How Exchange and Protocol Hacks Are Investigated

Where an investigation starts after a hack

A centralized-exchange hack and a DeFi protocol exploit look similar on-chain: a large outgoing transfer (or a series) from a known protocol or cold-wallet address to an address that then splits. The investigation does not start with "the hacker." It starts with facts: network, token contract, TxID, amount, block time, From and To. Until that snapshot is saved, it is easy to argue about a neighbouring transaction from the same minute.

Then comes a graph: each outgoing hop, internal contract transfers, DEX swaps, a move to another network. The goal is not to "unmask a person in the explorer." It is to find a pressure point: a deposit at a regulated platform while the funds are still on its books. How to read transaction fields is in how to read a blockchain explorer. A narrow 1–3 hop walk toward "whose wallet is this" is in how to trace a scammer crypto wallet.

Speed here is about the hold window, not a movie countdown. After a withdrawal from an exchange deposit, a mixer pass, or a long cross-chain route, the pressure point often disappears. A hold request is a separate platform process: see freezing stolen crypto on an exchange. A hop map does not replace that process and does not guarantee it.

Address clustering: turning a pile of 0x… into one wallet

Clustering groups addresses that are likely under one controller. A classic UTXO heuristic (Bitcoin and similar): if several inputs are spent in one transaction, they are often treated as common ownership. Change outputs that return to the sender are another signal. On account-based chains (Ethereum and similar), other patterns matter: a set of addresses funded from one source and emptied in sync; an exchange-deposit pattern (many inbound amounts, then a sweep to a hot wallet).

Attribution is the next layer: match a cluster to a type of entity. An explorer Exchange tag, a public bridge address, a known mixer contract, an OTC pattern. Labels are incomplete and go stale: a missing tag does not mean "not an exchange," and a tag is not a verdict. Checking more than one source reduces false calls, but it still does not produce a legal name for the owner.

Cross-chain hops and realistic limits of the map

After a large hack, funds often leave for another network: lock-and-mint or burn-and-release on a bridge, a wrapped token, a DEX swap, sometimes a mixer. The trail does not "vanish": the source chain shows a deposit into the bridge contract; the destination shows a mint or unlock. Matching uses amount (minus fees), time, and public message identifiers when the bridge exposes them. That is labour-intensive, not magic.

The limits are honest. Mixers and zero-knowledge pools break a direct A-to-B link: what remains is probabilistic (timing, amount, repeated patterns), not a cinematic identity reveal. False clustering glues together other people's addresses. Long peeling chains of small outputs stretch manual work. The wrong network in the explorer yields an empty picture. A public graph is not a compliance report: a platform needs reproducible TxIDs, not a screenshot of arrows.

Hand the analysis to blockchain analytics when you need service attribution, several networks, and a package for a platform or lawyers. A commercial report is a map and material for next steps, not a freeze promise. If the matter is already a case after that assessment, see the success-fee model.

First steps to record—and where DIY ends

1. Save the originating TxID of the hack (or your outgoing transfer if you are a victim, not the protocol), network, token contract, From / To, amount, and UTC time.
2. Open the explorer for that network; for tokens, read token transfers, not only native Value.
3. Record one to three further outflows until the amount splits, enters a bridge or mixer, or matches a deposit pattern.
4. If a bridge contract is visible, open the destination network and look for a mint or unlock of similar size—do not mix networks in one search.
5. Screenshot the URL, hash, and addresses; do not paste a seed phrase into advertised "tracers."
6. Stop when you have a snapshot and a pressure-point hypothesis—or a clear dead end.

• Do not promise yourself a legal name from an address balance.
• Do not treat an Exchange tag as enough proof for a court or a platform without a second check.
• Do not fire repeat "speed-up" transactions at a bridge contract without understanding status.
• Do not prepay "we recover everything after a protocol hack" for wallet access.

A self-serve explorer covers the first picture. Clustering across hundreds of addresses, cross-chain work, and a platform-ready report are no longer a single transaction page. That is the blockchain analytics contour: you bring hashes and receive a map, with no guarantee that a custodian will still hold—or agree to hold—the deposit.