Follow the Money: Tools for Investigating Crypto Onchain and Offchain
Most crypto investigations start with one wallet address. Then the money fans out, jumps to another chain, touches a bridge and lands somewhere with an unhelpful label like 0x7a...91f.
A block explorer is necessary, but it isn’t enough.
That is why I saved this tool list shared by ZachXBT in March 2025. He has spent years tracing hacks, scams and stolen funds, so a look at his working toolbox is far more useful than another generic list of “best crypto apps”.
ZachXBT said he wasn’t paid by any of the platforms and didn’t have referral links to share. Neither do I. I also haven’t personally tested every tool below, especially the enterprise products, so treat this as a map of what each tool is good for rather than an endorsement of every result it produces.
One important caveat: some of the offchain tools surface sensitive or breached data. Use them only for lawful research, accounts you own or investigations you’re authorised to conduct. Finding exposed credentials is a reason to secure an account, not an invitation to enter it.
1) Start with the raw onchain record
Before drawing a clever graph, confirm the boring facts: the transaction hash, block time, sender, recipient, token contract and amount. The raw record is the part you can keep returning to when a label or theory turns out to be wrong.
Etherscan is the default starting point for Ethereum transactions, contracts, logs and token transfers. Its wider family of explorers covers many EVM chains, and the contract tabs are especially useful when a transfer is actually a swap, approval or more complicated contract interaction.
Solscan plays a similar role for Solana. Solana transactions can contain many instructions and inner transfers, so a good explorer saves a lot of squinting at raw data.
Blockchair is a useful Bitcoin explorer with search and filtering across blocks, transactions and addresses. It also supports other chains, but I would reach for it mainly when the trail lands on Bitcoin.
MetaSuites adds address labels, fund-flow shortcuts, transaction explanations and other context directly inside popular block explorers. That is good because you keep the explorer as your source of truth while reducing the tab-opening Olympics.
An address label is still a lead, not proof. Even a correct exchange label doesn’t tell you who controls the customer’s deposit account behind it.
2) Turn a trail of transactions into a map
Once funds fan out across multiple wallets, reading one explorer tab at a time becomes painful. This is where tracking feeds, entity labels and graph visualisation earn their keep.
Cielo is strong for monitoring wallets across many chains and receiving real-time alerts through Telegram or Discord. It is trader-friendly, but the same feed is useful in an investigation because it tells you when a watched wallet moves again without requiring you to refresh an explorer all day.
MetaSleuth turns address activity into a visual fund-flow graph, with cross-chain paths, labels, filters, notes and shareable analyses. It is probably the easiest entry point here for a retail user who wants to follow several hops without buying an enterprise investigation platform.
Arkham combines a multichain explorer with entity profiles, labels, a transaction visualiser, automated tracing and alerts. Its biggest advantage is moving from an individual address to a possible real-world entity, then watching that entity as a group of wallets. But check whether a label is Arkham-verified, predicted or user-created before repeating it as fact.
TRM Labs is the heavyweight option. Its forensics platform is built for investigators, compliance teams and law enforcement, with auditable transaction graphs and proprietary attribution. The trade-off is access: this is generally an institutional product, not the first tool a curious retail user will casually open.
The graph makes movement easier to see. It does not magically prove common ownership, intent or guilt (sadly, there is no “solve case” button).
3) Follow funds when they cross a bridge
A normal explorer shows what happened on one chain. A bridge explorer connects the source transaction to the destination transaction, which is often the missing link in a cross-chain trail.
Range Cross-Chain Explorer started as a particularly useful way to trace Circle CCTP transfers and now covers a broader set of bridges and interoperability protocols. It is good when you need to connect a burn, message or deposit on one chain with the corresponding mint or receipt elsewhere.
Pulsy XFlow aggregates cross-chain activity across many bridges. The breadth is the attraction: you can search one place before working out which bridge-specific explorer you actually need.
SocketScan is a focused explorer for multichain transfers routed through Socket. It shows the source and destination sides together, including the status of the cross-chain request.
No bridge explorer covers everything. If a trail seems to vanish, check the source-chain contract, the bridge’s own documentation and the destination transaction before deciding the money disappeared.
4) Connect wallets to offchain clues
Blockchains show money moving between addresses. They usually don’t show who was behind a deleted X account, a Telegram handle or an IP address. OSINT tools help with that second half, but this is also where false confidence becomes dangerous.
