How to Trace Stolen Funds on Solana

Short answer: the wallet that took your funds is a public address like any other, and every move it makes from here is recorded on-chain. You can follow the money hop-by-hop with Scout, Wallet Sleuth's fund-flow tracer, but tracing tells you where the funds went, not who's behind the address. It doesn't recover anything by itself. This guide covers the tracing process and what to do with the trail once you have it.

What tracing actually finds

A theft on Solana almost never ends with the funds sitting still. The attacker's wallet typically moves funds through several addresses, sometimes routing through a swap or a bridge, before landing somewhere it plans to cash out. Usually that's a centralized exchange deposit address, since that's where crypto converts to something spendable. Tracing follows that chain: the immediate destination where your funds landed right after leaving your wallet, every subsequent hop the funds pass through after that (splitting funds across fresh addresses is a common way attackers try to break a simple one-hop trace), and the point where the trail goes cold or surfaces again, either a wallet that stops moving funds or one that deposits into a known exchange. That last point is where a report to the exchange or to law enforcement actually becomes useful.

Tracing a theft with Scout

Start an investigation at walletsleuth.app/scout with the wallet address the funds left from (yours, or the one you're investigating on someone else's behalf).
Scout auto-discovers destination wallets. Once it has the starting address, it follows where the funds moved and builds a hierarchical tree of every wallet downstream, rather than requiring you to manually paste in each new address as you find it.
Read the tree. Each branch is a hop; branches that split represent the funds being divided across multiple wallets, a common laundering pattern. Dead ends mean the trail currently stops there, not that the trace failed.
Check identity clustering. Wallets that behave like they share an owner, moving in the same patterns, active in the same windows, get grouped into one identity with a confidence score, which can connect an attacker's "fresh" wallet back to one you've already flagged.
Share or export what you find. Investigations can be shared, useful if you're building a case to hand to an exchange, a community, or investigators rather than working it alone.

What tracing can't do

Tracing shows movement, not identity or recovery, and the difference matters. An address is an address; some wallets do get tied to a real identity through exchange KYC data, public statements, or reused addresses elsewhere, but tracing alone gives you a wallet graph, not a name. Watching a wallet also doesn't stop it from moving funds again on its own; nothing about a trace freezes or claws anything back, recovery (if it happens at all) goes through the exchange the funds landed on or through law enforcement, never through the tracing tool. And a trail isn't guaranteed to stay followable. Mixers, cross-chain bridges, and enough hops can make a trail genuinely hard to follow, on Solana or any chain, because a tool that reads public transaction data can't see through a bridge to a chain it isn't watching.

What to do with a trace

The trace itself is only useful if it leads somewhere. If the funds landed on a known exchange, that exchange has KYC data on the account and can freeze funds or flag the deposit given enough detail, so file a report with its support or compliance team directly, transaction signatures and wallet trail attached. If the amount is significant, file a report with law enforcement too (in the US, the FBI's IC3), since a documented on-chain trail makes that report far more actionable than "my wallet got drained." And if you're a token team or community investigating on someone else's behalf, a shared investigation is a way to show your work instead of asking people to just trust a conclusion.

FAQ

Is tracing a stolen wallet legal? Yes. Solana is a public ledger; reading and following its public transaction data doesn't require anyone's permission or private keys. What you do with the findings, like publishing accusations about a specific person's identity, is a separate question and worth being careful about without solid evidence.

Can Scout recover my funds? No. Scout maps where funds went; it has no ability to move, freeze, or reclaim anything. Recovery, if possible, happens through the exchange holding the funds or through law enforcement.

How is this different from a block explorer? A block explorer like Solscan shows one wallet's transactions at a time, and you'd manually copy each new address and search again to follow the money further. Scout automates that hop-by-hop discovery and builds the tree for you, including the identity clustering that links wallets which likely share an owner.

What if the trail crosses to another chain? A bridge transaction is visible on Solana as funds leaving to a bridge contract; following the funds past that point requires tracing on the destination chain, which is outside what a Solana-only trace can show. Note this limitation explicitly if you're using a trace as evidence.