What Evidence Should You Preserve After a Crypto Scam?

Why early preservation matters

Scam operations change quickly. Websites go offline, social media accounts are deleted, chat groups are dissolved and exchange accounts are closed or drained. Evidence that is easy to collect in the first days can become difficult or impossible to obtain later. Preservation is not about building the case yourself. It is about making sure the raw material still exists when an investigator, lawyer or authority needs it.

On-chain evidence

Transaction hashes for every transfer you made or were shown, copied as text rather than retyped.
The wallet addresses you sent funds to, and your own sending addresses.
The network used for each transfer, because the same address format can exist on multiple chains.
Approximate dates and amounts, including the fiat value at the time if you know it.
Token contract addresses where relevant, especially for lesser-known tokens.

Platform and account records

The exact website addresses and app names you used, with screenshots of dashboards, balances and profiles.
Account statements, deposit and withdrawal histories, and any receipts the platform issued.
Registration emails, identity verification submissions and support tickets.
Referral links or codes, and the usernames of account managers or agents you dealt with.

Communication records

Complete chat histories from messaging apps, exported rather than screenshotted where the app allows it.
Emails with full headers where possible, not just the visible text.
Phone numbers, social media profiles and group links used by the people who contacted you.
Advertisements, videos or posts that introduced you to the scheme.

Payment and banking records

Fiat transfers often provide the strongest links to real-world identities.

Bank and card statements showing transfers to exchanges or payment processors.
Exchange account records showing purchases made before the cryptocurrency was sent onward.
Receipts from money transfer services, including reference numbers.

Devices and accounts

Secure your accounts first: change passwords on email and exchange accounts and enable two-factor authentication, because the same criminals may still have access.
Revoke token approvals you granted to suspicious sites if you know how, or ask for help doing it.
Do not wipe, reset or discard devices used during the incident. Deleted data can sometimes be recovered; wiped data often cannot.
Do not delete chats, apps or accounts, even under instruction from anyone claiming to help.

How to organize what you have

Investigators work fastest from a simple structure. A short written timeline of events in date order is more useful than a folder of unsorted screenshots. A basic table of transactions with date, amount, network, sending address, receiving address and hash covers most of what a first assessment needs. Keep original files unedited, and note where each item came from.

What not to do

Do not send more money to unlock, verify, insure or release funds.
Do not share seed phrases, private keys or passwords with anyone, including people claiming to be investigators.
Do not confront the suspected scammers before evidence is preserved. A warned operator deletes accounts.
Do not assume small details are irrelevant. A username or a reference number is often the piece that connects two cases.

This article explains general concepts and does not constitute legal or investment advice. When you are ready, our confidential case intake explains exactly what to include and what never to send.