The first job in any crypto fraud case is to preserve evidence and locate the deposit address or exchange that touched the stolen funds, because that single link is what turns a blockchain trace into a real legal case. Document transaction IDs, screenshots, and receipts immediately, then move fast toward a legal records request. Speed and documentation, not clever tracing alone, decide whether recovery is even possible.
TL;DR:
- Export transaction histories as CSV or JSON, preserve message files and metadata, and log block timestamps, collectors, and storage details to maintain chain of custody.
- On EVM chains, inspect internal transactions and cross chain activity, but stop manual tracing once funds reach a licensed exchange and prepare legal process.
- Victims should route subpoena requests through law enforcement or prosecutors, specifying the deposit address, transaction IDs, UTC timestamps, and sought KYC and account records.
- Recovery depends on funds remaining with an identifiable exchange, custodian, or stablecoin issuer; transfers are irreversible, and no tracing service can guarantee a return.
- Treat clustering labels as leads, not proof; avoid contacting suspects or sending test transactions, which can prompt fund movement and expose investigators to legal risk.
Table of Contents
- Build the evidence collection checklist before anything else
- Read the chain before you chase it: core on-chain tracing techniques
- Turn tracing into legal process: subpoenas, seizure, and prosecutors
- Tools and OSINT workflows that keep an investigation moving
- Protect the case: operational security and attribution ethics
- When a forensic specialist changes the outcome
- What experienced investigators get wrong, and what actually works
- How a forensic specialist supports an active investigation
- FAQ
- Sources
Build the evidence collection checklist before anything else
Evidence disappears or loses credibility fast: exchanges purge logs, chat apps delete messages, and memory fades. Organize collection around what a court or compliance officer will eventually ask for.
- Collect the transaction ID (TXID), the sending and receiving wallet addresses, and the exact amount and currency transferred.
- Gather the victim’s own records: bank or wire confirmations, crypto exchange receipts, screenshots of the fraudulent platform, and any app or website URLs used.
- Preserve all communications: chat logs, emails, and social media messages, exported in their native format whenever possible rather than just screenshotted.
- Record block height and confirmed block timestamps from a reputable explorer rather than relying only on a screenshot’s system clock.
- Log chain of custody: who collected each item, when, and how it was stored, because a gap here can undercut an otherwise solid case.
Decoding Crypto Crime guidance from OSCE and UNODC lists victim statements, screenshots, messaging logs, receipts, and the wallet address as the baseline evidence set, and treats identifying the receiving VASP as the single highest priority for any realistic shot at recovery. A step-by-step action guide can help structure this intake so nothing gets missed in the rush of a first report.
- Export wallet transaction history as CSV or JSON where the platform allows it.
- Save the original file metadata (creation date, device) alongside any screenshot.
- Keep a dated, written log of every action taken on the case from day one.
Read the chain before you chase it: core on-chain tracing techniques
A blockchain explorer is the investigator’s primary instrument, and reading it correctly matters more than any specialized software. Pull up the destination address and check first-seen and last-seen dates, total received versus current balance, and whether the address shows signs of active cash-out behavior.
On EVM chains like Ethereum, check internal transactions too, since a contract interaction can route funds in ways a simple balance check misses. Clustering heuristics help group addresses likely controlled by the same actor:
- Common-input ownership: addresses that jointly spend from the same transaction are usually controlled by one party.
- Change-address patterns: the “leftover” output in a transaction often returns to the sender’s own wallet.
- CoinJoin and mixer indicators: equal-value outputs and unusual input counts suggest deliberate obfuscation.
- Bridge activity: funds crossing from one chain to another often signal an attempt to break a trace or reach a more liquid off-ramp.
None of this tracing has value on its own. The investigative goal, according to OSINT practitioner guidance, is to find the off-ramp: the deposit address at a licensed exchange, because that exchange holds the KYC records that can turn an anonymous address into a real name. Once funds land at an identifiable VASP, continuing to manually trace small residual amounts usually wastes time that should go toward preparing legal process instead. Document the deposit address, the TXIDs leading to it, and the timestamps precisely, since that package is what a subpoena will need.
Turn tracing into legal process: subpoenas, seizure, and prosecutors
Tracing tells you where the money went. Legal process is what gets you a name, a freeze, or a return. A Law Enforcement Request (LER) or subpoena to a VASP should be built methodically.
- State the deposit address, every relevant TXID, exact amounts, and transaction timestamps in UTC.
- Attach the victim’s sworn declaration describing how the loss occurred and the platform or contact used by the scammer.
- Specify what is being requested: account-holder identity, KYC documents, IP login history, and linked bank or card details.
- Route the request through the appropriate law enforcement channel or prosecutor, since most exchanges will not respond to informal victim inquiries.
The DOJ Asset Forfeiture Policy Manual documents how seizure and restraint planning works for cryptocurrency cases, including early coordination with custodians and, where applicable, the US Marshals Service for custody of seized assets. Early seizure planning shapes every later operational step, including whether funds can realistically be frozen before they move again.
