Stop continuing access, secure affected accounts and isolate compromised devices without destroying volatile evidence.
Operational field guide · 2026 edition
Trace. Freeze. Preserve. Seize.
A practical cryptocurrency asset investigation playbook for law enforcement, financial investigators, prosecutors, forensic teams and asset-recovery practitioners-from first transaction triage to defensible evidence and coordinated restraint.
CASE ROUTE / 01LIVE DECISION MAP
01Validate the loss rootTransaction, asset, chain, timeFACT
02Preserve the trailRaw data, provider evidence, hashesCUSTODY
03Qualify the endpointAttribution, provenance, jurisdictionREVIEW
04Coordinate lawful actionPreservation, restraint, seizureAUTHORITY
A blockchain trace is evidence of movement-not, by itself, proof of identity, criminal ownership, or legal authority to freeze assets.
01 / THE FIRST HOUR
Move quickly without outrunning the evidence.
Digital assets can move across services and borders in minutes, while exchange records, account logs and off-chain communications may be time-sensitive. Speed matters-but every urgent step should preserve what was observed, when it was observed, and who made the decision.
Confirm the blockchain, transaction identifier, token contract, destination and claimant-controlled source.
Capture raw transaction data, explorer/RPC responses, screenshots, communications and acquisition timestamps.
Identify hosted-service touchpoints and route time-sensitive requests through authorised legal and operational channels.
DO FIRST
Record transaction hashes exactly; preserve wallet addresses in machine-readable form; note the reporting party’s basis for saying an address or account is theirs; and separate reported facts from analyst observations.
02 / INTAKE & TRIAGE
Build a case seed that can survive scrutiny.
A good investigation begins with a validated root, not a screenshot or an unsupported attribution. Triage should determine whether the supplied transaction exists, what economic event occurred and which questions remain unproven.
Essential transaction data
- Full transaction ID or signature
- Blockchain and network
- Asset and token contract
- Reported amount and timestamp
- Source and destination addresses
- Exchange order or withdrawal IDs
Off-chain evidence
- Platform account identifiers
- Chats, emails and call records
- URLs, domains and usernames
- KYC or payment documentation
- Device and authentication logs
- Prior reports and case references
Questions to resolve
- Was the event a transfer, swap or approval?
- Who controlled the sending account?
- Is the claimed loss amount on-chain?
- Did a drainer or smart contract intervene?
- Are multiple loss roots involved?
- What legal authority governs access?
03 / TRACE STRATEGY
Follow value, not visual proximity.
Investigators should distinguish economic-event reconstruction from fund provenance. Nearby addresses, shared services and behavioural similarity can generate leads, but only supported continuity should be described as movement of the reported assets.
Resolve chain-specific transaction structure, decimals, assets, inputs, outputs and fees.
Identify transfer, swap, bridge, internal call, approval, mint, burn or UTXO spend.
Track value conservatively through splits, consolidation, commingling and transformations.
Prioritise material branches using amount, time, asset continuity and investigative relevance.
Attach source-attributed entity, sanctions and risk intelligence without changing the path.
State confidence, breaks, alternative explanations and the analysis cut-off.
PROVENANCE ≠ ATTRIBUTION. An address attributed to an exchange does not establish that the reported funds reached it unless the value path is independently supported.
04 / DIGITAL EVIDENCE
Make the analytical trail reproducible.
A court-ready package needs more than an image of a block explorer. Preserve the source response, normalized interpretation, acquisition context, analyst decisions and integrity information so another qualified examiner can understand what happened.
VERIFIED
HASH
HASH
Integrity is a process.
A SHA-256 hash helps demonstrate whether a file changed after acquisition. It does not prove that the source was accurate, the interpretation was correct or the acquisition was lawful. Those questions require provenance, method and testimony.
| Preserve | Minimum context | Why it matters |
|---|---|---|
| Raw chain response | Endpoint/provider, request, response, block height, retrieval time | Supports independent verification and provider comparison. |
| Normalized record | Parser version, chain rules, token decimals, transformations | Shows how raw data became an investigative representation. |
| Communications | Original export, headers/metadata, timezone, custodian | Connects on-chain activity to reported conduct without altering blockchain facts. |
| Attribution record | Source, confidence, freshness, scope, analyst status | Prevents a lead from becoming an unsupported ownership assertion. |
| Decision log | Who decided, when, rationale, prior state, resulting state | Makes human judgment reviewable and auditable. |
| Report version | Hash, generation time, evidence cut-off, previous versions | Preserves historical reproducibility when intelligence changes. |
05 / ENDPOINT QUALIFICATION
A label is the start of verification-not the end.
Hosted services can become recovery or disclosure opportunities, but only when attribution quality, provenance continuity, account relevance and jurisdiction are assessed separately.
What strengthens an endpoint
✓Multiple independent sourcesCurrent provider intelligence, service documentation and investigator-confirmed records agree.
✓Provenance-qualified routeThe relevant value-not merely related activity-reaches the candidate endpoint.
✓Service-specific identifiersDeposit address, memo/tag, transaction and account reference can be stated precisely.
✓Jurisdictional routeThe legal team identifies the appropriate entity, country and process.
What weakens an endpoint
!Single stale labelDeposit infrastructure and ownership can change; freshness must be disclosed.
