What a legitimate firm actually sells
A genuine onchain investigation firm sells analysis and documentation, not an outcome. The work is to reconstruct where funds moved from your first transfer, classify each endpoint, and produce a written report that police, a regulated service or a solicitor can act on.
Nobody can reverse a confirmed transfer on a public network. Where funds are returned, it is because a court order, a regulated service's internal process or a law enforcement action moved them — on the strength of evidence. A firm that describes its own service as 'recovering' funds directly is describing something the technology does not allow.
Signals that a service is not what it claims
- It contacted you first, especially in reply to a public post about your loss or through a messaging app.
- It guarantees recovery, quotes a success rate, or names a timescale before seeing any of your data.
- It asks to be paid in cryptocurrency, or asks for an upfront 'unlock', 'tax', 'clearance' or 'gas' payment.
- It asks for private keys, seed phrases, exchange passwords or remote access to your device.
- It names an individual behind a wallet address purely from onchain data.
- It has no registered company you can find on the Companies House register, or a company registered days ago.
Checks worth running before you pay
- Search the company name and number on the Companies House register and confirm the address matches the one on the website.
- Check the FCA register and Warning List if anything is presented as a regulated or investment service.
- Ask for a written scope and a fixed price before work begins, and read what the deliverable actually is.
- Ask what happens if the trace ends at a dead end — a firm that has no answer has not run many real cases.
- Verify contact details from the firm's own website rather than from the message that reached you.
What an honest answer sounds like
A realistic firm will tell you when a case is not worth pursuing. Traces end for ordinary reasons: funds reach a mixing service, cross a bridge into a network with poor data, sit in a dormant wallet, or arrive at a service outside any cooperative jurisdiction. A first review should say plainly which of those applies, before money changes hands.
If a firm's answer to every case is the same confident yes, that is a sales script rather than an assessment.
How Wallsec works
Wallsec is WALLSEC LIMITED, a company registered in England and Wales (number 17393063), based in Reading, Berkshire. The first review of what you already have is free and we say honestly whether the data supports a trace. If it does, we quote a fixed scope in writing. We never request cryptocurrency, private keys or credentials.
If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.
Common questions
- Should I ever pay a fee before funds are released to me?
- No. A payment required before a release, refund or withdrawal can happen is a defining feature of second-wave fraud, whatever it is called.
- Can anyone guarantee my money back?
- No. Return of funds depends on where the money ended up and on decisions made by services, courts or law enforcement. A guarantee is a claim nobody in this field is able to honour.
- Is it worth doing anything at all if recovery is uncertain?
- Often yes. A documented trace supports a police report, an insurance or bank claim and any civil action, and it establishes what happened. It is also the only way to find out whether a realistic route exists.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the onchain data supports a traceable case.
Key terms in this guide
Plain-English definitions from the Wallsec glossary.