Investigation process
How we trace onchain activity, verify identities and prepare next steps
Wallsec runs every case through the same forensic method. Here is what happens to your evidence and what you receive at the end.
You receive: a written forensic report, an annotated exhibit pack, and a prioritised action list for your bank, solicitor or the relevant police unit.
The three pillars of our investigation work
- Every transaction hash you provide is verified directly against the chain, not screenshots.
- Multi-hop graphing follows funds through peel chains, consolidation wallets and bridges.
- We flag any balance still sitting in a reachable, non-cashed-out destination.
- Destination addresses are matched to known exchange, custodian and payment-processor clusters.
- OSINT review of domains, payment pages, social profiles and handles used in your case.
- Clear separation in the report between confirmed attribution and reasoned inference.
- A written forensic report with annotated flow diagrams and an exhibit pack.
- Formal notices and freeze requests submitted to the receiving exchanges.
- A prioritised action list for your lawyer, bank, insurer or the relevant police unit.
Forensic audit process
Every step, explained before you commit
Select a stage to see exactly what our investigators do, what you receive, and how long it usually takes.
Confidential intake
We capture what happened and protect your identity from the first message.
- Hour 0–2: secure, encrypted case questionnaire and document upload link issued.
- Hour 2–8: timeline reconstruction of every payment, wallet address and point of contact.
- Same day: immediate identity-protection steps for accounts, approvals and devices still at risk.
What you receive
A written case summary and an urgent actions list you can act on the same day.
Typical timeframe: Within 24 hours
- UK-based
- Reading, Berkshire
- Fixed-scope quotes
- Agreed in writing first
- Keys never requested
- Public data and your records only
- Honest early assessment — if the chain data cannot support a case, we say so first.
- Case data handled confidentially, with immediate advice on accounts still exposed.
- No outcome guarantees; any asset outcome runs through verified legal channels.
After the report: the lawful routes we support
A finished report is not the end of the case. Where the findings support it, we help you take the evidence to the bodies that have the authority to act, and we stay involved while those requests are considered. No outcome is ever promised.
Exchange and custodian notices
Where funds reached a regulated service, we submit a documented notice identifying the deposit addresses, timings and transaction hashes, so the provider can review the account under its own compliance procedures.
Bank and payment provider claims
If money left through a bank transfer or card payment, we help you assemble the evidence your bank needs for its fraud or reimbursement review, and respond in writing to its questions.
Law enforcement and regulatory referrals
We prepare the report in the format investigators expect, including an exhibit pack and reference numbers, so your case is easier for the relevant unit to pick up.
Working with your solicitor
Where you take civil action, we provide the underlying analysis, flow diagrams and source data your legal team needs, and answer follow-up questions on the findings.
Where the report goes, and what each body can do
Different institutions hold different powers. Part of our job is sending the right extract of the evidence to the right desk, rather than the same document everywhere.
- Exchange compliance teams
- Can review, restrict or freeze a receiving account internally and preserve records for later legal requests.
- Banks and payment providers
- Can reopen a fraud or reimbursement review and raise recall requests on the payment leg that funded the loss.
- Action Fraud and police units
- Can allocate the case for investigation and issue the formal requests exchanges need before releasing account data.
- Regulators and ombudsman schemes
- Can act where a regulated provider handled your complaint poorly, and can compel a fuller answer.
- Your solicitor
- Can pursue freezing or disclosure orders in the civil courts using the traced route as supporting evidence.
- You
- Keep the full report and exhibit pack. Nothing is sent to any third party without your instruction.
Any funds that are released are returned by the exchange, bank or authority directly to you. Wallsec never receives them, and we never charge a fee to release funds.