Investigation process
How we trace on-chain activity, verify identities and prepare next steps
Wallsec runs every case through the same forensic method. This page sets out exactly what happens to your evidence, what we can establish from the chain, and what you receive at the end of the investigation.
The three pillars of our investigation work
- Every transaction hash you provide is verified directly against the chain, not screenshots.
- Multi-hop graphing follows funds through peel chains, consolidation wallets and cross-chain bridges.
- Clustering heuristics group addresses that are controlled by the same operator.
- We flag any balance that is still sitting in a reachable, non-cashed-out destination.
- Destination addresses are matched to known exchange, custodian and payment-processor clusters.
- OSINT review of domains, payment pages, social profiles and messaging handles used in your case.
- Cross-referencing against documented scam infrastructure and previously investigated clusters.
- Clear separation in the report between confirmed attribution and reasoned inference.
- A written forensic report with annotated flow diagrams and an exhibit pack.
- Formal notices and freeze requests submitted to the receiving exchanges.
- A prioritised action list for your lawyer, bank, insurer or the relevant police unit.
- Ongoing written status updates while requests and referrals are pending.
Forensic audit process
Every step, explained before you commit
Select a stage to see exactly what our investigators do, what you receive, and how long it usually takes.
Confidential intake
We capture what happened and protect your identity from the first message.
- Hour 0–2: secure, encrypted case questionnaire and document upload link issued.
- Hour 2–8: timeline reconstruction of every payment, wallet address and point of contact.
- Same day: immediate identity-protection steps for accounts, approvals and devices still at risk.
What you receive
A written case summary and an urgent actions list you can act on the same day.
Typical timeframe: Within 24 hours
How we work
Evidence over promises
We give an honest early assessment. If chain data cannot support a case, we tell you before you commit.
Your identity is protected
Case data is handled confidentially, and we advise immediately on accounts still exposed to the fraudster.
No outcome guarantees
We are investigators, not a recovery guarantee. Any asset outcome runs through verified legal channels.