Know When to Stop Tracing

Core idea

The goal of a trace is to reach an entity that collects identity data, not to rack up hops. Every hop past a genuine stop signal spends time and adds a chance of following the wrong money. These are the five conditions that say stop.

Components

1. A VASP or crypto business. The best outcome. Stop tracing and switch to the request or legal process (see VASP Records: What to Request and What Exists).
2. A probable unattributed service address. No label, but the address carries more than roughly 1,000 transactions, or belongs to a cluster of more than roughly 500 addresses. Volume at that scale is service behaviour, so treat it as an unidentified service rather than a suspect wallet and stop.
3. A Bitcoin address-type change. Following BTC forward, watch for the output type shifting between the three common formats: addresses starting 1 (legacy, P2PKH), 3 (pay-to-script-hash), and bc1 (native SegWit, Bech32). A change of type can mean a payment into a different wallet or service rather than continued self-custody, so treat it as a checkpoint and reassess.
4. Excessive commingling. When the UTXO you are following becomes one input among many in a transaction with many outputs, you cannot tie your input to any particular output. Following past that is guesswork.
5. An identified privacy service. Mixers, tumblers, and CoinJoins break the link by design. Do not claim a through-path across one (this workspace treats post-mixer work as a separate discipline; see Post-Mixer Bitcoin Tracing and CoinJoin / Mixer Detection).

When to use

At every hop, as a quick check before committing to the next one. Also at the point where a case starts to feel endless, which is usually a sign that a stop signal was passed several hops back.

Avoid when

Stopping is not the same as concluding. Record what stopped you and why, because “commingled beyond attribution” and “reached Binance deposit address” lead to completely different next actions. And a stop on one branch does not close the others; the fund flow usually splits.

Example

A trace runs four hops, then the next address shows 3,400 transactions and no attribution anywhere. That is service behaviour, not the suspect’s wallet, so the trace stops there and the effort moves to the branch that reached a labelled exchange deposit address two hops earlier.

Related

Asset-Tracing Methodologies for Commingled Funds (PIFO, LIBR, LIFO, FIFO, Pari Passu, Rolling Charge) · Service Choke-Points: What Each Service Type Can Give You · Exchange / VASP KYC Correlation · Post-Mixer Bitcoin Tracing · CoinJoin / Mixer Detection · Bitcoin UTXO Clustering Heuristics · Bitcoin Transaction Shape Taxonomy · Self-Verified Contract Names Can Forge a Trace-Stopping Label · Verify a Landmark Address Before You Trust It · Case Tractability: When to Decline