How do I trace stolen Bitcoin step by step?

A DIY first-pass trace using only free tools:

1. Document the loss: your sending address, the scam destination address, transaction hash, timestamp, and amount.
2. Open a blockchain explorer (mempool.space, blockchain.com, or blockstream.info). Paste the destination address.
3. Follow the outputs. Each spend creates new UTXOs. Note the address(es) that received the funds and any change addresses.
4. Cluster: addresses that appear as joint inputs in the same transaction almost always belong to the same wallet. Note clusters as you go.
5. Watch for known service addresses. Some explorers label major exchanges automatically. If your funds land at a labeled exchange address — that is your enforcement target.
6. Stop at mixers, bridges, or privacy tools. A DIY trace can't usefully proceed past CoinJoin, Wasabi, JoinMarket, or a chain bridge to TRON/Monero. That's where professional tooling earns its fee.

Keep a written log of every hop with the tx hash. That log becomes the evidence package for any lawyer or investigator you engage later. Firms like Nethertrace will pick up from your DIY work and continue the chain into the harder hops.