Lost Cryptocurrency Evidence Checklist: What to Collect Before an Investigation
A practical checklist of information to preserve when cryptocurrency is lost, stolen, misdirected or connected to suspected fraud.
\\ ## Start with the facts
Before beginning an investigation, collect everything you already know about the incident.
Avoid guessing or changing the original records.
Wallet information
Preserve relevant wallet addresses and identify which wallet belonged to you.
Never share seed phrases or private keys.
Transaction information
Collect transaction hashes, dates, amounts, assets and blockchain networks.
Account records
Keep exchange confirmations, account notifications, withdrawal records and support tickets.
Communication evidence
Preserve emails, messages, invoices, websites and payment instructions.
Identity and ownership evidence
Where appropriate, keep documents showing ownership of the account or assets.
Build a timeline
Record events chronologically.
A simple timeline can make a complex case much easier to investigate.
Preserve original files
Do not edit screenshots, emails or exported records.
Keep original versions where possible.
Recovery warnings
Be cautious of anyone demanding an upfront cryptocurrency payment while guaranteeing recovery.
Final thoughts
A well-organized evidence package can make blockchain investigations more efficient and easier to verify.
Zenith Hackers Intelligence supports authorized cryptocurrency investigations and digital-forensics documentation.