How to Investigate a Suspicious Crypto Transaction Step by Step

1. Preserve the transaction before interpreting it

Start with the raw facts.

Record the blockchain or network, transaction hash, block number and timestamp, sender and recipient addresses, transferred asset, amount, transaction status, fees, relevant token-transfer events and contract calls where applicable.

If the transaction involves a smart contract, do not assume that the top-level from and to fields describe the actual economic transfer.

A contract interaction can trigger multiple internal transfers, token movements, approvals or calls to other contracts. The visible transaction may therefore be only the outer shell of the event.

At this stage, avoid conclusions such as “the recipient stole the funds,” “this is an exchange wallet,” “the assets are sanctioned,” or “the sender authorized every downstream transfer.”

Those may eventually become supported findings. They are not raw transaction facts.

2. Identify what actually moved

The native transaction value is only one part of the picture.

Check whether the transaction moved native cryptocurrency, fungible tokens, NFTs, wrapped assets, liquidity-pool tokens, stablecoins or assets emitted or received through a contract interaction.

A transaction with 0 ETH at the top level can still transfer a large amount of tokens.

Likewise, one contract call can produce several economically relevant transfers.

For each asset movement, preserve the relationship:

asset → amount → source → destination → transaction

That is often a better investigation unit than the transaction envelope alone.

3. Establish the immediate counterparties

Next, inspect the addresses directly connected to the suspicious transaction.

Ask whether an address has appeared before, whether it is a wallet or contract, whether it belongs to known infrastructure, whether it receives funds from many unrelated sources, whether it immediately forwards assets, and whether there is reliable attribution for it.

This is where investigators need to distinguish address attribution from behavioral inference.

For example:

“This address is labelled as Exchange X”

is an attribution claim.

“This address receives funds from many unrelated wallets and forwards them in batches”

is an observed behavioral pattern.

“Therefore it must be Exchange X”

is an inference and may be wrong.

Treat those as separate layers of evidence.

4. Look backward: where did the funds come from?

Before tracing the suspicious transaction forward, investigate its source of funds.

Was the sender funded minutes earlier or months earlier? Did the funds arrive from another wallet, an exchange, a bridge or a large group of smaller addresses? Was there previous exposure to a known scam, exploit or sanctioned entity? How many hops separate the transaction under investigation from that exposure?

This distinction matters because direct exposure and distant exposure are not equivalent investigative facts.

A wallet receiving funds directly from an address reliably attributed to illicit activity or an illicit entity presents a different relationship from a wallet several transactions removed from that entity.

The amount and context also matter.

A small historical exposure should not silently become a claim about the entire wallet or all of its funds.

For broader wallet-risk context, see our guide to crypto AML and KYT.

5. Trace the money forward

Now follow the assets after the suspicious transaction.

The immediate recipient may not be the final destination.

Look for rapid forwarding, splitting into multiple outputs, consolidation with other funds, recurring transfers, token swaps, bridge interactions, exchange deposits and contracts that redistribute assets.

If the transaction appears related to theft or unauthorized movement, our guide to tracing stolen crypto provides additional context for following downstream flows.

A simple tracing record might look like this:

The purpose is not to force every movement into a predetermined story.

It is to maintain a traceable chain of observations.

6. Do not stop at a bridge

Cross-chain movement is one of the easiest places to lose an investigation.

A source-chain transaction may show funds entering bridge infrastructure and then apparently disappearing.

Usually, the investigation has not ended. It has changed networks.

Identify the source-chain bridge interaction, the protocol or contracts involved, the asset and amount entering, the likely destination network and the corresponding destination-side release, mint, transfer or other protocol-specific settlement.

The mechanism depends on the bridge.

A protocol may use liquidity pools, locked inventory, burn-and-mint mechanics, message passing or another settlement design. Investigators should therefore avoid assuming that every source-chain deposit has a simple one-to-one “mint” transaction on the destination chain.

Depending on the protocol, matching may require comparing timestamps, amounts, message identifiers, transaction logs, recipient addresses and protocol-specific metadata.

And the result is not always deterministic.

If several destination-side movements are plausible, or if available evidence is incomplete, record the relationship as probable or partial rather than certain.

That distinction is much more useful than pretending every cross-chain hop can be reconstructed perfectly.

7. Check whether the funds reach a service or exchange

An important point in many transaction investigations is when funds appear to reach known infrastructure.

Possible endpoints include centralized exchanges, custodians, payment processors, bridges, marketplaces, gambling services, privacy-oriented services or other identifiable infrastructure.

But attribution does not automatically reveal the person behind the transaction.

Suppose an address is reliably associated with Exchange X.

Blockchain evidence may support:

Funds were transferred to infrastructure attributed to Exchange X.

It does not by itself support:

Person Y owns the Exchange X account that received those funds.

Connecting service infrastructure to an individual account generally requires additional off-chain evidence and, depending on the case, cooperation from the service or legal process.

Keep those two conclusions separate.

8. Check for patterns, not just individual transfers

A suspicious transaction may become more informative when compared with related activity.

Look for repeated deposits from related addresses, repeated withdrawals toward the same destination, recurring bridge usage, common services, similar transaction sizes, synchronized activity or reuse of operational addresses.

A single transfer may be ambiguous.

Twenty movements following a similar structure can form a meaningful behavioral pattern.

That still does not automatically prove common ownership.

A cluster or recurring pattern should usually be treated as a hypothesis to test, not as an identity claim.

9. Separate facts, derived findings and hypotheses

This is one of the most important disciplines in transaction investigation.

On-chain fact

Address A transferred 12.4 ETH to Address B in transaction X at 14:03 UTC.

