Wallet investigation after theft or hack

Has your wallet been emptied after a hack or theft? Paucitas carries out a wallet investigation after theft or a hack, following the outgoing transactions to reconstruct where the funds went and recording the findings verifiably.

What happens during a wallet hack?

In a wallet hack, an attacker who gains access to a private key or seed phrase can move funds out of the wallet. Those outgoing transactions are permanently recorded on the blockchain, which means the path the funds took remains visible even after the wallet is empty.

How Paucitas investigates a wallet

We identify the unauthorised outgoing transactions and follow them using blockchain analysis, reconstructing the chain of addresses the funds passed through. We record where they flow towards, including any cash-out points that connect to identifiable services, and we document each transaction hash so the trail is verifiable.

What you receive

You receive a factual account of how the wallet was emptied and where the funds went, as far as it can be established on-chain. The report is written to be verifiable and usable for a police report or further steps. More about the setup and limits can be found under the wallet investigation after theft or hack service.

Our approach step by step

We start with an intake to establish what happened and which data is available, such as the wallet address and the time of the incident. We then reconstruct the outgoing flow, map the destinations, and record the findings in a verifiable report. Preserve all data and avoid taking action yourself.

Frequently asked questions about wallet investigation after theft or hack

Can you tell who emptied my wallet?

We follow where the funds went and record any points where they connect to identifiable services. Naming an individual is usually a matter for the authorities, but our report gives them a verifiable starting point.

Should I create a new wallet first?

Securing your remaining assets is sensible, but preserve all data about the incident first and avoid taking action that could complicate the trail. We can advise on what to keep before you move anything.

How quickly do I need to act after a wallet theft?

As soon as possible, but there is no point at which it becomes too late. Blockchain transactions stay in place, so an older theft can still be examined. What does disappear over time is the material around the event: messages, screenshots and data held by platforms. Preserve those first.

What if the trail ends at an exchange?

That is the point where an authorised body can take over. We record the address, the moment and the amount and describe where the on-chain route stops. Customer data held by a platform can only be requested through the police or a court, not by us.