Onchain forensics & fund tracing
Wallsec is an onchain forensics company. When funds are lost to fraudsters we investigate what happened, trace the money across the chain, and protect your identity while we do it.
Confidential intake. Every case begins with an evidence review. Read our onchain investigation guides.
UK-based practice
Our office is in Reading, Berkshire, and we work to UK reporting routes.
BTC, ETH and SOL
Tracing coverage across the major networks and their leading tokens.
Source-referenced findings
Each conclusion is tied to the transactions that support it.
One business day reply
Case reviews are read and answered by an investigator, not a bot.
A focused forensic practice built to bring clarity, evidence, and direction after cryptocurrency fraud.
Where the evidence supports it, we also help clients pursue the return of their funds through the proper channels — supporting the reports and requests made to exchanges, banks, regulators and law enforcement, and working alongside your solicitor. Outcomes depend on the facts of each case and the decisions of those bodies, so no result can be promised, and we never hold or move client funds.
Forensic audit process
Select a stage to see exactly what our investigators do, what you receive, and how long it usually takes.
We capture what happened and protect your identity from the first message.
What you receive
A written case summary and an urgent actions list you can act on the same day.
Typical timeframe: Within 24 hours
Who handles your case
Cases are worked by named staff internally and reviewed before release. We describe the roles rather than publish individual profiles, because our analysts are contacted by the people they investigate.
Reads your first message, checks what records exist, and tells you plainly whether the onchain data supports a traceable case before anything is quoted.
Builds the transfer graph hop by hop from the transaction hashes in your own records, and classifies where each branch of value comes to rest.
A second analyst checks every hash, amount and attribution in the draft against the public ledger before the pack is released to you.
Applies access controls and retention rules to your documents, so case material is only visible to the people working on your file.
Sample transaction annexe (redacted)
An illustrative extract in the format we use. Addresses are shortened and figures are illustrative — no real client case is reproduced here.
| Hop | From | To | Amount | Classification |
|---|---|---|---|---|
| 1 | your wallet | TQ8x…4c1f | 18,400 USDT | Counterparty deposit address |
| 2 | TQ8x…4c1f | TKm2…9ab7 | 18,400 USDT | Forwarded 41s after receipt |
| 3 | TKm2…9ab7 | TRy6…02de | 11,900 USDT | Split — 64.7% of loss |
| 3 | TKm2…9ab7 | TWf4…7b30 | 6,500 USDT | Split — 35.3% of loss |
| 4 | TRy6…02de | Service deposit | 11,900 USDT | Terminal — centralised service |
Independent feedback
Reviews are collected and verified by Trustpilot, independently of Wallsec.
Our reviews are published on Trustpilot, where every review is tied to a verified Trustpilot account. We never publish testimonials we have written ourselves.
Read Wallsec reviews on TrustpilotTell us what happened. The first review is confidential and carries no obligation.
The channels below are the only ways Wallsec contacts you. We never ask for private keys, seed phrases, exchange logins or upfront fees before a written quote is agreed — and we never push for a decision under time pressure.
Official email
contact@wallsec.co.ukRegistered office
4th Floor, No. 1 Forbury Place
43 Forbury Road, Reading, Berkshire RG1 3JH
United Kingdom
Illustrative case scenarios
These are composite examples built from common fraud patterns, not records of specific clients or past results. They illustrate our workflow only and are not a prediction of the outcome of any individual case.
The scenarios below are illustrative composites, not client records or guaranteed results. We never publish client identities, wallet addresses or case documents, and every case differs on its facts.
Swipe to see more scenarios
What you receive
An investigation is only useful if someone else can act on it. Every case closes with the same four-part document set, written so a bank fraud team, a solicitor or a reporting body can verify each finding independently.
A plain-English account of what happened, in order, with each statement tied to a transaction reference so a third party can check it.
A visual map of the route funds took — each hop, split and merge — with terminal points labelled as service deposit, bridge, privacy protocol or dormant.
Every hop listed with network, timestamp, amount, sending and receiving address, and transaction hash, so nothing rests on our word alone.
What the data supports, what it does not, the confidence attached to each link, and who the pack can usefully be sent to next.
Three things that shape how a Wallsec case is run.