Crypto fraud investigations built on on-chain evidence
Wallsec is an onchain forensics company. When funds are lost to fraudsters we investigate what happened, trace the money across the chain, and protect your identity while we do it.
A focused forensic practice built to bring clarity, evidence, and direction after crypto fraud.
Case investigation
We reconstruct the timeline of events, trace transactions on-chain, and identify the wallets, exchanges, and services involved in the fraud.
Identity security
Your privacy is protected throughout the process. We use secure communication, encrypted document handling, and strict access controls.
Asset tracing
Using onchain analytics, we follow stolen funds across wallets, mixers, bridges, and exchanges, and attribute the endpoints where they came to rest.
Forensic reporting
Findings are compiled into a structured evidence pack prepared for your legal counsel, insurer, or the relevant authority.
Forensic audit process
Every step, explained before you commit
Select a stage to see exactly what our investigators do, what you receive, and how long it usually takes.
Confidential intake
We capture what happened and protect your identity from the first message.
Hour 0–2: secure, encrypted case questionnaire and document upload link issued.
Hour 2–8: timeline reconstruction of every payment, wallet address and point of contact.
Same day: immediate identity-protection steps for accounts, approvals and devices still at risk.
What you receive
A written case summary and an urgent actions list you can act on the same day.
Typical timeframe: Within 24 hours
How we work
Every case is different, but our process is built to move quickly, keep you informed, and protect your privacy at every step.
01
Initial review
Share what happened in a confidential intake. We assess the case, identify key evidence, and explain realistic next steps.
02
Onchain analysis
Our investigators trace transactions, map relationships, and build a forensic report your legal counsel or the relevant authority can review.
03
Evidence & escalation
We help you report the fraud, secure your identity, and hand the evidence to the institutions best positioned to act on it.
Illustrative case scenarios
How a typical investigation unfolds
These are composite examples built from common fraud patterns, not records of specific clients or past results. They illustrate our workflow only and are not a prediction of the outcome of any individual case.
The scenarios below are illustrative composites, not client records or guaranteed results. We never publish client identities, wallet addresses or case documents, and every case differs on its facts.
Illustrative scenario · Fake investment platform
Tracing layered transfers to exchange deposit addresses
A retired investor is moved off a social-media 'advisor' chat onto a cloned trading dashboard and makes a series of BTC payments over several weeks.
Workflow
1Intake and identity-exposure review within 24 hours of first contact.
2Chain graphing across 14 hops, including a peel chain and one cross-chain bridge.
3Attribution of two destination clusters to deposit addresses at regulated exchanges.
4Forensic report and draft notices prepared with a supporting exhibit pack.
This workflow aims to identify where value came to rest and hand a solicitor a file with named counterparties, ready to be sent onward on the client's instruction. Whether funds remain recoverable depends entirely on the facts of each case.
First findings
Agreed at intake
Indicative report
Day 8
Illustrative scenario · Wallet-drainer approval
Identifying malicious approvals and stopping further exposure
A holder signs a token approval on a spoofed airdrop site, and a sweeper contract begins draining the self-custody wallet within minutes.
Workflow
1Emergency approval audit and revocation guidance issued on day one.
2Smart-contract review of the drainer to identify the sweeper wallet pattern.
3Attribution linking the sweeper to a documented drainer-as-a-service cluster.
4Evidence pack prepared so the client can refer it to a cybercrime reporting body.
This workflow aims to close off remaining approvals before a second sweep and document the drainer infrastructure clearly enough for the client's chosen reporting route.
Approval audit
Day 1
Indicative report
Day 7
Illustrative scenario · Romance-investment fraud
Connecting separate reports to one consolidation wallet
Payments are made in USDT to addresses supplied over a messaging app, with the sender told that withdrawals require further 'tax' deposits.
Workflow
1Timeline reconstruction of every payment, contact handle and payment page used.
2Clustering revealed a shared consolidation wallet across multiple unrelated complaints.
3OSINT review tied the payment pages to one hosting and domain footprint.
4Consolidated referral prepared so all affected parties could act together.
This workflow aims to stop further payments immediately and present joined-up evidence that carries more weight when the affected parties take it to a venue or reporting body.
Pattern
Shared wallet
Indicative report
Day 9
Why Wallsec
A forensic practice built to bring clarity, evidence and direction after crypto fraud.
Confidential intake
Every case begins with a private review. Your details, documents, and wallet addresses are handled under strict confidentiality.
Multi-chain tracing
We trace activity across Bitcoin, Ethereum, Solana and major tokens, following funds through wallets, bridges, mixers and exchange endpoints.
Structured forensic reporting
Findings are compiled into a documented report with transaction graphs, timestamps and attribution logic, written so your solicitor or insurer can review the reasoning.
We never ask for private keys
Public addresses and transaction IDs are enough for a trace. We will never ask for your seed phrase, private keys or wallet credentials.
Identity protection
We use encrypted communication, secure document handling and strict access controls to protect your identity throughout the investigation.
Clear, written scoping
Any chargeable work is quoted in writing and agreed before it begins. No percentage of returned funds, and no upfront fee to open a case.
Clear boundaries
What we don't do
Knowing the limits of a legitimate investigation firm is the simplest way to spot one that isn't.
We never hold or move your funds
Wallsec has no custody of client assets. We will never ask you to send crypto to us, and we never act as an intermediary for a transfer.
We never ask for keys or credentials
No private keys, no seed phrases, no exchange logins. Anyone asking for these in our name is not us.
We never contact third parties without your instruction
No exchange, wallet provider, law enforcement body, or platform is contacted in your name unless you have asked us to do so and we have confirmed the scope in writing.
We never pressure you into immediate decisions
Any follow-up work is quoted in writing and agreed before it begins. We do not use urgency or threats to rush you into a commitment.
We never guarantee an outcome
No firm can promise funds will come back. What we can promise is a clear picture of where value moved and a file you can act on.
We don't publish or share client details
No case documents, wallet addresses or identities are shared publicly, and nothing goes to a third party without your instruction.
Open an investigation
Tell us what happened. The first review is confidential and carries no obligation.
4th Floor, No. 1 Forbury Place 43 Forbury Road, Reading, Berkshire RG1 3JH United Kingdom
Investigation outcomes depend on the facts of each case and the cooperation of third parties. We are honest about what the evidence can and cannot show.
Case intake form
Provide a brief summary. We will respond within one business day.
