How tracing
works.

A blockchain is a public ledger. Every move of stolen money is written down, forever. Clawback reads it for you and stops where someone can act.

The walk

From the thief’s wallet (or the wallet that received your money in the theft transaction), Clawback reads every outgoing payment after the theft: the chain’s own coin, internal transfers from contracts, and every priced token. Small change and spam tokens are left out. The biggest flows are followed to the next wallet, and so on, up to five hops and 45 wallets per case.

Where it stops

A trail ends when the money reaches something with a name. Explorers tag known addresses: exchange hot wallets, bridges, mixers, swap routers. A wallet that forwards almost everything to one exchange is treated as that exchange’s deposit address, which is the account the exchange can freeze. Swaps are passed through, because the swapped coins come back to the same wallet and leave in its next payment.

Freeze requests

Exchanges can freeze an account that received stolen funds. Tether, Circle and other stablecoin issuers can freeze their coins at any address. Each case writes those requests from the trail: the addresses, the amounts, the times and the transactions, so the person reading it can check every line on the explorer. You send them yourself, from your own email.

What it can’t see

Watching

After the trace, the wallets at the end of the trail are checked every ten minutes for thirty days. New movements show up on the case page.

Where the data comes from

Blockscout explorers for EVM chains, Solana’s public RPC, PumpPortal’s public feed of new pump.fun coins and DexScreener for markets. Nothing is invented: if a source doesn’t answer, the page says so.

What Clawback never does