02 / The graph
Reading the transaction graph
Tracing is reading the public ledger with discipline. The discipline part matters, because the graph contains two very different kinds of knowledge: things that are provable, and things that are merely probable. A trustworthy trace never confuses the two.
What is provable: the spend graph
Every output is in exactly one of two states: unspent — the value sits there, visible to everyone, until its key-holder moves it — or spent by exactly one later input. There is no third state and no double spending; consensus guarantees it. So for any coin you can ask a question with a hard answer: "where did this exact output go?" Either nowhere yet, or into one specific transaction whose outputs you can then ask the same question about, recursively.
Everything in that recursion is cryptographic fact. "Output a1b2…:0 was consumed by input 3 of transaction f9e8…, which created output 1 at address X" — that statement is checkable by anyone, forever, from public data alone. It needs no company database and no trust in the person asserting it. This is the spine of a defensible audit trail.
Ask the question yourself — paste a txid (your case's theft transaction, or the example) and see, per output, whether the value is still sitting there or where it went. Spent outputs can be followed one hop at a time, up to this page's limit.
Try it · where did the outputs go?
Live public chain data via Blockstream Esplora, fetched by your browser — vout.io never sees the txid.
What is inferred: heuristics
The graph tells you where value went. It does not tell you who controls an address or which output was the "real" payment. Those come from heuristics — educated guesses with known failure modes:
The assumes all inputs of a transaction belong to one party, since each input had to be signed. Usually true — and deliberately falsified by and transactions, which exist precisely to poison it. Change detection guesses which output is from signals like round payment amounts (0.5 BTC paid, 0.1382 BTC change), matching script types, and wallet fingerprints. Helpful, probabilistic, and wrong often enough that honest tools present it as a judgment, not a fact.
Clustering and labels: attaching names
Stack the co-spending heuristic across thousands of transactions and addresses collapse into — wallets, in the practical sense. The last step is labeling: identifying a cluster as "Exchange X hot wallet" or "sanctioned mixer Y." Labels come from interacting with services, published addresses, court records, leaks, and shared industry intelligence.
Be clear about what labels are: testimony, not proof. The chain proves funds reached an address; the claim that the address belongs to a particular exchange rests on the labeler's evidence. Good practice treats the spend graph as ground truth and every label as a sourced assertion that could be challenged — because in court, it will be.
Patterns in the wild
The peel chain
With facts and heuristics in hand, recognizable shapes emerge. The : a large stolen UTXO pays out a small amount, sends the remainder to a fresh change address, and repeats — sometimes hundreds of times. It looks intimidating and is actually among the most traceable patterns, one deterministic hop after another. Fan-outs (one output splitting into dozens) grow the frontier fast and are usually an attempt to exhaust whoever is following. Consolidations (dozens of tainted outputs merging into one) do the opposite — and often signal the thief preparing to cash out, which is exactly when the of an exchange tends to appear.
Why cash-out matters so much — and what can happen there — is chapter 5. First, the harder question: when stolen coins mix with clean ones, how much of what came out is stolen? That's taint accounting, next.