If you believe you have lost cryptocurrency through a scam, fraud, theft, or unauthorized transfer, preserving the right evidence can make a major difference in any later investigation.
Cryptocurrency transactions may leave a public blockchain trail, but blockchain data is only one part of the picture. Messages, screenshots, exchange records, wallet addresses, websites, usernames, bank records, and other information can help investigators understand what happened and develop useful investigative leads.
This checklist explains what to preserve after a cryptocurrency scam, what information may be useful for tracing, and what sensitive information you should never provide to an investigator.
Crypto Scam Evidence Checklist
Preserve as much original information as possible. Do not worry if you do not have every item on this list.
- Cryptocurrency transaction hashes or transaction IDs (TXIDs)
- Sending wallet addresses
- Receiving wallet addresses
- Cryptocurrency type and blockchain network
- Transaction amounts
- Transaction dates and approximate times
- Exchange deposit and withdrawal records
- Wallet transaction history
- Bank, wire, card, or payment-app records
- Emails
- Text messages
- WhatsApp, Telegram, Signal, or other chat records
- Social-media messages and profiles
- Usernames and account names
- Telephone numbers
- Email addresses
- Website URLs
- Domain names
- Screenshots of websites or investment platforms
- Photographs, documents, invoices, contracts, or payment instructions provided by the suspected scammer
- Police, cybercrime, or regulatory report numbers
1. Save Cryptocurrency Transaction Hashes and Wallet Addresses
One of the most important pieces of evidence in a cryptocurrency investigation is the blockchain transaction record.
Most public blockchains assign each transaction a unique identifier, commonly called a transaction hash or TXID.
A TXID can help investigators locate the transaction on the relevant blockchain and begin analyzing where the cryptocurrency moved.
Also preserve:
- The wallet address that sent the cryptocurrency
- The wallet address that received it
- The cryptocurrency or token involved
- The blockchain network used
- The amount transferred
- The date and time of the transaction
For example, do not record only that you sent “USDT.” Note whether the transaction occurred on Ethereum, Tron, another network, or through an exchange account if known.
2. How to Find a Transaction ID
Your wallet or cryptocurrency exchange will often display a transaction hash or provide a link to a blockchain explorer.
You may also be able to locate a transaction by reviewing:
- Your wallet transaction history
- Your exchange withdrawal history
- Confirmation emails
- Blockchain explorer records
When copying transaction hashes or wallet addresses, copy the complete value rather than relying only on a screenshot.
Screenshots are useful for context, but the actual TXID or address allows investigators to independently examine the blockchain record.
3. Preserve Exchange and Wallet Records
If you used a cryptocurrency exchange or hosted wallet, save as much account information as reasonably available.
Useful records can include:
- Deposit history
- Withdrawal history
- Transaction confirmations
- Order history
- Account statements
- Emails from the exchange
- Support conversations
- Names of exchanges or wallet providers involved
- Relevant account identifiers
If possible, download records directly from the exchange rather than relying exclusively on screenshots.
Do not provide an investigator with your exchange password or two-factor authentication codes.
4. Save All Messages With the Suspected Scammer
Communications often provide important context that does not appear on the blockchain.
Preserve messages from:
- Telegram
- Signal
- SMS or text messaging
- Dating applications
- Discord
- Other social-media or messaging platforms
Whenever possible, preserve the full conversation rather than only selected messages.
Important information may include:
- Payment instructions
- Wallet addresses sent by the suspected scammer
- Investment instructions
- Promises of returns
- Withdrawal instructions
- Requests for taxes or additional fees
- Usernames
- Phone numbers
- Email addresses
- Links to websites or applications
Do not delete embarrassing, emotional, or seemingly unimportant messages. Small details can sometimes help connect blockchain activity with broader investigative information.
5. Preserve Websites, Domains, and Online Profiles
Fraudulent websites and social-media profiles may disappear quickly.
Save:
- The complete website URL
- The domain name
- Login-page URLs
- Investment-platform URLs
- Social-media profile links
- Usernames
- Profile photographs
- Advertisements
- QR codes
- Payment instructions
Take screenshots showing the page and, where practical, include the browser address bar so the URL is visible.
