Investigation process

How we trace on-chain activity, verify identities and prepare next steps

Wallsec runs every case through the same forensic method. This page sets out exactly what happens to your evidence, what we can establish from the chain, and what you receive at the end of the investigation.

The three pillars of our investigation work

Tracing on-chain activity
We reconstruct the full path of your funds across wallets, bridges, mixers and exchange deposits.
  • Every transaction hash you provide is verified directly against the chain, not screenshots.
  • Multi-hop graphing follows funds through peel chains, consolidation wallets and cross-chain bridges.
  • Clustering heuristics group addresses that are controlled by the same operator.
  • We flag any balance that is still sitting in a reachable, non-cashed-out destination.
Verifying identities
Wallets are only useful once they can be attributed to a real service, custodian or operator.
  • Destination addresses are matched to known exchange, custodian and payment-processor clusters.
  • OSINT review of domains, payment pages, social profiles and messaging handles used in your case.
  • Cross-referencing against documented scam infrastructure and previously investigated clusters.
  • Clear separation in the report between confirmed attribution and reasoned inference.
Preparing next steps
Findings are packaged so the people with authority to act can act on them without translation.
  • A written forensic report with annotated flow diagrams and an exhibit pack.
  • Formal notices and freeze requests submitted to the receiving exchanges.
  • A prioritised action list for your lawyer, bank, insurer or the relevant police unit.
  • Ongoing written status updates while requests and referrals are pending.

Forensic audit process

Every step, explained before you commit

Select a stage to see exactly what our investigators do, what you receive, and how long it usually takes.

Confidential intake

We capture what happened and protect your identity from the first message.

  • Hour 0–2: secure, encrypted case questionnaire and document upload link issued.
  • Hour 2–8: timeline reconstruction of every payment, wallet address and point of contact.
  • Same day: immediate identity-protection steps for accounts, approvals and devices still at risk.

What you receive

A written case summary and an urgent actions list you can act on the same day.

Typical timeframe: Within 24 hours

How we work

Evidence over promises

We give an honest early assessment. If chain data cannot support a case, we tell you before you commit.

Your identity is protected

Case data is handled confidentially, and we advise immediately on accounts still exposed to the fraudster.

No outcome guarantees

We are investigators, not a recovery guarantee. Any asset outcome runs through verified legal channels.