How to use Coinpath

You sent money and it went somewhere you did not mean it to. Coinpath follows that payment through the blockchain's public transfers, step by step, and says where it ended — for example at an exchange, where it can sometimes still be stopped.

It does not get money back, and it does not say who anyone is: it names exchanges and services from their own published lists, and addresses on a public sanctions list. Everything it shows can be checked on the chain.

1 · Find your transaction

Every payment has a transaction hash (also called a transaction ID, or TxID): a long code that names that one payment on the chain.

• In your wallet (MetaMask, Trust Wallet, TronLink, Ledger Live and others): open your history or activity, open the payment, and look for “Transaction ID”, “TxID” or “Hash”. Copy it.
• In an exchange you sent from: open your withdrawal history, open the withdrawal, and copy its “TxID”.
• If you only have the address you sent to (the scammer's, say): paste the address instead. Coinpath lists the payments into it, newest first, and you pick yours.

What a hash looks like: on Ethereum and the other EVM chains 0x and 64 letters and digits; on Bitcoin and Tron, 64 letters and digits with no 0x.

2 · The form, field by field

Chain

Detect automatically is the default: leave it, and the page finds the chain itself. A Bitcoin address (bc1, 1, 3), a Litecoin address (ltc1, L, M), a Tron address (T), a Cardano address (addr1) and a Solana address or signature tell the chain by their shape. For the rest the page asks each chain at once: a transaction hash starting 0x is looked for on every EVM chain it can read, a 64-character hash without 0x on Bitcoin and Tron, then Litecoin if neither has it. A transaction hash is unique, so the first chain that has it is used — usually in under a second — and the answer says "Found on …". An 0x address exists on every EVM chain, so the page shows where it has payments — "Ethereum (12), Base (3)" — and you pick. When nothing is found, the page lists the chains it checked and any that did not answer within ten seconds or asked it to wait.

You can still choose the chain by hand; your choice wins. The common chains come first, the rest in alphabetical order. Chains marked needs a free key (Settings) — Solana, Cardano and the chains read through Etherscan — are looked at only once their key is set; see Settings.

Transaction hash or address

Paste the hash of your payment, or the address you paid. The page says what it recognised on the next screen; if what you pasted matches no format, it says so under the field.

Options: Follow and Method

Two more settings sit under Options, below the first two fields, closed at first. The defaults are fine for most payments: Coinpath follows the usual money for the chain and uses FIFO. Open Options only to change one of them; if one of them has a problem, the page opens Options for you.

Follow

Which money to follow. Usual follows USDT on Tron and the chain's own coin everywhere else (ETH, BTC, POL). Choose The coin or USDT when that is what you sent — for example, USDT on Ethereum, or TRX on Tron. Anything it moved lists every transfer in the transaction, whatever the token — use it for a token that is neither (a staked or wrapped token a drainer took).

Method

When your money arrives at an address that already holds other money, and that address then sends some on, how much of what it sent was yours? Nobody can know; each method is a rule, and the answer says which one it used. FIFO is the default. If in doubt, trace again with another — the answer has a button for each.

Say your 1 ETH arrives at an address that already holds 3 ETH, and it then sends 2 ETH:

3 · Reading the answer

• “Of your … sent in … on …” — the first line: where your amount went, in parts. Each part is where some of it ended:
  • reached an exchange or a service, named with where its name comes from (an exchange's own published list of its wallets), or a well-known contract — a mixer such as Tornado Cash, a cross-chain swap, a DEX router;
  • went into a bridge to another chain;
  • is still at an address that has not sent it on.
• A theft by approval — if your tokens were taken by a transaction you did not send (you signed an approval or a "permit" on a fake site), the answer says so first: who sent that transaction, the contract it called, the spender your approval named, and anything else it took from you. Give your own address and such transfers are listed as Taken; pick one to follow the thief.
• Address poisoning — if the address you paid looks like one you paid before (the same first and last characters) and it had put a worthless transfer into your history shortly before, the answer says so: you copied a poisoned address from your history. Only your own history of the week before is read. Before you paste an address, check every character — not only the first and the last.
• Frozen by Tether or Circle? — where USDT or USDC is still at an address, the page reads the issuer's own blacklist on the chain and says whether it is already frozen, or that you should write to the issuer, with its contact.
• Through swaps and conversions — money that went into a swap, a withdrawal from a lending pool, or an unwrapping (WETH to ETH) came back as something else in the same transaction. The page reads what each address gained and lost in it and follows on in what came out: up to three such points, each a few steps further.
• The flow — a picture of the answer: your money from left to right, a column for each step, each band as wide as the amount it carried; exchanges, mixers, bridges and addresses still holding it each in their colour, explained in the legend under it.
• Small transfers — each under 1% of what reached its sender — are shown, not followed; the first line gives their sum.
• Not followed past … (hop limit, budget) and not accounted for — the page follows at most 4 steps and reads at most 60 addresses, only the first pages of a busy address, and each address once. What lies beyond those limits is said, not guessed.
• Sanctions — an address on OFAC's sanctions list (SDN) on the path is marked, its entry linked. That is information from a public list, not a compliance decision.
• Pinned at block N — the answer is as of that block, when it was read. Later transfers are not in it; save the trace to keep this exact answer.
• The addresses and the transfers — every step, with why it was or was not followed.

