0stracing
TRACEHOUND
TRACEHOUND
Paste a hacker's address or an exploit tx. Get the money trail, who funded it and the wallets tied to it, every link a transaction you can open.
Try Bybit Exploiter OTC Desk (ZachXBT thread) Tron → THORChain
No cases yet
| Time | Token | Risk | Main reason |
|---|---|---|---|
| Loading… | |||
First money the wallet ever received, followed back up to four hops until an exchange, mixer or bridge.
Other wallets the same funder topped up around the same time. Usually the same operator.
Largest recipients, three levels deep. Swaps paid to a fresh wallet are followed through.
Deposits into THORChain, Wormhole, Mayan, deBridge, Across, Stargate, other LayerZero token bridges and Circle's CCTP matched to the payout on the other chain, and followed there.
Wallets forwarding nearly everything to an exchange. The exchange can freeze and identify.
| Time | Query | Route | Wallets | Top finding |
|---|---|---|---|---|
| Loading… | ||||
Loading…
Solana, Base and BSC. Who launched the token, what the contract lets them do, and whether the first buyers are the developer's own wallets.
Every link Tracehound draws between two wallets is a transaction you can open. This page says what each check looks at, where the data comes from, how sure each kind of finding is, and where the trail stops.
The first money the wallet ever received, followed back up to four hops until it reaches an exchange, a mixer, a bridge or a contract. An exchange withdrawal is the strongest lead: the exchange knows the account.
Other wallets whose first money came from the same funder around the same time. A shared first funder usually means one operator.
Recipients ranked by their share of each asset leaving the wallet, three levels deep, four branches per wallet. Tokens of unknown value weigh less than real money.
Money sent into a router or pool is opened up: when the swap pays its output to another wallet, the trace continues from that wallet.
On EVM chains every traced wallet's liquidity positions are checked: Uniswap V2 style LP tokens and V3 position NFTs minted to it. When the LP tokens or the position go to another wallet, when they are minted straight to another wallet, or when pulling the liquidity pays someone else, the money moved without a transfer between the two. The trace links them and continues from the new holder.
Deposits into THORChain, Wormhole, Mayan, deBridge, Across, Stargate, other LayerZero token bridges and Circle's CCTP are matched to the payout on the other chain through each bridge's own index, and the trace continues there (Bitcoin and Tron included).
A wallet that forwards most of what it gets to an exchange is a deposit address. Deposit addresses belong to one exchange account, so the exchange can identify and freeze.
Exchanges, mixers, bridges and known exploiters come from open label data, the wallets exchanges publish in their proof-of-reserves reports (Solana and Tron included), Dune (with a key) and labels added by hand. A wallet already tagged as an exploiter is flagged.
Loot that comes back to the wallet that paid the attacker's gas proves one operator controls both sides.
Each flow of a known asset is priced at the hour it moved (DefiLlama). A token that only calls itself "USDT" gets no dollar value.
The longest daily window with no activity, read as sleep. Weak evidence, only a hint.
The chain itself proves it: an exchange withdrawal or deposit, a bridge's own index matching both sides, loot back to the funder, a public exploiter label.
A strong pattern that still has innocent explanations: shared first funder, a likely deposit address without an exchange label, money leaving through a bridge or mixer.
A hint to check by hand: a contract as the first funder, an ordinary wallet at the end of the funding trail, the time zone.
Mint or freeze authority still set (Solana). On Base and BSC: honeypot, trading tax, mint function, blacklist, paused transfers, hidden owner, proxy, unverified source (GoPlus).
Who paid for the developer's wallet and when, a mixer behind it, what the developer and the other wallets of that funder launched before and how many of those tokens are dead now.
How much of the launch bag the developer has already sold.
First buyers funded by the developer, the developer's funder or one shared funder; wallets that bought in the launch block.
Share held by the developer's wallets and the top 10, pools and program accounts excluded; holders created in the last 24 h; one wallet handing the token out to many, or many sending it back to one.
Wallets of known pump rings among early buyers and holders, a developer funded from a ring, and a launch funded the way a ring funds its launches.
Whether pool liquidity can be pulled, bot-like trading, socials reused from earlier tokens.
