scanned. The larger cost is usually expert time: an analyst paging a free explorer by hand bills hours for work a query does in seconds, and that time shows up on the client's invoice.

What should crypto tracing evidence include?

Six things, for every figure in the report: the address or wallet, the block height of the balance, the transaction IDs of every transfer, the amounts in satoshis, the heuristic used to attribute each hop, and a reconciliation showing that opening balance plus transfers equals closing balance. Block heights matter because Bitcoin block timestamps are not strictly in order, so a cutoff by date can be ambiguous. At the 2025 year end, the last block before midnight Eastern was ambiguous by two blocks and 8,821 transactions. A named height is not ambiguous.

The reconciliation line is the one opposing experts check first. When we traced 5,094 transactions through that exchange hot wallet between blocks 967,239 and 968,069, the gross flow was 199,166.42 BTC and the net was minus 3,032.34 BTC, and the net matched the independently read balance change to the satoshi. That tie-out is what makes a trace defensible. Our Bitcoin audit trail API page shows how to produce it at a named block.

Is blockchain tracing accurate enough for court?

The transfers themselves are exact: amounts, transaction IDs and block heights come straight from the ledger and anyone can verify them. The attribution of an address to a person is an inference, as strong as the heuristic and the off-chain evidence behind it. Courts and opposing experts probe that second part. Keep the two apart in the report, cite the heuristic at each hop, and let the attorneys decide how to present it. When the legal team is drafting the motion or the expert disclosure around your findings, AI software for law firms can speed up the research and drafting on their side.

How to run a Bitcoin trace with an API

Start with GET /v1/address/{addr}/txs for each known address, which returns the transactions with block heights and fees. If you hold an extended public key from a device, GET /v1/xpub/{xpub} derives the wallet's addresses and returns the combined balance. From the Growth plan, the balance of any set of addresses at a named block is one SQL query over the outputs and inputs tables, and so is the common-input check: which other addresses were ever spent in the same transaction as your known ones. Scale adds entity labels as leads and bulk CSV exports for the workpapers. The Developer plan keeps one year of history, which is not enough for most litigation lookbacks, so plan on Growth.

The Bitcoin transaction tracing API page shows the calls, and our guide to Bitcoin wallet statement tools covers turning a trace into a statement a lender or court can read. Our data is informational and does not identify people; your analysis and the legal team decide what it means.