When a client contacts us after a crypto scam, the first question I ask is not "how much did you lose?" — it is "what evidence do you have?" The answer determines everything that follows. A client who has screenshots, transaction hashes, and correspondence can be helped. A client who has deleted their chat history, closed the fake website, and does not know their wallet address cannot be helped — regardless of how much they lost. Evidence is the foundation of every recovery action, and the evidence you preserve in the first hours after discovering the scam is the most important evidence you will ever collect.

In this article, I provide a comprehensive checklist of the evidence you should preserve after a crypto scam. This checklist is based on years of handling recovery cases — it includes every piece of evidence that has ever made a difference in a case I have worked on. Print it, bookmark it, share it with anyone you know who has been affected by crypto fraud. The evidence you preserve today is what your lawyer, your forensic analyst, and law enforcement will need tomorrow.

Why evidence preservation is urgent

Cryptocurrency transactions are irreversible and fast. Within minutes of sending funds to a scammer, the funds can be moved through multiple wallets, across blockchains, and to an exchange. Within hours, the funds can be cashed out and converted to fiat currency. Once the funds are in fiat, they are almost impossible to trace through blockchain forensics.

But the blockchain is not the only evidence that disappears. Scammers routinely delete their online presence — fake websites are taken down, social media profiles are deleted, email addresses are abandoned, phone numbers are changed. If you do not preserve this evidence immediately, it will be gone within days. And without it, your police report, freeze requests, and court filings will lack the supporting evidence needed to be taken seriously.

The urgency cannot be overstated. The moment you realize you have been scammed, stop everything else and begin preserving evidence. Do not confront the scammer (they will delete evidence). Do not delete your correspondence. Do not close your accounts. Preserve everything, document everything, and then contact a professional.

The complete evidence checklist

1. Transaction evidence

This is the most important category of evidence. Transaction evidence allows forensic analysts to trace the funds and identify the cash-out point. For every transaction you made to the scammer, preserve:

Take screenshots of the transaction in your wallet interface AND on the blockchain explorer. Save the blockchain explorer URL. Export the transaction data as a CSV or JSON file if your wallet supports it.

2. Correspondence with the scammer

All communication with the scammer must be preserved. This evidence is critical for proving fraud (intent to deceive) and for identifying the scammer. Preserve:

The most important messages to preserve are those where: (1) the scammer asked you to send cryptocurrency, (2) the scammer provided a wallet address, (3) the scammer made promises about returns or profits, (4) the scammer explained how to use an exchange or wallet, and (5) the scammer provided any identifying information (name, location, employer, photos).

3. The scammer's digital footprint

Scammers create fake online profiles to build trust. These profiles are often deleted within days of the scam being discovered. Preserve everything you can about the scammer's online presence:

4. Financial records

Preserve all financial records related to the scam:

5. Device evidence

If you communicated with the scammer through apps on your phone or computer, the device may contain additional evidence:

6. Identifying information about the scammer

Preserve everything the scammer told you about themselves, even if you suspect it is false:

Even if the scammer's identity is entirely fabricated, the details they provided can help forensic analysts and law enforcement. Fabricated identities often contain inconsistencies that can be used to narrow down the real identity. And if the scammer made any truthful statements (a real phone number, a real address, a real employer), these can be the thread that unravels the entire scheme.

How to preserve evidence properly

Preserving evidence is not just about saving files — it is about ensuring the evidence is admissible in legal proceedings. Here are the best practices:

Case study: how evidence made the difference

In a 2024 case, a client lost $145,000 in USDT to an investment fraud scam. The client had been communicating with the scammer on Telegram for 3 months. When the client realized the scam, the first instinct was to delete the Telegram chat in anger. Fortunately, the client contacted us before doing so. We instructed the client to:

With this evidence, we were able to: (1) trace the USDT through three wallet hops to a Binance deposit address, (2) file a police report with the FBI IC3 that included the full Telegram export and blockchain evidence, (3) file a freeze request with Binance that included the police report and forensic tracing, and (4) file a Norwich Pharmacal order to compel Binance to disclose the account holder's identity. The client recovered 80% of the lost funds within 6 weeks.

The Telegram export was particularly valuable. It contained messages where the scammer provided wallet addresses, explained how to use the fake platform, and made specific promises about returns. These messages proved intent to deceive — which is the legal definition of fraud. Without the Telegram export, proving fraud would have been much harder, and the freeze request and Norwich Pharmacal order would have been weaker.

What not to do

Common mistakes that destroy evidence:

The chain of custody: keeping evidence legally admissible

If your evidence is going to be used in court (in a civil claim for conversion, a Norwich Pharmacal order application, or a criminal prosecution), it must be admissible. Admissibility depends on the chain of custody — the documented trail of who handled the evidence, when, and how. If the chain of custody is broken, the opposing party can challenge the authenticity of the evidence, and the court may exclude it.

For digital evidence (screenshots, exports, files), maintaining the chain of custody means:

In practice, most crypto fraud cases do not go to trial — they are resolved through freeze requests, settlements, or law enforcement seizures. But admissibility matters even in these cases. An exchange that receives a freeze request will take it more seriously if the evidence is well-documented and properly preserved. And if the case does go to court, properly preserved evidence can make the difference between winning and losing.

Creating your evidence timeline

One of the most valuable documents you can create after a scam is a chronological timeline. This document is not evidence itself — it is a summary that organizes the evidence into a coherent narrative. The timeline should include:

The timeline helps your lawyer, forensic analyst, and law enforcement understand the sequence of events. It also helps identify gaps in the evidence — if the timeline references a conversation that you did not preserve, you know you need to go back and find it. Write the timeline as a simple document (a numbered list with dates) and update it as you gather more evidence.

The bottom line

Evidence is the foundation of every recovery action. The evidence you preserve in the first hours after discovering a scam determines whether recovery is possible. Transaction hashes, wallet addresses, correspondence, and the scammer's digital footprint are all critical. Preserve everything, document the timeline, and do not confront the scammer or delete any evidence. Then contact a professional who can use the evidence to trace the funds, file freeze requests, and pursue legal action.

If you have been scammed and need help preserving evidence or pursuing recovery, contact us immediately. We can guide you through the evidence preservation process and begin tracing and legal action within hours.

N. Silinevics
Nils Silinevics Crypto Compliance Counsel · Former FIU Investigator · Valken Legal AG