Why a transfer cannot simply be reversed
Once a transaction is confirmed, it is part of the permanent record of the network. There is no operator, chargeback scheme or support desk with the authority to undo it. Any service claiming to reverse a transfer is misdescribing what it does.
What is possible is following the money. Every subsequent movement is public, which means the path from your address onwards can be reconstructed in detail.
Where returned funds actually come from
- A regulated exchange or service holding the funds freezes an account after a law enforcement request or court order, and releases value to the rightful owner.
- A police or agency investigation seizes assets and a court directs their return.
- A civil claim, sometimes with a freezing injunction, is brought against an identified party or against persons unknown attached to a specific address.
- A payment provider or bank reverses a fiat leg of the transaction, where one exists.
What makes a case realistic
- Funds reached a deposit address at a known, regulated service rather than a self-hosted wallet.
- The loss is recent enough that value has not been fully dispersed or cashed out.
- The amount justifies the legal steps involved.
- There is a live police report with a crime reference number to attach evidence to.
- The transfers are on networks with complete public data rather than privacy-focused ones.
What makes it unlikely
Traces end at mixing services, at bridges into networks with thin data, at dormant self-hosted wallets, or at services in jurisdictions that do not respond to requests. In those cases a report still records what happened and supports your police report, but there is no realistic route to a return, and you should be told so before you spend anything.
The order to work in
- Stop any further payments and preserve transaction IDs, addresses, chat logs and screenshots.
- Report to Action Fraud, or Police Scotland on 101 in Scotland, and keep the crime reference number.
- Notify any exchange involved with the addresses and hashes, in writing.
- Have the movement of funds traced and documented so the report can be acted on.
If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.
Common questions
- How long do I have before it is too late?
- Onchain data is permanent, so tracing is possible long afterwards. Practical chances fall quickly, though, because funds are dispersed and cashed out within days. Report and preserve records immediately.
- Do you hold or return funds yourselves?
- No. Wallsec never holds or moves client funds. Any return happens through the exchange, court or law enforcement process that acts on the evidence.
- Is a police report really necessary?
- In practice yes. Exchanges and courts act on official process, and evidence is far more useful when it attaches to an open report with a crime reference number.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the onchain data supports a traceable case.
Key terms in this guide
Plain-English definitions from the Wallsec glossary.