Tracing funds

A trace follows funds from one source address forward, hop by hop, and reports how much of the original amount reached each address. The traced amount is called taint.

Tron and Ethereum trace methods

These apply to Tron and Ethereum alike; on Ethereum, amount and min-taint are in the asset’s base units. Pick a method with the method option. Each trace covers one token (token: usdt, trx, usdd, usddold or jusdt).

method	How it divides mixed funds	Use it for
rolling (default)	Each outflow carries the tainted share of the address’s balance at that moment. Clean inflows dilute the share.	“How much went where?”
haircut	Each tainted arrival is spread over the outflows that follow it, in proportion to their size.	A proportional cross-check.
fifo	Tainted arrivals form a queue; outflows take from it first in, first out.	Following specific deposits.
poison	Every address the funds touch is fully tainted from then on.	Flagging related addresses. Amounts are not meaningful.

Taint that arrives in installments, passes through a relay, or comes back to an address is followed in full. hops limits the length of the paths followed; a bounce A → B → A uses two hops.

Taint does not cross a swap, a USDD mint or a JustLend deposit (USDT into jUSDT). Trace each token separately.

Time rules

• An outflow that happened before the taint arrived never carries it.
• start-block keeps only the source’s transfers from that block on. Set it near the incident.
• amount sets how much you follow. By default it is the source’s whole outflow of that token from start-block on. On a busy source, pass both amount and start-block.

Where did the rest go?

accounting (Tron) and accounting_btc (Bitcoin) split the traced amount into buckets that add up to the whole. conserved confirms the sum (it is null under poison).

Bucket	Meaning
label_stops	Reached a labelled stop, such as an exchange.
hub_stops	Parked at a very busy address that was not followed further.
retained	Held by addresses that did not pass it on.
at_horizon	Still moving at the last hop. Not lost: add hops to follow it.
dropped_min_taint	Pieces smaller than min-taint (min-taint-sat on Bitcoin).
cut, dropped_max_nodes	Left out by a cap.
returned_to_source, source_unemitted	Came back to the source, or could not leave it.
unspent, fees, fanout_stops, absorbed_same_coin, purity_stops	Bitcoin only: still unspent, paid as fees, inside a transaction wider than max-fanout, counted once instead of twice, or stopped by min-purity.

The bottom line of a Tron trace is taint_at_label_stops, which maps each labelled entity to the taint that reached it. Read it next to accounting. On Bitcoin, use accounting_btc.label_stops and the nodes with is_stop.

Tron nodes[].stop says why an address was not followed: label (a stop label), hub_degree (a very busy address; this is not an identification), or no_outflow (nothing left after the taint arrived).

Stop labels

By default a trace stops at cex,exchange,mixer,privacy. stop-labels replaces the whole list, so repeat the defaults when you add one:

{"stop-labels": "cex,exchange,mixer,privacy,bridge"}

Names match a label’s entity or category, ignoring case. Sanctioned and incident addresses do not stop a trace by default. See Labels.

Bitcoin traces

Bitcoin and Zcash traces split each transaction’s inputs over its outputs with a rule: haircut (default), fifo, lifo or poison. On Zcash, taint that enters a shielded pool (z:sprout, z:sapling, z:orchard) stays there: a trace never continues from a deposit into a pool to a later withdrawal.

Wallet clusters

Addresses spent together in one transaction usually belong to the same wallet. hodlflow groups them into clusters. With {"node": "cluster"} a trace follows wallets instead of single addresses, which is usually the right unit for Bitcoin.

• A cluster is named by cluster_id, the address of one of its members. Pass it as cluster:<address>; any member address also opens the cluster.
• Clusters grow as new transactions arrive, and two clusters can merge. The old name still opens the merged cluster.

Pinning deposit addresses

An exchange’s deposit addresses fold into the exchange’s cluster, which hides whose account received the funds. A pinned address stays its own node:

• labelled deposit addresses are pinned automatically (no-pin-deposits turns this off);
• pin-addr pins up to 20 addresses of your own, such as a deposit address named in your case.

Peel chains

{"min-purity": 0.99} follows only coins the traced funds fully own, such as a peel chain and the deposit addresses it pays. Everything else is parked in accounting_btc.purity_stops.

Trace versions

Tron trace answers carry trace_semantics: 2 since 2026-10-09. Answers without that field undercounted installments and relays; re-run them before quoting.