4 · What to do next

• Copy link — the address of this answer: it opens the same trace as of the same block, so it gives the same answer tomorrow. It holds only the transaction, the chain, the payee, the asset, the method and the block — never a key from Settings.
• Save the trace — the button under the answer gives you a file. It opens again here (“Open a saved trace”), the same answer, with no request to anyone.
• If it reached an exchange, write to that exchange's compliance or support team at once: your transaction, the steps to their address, and the saved file. Exchanges can freeze funds still in their hands, and time matters.
• Report it to the police, and give them the saved file.
• Prepare a report — under the answer — writes these texts for you: a request to freeze for each exchange the money reached (with where that exchange publishes its contact, when it does — the page never invents one), a letter to Tether or Circle when USDT or USDC is still held and not frozen, a summary for the police with the SHA-256 of the trace file (save the file from that screen and attach it), and a text for Chainabuse. The scammer's addresses are listed apart from the services the money reached: an exchange or a mixer is never called the scammer. Nothing is sent from the page: copy each text, or open it in your mail, and send it yourself. Times are given in UTC and in your own time zone.
• Still there? — for every address where your money stayed, the answer reads its balance now, not at the pinned block: still there, partly moved, or moved on since — and for USDT or USDC whether the issuer has frozen it. What is still there can still be frozen.

5 · Export for analysis

Under the answer, Export for analysis gives one zip file for the tools investigators and analysts use. Inside:

• edges.csv — every transfer on the path: from, to, amount, time, transaction, and the part the method counted as your money; nodes.csv — every address: what was found there, its name and where to check it, whether it is on the sanctions list, totals in and out. Excel, R, Python, Maltego and i2 open them as they are.
• trace.graphml — the same as a graph for Gephi, Cytoscape or yEd; neo4j/ — files and a script to load it into Neo4j.
• features.csv and its two companions — one row per address with numbers a model can learn from, in the shape of the Elliptic dataset researchers use.
• meta.json — the trace's method and pinned block, and the type of every column; trace.json — the saved trace; README.txt — what each file is.

Every table has a header row, times in ISO 8601 (UTC), a dot for decimals and no thousands separator, so no tool has to guess. Examples that read an export in R and in Python are in Coinpath's repository (analysis/).

6 · Settings: keys of your own

Some providers answer faster, or at all, with a free key of your own; some people run their own node. Open Settings at the top of the page and fill in only what you have. Your keys stay in this browser only, and each is sent only to its own provider; a saved trace never contains one. Forget my keys removes them all.

Setting an address of your own (an instance, a node, an RPC URL) reloads the page once, so the page may ask it: the page lets itself talk only to the providers it knows and the addresses you set.

How fresh the data is, the first page says under "The data": the day of the names (exchanges' own lists, updated by hand) and the sanctions list's date with the day it was last checked — weekly, by a scheduled job. When that check is more than two weeks old, the page says so.

7 · Privacy

This page runs in your browser. It asks the public explorers of the chain you chose (Blockscout, Esplora, TronGrid) about your transaction and the addresses it follows; nothing else of ours sits in between. The names of addresses come as static files, asked by a short code computed from the address, so the address itself is not sent for them. Nothing is kept unless you save a file — or set a key on Settings, which stays in this browser.

Start