Trace stolen crypto in minutes
First response tool for crypto hack victims, lawyers, and security researchers. Paste an address, get a full fund-flow analysis.
Free for your first investigation — no card
Trace funds across 3.8M+ labelled exchange addresses
One address, followed to where it ends
Start from the one address the money left from — here the Bybit exploiter's, the real one from the published case.
Ethereum · the address the theft left from
Every trace we publish, open to check
Hacks we walked hop by hop. Everything in the file is read from the graph behind it.
Bybit
Ethereum · February 21, 2025
On February 21, 2025, Bybit suffered the largest crypto hack in history. Attackers — later attributed to North Korea's Lazarus Group — compromised Bybit's Ethereum cold wallet via a malicious multisig transaction, draining approximately $1.5 billion in ETH and stETH. The funds were immediately split across dozens of wallets and routed through mixers to obscure the trail.
- Loss, as publicly reported
- $1.5B
- Traced Outflow
- $1.4B
- largest leg ETH $1.1B
- 6
- hops followed
- 356
- addresses
- 833
- transfers
- Jan 2026
- latest transfer
One trace, three kinds of trouble
Whether it was your wallet, your client's, or the exploit everyone is talking about.
Your wallet was drained
See where the money went, what still holds it, and which exchange can be asked to freeze it.
- Fund-flow graph
- Freeze candidates
- Freeze-request packet
Binance0xc4e7…02bdStill holding
OKX0x9f02…c7a1Deposit
Kraken0x3ad8…1f6bDeposit
KuCoin0x5e1b…44d2Deposit
Coinbase0x7d21…9e04Deposit
HTX0x2b6f…d318DepositYou are building a case
The graph and the full transaction trail as one document, every figure carrying what it was read from.
- PDF report
- Transaction trail CSV
- Shareable graph link
You are dissecting a hack
Follow attacker wallets across twelve chains, with mixers, bridges and swaps named on the way.
- Twelve chains
- Entity labels
- Hack tracker feed
12 chains. One trace.
Every network the walk reads, feeding one graph.
Ethereum
Bitcoin
Solana
BNB Chain
Polygon
ArbitrumEthereumBitcoinSolanaBNB ChainPolygonArbitrum
Optimism
Base
Avalanche
Gnosis
TON
TronOptimismBaseAvalancheGnosisTONTronEverything between an address and a filed report
Fund tracing
Every hop, followed
The walk follows the money out until every branch ends somewhere with a name — and shows you the address still holding it.
- Sanctioned counterparty0x71c3…a09e sent to an OFAC SDN addressnow
- Mixer0x3ad8…1f6b → Tornado Cash4m
- Large transfer$48,200 out of 0x5e1b…44d28m
- Bridge0x9f02…c7a1 → THORChain12m
Monitoring
Alerts when the money moves
Watch the addresses still holding funds. The moment they reach an exchange, mixer or bridge, you get an alert.
Binance0x8c1a4f…e3b977f2Exchange
Uniswap0x2e4b90…6a0cd913DEX
THORChain0xa07f3c…91d24c58Bridge
Tornado Cash0x5f1d27…c04aa8c2MixerRisk scoring
Risk, with its sources
Every score says what it rests on, and a check that timed out is marked unanswered.
Reports
Evidence you can file
The graph, the trail and a freeze packet per exchange — for a compliance desk or a court.
Simple pricing for every case
Start free. Scale when you need to.
Crypto payment via NOWPayments. No auto-renewal, no refunds. Your plan ends on the expiry date — buy again any time to continue.
From the research desk
Read article21 Sept 2026
How 40 BTC becomes 256 BTC, and every digit stays true
On 15 May 2026 a THORChain vault paid 36.853504 BTC into an address that had no business receiving it.
Read article28 Aug 2026
MetaSleuth Alternative: ChainHint vs MetaSleuth for Crypto Investigations (2026)
MetaSleuth vs ChainHint compared honestly: both trace 12 chains hop-by-hop. The real differences are quota models, AI reports, and Source of Funds.
Read article21 Apr 2026
Lazarus Group Laundering Playbook: 8 Years, $6.7B, and the Patterns Every Investigator Should Know
How North Korea's Lazarus Group launders stolen crypto — the four-phase playbook, on-chain fingerprints, and what fund tracing tools detect.
Read article29 Mar 2026
Bybit Hack Fund Flow Analysis: How $1.5B Moves Through the Blockchain
How Lazarus Group moved $1.5B through the blockchain after the Bybit hack — and how blockchain forensics tools trace it address by address.
Read article27 Mar 2026
The $6.7B Problem: Why Crypto Hack Victims Have Nowhere to Turn
The blockchain forensics market was built for governments and banks. Here is why crypto hack victims have nowhere to turn and what needs to change.
Common questions
What people ask before the first trace.
Minutes. How long exactly depends on how deep the trace goes and how widely the funds fanned out: a shallow trace over a few wallets finishes fastest, a 6-hop Agency trace over 2,000 addresses takes longest.
ChainHint exports fund-flow graphs and reports in which every transfer carries its transaction hash and block time, so each line can be checked on a public explorer. It is an investigative tool, not a certified forensics provider — ask your attorney about admissibility.
Ethereum, Bitcoin, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Gnosis, Solana, TON, and Tron (beta) — 12 chains total.
Yes. Your investigations are private by default and only visible to you. We do not share or sell your data.
We combine multiple data sources including GoPlus, Chainalysis sanctions, and our own growing entity database. Known entities like exchanges and mixers are identified automatically. Unknown addresses show risk scores and behavioral flags.
Investigator ($79/mo or $639/yr) is for individual investigators — unlimited investigations, 500 addresses per trace, 4 hops. Agency ($499/mo or $3990/yr) is for law firms and compliance teams — 2,000 addresses per trace, 6 hops, plus Wallet Reputation API access.
Annual billing saves 33% — effectively 4 months free. Investigator is $639/yr ($53.25/mo equivalent) and Agency is $3990/yr ($332.50/mo equivalent), paid once via crypto through NOWPayments. The plan runs for 365 days from the moment your payment confirms. There is no auto-renewal: when the period ends, your plan stops and you simply buy again if you want to continue. No refunds for unused time.
Yes. Just buy the annual plan from /pricing — the new payment activates a fresh 365-day window from the moment it's confirmed. Any remaining days on your monthly cycle are forgiven (no pro-rating). We keep it simple so you always know exactly what you're paying for and when it expires.
Yes — Bitcoin traces use the Blockstream API, cluster labels from WalletExplorer, and sanctions matching. The hop-by-hop traversal works the same as on EVM chains.
There's nothing to cancel. NOWPayments doesn't store payment details and we don't auto-renew — your plan runs until its expiry date and then stops automatically. To continue afterwards, just buy again from /pricing. No refunds for unused time.
Yes — @chainhint_bot runs a free AML check on any address right inside Telegram: risk score, entity attribution, and sanctions screening, one free check per day. Need more, buy extra checks with Telegram Stars. Every verdict links back to the full investigation on chainhint.com.
Where did the money go?
Paste the address it left from. The first trace is free, and the graph, the entities and the report are yours to keep.
Check any address in Telegram
Paste an address into the chat. Risk score, sanctions and a link to the full report come back in the chat. One free check a day; more with Telegram Stars.
Open @chainhint_bot