On-chain Tracking and Fund Freezing

This article has three layers:

1. Layer 1: The Intuition: Transparent ledgers and masked individuals
2. Layer 2: Real-World Use: Bitfinex recovery, Tornado Cash sanctions, stablecoin freezes, and exchange cooperation
3. Layer 3: Principles and engineering key points: Address clustering, mixer principles, limitations of tracking, and what victims should do

Layer 1: The Intuition

1.1 Transparent ledgers, masked individuals

Imagine a ledger open to the entire world, recording every single transaction: from which account, to which account, how much money, and at what time. Accounts do not list names, only serial numbers.

Looking at a single number alone tells you nothing about the person. However:

• If this number once sent money to a KYC-compliant exchange deposit address → the exchange knows who it is;
• If this number was once made public by the owner on social media → everyone knows who it is;
• If this number always appears together with another known identity in the same transaction → it is very likely the same person.

Once a mask is removed once, all past and future transactions are exposed.

1.2 How attackers "wash" funds

Layer 2: Real-World Use

• Bitfinex (stolen in 2016, recovered in 2022): Approximately 120,000 BTC were stolen. In the years following, law enforcement tracked the flow of funds, eventually locating the suspects and finding the wallet private key in their cloud storage, recovering approximately 94,000 BTC—the largest financial seizure in US Department of Justice history at the time.
• Tornado Cash Sanctions (2022): The US Treasury Department added the Ethereum contract addresses of the mixer Tornado Cash to the sanctions list, citing its use for "money laundering for North Korean hackers and others." This move sparked massive controversy: can an immutable smart contract be "sanctioned"? In late 2024, a US Federal Appeals Court ruled that the Treasury had exceeded its authority, and in 2025, the Treasury removed it from the list.
• Stablecoin Freezing: Centralized stablecoins like USDT and USDC have freeze functions within their contracts. When requested by law enforcement or upon confirmation of theft, issuers can freeze stablecoins in specific addresses. In many theft incidents, attackers immediately swap stablecoins for ETH specifically to avoid being frozen.
• Exchange Cooperation: Large exchanges monitor known stolen fund addresses; once these funds are deposited, they freeze the account and cooperate with investigations.

Layer 3: Principles and Engineering

3.1 Address Clustering

Commercial on-chain analysis companies combine these heuristics with massive amounts of labeled data to construct an identity map of addresses covering the entire network.

3.2 Principles of Mixers

Taking a zero-knowledge proof-based mixer like Tornado Cash as an example:

1. When depositing, the user submits a commitment (a hash of a secret value), and the funds enter a public pool;
2. When withdrawing, the user uses a zero-knowledge proof to prove "I know the secret corresponding to a certain commitment in the pool," without revealing which one (the principle);
3. A "nullifier" must also be submitted to prevent the same deposit from being withdrawn twice.

The more people who deposit into the pool, the larger the "anonymity set" becomes, making it harder to correlate deposits with withdrawals. However, if a user deposits and then withdraws quickly, uses a unique amount, or immediately transfers funds back to an old address, they can still be linked.

3.3 Limitations of Tracking

• Can only track to "checkpoints": Tracking can tell you which exchange the money entered, but freezing and obtaining identity information requires exchange cooperation, and some exchanges do not cooperate;
• Cross-chain and Privacy Coins: Once funds jump to a chain with higher privacy, tracking difficulty increases significantly;
• Misidentification: Clustering heuristics can make mistakes, potentially marking unrelated individuals as suspicious;
• Privacy Cost: The same technology can be used to track the financial status of ordinary users. It is a double-edged sword.

3.4 What to do after being stolen

1. Immediately transfer the remaining assets in the same wallet to a brand-new, securely generated wallet; revoke all approvals (see "Unlimited Approvals");
2. Record the transaction hash, the attacker's address, and the timeline of the theft (see "Incident Response and Post-Mortem");
3. If stablecoins are involved, contact the issuer as soon as possible;
4. Contact large exchanges that the attacker might use to request a freeze on the addresses;
5. Report to the police and contact professional on-chain tracking services or security emergency organizations (such as SEAL 911);
6. Beware of "fund recovery" scams: After being stolen, people often claim they can help you recover the funds for an upfront fee; these are almost always secondary scams.

Summary