Crypto fraud leaves a digital trail, but only if you know what to look for and how to preserve it
If you suspect you have been the victim of cryptocurrency fraud, the evidence you collect in the first hours and days after discovering the problem will determine whether you can recover your funds and hold the responsible parties accountable. Crypto fraud operates across multiple platforms, wallets, exchanges, and blockchain networks. The evidence exists in different formats and locations, and much of it can disappear or become corrupted if you do not act with precision and speed.
This checklist provides a systematic approach to identifying, documenting, and preserving the evidence you will need if you pursue legal action or regulatory complaints. Whether you are dealing with a Ponzi scheme, unauthorized account access, misrepresentation by a crypto investment advisor, or outright theft, the steps outlined here will help you build a defensible record of what happened and who was responsible.
Immediate Actions: The First 24 Hours Matter
The moment you discover fraudulent activity, your priority is to stop the bleeding and create an unalterable record of the current state of your accounts and assets. Do not attempt to recover funds on your own, do not contact the suspected fraudster directly, and do not make changes to your accounts that might alter the evidence.
Take screenshots of every account screen showing your current balance, transaction history, and any suspicious activity. Include the full URL of the page, the date and time stamp visible on your device, and any error messages or unusual notifications. Screenshots should capture the entire screen, not just portions. If your device allows it, take multiple screenshots from different angles to show that the information is genuine and not digitally altered.
Photograph your device screen with a separate camera if possible. This creates a secondary record that shows the information was displayed on an actual device at a specific moment in time. Include a clock or timestamp in the photograph to establish when the image was taken.
Download and save all emails, text messages, and direct messages related to the transaction or relationship with the person or entity you suspect of fraud. Export these communications in their native format if your email or messaging platform allows it. Do not rely on screenshots alone for communications, as metadata embedded in the original files can prove when messages were sent and received.
If you have access to your account settings, download your complete transaction history in CSV or PDF format directly from the platform. This creates an official record from the source rather than relying on screenshots. Many exchanges and wallet providers allow you to export this data. Do this immediately, as fraudsters often delete or alter transaction records once they realize they have been discovered.
Blockchain and Wallet Evidence
Cryptocurrency transactions are recorded on the blockchain, which is a permanent, distributed ledger. This is one of your strongest sources of evidence because blockchain records cannot be altered retroactively. However, you must know how to access and interpret this information correctly.
Identify the blockchain network on which the fraudulent transaction occurred. Bitcoin, Ethereum, and other major cryptocurrencies operate on different blockchains. You will need to search the correct blockchain to find your transaction.
Use a blockchain explorer to locate the transaction. Popular explorers include Etherscan for Ethereum, Blockchain.com for Bitcoin, and network-specific explorers for other cryptocurrencies. Search for your wallet address or the transaction ID (also called a hash). Record the complete transaction details, including the sending address, receiving address, amount transferred, timestamp, and transaction fee.
Document the wallet addresses involved in the fraud. Blockchain transactions are pseudonymous, meaning they do not display names or personal information. However, if you can connect a wallet address to a specific person or entity through other evidence, you have established a link between the fraudster and the stolen funds. Save the wallet address, the date you first identified it, and any information showing who controls that wallet.
If the fraudster transferred your funds to an exchange or another wallet, follow the trail as far as you can. Each transfer creates another transaction record on the blockchain. Document each step of the transfer chain. This shows the path your funds took and can help identify where they were converted to fiat currency or moved to another person's control.
Preserve screenshots of the blockchain explorer pages showing your transactions. Include the URL, the transaction hash, and all transaction details. Blockchain data is permanent, but your screenshots create a timestamped record of when you discovered and documented the fraud.
Exchange and Platform Records
If the fraud occurred on a cryptocurrency exchange, trading platform, or wallet service, that platform maintains records of account activity, login history, and fund transfers. These records are critical evidence and often contain information not visible to you as a user.
