Crypto Evidence Checklist for Stolen Funds

When cryptocurrency is stolen, the first hours often determine whether the case can be traced clearly or becomes a collection of incomplete screenshots and fading memories. A crypto evidence checklist creates order at the point of maximum stress. Its purpose is not to prove every aspect of a fraud immediately. It is to preserve the facts, records, and technical identifiers that a forensic investigator, exchange compliance team, law enforcement agency, or legal counsel may need later.

Blockchain transfers are visible, but a transaction alone rarely tells the full story. The recovery path may depend on linking on-chain activity to exchange accounts, fraudulent communications, payment records, and a documented timeline. Preserve those materials before accounts are closed, messages disappear, websites change, or platforms delete access logs.

Start With Safety, Then Preserve the Scene

If you believe a wallet is actively compromised, protecting any remaining assets may be necessary. Disconnect affected devices from the internet where appropriate, revoke suspicious wallet permissions, change passwords from a known-clean device, and contact the relevant exchange through its official support channel. Record each protective action, including the date, time, account, and reason for it.

There is a real trade-off here. Moving remaining assets can reduce further loss, but it may also complicate the transaction history. Do not improvise by sending funds to a supposed recovery wallet or by paying a person who claims they can freeze the theft. A legitimate forensic provider does not need your seed phrase or private keys, and no genuine recovery process requires a release fee to “activate” stolen funds.

Before deleting an app, resetting a phone, or reinstalling a browser extension, capture the available records. Those devices may contain session information, wallet connection history, malicious URLs, emails, or screenshots that help explain how the compromise occurred.

Create a Written Incident Timeline

Start a simple chronological log while the details are fresh. State when you first noticed the loss, what you were doing immediately before it occurred, which wallet or exchange was involved, and when you contacted any platform or authority. Use the time zone and note whether timestamps are shown in local time or UTC.

Include facts rather than assumptions. “At 10:14 a.m. Eastern Time, I approved a transaction in my wallet extension after connecting to a website” is more useful than “the scammers hacked my wallet.” The first statement can be tested against blockchain data, browser records, and wallet activity. The second may be true, but it does not establish the mechanism.

Crypto Evidence Checklist: Records to Collect

The strongest case files combine original source material with a clear explanation of how each item relates to the loss. Keep originals unchanged wherever possible. If you annotate a screenshot or highlight a transaction, retain the unedited version as well.

• Wallet and blockchain identifiers: Record every relevant wallet address, blockchain network, transaction hash, token name, token contract address, amount, date, and time. Capture both outgoing theft transactions and earlier incoming transactions that show how the wallet was funded. If several networks are involved, identify each one separately. An address that looks similar on one network may not establish activity on another.

• Wallet access and device information: Preserve the wallet provider name, browser extension or app version, connected sites, approval history, and any suspicious pop-ups or permission prompts. Take screenshots of transaction details and account settings. Record the device type, operating system, browser, and whether the device was shared or remotely accessed. Do not include your seed phrase, private key, or recovery phrase in materials sent to an investigator, lawyer, or support team.

• Exchange account records: Download deposit, withdrawal, trading, conversion, and account-statement history in the platform’s available format. Retain account emails, user IDs, verification notices, withdrawal confirmation messages, support ticket numbers, and the exchange’s responses. If stolen assets reached an exchange, the deposit address, transaction hash, and time of arrival can be critical for a preservation request or compliance review.

• Communications with the suspected fraudster: Save complete chat exports when available, not only selected screenshots. Preserve email messages with full headers, text messages, social media profiles, call logs, usernames, phone numbers, website addresses, and payment instructions. Capture the account or profile URL in a screenshot if the platform allows it. Fraudsters frequently delete profiles, edit messages, or move victims to another platform once challenged.

• Website and investment materials: Keep copies of promotional pages, account dashboards, terms displayed by the platform, fake profit statements, withdrawal error messages, and any instructions to pay tax, verification, gas, insurance, or release charges. Record the web address exactly as shown. A screen recording may be useful when a website contains changing balances, countdowns, or interactive account pages.

• Banking and payment evidence: Preserve bank statements, card receipts, wire confirmations, peer-to-peer payment records, and invoices connected to the crypto purchase or scam payment. Where fiat was sent to a crypto exchange before the theft, the funding trail helps establish source of funds and the broader event timeline.

• Identity and entity details: Record names used by the counterparty, company names, claimed regulator details, physical addresses, recruiter identities, and any photographs or documents they supplied. Treat these as allegations or claimed identities until verified. Scammers often misuse real company names, copied registration numbers, and images belonging to unrelated people.

• Platform reports and official references: Save confirmation pages for reports made to exchanges, banks, police, consumer-protection bodies, or cybercrime units. Record reference numbers, submission dates, and the precise information submitted. Consistency matters. If new information emerges, document it as an update rather than replacing the original account.

Preserve Files in a Defensible Way

Evidence loses value when its origin is unclear. Create a dedicated folder for the matter and use plain, consistent file names, such as `2026-10-20_exchange-withdrawal-confirmation.pdf` or `2026-10-20_telegram-chat-export.html`. Avoid renaming original files repeatedly or editing them in place.

Maintain a short evidence register. For each item, note the file name, source, date obtained, relevant date of the event, and a one-sentence description. If a professional investigation or litigation is likely, this register helps establish continuity: what was collected, from where, by whom, and when.

Store at least two copies in controlled locations. A secure encrypted drive plus a protected cloud account is often practical for an individual victim. Access should be limited to people directly involved in the case. Do not post transaction details, wallet balances, identity documents, or chat records publicly in an attempt to find help. Public posts can expose you to impersonators and give fraudsters time to alter their approach.

Screenshots Help, but Originals Matter More

Screenshots are useful for showing what you saw at a particular time, especially where a platform may later change its display. They are not a substitute for exports, statements, transaction hashes, email source data, or account logs. Capture the full screen where possible, including the visible date, URL, account identifier, and relevant browser or app context.

Do not crop out details simply because they seem unimportant. A timestamp, URL fragment, transaction status, or wallet label can later become a key link in the analysis. If sensitive information must be redacted for a third party, create a separate redacted copy and retain the original securely.

What Not to Do After a Crypto Theft

Do not send additional funds to “verify” your wallet, pay an alleged blockchain miner, or authorize a stranger to remote-control your device. These are common secondary fraud tactics. A transaction cannot be reversed merely because someone claims access to a recovery dashboard or a special tracing tool.

Avoid confronting the suspected fraudster with detailed evidence. This can cause them to move assets, close accounts, delete communications, or pressure you into further payments. Keep communications factual if contact is unavoidable, and preserve every response.

Finally, do not fabricate, alter, or reconstruct missing evidence. Explain what is unavailable and why. A transparent gap is less damaging than a record that appears manipulated. Forensic work can identify patterns and follow funds across many services, but it depends on accurate inputs and a disciplined chain of documentation.

A well-preserved case file gives investigators and counsel something concrete to act on. Start with the records you control, protect your remaining assets without sharing credentials, and keep every next step tied to dates, identifiers, and original evidence.