Onchain forensics & fund tracing
Wallsec is an onchain forensics company. When funds are lost to fraudsters we investigate what happened, trace the money across the chain, and protect your identity while we do it.
Confidential intake. Every case begins with an evidence review. Read our onchain investigation guides.
UK-based practice
Our office is in Reading, Berkshire, and we work to UK reporting routes.
BTC, ETH and SOL
Tracing coverage across the major networks and their leading tokens.
Source-referenced findings
Each conclusion is tied to the transactions that support it.
One business day reply
Case reviews are read and answered by an investigator, not a bot.
A focused forensic practice built to bring clarity, evidence, and direction after cryptocurrency fraud.
Where the evidence supports it, we help you pursue the return of funds through the proper channels — preparing reports and requests for exchanges, banks, regulators and law enforcement, and working alongside your solicitor. No result can be promised: those decisions belong to other bodies.
Verify Wallsec
People affected by fraud are often targeted again. Confirm our company identity, official domain and written scope independently before sharing case documents.
Forensic audit process
Select a stage to see exactly what our investigators do, what you receive, and how long it usually takes.
We capture what happened and protect your identity from the first message.
What you receive
A written case summary and an urgent actions list you can act on the same day.
Typical timeframe: Within 24 hours
Who handles your case
Cases are worked by named staff internally and reviewed before release. We describe the roles rather than publish individual profiles, because our analysts are contacted by the people they investigate.
Reads your first message, checks what records exist, and tells you plainly whether the onchain data supports a traceable case before anything is quoted.
Builds the transfer graph hop by hop from the transaction hashes in your own records, and classifies where each branch of value comes to rest.
A second analyst checks every hash, amount and attribution in the draft against the public ledger before the pack is released to you.
Applies access controls and retention rules to your documents, so case material is only visible to the people working on your file.
Tell us what happened. The first review is confidential and carries no obligation.
The only ways Wallsec contacts you. We never ask for a private key, seed phrase or login, and never press for a decision under time pressure.
Registered office
4th Floor, No. 1 Forbury Place, 43 Forbury Road
Reading, Berkshire RG1 3JH, United Kingdom
Illustrative case scenarios
These are composite examples built from common fraud patterns, not records of specific clients or past results. They illustrate our workflow only and are not a prediction of the outcome of any individual case.
The scenarios below are illustrative composites, not client records or guaranteed results. We never publish client identities, wallet addresses or case documents, and every case differs on its facts.
Swipe to see more scenarios
What you receive
An investigation is only useful if someone else can act on it. Every case closes with the same four-part document set, written so a bank fraud team, a solicitor or a reporting body can verify each finding independently.
A plain-English account of what happened, in order, with each statement tied to a transaction reference so a third party can check it.
A visual map of the route funds took — each hop, split and merge — with terminal points labelled as service deposit, bridge, privacy protocol or dormant.
Every hop listed with network, timestamp, amount, sending and receiving address, and transaction hash, so nothing rests on our word alone.
What the data supports, what it does not, the confidence attached to each link, and who the pack can usefully be sent to next.
Sample transaction annexe (redacted)
An illustrative extract in the format we use. Addresses are shortened and figures are illustrative — no real client case is reproduced here.
| Hop | From | To | Amount | Classification |
|---|---|---|---|---|
| 1 | your wallet | TQ8x…4c1f | 18,400 USDT | Counterparty deposit address |
| 2 | TQ8x…4c1f | TKm2…9ab7 | 18,400 USDT | Forwarded 41s after receipt |
| 3 | TKm2…9ab7 | TRy6…02de | 11,900 USDT | Split — 64.7% of loss |
| 3 | TKm2…9ab7 | TWf4…7b30 | 6,500 USDT | Split — 35.3% of loss |
| 4 | TRy6…02de | Service deposit | 11,900 USDT | Terminal — centralised service |