Request your complete account history from the platform. Most exchanges and wallet providers have a data download or account export feature. Use this feature to obtain all available records, including login history, IP addresses used to access your account, two-factor authentication changes, withdrawal addresses added to your account, and all transactions.
Document any unauthorized changes to your account security settings. If someone changed your password, disabled two-factor authentication, or added a new withdrawal address without your permission, the platform will have a record of when these changes occurred and from which IP address. Request this information explicitly if it is not included in your standard account export.
Preserve any notifications or alerts the platform sent you regarding account activity. These emails or in-app messages create a timeline of events and show what information the platform provided to you about suspicious activity. If the platform failed to alert you to unauthorized access or changes, this can support a claim of negligence.
If you contacted the platform's support team about the fraud, save all support tickets, chat transcripts, and email responses. These records show when you reported the problem, what information you provided, and how the platform responded. If the platform was slow to act or failed to freeze the account, these records document that failure.
Communication Records and Relationship Evidence
Fraud typically involves deception. The fraudster made promises, provided false information, or misrepresented their identity or the nature of the investment. Your communications with the fraudster are evidence of this deception.
Collect all emails, text messages, social media messages, and direct messages exchanged with the person or entity you suspect of fraud. Save these in their original format, not just as screenshots. If the platform allows it, export the entire conversation thread. Include messages from before the fraud occurred, as these establish the relationship and the promises that were made.
Document any false claims made by the fraudster. If they promised a specific rate of return, guaranteed profits, or exclusive access to an investment opportunity, save the exact language they used. If they misrepresented their credentials, experience, or the legitimacy of their business, document those misrepresentations.
Preserve any marketing materials, websites, or promotional content the fraudster used to solicit your investment. Take screenshots of websites, save PDF copies of promotional materials, and document any social media profiles or accounts used in the fraud. Include the URL, the date you accessed it, and any information showing the fraudster's identity or connection to the account.
If the fraudster used a third party to facilitate the fraud, such as a money transmitter or a business associate, document that relationship. Save communications showing how the third party was involved and whether they knew or should have known about the fraud.
Financial Records and Transaction Documentation
Your own financial records establish how much money you sent to the fraudster and when you sent it. These records support your damages claim and show the extent of your loss.
Gather bank statements showing transfers you made to the fraudster or to an exchange or wallet used in the fraud. Highlight the specific transactions and note the date, amount, and recipient. If you made multiple transfers, create a summary showing the total amount transferred and the dates of each transfer.
If you used a wire transfer, ACH transfer, or other payment method, obtain the confirmation receipt showing the transaction details. These receipts include the amount sent, the recipient's account information, and the date and time of the transfer. They are official records from your financial institution and carry significant weight as evidence.
Document any fees you paid in connection with the fraud. If you paid transaction fees, exchange fees, or other charges related to the fraudulent transaction, these are part of your total loss. Save receipts or statements showing these fees.
If you borrowed money to invest with the fraudster, document the loan. Save loan agreements, promissory notes, and statements showing the outstanding balance. This establishes that your loss extends beyond your own funds and may increase your damages claim.
Device and Network Information
Technical evidence can help establish when and how the fraud occurred and whether your account was accessed without authorization. This information is often stored on your device or by your internet service provider.
Document your device information, including the operating system, browser type and version, and any security software installed. If your account was compromised, this information can help determine whether your device was vulnerable to malware or hacking.
If you suspect your account was accessed without your permission, check your device for malware or unauthorized software. Run a full antivirus scan and save the results. If malware is detected, this supports a claim that your account was hacked rather than compromised through your own negligence.
Request your IP address history from your internet service provider. This shows which IP addresses were used to access your account and when. If your account was accessed from an IP address you do not recognize, this indicates unauthorized access. Compare the IP addresses used to access your account with the IP addresses you typically use. If there are significant differences, document them.
If you use a VPN or proxy service, document this. If your account was accessed from an IP address associated with a VPN or proxy, the fraudster may have used these tools to hide their location. Save any VPN or proxy logs showing your own usage patterns.
