Bitcoin vs Ethereum tracing for victims: what is different under the hood

Victims often say “Bitcoin was stolen” when they mean an ERC-20 on Polygon, or confuse an L2 with “the main chain.” Precision matters because analysts use different heuristics and tooling. Deep dive: scam investigation and tracing.

Bitcoin’s UTXO model and clustering

Unspent transaction outputs (UTXOs) can be combined in a single transaction from multiple prior coins. Investigators use multi-input clustering heuristics—carefully, because CoinJoin and intentional privacy breaks naive assumptions—to suggest common ownership. Change addresses and peel chains create visual complexity that victims misread as “money disappeared.” Your job as a victim is to provide the exact funding transaction and every address you knowingly controlled, not just the “from” address of the theft.

Ethereum’s account model and token complexity

Externally owned accounts (EOAs) hold ETH and interact with contracts. Theft often involves ERC-20 transfers, router swaps through Uniswap-style pools, or malicious setApprovalForAll on NFTs. A single “hash” might be an approval, not a transfer of funds—yet it enabled the drain. Analysts need the full transaction list, not only the largest outgoing value. See DeFi risks and phishing for how approvals fit into drainer workflows.

Layer 2 and bridges multiply hops

Moving from Ethereum mainnet to Arbitrum, Optimism, or Base changes which explorer and which indexer analysts trust. Bridges introduce wrapper assets and message-passing delays. If you only screenshot mainnet, you may miss where funds actually exited. Tell investigators every chain and bridge you knowingly used, even if you think the theft was “only” on one chain.

What to hand your investigator on day one

All transaction hashes, grouped by chain.
Wallet software and version (MetaMask, Rabby, hardware wallet app, etc.).
Whether you ever signed “unlimited” approvals.
Any contract addresses shown in the fraudulent dApp UI.

VaultTrace Recovery supports multi-chain tracing engagements with deliverables designed for exchanges and counsel.