Directly verifiable.

Derived finding

Address B forwarded approximately 96% of the received value to Address C seven minutes later.

Calculated from observable transactions.

Attribution

Address C is attributed to a particular exchange.

This depends on the quality and provenance of the attribution.

Hypothesis

Addresses A and B may be controlled by the same entity.

That may be a useful investigative hypothesis. It is not yet a fact.

Strong investigations make these levels of certainty obvious.

Weak investigations quietly turn hypotheses into conclusions.

10. Check sanctions and risk exposure carefully

When a suspicious transaction is connected to a sanctioned or otherwise high-risk entity, document the exact relationship.

Do not write:

This wallet is sanctioned.

unless the address itself is actually listed or there is sufficient evidence that it belongs to the sanctioned entity.

Instead, record what happened.

For example:

The investigated address received funds directly from address X, which is listed by sanctions authority Y.

Or:

The transaction is two hops removed from an address attributed to entity Z.

Useful context includes the number of hops, amount involved, proportion of relevant funds, date of the interaction and confidence in the attribution.

For a dedicated workflow, see our guide to crypto sanctions screening.

Risk is rarely represented accurately by a single word.

11. Check the transaction against the wallet's history

Although this guide begins from a specific transaction rather than a wallet, the wallet's historical behavior can provide important context.

Ask whether this is the first interaction with the counterparty, whether the amount is unusual, whether the wallet normally uses this asset or protocol, whether it has used the same bridge before and whether transaction frequency changed suddenly.

If several assets leave within a short time window or a previously inactive wallet suddenly changes behavior, that may matter to the investigation.

A wallet-screening tool such as our crypto wallet checker can provide additional address-level context, but this remains supporting context around the transaction.

A full wallet-level investigation is a broader task and is covered separately in the crypto-address investigation guide.

That distinction keeps the transaction and address search intents separate.

12. Investigate approvals and smart-contract authority when relevant

Sometimes the transaction in which assets finally move is not the transaction in which the critical authority was granted.

The movement may depend on token approvals, delegated permissions, smart-account execution, malicious contracts or previously granted authority.

In those situations, asking only:

Who sent the final transaction?

may be insufficient.

Instead ask:

• What authority allowed the assets to move?
• When was that authority granted?
• Which account or contract exercised it?
• Did the asset owner authorize the current transaction directly?
• Does relevant authority remain active?

This is investigation methodology, not a claim that every blockchain-analysis product can automatically reconstruct every authorization path.

The distinction matters increasingly as wallet and account-execution models become more complex.

13. Preserve an evidence trail

A useful investigation should be reproducible.

For each material finding, preserve the transaction hashes, addresses, block numbers, timestamps, networks, assets, amounts, relevant logs or contract data, attribution sources and an explanation of how the conclusion was derived.

If the final report says:

Funds moved from the original transaction through a bridge and later entered exchange infrastructure.

another investigator should be able to inspect the evidence supporting each part of that statement.

This matters even when the investigation never becomes a legal case.

It allows other analysts — and your future self — to distinguish what was known, what was calculated and what remained uncertain.

14. Know when to stop

Blockchain tracing does not always produce a final identity or complete transaction path.

A defensible investigation may end because funds reached an exchange, a bridge exit could not be uniquely matched, an attribution remained uncertain, activity split into too many plausible paths, available coverage became insufficient or additional off-chain information was required.

That is not necessarily a failed investigation.

A defensible partial conclusion is better than an unsupported complete one.

The purpose of transaction investigation is not to manufacture certainty.

It is to reduce uncertainty while preserving the evidence behind each conclusion.

A practical transaction-investigation checklist

When investigating a suspicious crypto transaction:

1. Verify the raw transaction.
2. Identify every economically relevant asset movement.
3. Inspect immediate counterparties.
4. Trace the source of funds backward.
5. Trace the destination of funds forward.
6. Follow cross-chain activity where the available evidence supports it.
7. Identify exchanges and other services carefully.
8. Look for repeated behavioral patterns.
9. Separate facts, attribution and hypotheses.
10. Describe sanctions and risk exposure precisely.
11. Use wallet history as supporting context.
12. Inspect approvals or delegated authority when relevant.
13. Preserve evidence behind every material finding.
14. Stop where the evidence stops.

Using blockchain investigation tools without creating a black box

Automation can make this process faster.

Blockchain-analysis tools can help collect transaction context, identify counterparties, expand transaction graphs, surface risk indicators and highlight possible cross-chain activity.

But software should not replace the evidence underneath the conclusion.

For every important finding, an investigator should still be able to answer:

• Which transaction supports this?
• Which address or contract is involved?
• Which part is directly observable?
• Which part is derived or inferred?
• Where did the attribution come from?
• How confident are we?

That is the difference between using software to assist an investigation and simply accepting a label.

For a deeper discussion of where automation and model reasoning fit into this process, see AI Agents for Crypto Investigations.

OnChainRisk supports this workflow with address analysis, transaction and counterparty context, risk signals, graph expansion and cross-chain indicators where available. Capability depth varies by network and analysis type, so every investigation should distinguish what the available data supports from what remains unknown.

Final takeaway

A suspicious crypto transaction is not a verdict.

It is a starting point.

A disciplined transaction investigation moves from the event itself into the surrounding flow of funds:

transaction → asset movements → counterparties → source → destination → bridges → services → patterns → evidence

At every stage, keep facts separate from interpretation.

If the evidence supports a conclusion, document it.

If it supports only a hypothesis, call it a hypothesis.

And when the evidence runs out, say so.

That discipline is what turns blockchain tracing into an investigation rather than a collection of colored wallet labels.