How to Organize Documents and Evidence After Cryptocurrency Fraud
First steps: preserve everything and avoid changes
Start by stopping any further interactions that could alter evidence. Don't delete messages, reset devices, or move funds without explicit authorization from the account holder and, if needed, guidance from a trusted professional.
Preservation protects later review by exchanges, support teams and law enforcement. A clear chain of custody increases the usefulness of your records and reduces disputes about when and how information was collected.
- Do not disclose private keys, seed phrases or passwords to anyone.
- Avoid logging in and out of accounts or reinstalling wallet apps unless authorized and advised.
- Take initial screenshots or exports of transaction pages, messages and account summaries.
Collect core transaction data
Gather immutable blockchain details for every disputed transfer: transaction hashes (txIDs), block timestamps, sending and receiving addresses and amounts. These are primary evidence items exchanges and investigators will look for.
Use publicly available blockchain explorers to note the same txIDs and URLs as supplementary references. Record the date and time you retrieved any public record to show when the evidence was collected.
- Transaction ID (txID) or hash for each transfer
- Exact amount and cryptocurrency type (e.g., BTC, ETH, USDT)
- Sending and receiving wallet addresses for each transaction
- Block number and timestamp if available, and explorer URLs
Export and snapshot account and exchange records
Request or export account history, trade reports and withdrawal records from any exchanges, custodial wallets or payment services involved. Many platforms offer CSV or PDF exports—capture those files and note the export time.
If account access is restricted, record the account name, email, KYC status and any ticket numbers from support interactions. Keep copies of identity verification documents only when necessary and with secure handling and authorization.
- Exchange account username/email and account ID
- CSV/PDF exports of transaction history, deposit and withdrawal logs
- Support ticket numbers, timestamps and responses
- Notes on KYC/identity checks if relevant (handle securely)
Document communications and receipts
Save emails, chat logs, social messages, invoices and payment receipts. For emails, keep the original message including headers if possible; for chats, include timestamps and participant names. Screenshots are useful but preserve originals where available.
When possible, annotate communications with context: how contact was made, whether requests came from known accounts, and any links or wallet addresses provided in messages. Avoid altering originals; instead create copies and work from those.
- Full emails and headers, chat transcripts, and screenshots with timestamps
- Copy of any invoices, payment confirmations, or bank/fiat transfer receipts
- Notes describing how contact occurred and any social engineering indicators
Handle devices and forensic needs with authorization
If devices may hold evidence (phones, computers, hardware wallets), do not factory-reset or wipe them. Preserve devices in their current powered state if possible and document their condition and any visible messages or screens.
Forensic imaging and deep recovery should be performed only by qualified professionals and with the account holder's written authorization. That preserves admissibility and avoids unintentionally damaging data or violating laws.
- Document device make/model, OS, visible apps and battery state
- Avoid factory resets, OS reinstalls or app removals without authorization
- Consider a professional forensic image with written permission from the owner
Organize, secure and share evidence appropriately
Create a clear timeline that links transactions, communications and actions. Use folders labeled by date and case item, and include a simple index or spreadsheet that references filenames, timestamps and a short description.
Store copies securely: encrypted archives, password-protected files and offline backups reduce risk. When sharing with exchanges, support or law enforcement, follow their preferred formats and always confirm you have authorization from the account holder before transmitting sensitive materials.
- Chronological timeline linking txIDs, addresses and communications
- Encrypted backup of exported CSVs, screenshots and PDFs
- Record of who received each file, when and under what authorization
Perguntas frequentes
What is the most important item to collect after suspected crypto fraud?
Transaction IDs (txIDs) and corresponding wallet addresses are the most important because they show on-chain movement. Also capture timestamps, amounts and any related exchange or account records. Always obtain these with the account holder's authorization.
Should I contact the exchange first or law enforcement?
Both can be necessary. Contact the exchange or wallet provider to report suspicious activity and open a support ticket, and consider filing a report with local law enforcement. Provide organized evidence to both and follow any official guidance; ensure you have authorization to act on the account.
Can I share my screenshots and logs with a recovery service?
Only share evidence with trusted, authorized services and after verifying their credentials. Never share private keys or seed phrases. Prefer formal, written agreements and provide the minimum information necessary for assessment.
How should I store sensitive documents to keep them safe?
Use encrypted storage, strong passwords and at least one offline backup. Limit access to the account holder and authorized professionals. Keep a log of anyone who views or copies files to maintain a chain of custody.
What if I need forensic analysis of a device?
Seek a qualified digital forensics professional and obtain written authorization from the device or account owner before any imaging or analysis. Forensic work preserves evidence integrity and helps ensure findings can be used by exchanges or authorities.
Read also
Organizing clear, authorized evidence improves the ability of exchanges, support teams and authorities to assess your case
Organizing clear, authorized evidence improves the ability of exchanges, support teams and authorities to assess your case. If you need further help, consider contacting official support or a qualified specialist and always act only with the account holder's authorization.
Fale com a equipa