Field Notes · 6 MIN
How do you trace a crypto wallet to an exchange?
How a wallet-to-exchange tracer works: cited address labels, following money forward hop by hop, scoring confidence, evidence hashes, and public chain API rate limits.
You trace a crypto wallet to an exchange by following its money forward, transfer by transfer, until the funds reach an address the exchange is known to control, then reporting the deposit address one step before it. We built an attribution engine that does this across five networks. This post explains the method, how the engine scores confidence, and how public API rate limits shaped it.
- The most useful output is the customer deposit address, because an exchange can map it to an account.
- Address labels are only as good as their sources, so every label keeps the URL it came from.
- Confidence should reflect source strength, the number of steps and how diluted the money became.
- Every result carries hashes of its input data and of itself, so it can be checked later.
- A keyless public chain API allowed about one request per second per IP, so heavy jobs run one at a time.
- Nactore is a technology and growth company that builds, ships, ranks and grows, including data products that people act on.
What does tracing a wallet to an exchange mean?
Tracing a wallet to an exchange means finding the nearest point where the wallet's funds entered an exchange, the path they took, and the customer deposit address they landed in. The deposit address matters most, because the exchange can map it to an account holder, while the exchange's main wallet only tells you which company to ask.
Our engine takes a suspect wallet and returns that path, the amounts, a confidence level with plain-English reasons, a ready-to-send disclosure or freeze request addressed to the exchange, and a PDF case report. It covers Bitcoin, Ethereum, BNB Chain, Polygon and Tron, for the native coin plus USDT and USDC.
A person reads the report and decides what to do with it. That shaped every design choice that follows.
Where do address labels come from?
Address labels come from sources you can cite. Ours come from exchanges' own published proof-of-reserve wallet lists and the US Treasury's sanctions list, and every label stores the URL it came from. A label without a source cannot be defended when someone acts on the result, so the engine does not use one.
The sanctions data comes from the OFAC Specially Designated Nationals list. Each label set has a version number, and every result records which version it used.
Labels are also the limit of any tracer. If an exchange has not published a wallet, a trail can end at an address nobody can name. Our evaluation keeps hold-out cases that hide a known exchange wallet on purpose, to measure exactly how often that happens.
How does the trace follow the money?
The trace runs breadth-first from the suspect wallet and follows only money that left after it arrived, which avoids blaming earlier, unrelated transfers. Each trail stops at a labelled exchange, a mixer or bridge, the step limit or the work limit. The wallet one step before an exchange's main wallet is reported as the likely deposit address.
- Start at the suspect wallet and read its incoming transfers.
- Follow outgoing transfers that happened after the money arrived.
- Stop at a boundary, meaning a labelled exchange, a mixer or bridge, or a step or work limit.
- Name the deposit address, the hop just before the exchange's main wallet.
- Merge near-duplicate trails that share every step but the last, so one path is not counted twice.
The engine says where it stops. Following funds through bridges and swaps is not in this version, and neither is Solana, so a trail that hits a bridge ends there and the report says why.
How do you score confidence in a trace?
Confidence comes from three things: how strong the label source is, how many steps separate the wallet from the exchange, and how diluted the money became, meaning how much of each transfer could really be the suspect's funds. The engine reports a confidence level with plain-English reasons, not a bare percentage that hides why.
| Factor | Raises confidence | Lowers confidence |
|---|---|---|
| Label source | The exchange's own published wallet list | A weaker or indirect source |
| Steps | One or two hops | Many hops |
| Dilution | Most of each transfer traces back to the suspect | Funds mixed with large unrelated amounts |
| Trail ending | Reaches a labelled exchange | Ends at a mixer, bridge or limit |
Every result also carries a SHA-256 hash of the data it was built from and of the result itself, plus the engine version and the label-set version. Anyone can later confirm that a report has not changed and see exactly what produced it.
Accuracy is measured, not estimated. We report right, wrong and no answer as three separate numbers, a method explained in how we built an attribution engine and proved it accurate. The same discipline appears in why AI features need evals before production and how to evaluate LLM output quality.
How do you live with public chain API rate limits?
Public chain APIs used without a key are slow by design. The keyless tier we used for one network allowed about one request per second per IP and briefly suspended callers who went faster. So the engine spaces every call to a data source, waits and retries after a 429 response, and never runs two heavy jobs at once.
Limits like these belong to the vendor and change, so check the current TronGrid documentation before you depend on a number. The engine reads a minimum interval between calls from its settings, so tightening or relaxing it is a config change.
Privacy matters as much as speed. If your users look up addresses, the lookups themselves are sensitive. In production the engine is meant to point at self-hosted nodes and indexers, so no outside API learns which wallets are being examined.
Write the "stop here and say why" path before the clever tracing path. A tracer that cannot explain where a trail ended will quietly guess, and a guess in an evidence report is worse than an honest gap.
Frequently asked questions
Can a tracer follow funds through mixers and bridges?
Ours does not in this version. When a trail reaches a mixer or bridge, it stops and the report says so, instead of guessing across the gap.
How accurate is blockchain tracing?
It depends on label coverage and the case. Measure it on real cases, report right, wrong and no answer separately, and never quote a small sample as a general rate.
Which networks does the engine support?
Bitcoin, Ethereum, BNB Chain, Polygon and Tron, covering the native coin plus USDT and USDC.
Can you build a data product like this for us?
Yes. We build engines whose output people act on, with evaluation from day one. See our work page.
Trust comes from the evidence, not the answer
A wallet tracer is only useful if someone can act on its output and defend it later. Cited labels, forward-only tracing, honest stopping points and hashed evidence are what make that possible. Nactore is a technology and growth company, one partner that builds, ships, ranks and grows, measured on your growth.
Working on a data product that has to hold up under scrutiny? Book a free 30-minute call and walk us through it.
Want to apply this to your business?
Book a free 30-minute call. We will tell you what we would do first.