bitcoin transactions are traced by following outputs to inputs across the public ledger. Investigators use addresses, clustering, and metadata to map flows and identify patterns.