Each finding adds points; 25+ is medium risk, 50+ high. The points are set by hand today and are being calibrated against what happened to checked tokens 24 h later (table below).
Bridges run by exchanges still end the trace on the source chain.
The sender of a tx is its largest input and outputs back to an input are change. CoinJoin and batched exchange payouts break that reading.
Only the exchange wallets published in proof-of-reserves reports are known; other services show as busy wallets unless labeled by hand.
Wallet histories there need a paid Etherscan plan. Token checks on Base and BSC skip the developer's funding and past launches.
Three levels, four branches per wallet, up to 80 wallets per case and two chain crossings. Small branches below 2% of a flow are left out.
Tracehound never says who someone is. It shows where the money went and who can identify the owner.
Loading…
Loading…
Our messages are full of one question: "can you find them?" Here is what already works, what we are building next, from the most wanted down, and the team we are hiring to answer every request.
Tools find the trail. People close the case. We are putting together a team of on-chain analysts to take the requests from our messages and the wanted board and work through them end to end.
Trace wallets for fun or for work? Write to @tracehoundpro.
"Scammer moved" feed. Shipped. Wallets on the wanted board are checked every 6 hours. When the money moves, it shows on the board with where it landed, and the victim gets a Telegram message.
Check before you send. Paste an address before you send. If it is tied to a scam, you know first. Browser extension and bot.
Freeze request kit. Shipped. Every case has a Freeze tab: one ready letter per exchange deposit the money reached, with the transactions, exact amounts, times and the path from the thief. Copy it, or save it as .md, CSV or PDF.
Track your case. Submit a case and follow it like a parcel: received, tracing, exchange found, report ready.
Operator files. Different cases, different chains, the same person behind them. One file per operator.
Was I drained? Paste your wallet: which drainer took the money, through which approval, and what to revoke right now.
Address poisoning alarm. An address that looks like one you send to but isn't, flagged before you copy it.
Hunter leaderboard. Tips on the wanted board that led to the exchange, ranked in public.
Drainer and phishing database. Every drainer contract and phishing domain from our cases, open to everyone.
Scams of the week. Fresh scams, traced and explained, every week.
The trace as a story. The whole case told in plain English: where the money went and where it is now.
New chains. TON, Hyperliquid, Sui, XRP.
Telegram mini app. The tracer and the token check inside Telegram.
Sharper verdicts. Every red flag with its measured hit rate, deeper developer checks on Base and BSC, webhooks for the API.
"Sorry, crypto is untraceable."
Every scam ends with a file: the trail, the exit, the name.
Got scammed? Post it on the wanted board or write to @tracehoundpro.
Paste a Solana wallet. Every memecoin it bought, how many went to zero after it got in, and a file on the developers behind the worst of them. Read-only: no connect, no signing.
Paste the wallet that lost money. We show how it left (an approval or permit you signed, or your own key), who took it and where it went, and which approvals to revoke right now. Ethereum, Arbitrum, Polygon and Solana. Read-only: no connect, no signing.
Paste the address you are about to send to: we tell you if it is an exchange, a mixer, a known exploiter, a suspect in a traced case or on the wanted board. Add your own wallet and we also look for lookalikes planted in your history (address poisoning). Read-only: no connect, no signing.
Scams posted by the people they hit, with a reward for information. Know who is behind one? Send the victim a tip. Rewards are a promise between the poster and the tipster: Tracehound holds no money and pays nothing.
Groups of wallets that buy almost nothing but the same few tokens, early, funded from linked wallets: the people pumping those tokens, not lucky traders. Found by the daily smart money scan; each ring shows how it launches, what it pumped and how those tokens ended.
A trading agent that plays the token check's verdicts with pretend money. Every token the sampler checks is a chance to buy: the agent skips high risk, stakes less the higher the score, and sells when the developer sells, the price doubles, it halves, the pool disappears or a day passes. Next to it, the naive baseline buys every one of those tokens for $100 and holds for a day. No real money until the agent beats that baseline for weeks.
Your wallet signs a one-time message to prove you own the address. It costs nothing, sends no transaction and gives the site no access to your funds. No email, no password.
Your plan, what you used today and what each plan includes.