If a fraudulent investment platform shows an account balance, profits, withdrawal status, or demands for additional payments, preserve screenshots of those pages as well.
6. Save Bank, Wire, Card, and Other Payment Records
Many cryptocurrency scams involve more than blockchain transactions.
For example, a victim may first send money through a bank or payment provider to purchase cryptocurrency.
Preserve relevant:
- Bank statements
- Wire-transfer confirmations
- Credit or debit card records
- Payment-app transactions
- Remittance records
- Cryptocurrency purchase receipts
- Exchange funding records
These records can help document the origin of funds and establish the sequence of events.
7. Create a Timeline of What Happened
A simple chronological timeline can make a complex case much easier to understand.
Include:
- When you were first contacted
- Where the contact occurred
- Names or aliases used
- When the financial discussion began
- When each payment or cryptocurrency transfer occurred
- When withdrawal problems began
- Any additional payment demands
- When you realized the activity might be fraudulent
- When you contacted financial institutions, exchanges, or law enforcement
You do not need to prepare a legal document. A clear chronological summary is usually more useful than a long unstructured description.
8. Preserve Evidence of the Original Source of Funds
Investigators may need information showing how the cryptocurrency involved in the matter originated or how it was acquired.
This can include:
- Exchange purchase records
- Bank records showing the purchase
- Wallet history
- Prior transaction records
- Account statements
The appropriate documentation varies depending on the case.
There is generally no need to transfer additional cryptocurrency merely to prove ownership unless a specific authorized process requires it.
A legitimate blockchain tracing investigation does not require your seed phrase or private key.
Anyone who obtains a seed phrase or private key may be able to control the cryptocurrency associated with that wallet.
Do not provide an investigator with:
- Seed phrases
- Private keys
- Wallet passwords
- Exchange passwords
- Two-factor authentication codes
- Remote access to your device unless you independently understand and trust the purpose
CNC Intelligence does not require seed phrases, private keys, exchange passwords, or two-factor authentication codes to perform cryptocurrency tracing.
10. Secure Accounts That May Have Been Compromised
If the scam involved phishing, malware, credential theft, remote-access software, or account compromise, secure your accounts as soon as reasonably possible.
Depending on what happened, consider:
- Changing compromised passwords
- Enabling multi-factor authentication
- Revoking suspicious application access
- Reviewing exchange and wallet account activity
- Securing email accounts
- Removing unauthorized remote-access software
- Contacting the relevant exchange or service provider
If you believe a device may contain malware, consider obtaining qualified technical assistance before continuing to use it for sensitive financial activity.
11. Contact Relevant Exchanges and Financial Institutions
If an exchange, bank, payment provider, or other financial institution was involved, notify it promptly that the transaction may be connected with fraud.
Provide accurate transaction information and ask what fraud-reporting or account-security procedures are available.
If cryptocurrency later reaches an identifiable exchange, that service provider may possess non-public account or transaction records.
However, identifying an exchange on the blockchain does not automatically identify the customer or mean that assets have been frozen.
12. Report the Scam to Law Enforcement
Victims should consider reporting suspected fraud to the appropriate law-enforcement or cybercrime authority in their jurisdiction.
In the United States, cyber-enabled fraud can be reported to the FBI’s Internet Crime Complaint Center at IC3.gov.
Consumer fraud can also be reported to the Federal Trade Commission at ReportFraud.ftc.gov.
If you are located outside the United States, contact the appropriate national or local police, cybercrime, financial-crime, or consumer-protection authority for your jurisdiction.
Keep copies of any report numbers, correspondence, or documents you receive.
What Can Cryptocurrency Tracing Show?
Cryptocurrency tracing analyzes blockchain activity after a transaction occurs.
