Blockchain forensic evidence for lawyers and solicitors

Crypto Theft Evidence Checklist for Lawyers

Start with the records that make the loss traceable: wallet addresses, transaction hashes, the correct blockchain network, amounts, timestamps, account statements, communications and proof of control. Preserve the originals, record where each item came from, and define the legal purpose before commissioning analysis.

Build the evidence for your next recovery decision. Recoveris helps legal teams reconstruct stolen-asset flows, identify exchange and issuer touchpoints, and prepare forensic reports for legal action. Use this crypto theft evidence checklist for lawyers to brief the investigation, then assess what the findings can support in your client’s matter.

Discuss a client matter Open the intake checklist ↓

Independent forensic specialists working alongside counselUpdated 16 September 2026

How forensic evidence supported recovery action

Case experience

Selected Recoveris matters show the link between the transaction evidence, the parties able to act and the result achieved. A freeze preserves assets; return to the victim requires a further process. Each outcome below is labelled accordingly.

RECOVERY

USD 10.5M Swiss investment-fraud recovery

A Swiss company transferred crypto to perpetrators posing as investment providers. Recoveris traced the flows across addresses and chains, identified Tether and Bitfinex as intervention points, and coordinated the freeze.

The matter proceeded through Swiss law enforcement and prosecutors. Tether subsequently burned the frozen tokens and reminted corresponding value to an authority-designated address as part of the return process.

Relevance for counsel: the trace connected the loss to parties capable of restraining value, giving the authorities a basis for the next recovery steps.

Read the Swiss recovery case

FROZEN AND PRESERVED

Over USD 1.7M preserved after investor impersonation

A victim lost approximately USD 2.7M across two incidents involving fake investors. Recoveris followed stablecoins across chains, produced forensic reporting and worked with law enforcement and service compliance teams.

Approximately USD 1M and USD 700,000 were frozen through issuer coordination; additional balances were preserved at centralised services. The documented outcome is frozen and preserved assets.

Relevance for counsel: identifying where assets remained and documenting the path helped prioritise issuer and exchange action.

FROZEN

USD 1.6M in stablecoins frozen in a corporate fraud

After approximately USD 40M in fraudulent wire transfers entered crypto laundering channels, Recoveris traced the cross-chain movements and prepared a forensic memo for law enforcement.

The response secured approximately USD 1.6M in stablecoin freezes and a courtesy freeze of 1 BTC pending formal action.

Relevance for counsel: separating unspent balances from onward flows helped focus immediate action while the wider investigation continued.

TRACED AND REPORTED

1inch: investigating USD 2.2M routed through Tornado Cash

Recoveris analysed withdrawal behaviour and subsequent cross-chain movements to link mixer-obscured funds to identifiable cryptocurrency service providers.

The investigation delivered a structured forensic report with an evidential narrative, reopening potential recovery routes. This result is investigative intelligence, with no completed return claimed here.

Relevance for counsel: a documented attribution method can help assess whether further records or legal action are justified when a straightforward transaction trail ends.

Source: Recoveris’s published case accounts. Read the case narratives on our legal-professionals page. Cases are anonymised where appropriate. Previous results do not predict the outcome of another matter.

The working brief

What evidence does a lawyer need for a crypto theft case?

Collect a complete transaction record, proof linking the client to the originating account or wallet, the communications and access events surrounding the transfer, and a chronology of reports already made. Then define the question for the investigator: where the assets moved, which services may have been reached, what can be stated confidently, and what further records or legal steps may be needed.

The FBI asks cryptocurrency complainants to provide wallet addresses, transaction IDs or hashes, asset type, amount, date and time, and related communications. NIST guidance stresses the preservation and management of digital evidence. FBI guidance for cryptocurrency scam victims · NIST digital evidence preservation guidance

Crypto theft client intake checklist

Asset, network and token

Record the asset exactly, the blockchain used and the token contract when relevant. “USDT” alone is incomplete because the token can move across several networks.

Transaction identifiers

Collect each transaction hash, originating address, receiving address, amount, fee and timestamp. Include earlier funding transactions if they help establish control.

Account and ownership records

Preserve exchange statements, deposit and withdrawal records, wallet setup records, purchase receipts and material showing who controlled the relevant account.

Communications and representations

Keep complete email files, chat exports, usernames, telephone numbers, domains, advertisements and documents. Record what induced each transfer.

Access and compromise evidence

Note unfamiliar logins, password resets, device alerts, remote-access sessions, malicious approvals, SIM changes or API activity without altering the source records.

Reports and responses

List exchange tickets, police or regulator reports, stablecoin issuer correspondence and any response received. Keep exact dates, reference numbers and attachments.

Preserve the record before analysing it

Keep original files

Retain source emails, exported chats, statements, images and device records in their original format where possible. Work from copies and document any conversion.

Record provenance

Note who supplied each item, when it was obtained and how it was transferred or stored. A clear trail makes later review easier.

Separate fact from instruction

Mark what the records show, what the client recalls and what a third party claimed. Do not let a scammer's labels become the case theory by default.

Protect confidentiality

Use the firm's approved channels and access controls. Seed phrases, private keys and passwords should not be collected for a tracing assignment.

Admissibility is jurisdiction-specific

A blockchain record can be public without automatically satisfying every evidential requirement. Counsel should set the relevant rules for authenticity, expert evidence, disclosure, privilege and chain of custody. The forensic work should be scoped around that legal framework.

Discuss a client matter

Brief the investigation around the decision you need to make

An effective brief explains the intended legal use, the available evidence and the deadline. It lets the forensic team focus on the findings that could change your next step.