Third-Party Verification and Expert Analysis
Some evidence requires analysis by someone with focused knowledge of cryptocurrency, blockchain technology, or digital forensics. Engaging a focused professional early in the process can strengthen your evidence and identify details you might otherwise miss.
Consider hiring a blockchain analyst to trace the movement of your funds across the blockchain. These professionals can follow the transaction chain, identify where your funds were converted to fiat currency, and potentially identify the person or entity that received them. Their analysis creates a professional report that carries significant weight in legal proceedings.
If you suspect your device was compromised, a digital forensics professional can examine your device for malware, unauthorized access, or evidence of hacking. They can create a forensic image of your device that preserves all data and can be used as evidence in court.
If the fraud involved a cryptocurrency exchange or platform, a focused professional can review the platform's security practices and determine whether the platform failed to implement reasonable security measures. This can support a claim of negligence against the platform.
Regulatory Complaints and Official Reports
Filing complaints with regulatory agencies creates an official record of the fraud and can trigger investigations that uncover additional evidence. These complaints also establish the date you reported the fraud, which can be important for statute of limitations purposes.
File a complaint with the Securities and Exchange Commission (SEC) if the fraud involved securities or investment advice. File a complaint with the Commodity Futures Trading Commission (CFTC) if the fraud involved commodity futures or options. File a complaint with the Financial Crimes Enforcement Network (FinCEN) if the fraud involved money laundering or suspicious financial activity.
File a complaint with your state's attorney general office. Many state attorneys general have divisions focused on consumer protection and fraud. They can investigate the fraud and potentially pursue criminal charges against the fraudster.
File a report with the FBI's Internet Crime Complaint Center (IC3). The IC3 maintains a database of internet fraud complaints and shares information with law enforcement agencies. Filing a report creates an official record and may trigger an investigation.
File a police report with your local law enforcement agency. This creates an official record of the crime and may trigger a criminal investigation. Provide law enforcement with copies of all evidence you have collected.
Save copies of all complaints and reports you file, including confirmation numbers and dates. These documents show that you reported the fraud promptly and cooperated with authorities.
Organization and Storage of Evidence
As you collect evidence, organize it in a way that makes it easy to locate and reference. Create a folder structure on your computer or cloud storage service that separates evidence by category, such as communications, blockchain records, exchange records, and financial documents.
Create a master spreadsheet or document that lists all evidence you have collected, including the date you obtained it, the source, and a brief description of its contents. This index makes it easy to locate specific evidence and ensures you do not overlook anything.
Store evidence in multiple locations. Keep copies on your personal computer, on a cloud storage service, and on an external hard drive. This ensures that if one copy is lost or corrupted, you still have backups.
Do not alter or modify any evidence. Store files in their original format and do not edit screenshots or documents. If you need to highlight or annotate evidence for clarity, create a separate annotated copy and keep the original unchanged.
Consider using a service that creates a timestamped, immutable record of your evidence. Some services allow you to upload files and receive a certificate showing the date and time the file was received. This creates a professional record that can be used in court to prove when you obtained the evidence.
Next Steps
Cryptocurrency fraud is complex, and the evidence you collect must be organized, preserved, and presented in a way that holds up under legal scrutiny. The checklist above provides a framework for gathering evidence, but your specific situation may require additional steps or focused analysis.
If you have been the victim of crypto fraud, contact the Puerto Rico Business Law Firm for a free initial evaluation. Christian M. Frank Fas, Esq. has over 20 years of experience in commercial and business law and can review your evidence, assess your legal options, and help you pursue recovery. During your free initial evaluation, you will discuss the details of your case, the evidence you have collected, and the steps you should take next.
You can also learn more about how blockchain technology and cryptocurrency are regulated by reviewing our blockchain compliance resources. If your case involves commercial disputes or litigation, our commercial litigation services can help you pursue your claim in court.
Start your free initial evaluation today by visiting lawyerinpr.com/start.