Set expectations honestly. Blockchain transfers are irreversible by design, and recovery depends entirely on reaching a centralized custodian, exchange, or stablecoin issuer still holding the funds before they are withdrawn or laundered further. A cryptocurrency tracing engagement exists to compress this timeline, not to guarantee an outcome that the technology itself cannot promise.
Tools and OSINT workflows that keep an investigation moving
Most cases do not need a dozen tools. They need the right few, used in the right order.
- Public explorers (Etherscan, Blockchair, and chain-specific equivalents) for initial address lookups and transaction history.
- Commercial clustering and analytics platforms for probable ownership grouping and cross-chain movement.
- Link intelligence and OSINT tools for connecting wallet activity to social media handles, forum posts, or leaked data.
- Bank and wire reconciliation tools where fiat on-ramps or off-ramps intersect with the crypto trail.
A workable triage sequence: run a quick explorer check on the destination address, document the deposit pattern and any clustering signal, treat any vendor-supplied label (such as “exchange hot wallet” or “known scam cluster”) as a probable lead rather than confirmed fact, and move directly to preparing a subpoena packet once a licensed VASP deposit is confirmed. A detailed walkthrough of these forensic methods shows how raw transaction data becomes a report a court can actually use.
Protect the case: operational security and attribution ethics
Two mistakes derail more cases than any technical error: sending a test transaction to a suspect wallet, and contacting a suspected scammer directly. Both can alert the target to move funds immediately and can create legal exposure for the investigator. Keep all research in an isolated environment separate from any wallet you control, and log passive observations with timestamps rather than interacting with subject addresses at all.
Attribution from on-chain data is probabilistic, not definitive. A cluster label or heuristic match is a lead, not proof, and naming a suspect publicly without off-chain legal confirmation, such as a KYC return, risks both the case and the investigator’s credibility.
Pro Tip: Treat every address label as a hypothesis to test through legal process, never as a fact to repeat in a report.
When a forensic specialist changes the outcome
Complex cases involving mixers, bridges, or cross-chain laundering often exceed what a single investigator can document alone. Specialist engagements add value through deeper transaction reconstruction and reports built for admissibility.
- Tracing services that reconstruct multi-hop transfers across chains and mixing services.
- Technical reports formatted for submission to courts, prosecutors, or civil litigation counsel.
- Direct coordination with law firms handling the resulting claim or filing.
What experienced investigators get wrong, and what actually works
The biggest early mistake is spending days manually tracing dust-sized residual transactions instead of locking in the deposit address and firing off legal process the moment a VASP is identified. Off-ramps and subpoenas recover money; endless on-chain rabbit holes mostly burn time. Cross-agency coordination, ongoing training, and disciplined evidence preservation from hour one consistently separate cases that go somewhere from cases that stall.
— cristian
How a forensic specialist supports an active investigation
When a case involves mixers, bridges, or multiple exchanges, we build the transaction reconstruction and courtroom-ready report that turns a trace into something a prosecutor or civil attorney can actually file. Our forensic investigation services cover tracing, evidence preservation, and OSINT attribution for individuals and law firms working an active fraud claim. If you are documenting a loss right now, the guide on what to gather first walks through exactly what a court-ready package needs.
This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.
FAQ
How can you tell if a crypto scammer is targeting you?
Common warning signs include unsolicited investment offers promising guaranteed returns, pressure to move funds quickly, and requests to pay “fees” or “taxes” in crypto before releasing your own money. Discussing any offer with a third party before acting introduces a delay that often exposes scam indicators, according to FINRA.
Who is considered a trusted authority on crypto investigation standards?
No single person holds that title. Credible guidance comes from institutional sources such as the DOJ’s Asset Forfeiture Policy Manual, OSCE and UNODC investigator materials, and established OSINT practitioner references rather than any individual commentator.
Is there a certification for cryptocurrency investigators?
Several industry and vendor-specific certifications exist in blockchain analytics and digital forensics, though there is no single universal licensing body for the field. Investigators typically combine formal training with hands-on casework and the kind of institutional guidance referenced in official manuals and practitioner guides.
Can you get your money back after a crypto scam?
Recovery is possible in some cases but never guaranteed, since blockchain transfers are irreversible and recovery depends on reaching funds while they still sit with a centralized exchange or custodian. FINRA also warns that recovery scammers specifically target people who already lost money, often demanding upfront crypto fees, so legitimate help comes only through law enforcement, judicial process, or a vetted forensic investigation.
Should investigators work with international agencies on crypto cases?
Yes, because stolen funds frequently cross jurisdictions through multiple exchanges and chains before reaching a usable off-ramp. Cross-border cooperation and timely evidence preservation, paired with a documented chain of custody, give prosecutors the best shot at acting before funds move again.
Sources
- Decoding Crypto Crime (OSCE guidance)
- Asset Forfeiture Policy Manual 2025 (DOJ)
- follow-the-crypto (OSINT Skill reference)
