Ethereum Transaction Tracing: A Beginner's Guide
How to understand ETH transactions, read Etherscan, and trace ERC-20 tokens through smart contracts.
Tracing Ethereum differs fundamentally from Bitcoin. Bitcoin uses the Unspent Transaction Output (UTXO) model, whereas Ethereum operates on an account-based model, similar to a traditional bank. Understanding this architecture is essential for any investigator.
Furthermore, Ethereum is a global computer. Transactions don't just move money; they execute code (smart contracts), adding layers of complexity to forensic analysis.
The Anatomy of an ETH Transaction
- •Nonce: The transaction count for a specific address. Useful for ensuring chronological order.
- •Gas Price & Limit: The fee paid to execute the transaction.
- •To/From: The sender and recipient addresses.
- •Value: The amount of native ETH being transferred.
- •Data Payload: The input data instructing a smart contract on what to execute.
Reading Etherscan Like a Pro
Etherscan is the default block explorer for Ethereum. When investigating a standard ETH transfer, the process is simple: look at the "Transactions" tab. However, criminals rarely just send raw ETH.
The ERC-20 Complication
Most value on Ethereum moves as ERC-20 tokens (like USDT, USDC, or UNI). An ERC-20 transfer is not a native ETH transaction; it is a smart contract interaction.
To trace these, investigators must look at the "ERC20 Token Txns" tab on Etherscan. The "To" address on the main transaction will be the token contract itself, while the actual recipient is buried in the transaction logs.
Tracing Through Decentralized Exchanges (DEXs)
Criminals frequently use DEXs like Uniswap to swap stolen tokens (e.g., swapping stolen SHIB for ETH). When a user interacts with a DEX, they send one token to a liquidity pool and receive another back.
On a DEX, the blockchain does not explicitly link the incoming token to the outgoing token. Investigators must manually correlate the swap events in the transaction logs to follow the value.
Internal Transactions
When a smart contract sends ETH to another address, it creates an "internal transaction." These do not appear on the main transaction list but are crucial for tracing funds moving out of automated splitters or exploit contracts. Always check the "Internal Txns" tab.
Mastering Ethereum tracing requires shifting from following "coins" to following "events" triggered by code execution.
Simplify Smart Contract Tracing
Aletheia demystifies complex EVM data, automatically unraveling DEX swaps, internal transactions, and token transfers into a clean, human-readable graph.