LEGAL OBJECTIVE

Define the question and forum

Identify counsel, the relevant jurisdictions and whether you need evidence for a criminal complaint, civil fraud claim, potential freezing application or exchange engagement. State any filing deadline and what has already been reported.

RECOVERY FEASIBILITY

Test the practical route

Provide the approximate loss, incident date, known transactions and any existing trace. The assessment should consider identifiable services, observable balances, evidence gaps and whether further investigative spend is proportionate to the potential recovery.

SCOPE AND FEES

Agree the work before commissioning it

Define the networks, starting transactions, reporting requirements and update needs. Recoveris provides a written scope and fee proposal before a paid investigation begins. Flag urgency at the outset so timing can be discussed against the actual work required.

INSTRUCTIONS AND HANDOVER

Keep counsel in control of legal strategy

Agree who instructs the investigation, who receives the report and how sensitive material will be transferred. Counsel determines legal strategy and any privilege arrangements; Recoveris supplies forensic analysis and technical support for the agreed next steps.

What a crypto tracing report for solicitors should contain

A legal team needs to be able to follow the reasoning from the client’s transfer to each material conclusion. Recoveris prepares structured forensic reports with a chronological narrative, transaction maps, service attribution and verifiable blockchain data, tailored to the agreed instructions.

Instructions and materials: the question addressed, starting transactions, records reviewed, relevant dates and scope exclusions.
Reconstructed asset flow: the path across wallets, swaps, bridges and services, supported by transaction hashes and visual exhibits.
Methodology and attribution: the data sources, analytical method and basis for linking an address to a service, with confidence and limitations stated.
Findings for the next decision: observable balances at the time of analysis, potential intervention points and records needed from third parties.

Blockchain forensic evidence for potential freezing applications

Counsel should specify what the intended application needs to establish. We can supply technical findings about the transaction path, service touchpoints and asset position; counsel assesses the legal test and prepares the application. A report does not itself freeze assets or establish an automatic right to disclosure.

Meet the people behind the forensic work

Our team combines financial-crime investigation, blockchain analysis and experience working with legal authorities. These are members of the wider Recoveris team; the specialists assigned to a matter depend on its scope.

Umberto Buonora

Head of Investigations

Former Guardia di Finanza investigator with more than 14 years of experience, including cybercrime leadership. Led the investigative team in the Swiss USD 10.5M case.

Umberto’s professional profile

Roman Bieda

Chief Intelligence Officer

Virtual Assets Expert for OSCE and Interpol, and US court expert witness. His investigative experience includes QuadrigaCX, the DAO hack and Cryptsy.

Roman’s professional profile

Sol Cinosi

Chief Government & Corporate Affairs Officer

Attorney with more than 10 years in criminal investigations. Co-created the cryptoasset investigation task force within the Buenos Aires Public Prosecutor’s Office’s Cybercrime Department.

Sol’s professional profile

Further support for your client’s matter

Broader support for legal professionalsReview Recoveris capabilities for legal teams, including forensic analysis and recovery coordination. General digital asset recoveryUnderstand tracing, intervention points and the role of legal authority in a recovery process. Client needs immediate first actionsUse the victim-facing checklist for security, preservation and urgent reporting.

Frequently asked questions

FAQ

What should a lawyer ask a client after a crypto theft?

Ask for the asset and network, originating and receiving wallet addresses, transaction hashes, amounts, dates and times, account records, communications, domains, device or access events, and any reports already made. Keep the client's explanation separate from the underlying records and identify gaps that still need to be filled.

Are screenshots enough to evidence cryptocurrency theft?

Screenshots can preserve useful context, but they should not be the only record when original emails, chat exports, exchange statements, transaction data or device records are available. Preserve source files and metadata where possible, and follow the evidential and disclosure rules that apply in the relevant jurisdiction.

What should I send when requesting a crypto tracing report?

Start with the incident date, approximate loss, asset and network, transaction hashes, relevant wallet addresses and a short chronology. Explain the intended legal use, jurisdictions and deadline, and identify any existing reports. Agree an appropriate channel for sensitive records. Recoveris does not need seed phrases, private keys or account passwords.

Will a blockchain forensic report be admissible in court?

Admissibility depends on the jurisdiction, procedural rules and purpose of the evidence. A report should explain its sources, methodology, findings and limitations so the analysis can be scrutinised. Counsel should specify the relevant requirements before commissioning the work and assess whether further expert evidence is needed.

Can a blockchain investigation identify the exchange holding stolen crypto?

It may identify an address associated with a known exchange or other service, but attribution must be supported and expressed with an appropriate confidence level. The service controls its customer records, and disclosure, restraint or freezing decisions depend on its procedures and the relevant legal authority.

When should a lawyer involve a cryptocurrency investigator?

Consider early forensic input when the transaction path is unclear, assets cross networks or services, a time-sensitive intervention point may exist, or the case requires a reproducible flow of funds. The lawyer remains responsible for legal strategy and should define the jurisdiction, purpose and evidential standard for the work.

For legal professionals

Turn your client’s evidence into an investigative brief

Contact our team with your firm, the jurisdictions involved, approximate loss, incident date and any deadline. Indicate whether transaction hashes or an existing report are available so we can discuss scope and next steps. Agree an appropriate transfer channel before sharing sensitive files. Never send seed phrases, private keys or passwords.

Discuss a client matter

This page provides general information and is not legal advice. Evidential, disclosure and procedural requirements vary by jurisdiction. Recoveris provides blockchain forensic analysis and investigative support; legal strategy and representation remain with qualified counsel. Asset freezes, disclosures and recovery outcomes depend on third-party and legal decisions and are never guaranteed.