Investigation services
Cryptocurrency investigation and onchain transaction tracing
Wallsec is a UK onchain forensics firm based in Reading. We reconstruct how funds moved after a fraud, classify where the value ended up, and prepare a structured evidence report you can give to the police, a regulated service or a solicitor. We do not hold client funds and we do not promise outcomes.
What an investigation covers
Every case is different, but the work is made up of the same four components. You are told at the outset which of them your case realistically needs.
Transaction tracing
We follow the movement of value from your first transfer through each subsequent hop, across Bitcoin, Ethereum, Tron and other public networks, recording the hash, amount and timestamp behind every step so the path can be checked independently.
Endpoint classification
Each branch of a trace ends somewhere. We identify whether value reached a deposit address at a regulated service, a bridge to another network, a privacy protocol or a wallet that has gone quiet — and say which, rather than implying more than the record supports.
Evidence and forensic reporting
The deliverable is a structured report: methodology, the transfer graph, the reasoning behind each judgement call, and the supporting data in a form a police officer, a compliance team or a solicitor can work from.
Case preparation support
We set out the realistic next steps your findings support, whether that is a report to Action Fraud, a request to a service holding the funds, or instructions to a legal adviser. We do not contact third parties without your instruction.
How a case runs
1. Free first assessment
You send the transaction hashes, addresses and dates you already hold. We check whether the onchain record supports a traceable case and tell you plainly if it does not. Usually a few working days, at no cost.
2. Written scope and fixed quote
If the case is viable, we set out exactly what will be examined, what the report will contain and what it costs. Nothing begins until you agree the scope in writing.
3. Investigation and reporting
We build the trace, classify the endpoints and document the methodology. A full trace and report typically takes around two weeks, depending on hop count and how many networks are involved.
Stage-by-stage timings and the methodology behind each step are set out on our investigation process page, and the deliverable itself is described in what an onchain evidence pack contains.
What an investigation cannot do
These limits apply to every firm working with public network data, including us. Anyone telling you otherwise is describing something the technology does not permit.
- A confirmed transfer on a public network cannot be reversed, cancelled or frozen by us or by anyone else.
- We do not hold, move or return client funds at any point, and we cannot compel a third party to do so.
- Public networks record addresses, not identities. Naming a person requires off-chain information that is normally released only under legal process.
- Some traces end at a privacy protocol or a dormant wallet. Where that happens we report it as the conclusion rather than continuing billable work.
- No investigation can guarantee an outcome. What we provide is evidence and a documented methodology.
Cryptocurrency investigation FAQ
- What is a cryptocurrency investigation?
- It is the reconstruction of how funds moved after a fraud, using the public record each network publishes. An investigator follows the transfers hop by hop, documents where value split or consolidated, classifies the endpoints reached, and produces a report that others can verify against the same public data.
- What is the difference between onchain analysis and blockchain forensics?
- In practice they describe the same work. Both mean reading the public transaction record of a network to establish how value moved and where it ended up. We use the term onchain analysis, and the output is a forensic evidence report.
- What information do you need to start?
- The transaction hashes of your transfers, the addresses you sent to, approximate dates and amounts, and any correspondence with the party involved. Screenshots help. If you only have part of this, send what you have and we will tell you whether it is enough to begin.
- Can you identify who owns a wallet address?
- Not from the ledger alone. Addresses are pseudonymous. Attribution becomes possible only where an address connects to off-chain records held by a service, and those records are normally disclosed under legal process rather than to a private firm.
- How much does an investigation cost?
- We quote a fixed scope in writing after the free first assessment, so you know the cost before anything starts. We never ask for payment in cryptocurrency and we never arrange payment over messaging apps.
- Do I need to report to the police as well?
- Yes, and preferably first. In the UK that means Action Fraud, or Police Scotland on 101 in Scotland. A forensic report is considerably more useful when it attaches to an open report with a crime reference number.
- Is an investigation worth it for a small loss?
- Sometimes not, and we will say so. If the likely cost of the work is out of proportion to the amount lost, or the record does not support a traceable path, the honest answer is that an investigation is not the right step. That answer costs you nothing.
Not sure whether your case is traceable?
Send what you have. The first assessment is confidential, obligation-free and answered honestly.