Depending on the blockchain, asset, and transaction path, investigators may be able to:
- Follow transaction flows
- Identify intermediary wallets
- Analyze transaction relationships
- Evaluate address-clustering indicators
- Identify known exchanges or other Virtual Asset Service Providers where possible
- Identify cross-chain movements
- Develop additional investigative leads
A simplified transaction path might look like:
Victim wallet → scam wallet → intermediary wallets → cryptocurrency exchange
A cryptocurrency wallet address does not automatically reveal the identity of the person controlling it.
What Happens if Cryptocurrency Reaches an Exchange?
An identifiable centralized exchange or custodian may become an important investigative lead because it may possess information that is not publicly visible on the blockchain.
Depending on the facts and jurisdiction, authorized parties may evaluate procedures involving:
- Preservation of records
- Law-enforcement inquiries
- Requests for account or transaction records
- Subpoenas or other legal processes
- Court proceedings
- Asset restrictions or freezing procedures where available
Those procedures are separate from blockchain tracing.
CNC Intelligence does not independently compel an exchange to disclose customer information, freeze an account, seize cryptocurrency, or return assets.
Does Preserving Evidence Guarantee Recovery?
No.
Preserving evidence can make an investigation more complete and help investigators understand what happened, but it does not guarantee that cryptocurrency can ultimately be frozen, seized, or returned.
The outcome of any case can depend on factors such as:
- Where the cryptocurrency moved
- Whether the assets remain available
- The blockchain and digital assets involved
- Whether identifiable service providers are involved
- The quality of the available evidence
- The jurisdictions involved
- The response of exchanges or financial institutions
- Available law-enforcement or legal procedures
Beware of Recovery Scams After Losing Cryptocurrency
People who have already lost cryptocurrency are frequently targeted again.
A second scammer may claim that your cryptocurrency has already been:
- Located
- Frozen
- Seized
- Recovered
- Placed in escrow
They may then demand another payment for supposed taxes, insurance, release fees, wallet activation, liquidity requirements, or other charges.
Be extremely cautious of unsolicited recovery offers and guaranteed recovery claims.
Never provide a seed phrase, private key, password, or authentication code to someone who contacts you unexpectedly.
Learn more about crypto recovery scams and how to evaluate recovery-service claims.
How CNC Intelligence Can Assist
CNC Intelligence is a private investigation and cyber intelligence firm specializing in cryptocurrency tracing, blockchain analysis, asset tracing, cyber intelligence, and investigative reporting.
Depending on the circumstances and available evidence, our work may include:
- Reviewing transaction hashes and wallet addresses
- Tracing cryptocurrency transaction flows
- Analyzing wallet activity
- Identifying known exchanges or other service providers where possible
- Conducting lawful Open Source Intelligence (OSINT) and cyber intelligence research
- Reviewing relevant websites, domains, and online information
- Developing investigative leads
- Preparing investigative reports
- Providing technical assistance concerning investigative findings
Investigative findings may assist law enforcement, attorneys, financial institutions, exchanges, corporations, or other authorized parties in evaluating appropriate investigative or legal next steps.
CNC Intelligence does not independently freeze, seize, hold, release, or return cryptocurrency or other assets and cannot guarantee recovery.
Learn more about our cryptocurrency tracing and investigation services.
Crypto Scam Evidence Checklist: Bottom Line
If you believe you have been targeted by a cryptocurrency scam, preserve the original evidence before accounts, websites, profiles, or messages disappear.
The most useful starting information often includes:
- Transaction hashes
- Wallet addresses
- Exchange records
- Messages
- Screenshots
- Websites and usernames
- Bank or payment records
- A clear timeline of events
Do not send additional cryptocurrency simply because a scammer or recovery service claims another payment is required.
If you have transaction hashes, wallet addresses, exchange records, communications, or other evidence relating to a cryptocurrency scam, CNC Intelligence can review the available information to determine whether an investigation may be appropriate.
Request a Confidential Case Evaluation
Frequently Asked Questions
What is the most important evidence after a cryptocurrency scam?
Transaction hashes, wallet addresses, exchange records, communications, website information, and payment records are often among the most useful starting points.
Should I delete messages from the scammer?
No. Preserve the original communications whenever possible. Messages may contain wallet addresses, usernames, telephone numbers, payment instructions, websites, and other investigative information.
