1. Case summary
One page, written for a non-technical reader. What was lost, when, through what mechanism, and what the trace established. If someone reads nothing else, this page has to stand on its own — most recipients will make their decision on it.
2. Timeline of events
A chronological reconstruction combining your own records with on-chain timestamps: first contact, first deposit, subsequent deposits, the point at which withdrawal was refused, and each on-chain movement. Timelines matter disproportionately because they show a pattern rather than an isolated payment, and patterns are what fraud teams act on.
3. Address inventory
- Every address involved, labelled by role — your own, the counterparty's stated deposit address, intermediates, terminals.
- Network for each address, stated explicitly, because the same string can be valid on more than one chain.
- The basis for each label, so a reviewer can see which are established from your records and which are inferred from the graph.
4. Trace narrative and diagram
The hop-by-hop path from source to terminal, in prose and as a flow diagram. Every hop carries its transaction hash so any reader can verify it on a public explorer without taking our word for anything. Where value splits, each branch is followed and its share of the original loss stated as a percentage.
5. Terminal findings
The end point of each branch and its classification. Where a branch ends at a deposit address belonging to a centralised service, we say which service the address set is associated with and on what basis. Where we cannot attribute it, we say that instead. An evidence pack that overstates attribution is worse than useless, because the first reviewer to check it will discount the whole document.
6. Verification appendix
Raw transaction hashes, block heights, timestamps in UTC, and the explorer references used. This is the part that makes the report checkable. It is also the part that distinguishes a forensic document from a marketing PDF.
7. Limitations and confidence statement
An explicit list of what could not be established, where inference was used rather than deterministic linkage, and what additional information would strengthen the case. Every genuine forensic report has this section. Its absence is a warning sign.
How the pack is meant to be used
The pack is supporting material for someone else's process. Your bank may use it to support a chargeback or fraud claim. A solicitor may use it to support an application. An exchange compliance team may use it to review a deposit address. A police force may attach it to a report reference.
Wallsec does not send the pack to any third party unless you instruct us to, and we do not hold, handle or return funds at any stage. Whether a recipient acts on the document is entirely their decision, and no report can guarantee an outcome.
Common questions
- Is an evidence pack accepted by banks and exchanges?
- There is no universal standard, and no provider can guarantee acceptance. What we can control is that the document is verifiable, states its limitations, and presents findings in the format fraud and compliance teams are used to reading.
- Who sends the pack to third parties?
- You do, unless you instruct us otherwise in writing. We do not contact your bank, exchange or any authority on your behalf without your instruction.
- Does a completed pack mean funds will be returned?
- No. The pack documents where value went. Any recovery depends on decisions made by regulated third parties and, in most cases, on legal process — none of which we control or promise.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the on-chain data supports a traceable case.