What a legitimate firm actually sells
A genuine onchain investigation firm sells analysis and documentation, not an outcome. The work is to reconstruct where funds moved from your first transfer, classify each endpoint, and produce a written report that police, a regulated service or a solicitor can act on.
Nobody can reverse a confirmed transfer on a public network. Where funds are returned, it is because a court order, a regulated service's internal process or a law enforcement action moved them — on the strength of evidence. A firm that describes its own service as 'recovering' funds directly is describing something the technology does not allow.
Signals that a service is not what it claims
- It contacted you first, especially in reply to a public post about your loss or through a messaging app.
- It guarantees recovery, quotes a success rate, or names a timescale before seeing any of your data.
- It asks to be paid in cryptocurrency, or asks for an upfront 'unlock', 'tax', 'clearance' or 'gas' payment.
- It asks for private keys, seed phrases, exchange passwords or remote access to your device.
- It names an individual behind a wallet address purely from onchain data.
- It has no registered company you can find on the Companies House register, or a company registered days ago.
Checks worth running before you pay
- Search the company name and number on the Companies House register and confirm the address matches the one on the website.
- Check the FCA register and Warning List if anything is presented as a regulated or investment service.
- Ask for a written scope and a fixed price before work begins, and read what the deliverable actually is.
- Ask what happens if the trace ends at a dead end — a firm that has no answer has not run many real cases.
- Verify contact details from the firm's own website rather than from the message that reached you.
What an honest answer sounds like
A realistic firm will tell you when a case is not worth pursuing. Traces end for ordinary reasons: funds reach a mixing service, cross a bridge into a network with poor data, sit in a dormant wallet, or arrive at a service outside any cooperative jurisdiction. A first review should say plainly which of those applies, before money changes hands.
If a firm's answer to every case is the same confident yes, that is a sales script rather than an assessment.
How Wallsec works
Wallsec is WALLSEC LIMITED, a company registered in England and Wales (number 17393063), based in Reading, Berkshire. The first review of what you already have is free and we say honestly whether the data supports a trace. If it does, we quote a fixed scope in writing. We never request cryptocurrency, private keys or credentials, and we do not hold or move client funds at any point.
If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.
Common questions
- Should I ever pay a fee before funds are released to me?
- No. A payment required before a release, refund or withdrawal can happen is a defining feature of second-wave fraud, whatever it is called.
- Can anyone guarantee my money back?
- No. Return of funds depends on where the money ended up and on decisions made by services, courts or law enforcement. A guarantee is a claim nobody in this field is able to honour.
- Is it worth doing anything at all if recovery is uncertain?
- Often yes. A documented trace supports a police report, an insurance or bank claim and any civil action, and it establishes what happened. It is also the only way to find out whether a realistic route exists.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the onchain data supports a traceable case.
Key terms in this guide
Plain-English definitions from the Wallsec glossary.