Investigation services
Cryptocurrency fraud investigation: trace lost crypto
If you lost crypto to fraud, Wallsec can investigate where it went. Our Reading-based UK team follows transactions across wallets and networks, identifies supported endpoints, and helps you understand what action the findings support. We prepare reports and practical next steps for your bank, the police or your solicitor. No outcome is guaranteed.
How to trace lost crypto after fraud
- Preserve the transaction hash, network, receiving address, amount and date, alongside payment receipts and the original messages.
- Notify your bank or the relevant exchange promptly, where applicable, and make an official fraud report. Do not wait for a completed trace before reporting.
- Open the hash in an explorer for that network and check whether the transfer completed. Save the public transaction record.
- Follow onward transfers, noting splits and network changes. A service label is a lead to verify, not proof of who owns the address.
- Use a documented trace to assess the next step with your bank, the police or a solicitor. Where the trail cannot be established, record that limit.
For a worked starting point, read our Bitcoin transaction tracing guide or the tracing overview for other assets. A missing transfer, an inaccessible wallet and a fraud loss need different checks.
Keep your records using our evidence-preservation checklist. For an official report in England, Wales or Northern Ireland, use Report Fraud; in Scotland contact Police Scotland on 101.
From tracing to informed action
Tracing establishes where value moved and helps assess what can lawfully be done with those findings. Depending on the evidence, next steps may include a bank complaint, a preservation request to an identified service through the appropriate channel, or legal advice. Identifying an exchange does not mean funds are still there or can be returned.
Wallsec’s free initial review checks whether your records support a useful investigation. If they do, you receive a written scope and quote before deciding. The report separates confirmed transactions, supported inferences and unresolved questions.
What an investigation covers
Every case is different, but the work is made up of the same four components. You are told at the outset which of them your case realistically needs.
Transaction tracing
We follow the movement of value from your first transfer through each subsequent hop, across Bitcoin, Ethereum, Tron and other public networks, recording the hash, amount and timestamp behind every step so the path can be checked independently.
Endpoint classification
Each branch of a trace ends somewhere. We identify whether value reached a deposit address at a regulated service, a bridge to another network, a privacy protocol or a wallet that has gone quiet — and say which, rather than implying more than the record supports.
Evidence and forensic reporting
The deliverable is a structured report: methodology, the transfer graph, the reasoning behind each judgement call, and the supporting data in a form a police officer, a compliance team or a solicitor can work from.
Support with next steps
We set out the realistic next steps your findings support, whether that is a report to Report Fraud, a request to a service holding the funds, or instructions to a legal adviser. We do not contact third parties without your instruction.
How a case runs
1. Free first assessment
You send the transaction hashes, addresses and dates you already hold. We check whether the onchain record supports a traceable case and tell you plainly if it does not. Usually a few working days, at no cost.
2. Written scope and fixed quote
If the case is viable, we set out exactly what will be examined, what the report will contain and what it costs. Nothing begins until you agree the scope in writing.
3. Investigation and reporting
We build the trace, classify the endpoints and document the methodology. A full trace and report typically takes around two weeks, depending on hop count and how many networks are involved.
Stage-by-stage timings and the methodology behind each step are set out on our investigation process page, and the deliverable itself is described in what an onchain evidence pack contains.
What an investigation cannot do
These limits apply to every firm working with public network data, including us. Anyone telling you otherwise is describing something the technology does not permit.
- Tracing does not cancel a confirmed transfer. A service may restrict its own accounts, and some token issuers can freeze balances under their contracts. Those decisions belong to the provider or issuer, not an investigator.
- Public networks record addresses, not identities. Naming a person requires supporting off-chain evidence; access to private account records depends on a lawful disclosure process.
- Some traces end at a privacy protocol or a dormant wallet. Where that happens we report it as the conclusion rather than continuing billable work.
- No investigation can guarantee an outcome. Our findings help you assess available options; decisions by banks, services and authorities are outside our control.
Cryptocurrency investigation FAQ
- What is a cryptocurrency investigation?
- It is the reconstruction of how funds moved after a fraud, using the public record each network publishes. An investigator follows the transfers hop by hop, documents where value split or consolidated, classifies the endpoints reached, and produces a report that others can verify against the same public data.
- What is the difference between onchain analysis and cryptocurrency forensics?
- In practice they describe the same work. Both mean reading the public transaction record of a network to establish how value moved and where it ended up. We use the term onchain analysis, and the output is a forensic evidence report.
- What information do you need to start?
- The transaction hashes of your transfers, the addresses you sent to, approximate dates and amounts, and any correspondence with the party involved. Screenshots help. If you only have part of this, send what you have and we will tell you whether it is enough to begin.
- Can you identify who owns a wallet address?
- Not from the ledger alone. Addresses are pseudonymous. Attribution becomes possible only where an address connects to off-chain records held by a service, and those records are normally disclosed under legal process rather than to a private firm.
- How much does an investigation cost?
- We quote a fixed scope in writing after the free first assessment, so you know the cost before anything starts. We never ask for payment in cryptocurrency and we never arrange payment over messaging apps.
- Do I need to report to the police as well?
- Yes, and preferably first. In England, Wales and Northern Ireland use Report Fraud, which replaced Action Fraud; in Scotland contact Police Scotland on 101. Keep the report reference with your evidence so a forensic report can support the official record.
- Is an investigation worth it for a small loss?
- Sometimes not, and we will say so. If the likely cost of the work is out of proportion to the amount lost, or the record does not support a traceable path, the honest answer is that an investigation is not the right step. That answer costs you nothing.
Not sure whether your case is traceable?
Send what you have. The first assessment is confidential, obligation-free and answered honestly.