Official Wallsec emails only ever come from an @wallsec.co.uk address.

Bitcoin (BTC)

Bitcoin tracing and evidence reporting

Bitcoin publishes every transaction permanently, which is why a trace is possible at all. It also uses a transaction model unlike any other major network, and that model shapes both what a Bitcoin trace can establish and where it stops.

Is Bitcoin traceable?

Yes. Every Bitcoin transaction is published permanently, so a payment can be followed from the address you sent to, hop by hop, until the funds reach an exchange deposit address, a mixing service or an address that has stopped moving. What tracing cannot do is reverse a confirmed payment or name the person holding an address.

  • Public and permanent: anyone can verify each hop from the transaction ID, with no special access.
  • Traceable does not mean reversible — no party can undo a confirmed Bitcoin transaction.
  • Traceable does not mean identifiable — a name only comes from records held off the ledger and released under legal process.
  • Coinjoin and similar tools can end deterministic linkage, and an honest report says so rather than presenting association as proof.

How a Bitcoin trace is built

Following unspent outputs

Bitcoin has no account balances. Each transaction consumes earlier outputs and creates new ones, so a trace follows outputs rather than addresses. This makes value flow unusually explicit — you can see precisely which prior coins funded a payment.

Separating payment from change

Most transactions produce two outputs: the payment and the change returning to the sender. Distinguishing them correctly is the single most important judgement in a Bitcoin trace, and an error here sends the entire path in the wrong direction. We record the reasoning behind each call rather than presenting it as fact.

Common-input clustering

When several outputs are spent together in one transaction, they were normally controlled by the same party. Applied carefully this groups addresses into entities; applied carelessly, in the presence of coinjoins or payment batching, it produces confident nonsense.

Classifying the endpoint

Every branch ends somewhere: a deposit address at a regulated service, a mixing protocol, a bridge to another network, or a wallet that has simply gone quiet. Naming which one you have reached is the most useful output of the work.

What a Bitcoin trace cannot do

  • A confirmed Bitcoin transaction cannot be reversed, cancelled or frozen by us or by anyone else.
  • Addresses are not identities. Attribution requires off-chain information, normally released only under legal process.
  • Coinjoin and similar protocols can break deterministic linkage. Where that happens we say so instead of presenting statistical association as proof.
  • Exchange-internal movements are invisible: once value reaches a custodial deposit address, the ledger stops recording what happens next.

The deliverable is described in full in our guide on what an onchain evidence pack contains, and the stage-by-stage timings are on our investigation process page.

Common questions

Can stolen Bitcoin be traced?
Usually the transfers themselves can be followed, because every Bitcoin transaction is public and permanent. Whether that trace reaches a useful endpoint is a separate question, and depends on where the funds settle.
Can Bitcoin be recovered once sent?
Not by reversing the transfer — that is not possible on any public network. Funds are returned in practice only through legal or regulated processes acting on evidence of where value ended up.
How long does a Bitcoin trace take?
A first assessment is normally a few working days. A full trace and evidence report typically takes around two weeks, depending on hop count and whether the path crosses into other networks.
Wallsec does not hold, handle or return client funds, and no report can guarantee an outcome. This page is general information, not legal or financial advice.