Back to Blog

How to Track a Solana Wallet

MetaSleuth
May 3, 2024

Solana is a fast and scalable blockchain network that has gained significant popularity in cryptocurrency.

As a Solana user, you may want to track your wallet’s activity and transactions for various reasons, such as monitoring your holdings, verifying recent transactions, or investigating suspicious activity. Or sometimes you want to track the smart money in Solana.

One way is to use Solscan. However, the Solscan can only show the SoL or SPL token transfers in one hop. If you want to track more hops, it will not help you.

MetaSleuth is an efficient tool to track Solana wallet and fund flows in multiple hops. It supports more than 20 different chains and cross-chain transactions.

Input an Address to Get Started

To start tracking a wallet, open MetaSlueth's website (https://metasleuth.io) and insert an address to start the tracking.

Let's use the address 9wAfrMnzrJ1XWXXDDmqh7gH7Q9ZBJjLhgou5GrUcHsZy as an example, input the address and press enter. The tool will perform an intelligent analysis to show the initialized result (as shown in the following Figure).

On the left is the side panel of an address, which will be shown when you click an address on the main canvas. The node on the main canvas means an address, and the edge between nodes represents the aggregated token transfers for each token. That means if there are multiple transactions to transfer one token between two nodes, there will be only one edge between them. You can click the edge to show the detailed transactions for the token transfer.

The result shows the token swap in Raydium, with 30.38 wSoL flowing into it and 288,723,795.50 TIM out. As we just said, the edge shows the aggregated token transfers. We can click the edge to see more detailed information.

From the transaction list, we can see that the 9wAfr used 30.38 SoL to swap 288,723,795.50 TIM tokens from 04-28 02:33:33 to 04-28 02:25:49 in two minutes.

Track the Fund Flow

After receiving the TIM tokens, the address 9wAfr wants to sell TIM tokens for profit. Instead of directly selling the tokens using the 9wAfr address, it uses three layers of addresses to hide the trace. How is this achieved?

To track the fund flow, we first find the TIM tokens transferred out from the address 9wAfr. We can click the address 9wAfr to show the side panel, and select all the output TIM tokens.

After selecting the addresses that receive the TIM tokens, we can click the node of the address to track further the token flows. For instance, we can click on the address Ax39bkxVxfC9Riz9fSKHVWGjwLSdHv2zCnHFyNWq15eK, and we find that this address swaps the received TIM tokens to SoL and transferred SoL to DJGiuwGs1WtC1QkEj3GkGtdVoXuEk34uwWmvQvLi72SZ.

We can use similar methods to track other addresses that receive TIM tokens from 9wAfr.

Subscribe and Enjoy 10% Off Discount

When signing up for MetaSleuth, use BLOCKSEC as the invitation code to enjoy 10% off for the subscription.

https://metasleuth.io/?invite-code=BLOCKSEC

drawing

Read More

Sign up for the latest updates
Newsletter - April 2026
Security Insights

Newsletter - April 2026

In April 2026, the DeFi ecosystem experienced three major security incidents. KelpDAO lost ~$290M due to an insecure 1-of-1 DVN bridge configuration exploited via RPC infrastructure compromise, Drift Protocol suffered ~$285M from a multisig governance takeover leveraging Solana's durable nonce mechanism, and Rhea Finance incurred ~$18.4M following a business logic flaw in its margin-trading module that allowed circular swap path manipulatio

~$7.04M Lost: GiddyDefi, Volo Vault & More | BlockSec Weekly
Security Insights

~$7.04M Lost: GiddyDefi, Volo Vault & More | BlockSec Weekly

This BlockSec weekly security report covers eight attack incidents detected between April 20 and April 26, 2026, across Ethereum, Avalanche, Sui, Base, HyperLiquid, and MegaETH, with total estimated losses of approximately $7.04M. The highlighted incident is the $1.3M GiddyDefi exploit, where the attacker did not break any cryptography or use a flash loan but simply replayed an existing on-chain EIP-712 signature with the unsigned `aggregator` and `fromToken` fields swapped out for a malicious contract, demonstrating how partial signature coverage turns any historical signature into a generic permit. Other incidents include a $3.5M Volo Vault operator key compromise on Sui, a $1.5M Purrlend privileged-role takeover, a $413K SingularityFinance oracle misconfiguration, a $142.7K Scallop cross-pool index injection, a $72.35K Kipseli Router decimal mismatch, a $50.7K REVLoans (Juicebox) accounting pollution, and a $64K Custom Rebalancer arbitrary-call exploit.

Weekly Web3 Security Incident Roundup | Apr 13 – Apr 19, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Apr 13 – Apr 19, 2026

This BlockSec weekly security report covers four attack incidents detected between April 13 and April 19, 2026, across multiple chains such as Ethereum, Unichain, Arbitrum, and NEAR, with total estimated losses of approximately $310M. The highlighted incident is the $290M KelpDAO rsETH bridge exploit, where an attacker poisoned the RPC infrastructure of the sole LayerZero DVN to fabricate a cross-chain message, triggering a cascading WETH freeze across five chains and an Arbitrum Security Council forced state transition that raises questions about the actual trust boundaries of decentralized systems. Other incidents include a $242K MMR proof forgery on Hyperbridge, a $1.5M signed integer abuse on Dango, and an $18.4M circular swap path exploit on Rhea Finance's Burrowland protocol.

Go Deeper with MetaSleuth Investigation

Extend your crypto compliance capabilities with Blocksec's MetaSleuth Investigation, the first platform for tracing funds, mapping transaction networks and revealing hidden on-chain relationships.

Move from detection to resolution faster with clear visual insights and evidence-ready workflows across the digital assets ecosystem.

MetaSleuth Investigation