Should I give an investigator my seed phrase?
No. A blockchain tracing investigation does not require your seed phrase or private key. Anyone who obtains that information may be able to control cryptocurrency associated with the wallet.
Can a transaction hash help trace cryptocurrency?
Yes. A transaction hash identifies a specific blockchain transaction and can provide an important starting point for analyzing how cryptocurrency moved.
Does a wallet address identify the scammer?
Not automatically. A wallet address is a blockchain identifier and does not by itself reveal the real-world identity of the person controlling it.
What if the cryptocurrency reaches an exchange?
An identifiable exchange may become an important investigative lead because it may hold non-public account or transaction records. Any disclosure, restriction, freeze, seizure, or return depends on the exchange’s procedures and appropriate authorized processes.
Does preserving evidence guarantee that the cryptocurrency will be recovered?
No. Preserving evidence and tracing cryptocurrency can support an investigation, but neither guarantees that assets remain available or can ultimately be frozen, seized, or returned.
Does CNC Intelligence recover cryptocurrency?
CNC Intelligence provides cryptocurrency tracing, cyber intelligence, and investigative reporting. CNC Intelligence does not independently freeze, seize, hold, release, or return cryptocurrency and cannot guarantee recovery.
Your name, comment, and timestamp will be public when you comment. We also store this data, which may be used for research or content creation in accordance with our Privacy Policy. By commenting, you consent to these terms.
I know that nothing is 100% on actually get the funds back. However my family and I are fare from financially set and with everything els we have lost recently I’d like to ask how long something like this might take to see some of the funds come back?! Unfortunately I’m not in a position operat my business to provide for my family at this point so it’s a vary scary stressful situation for me rn. And do you know of any assistance programs you could lead us to just to get us by it’s a better outcome comes from you helping my business and family. Honestly anything would help. I just figured I’d ask. If you need any evidence or information I’m available. Thank you so much for your time a carful consideration and I pray you guys help us out even though I can’t afford to provide anything financially upfront.
Dear Zachary,
Thank you for reaching out to CNC Intelligence Inc. with your concerns. We understand the stress and uncertainty you’re facing, and we appreciate the opportunity to assist you during this challenging time.
Firstly, we want to assure you that while the process of asset and fund recovery can be complex and varies case by case, our team of Cryptocurrency Forensic Specialists is committed to providing you with the highest level of support and expertise. The timeline for seeing some of the funds returned can vary widely depending on the specifics of the case, including the nature of the scams, the entities involved, and the jurisdictions in question. In some cases, the process can take several months to a year or more. We strive to work as efficiently as possible, but our primary focus is on thoroughness and maximizing the potential for a successful recovery.
Regarding financial assistance during this period, we understand the urgency and necessity of finding support. While CNC Intelligence focuses on cyber investigations and assisting law enforcement and law firms in asset recovery, we recommend contacting local support services and organizations dedicated to providing financial assistance to those affected by fraud and financial crimes. These may include local community organizations, government assistance programs, and non-profits that offer emergency financial support. Additionally, some law firms might provide guidance on possible avenues for immediate assistance or loans based on the potential for recovery in your case.
We noticed that you’ve already provided essential details regarding your situation, including your contact information and a brief overview of the scams you’ve encountered. To move forward effectively, we suggest scheduling a detailed consultation with our team. This will allow us to gather all necessary evidence, discuss the specifics of your case, and outline the next steps in our investigation and recovery process.
Your case has been assigned to Mitchell Steiner, who has been attempting to reach out. We understand the importance of prompt communication, especially in these trying times, and we’re committed to keeping the lines of communication open. We encourage you to respond to our outreach or schedule a consultation through https://cncintel.com/consultation/ at your earliest convenience.
Please know that CNC Intelligence is here to support you through this process. While we cannot guarantee the recovery of lost funds, we are dedicated to employing our expertise and resources toward the best possible outcome for your case.
Thank you again for reaching out to us. We look forward to speaking with you soon and assisting you to the best of our abilities.
Warm regards,
The CNC Intelligence Team