OSINT Industries searches emails, phone numbers and usernames across public online services. It is useful for finding linked profiles and turning one identifier into several new leads, with timeline and export tools to keep the result organised.
LeakPeek, Snusbase and Intelligence X search breach data and other indexed datasets. Their legitimate value is confirming that an email, username, phone number or domain appeared in an exposure, which can explain an account takeover or connect reused identifiers. Never use a returned password or session data, and don’t assume every old database row is current or accurate.
Spur enriches an IP address with network, location, ASN, VPN, proxy and anonymisation context. That can help distinguish a residential connection from a data-centre proxy, but IP geolocation is supporting evidence, not a home address or proof of identity.
Cavalier by Hudson Rock focuses on infostealer exposure. For defenders, this can reveal whether company domains, employee accounts or machines appear in stealer data and need urgent remediation.
Mugetsu is a Telegram bot for checking historical X usernames and meme-coin-related clues. Public documentation is thin, so I would use its output as a pivot and verify it elsewhere before relying on it.
TelegramDB Search Bot searches public Telegram groups, channels and their indexed members. This is handy when a handle or account appears across several public communities, although coverage is incomplete and membership alone says very little about intent.
Discord.ID takes a Discord user ID and returns basic public account information. The permanent numeric ID matters more than a display name that can be changed, and its embedded timestamp can help establish when the account was created.
The sensible rule is simple: one matching username is a clue. Several independent identifiers, preserved with timestamps and original sources, start to become evidence.
5) Preserve the evidence and your reasoning
Crypto investigations have a nasty habit of changing while you are looking at them. Websites disappear, social profiles get renamed and project teams quietly edit old claims.
Wayback Machine lets you search historical snapshots and save a public page as it appears now. It has enormous historical coverage, which makes it the first place I would check for an older version of a site.
Archive.today saves both a text and graphical snapshot and often handles modern web pages differently from the Wayback Machine. I would try both because either service can miss a page, especially when it depends on a login or heavy client-side code.
Obsidian Canvas is not a blockchain tool at all, and that is exactly why it belongs here. It gives you a local visual workspace for connecting wallets, people, transactions, screenshots and source notes without forcing every clue into the shape of an onchain graph.
Save the URL, capture time and transaction hash alongside every screenshot. A screenshot without provenance is just a picture of a claim.
6) Ask bigger questions with Dune, then check the PnL
Following one address is an investigation. Asking how thousands of addresses behaved is an analytics problem.
Dune lets you query decoded blockchain data with SQL, turn the results into charts and publish a reproducible dashboard. It is excellent for testing a broader theory such as whether a group of wallets funded the same contract, used the same bridge or sold within the same time window. The catch is obvious but easy to forget: a beautiful chart can still be built on a bad query.
Summ, formerly CryptoTaxCalculator, imports wallet and exchange activity to calculate portfolio performance, gains, losses and tax reports. It is useful when you are analysing your own address or authorised records and need cost basis rather than a rough money out minus money in estimate. DeFi, transfers between your own wallets and missing price data can all make PnL messier than it looks.
Dune explains patterns. Summ explains accounting. Neither replaces checking the underlying transactions.
7) Inspect a dApp without controlling the wallet
Impersonator is an unusual Chrome extension that lets a dApp see any EVM address as the connected account in watch-only mode. No private key is required, and it cannot sign transactions for that address.
That is useful when a dApp displays different positions, claims or interface states depending on the connected wallet. You can inspect what a public address would see without asking its owner to connect or putting funds at risk. Use a separate browser profile and remember that this tests the front end’s view, not ownership or signing authority.
8) What I would actually start with
You do not need all these tools open at once. That is how an investigation turns into far too many tabs and a vague feeling that the browser is judging you.
For a practical first pass:
- Confirm the transaction on Etherscan, Solscan or Blockchair.
- Map the next few hops in MetaSleuth or Arkham.
- Add the important wallets to Cielo so you know if they move again.
- Check Range, Pulsy or SocketScan when the trail crosses chains.
- Archive relevant pages and profiles immediately.
- Use OSINT only when you have a specific identifier and a legitimate reason to investigate it.
- Keep your notes, sources and confidence level in Obsidian.
The tools help you follow the money. The discipline is knowing where the evidence ends.
