The first assessment: a few working days
Before anything is priced, the question is whether the record supports a traceable case at all. That means checking your starting hashes resolve, following the first few hops, and seeing whether the trail heads somewhere meaningful or straight into a privacy protocol.
This takes a small number of working days and produces a plain answer: worth pursuing, not worth pursuing, or pursuable with specific limits. We do not charge for it, and a negative answer is a legitimate result.
The full trace: usually around two weeks
A full trace with a written evidence pack typically takes about two weeks from the point work is agreed. The tracing itself is often the shorter part; assembling a report that a third party can verify line by line is the longer one.
- Hop-by-hop reconstruction across every branch that carries material value.
- Clustering work to group addresses under likely common control, with the reasoning recorded.
- Endpoint classification: exchange deposit, bridge, privacy protocol or dormant address.
- Drafting, internal review and a confidence statement for each material finding.
What makes a case take longer
- Multiple networks. A route that crosses a bridge has to be re-evidenced on the far side by amount and timing correlation.
- High hop counts. Cheap networks make thousands of transfers affordable, and each branch still has to be judged.
- Incomplete records. Missing hashes or a deleted app means reconstructing the starting point before tracing can begin.
- Multiple victims or payment routes. More entry points means more graph, and often more value in the result.
The part of the clock you control
Nothing an investigator does is as time-sensitive as the first hours after a loss. Exchanges can only restrict funds still sitting in an account, and issuers can only act on balances that have not moved.
So the sequence that preserves the most options is: stop further payments, capture hashes and screenshots, notify the receiving exchange and your bank, report to Action Fraud — and then commission a trace. A trace does not become less possible later, but a freeze does.
If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.
Common questions
- How quickly can you tell me if my case is traceable?
- Usually within a few working days of receiving your transaction hashes and account records. That first assessment is free.
- How long does a full trace and report take?
- Around two weeks in a typical case, longer where funds cross networks, split across many branches, or where the starting records have to be reconstructed first.
- Is it too late if the fraud happened months ago?
- Not for tracing — the ledger is permanent and older cases trace just as well. It is usually too late for a freeze, because funds have long since moved on.
- Can a trace be done faster in an emergency?
- The urgent actions in a live case are notifying the exchange and reporting, not tracing. We will tell you which of those to do first rather than sell you speed you do not need.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the onchain data supports a traceable case.
Key terms in this guide
Plain-English definitions from the Wallsec glossary.