!Broken provenanceAn exchange-labelled address beyond an evidential break remains a related lead.
!Community allegationA fraud report is an intelligence indicator, not proof of criminal control.
!Unclear service entityA brand name alone may not identify the contracting or legally responsive entity.
06 / PRESERVATION & FREEZING
Match the request to the evidence and authority.
Terminology varies by jurisdiction and provider. A preservation request, voluntary hold, disclosure request, restraint order and seizure warrant are not interchangeable. Investigators should coordinate early with prosecutors, central authorities and the service’s lawful-request channel.
Preservation
Seeks retention of records that might otherwise expire or change. It may protect account, login, device, KYC, transaction and communication records while legal process is prepared.
Restriction or restraint
May prevent transfer or disposal under applicable authority. Requirements depend on jurisdiction, provider policy, asset location and the legal basis asserted.
Disclosure
Seeks subscriber, KYC, transaction, device or account records. Scope, minimisation, secrecy and cross-border mechanisms should be addressed deliberately.
REQUEST QUALITY
Include the exact chain, address, transaction ID, asset, relevant time range, account identifiers, preservation scope, lawful authority, return channel, urgency basis and a technically competent contact. Avoid claiming ownership or provenance beyond the supporting evidence.
07 / CONTROL & SEIZURE
Plan custody before taking control.
Seizing a digital asset is both a legal and technical event. The operational plan should address authority, key material, transaction construction, destination control, fee funding, confirmation monitoring and post-transfer custody.
| Control point | Operational question | Failure to avoid |
|---|---|---|
| Legal authority | What exactly may be searched, restrained, transferred or forfeited? | Technical access exceeding the authorised scope. |
| Wallet architecture | Single key, seed phrase, multisig, MPC, hardware wallet, smart account or custodian? | Assuming possession of a device equals control of funds. |
| Secure destination | Who generated it, who verified it, what approvals are required and how is it backed up? | Sending to an unverified address or single-person wallet. |
| Transaction fees | Does the wallet have the native asset required for gas or miner fees? | Introducing commingling or an undocumented funding source. |
| Token behavior | Are there transfer taxes, freezes, proxies, blacklists or unusual decimals? | Treating every token as a simple native-asset transfer. |
| Documentation | Are screens, device state, commands, approvals, TXIDs and timestamps recorded? | Leaving an unexplained gap between access and custody. |
08 / CROSS-BORDER COORDINATION
Digital speed meets legal geography.
Virtual asset service providers, infrastructure and decision-makers may sit in different jurisdictions. Fast informal coordination can preserve opportunities, but compulsory disclosure, restraint and admissibility remain governed by applicable law and formal channels.
Do not assume a brand’s website domain, headquarters or app-store listing identifies the entity holding the relevant records or assets.
Where permitted, preserve records while preparing the appropriate domestic or international request.
KYC, account history, internal transfers, withdrawal addresses, IP/device logs and account notes may answer different questions.
Consider tipping-off rules, investigative sensitivity, privacy, safeguarding and how returned records will be handled.
09 / DEFI, BRIDGES & COMPLEX ASSETS
Reconstruct the economic event before describing the flow.
Swaps, bridges, liquidity positions, wrapped assets, NFTs and smart accounts can change the representation of value. Investigators should record both the protocol interaction and the conservative provenance conclusion.
Swaps
Separate input asset, output asset, routing contracts, fees, slippage and recipient. A swap is not automatically obfuscation.
Bridges
Link source-chain deposit and destination-chain release using supported bridge evidence. Timing and amount similarity alone may be insufficient.
Mixers and CoinJoin
Document structure and uncertainty. Participation in a mixing pattern does not by itself identify a user or prove criminal intent.
Tokens and NFTs
Validate contracts, decimals, ownership events, approvals and marketplace settlement rather than relying on display names.
Smart contracts
Review event logs, internal calls, proxy implementations and state changes. The visible transaction recipient may not be the economic beneficiary.
Multisig and MPC
Control may be distributed across signers or policy systems. Identify approval thresholds, signing records and custodian responsibilities.
10 / REPORTING STANDARD
Write what the evidence supports-and show the limits.
A useful forensic report distinguishes observed facts, normalized transaction events, provenance assessments, external intelligence, analytical findings and investigator confirmations.
| Evidence class | Preferred language | Avoid |
|---|---|---|
| Blockchain fact | “Transaction X recorded a transfer of…” | Inferring the human actor from an address alone. |
| Attribution | “Source Y attributes Address A to Service Z; investigator validation remains required.” | “Address A belongs to Z” without sufficient support. |
| Sanctions intelligence | “Address A matched a record from Authority Y, retrieved on Date Z.” | Calling an address clean when coverage was unavailable. |
| Provenance | “A probable/validated value path continues through…” | Using attribution to repair a broken path. |
| External report | “Fraud reports were identified and remain unverified intelligence indicators.” | Describing a community report as proof of crime. |
| Investigator decision | “The investigator confirmed/rejected the attribution because…” | Hiding the decision-maker or rationale. |
11 / FIELD CHECKLISTS
Three compact controls for the case file.
Use these prompts as a quality-control aid. They do not replace agency policy, specialist training, legal advice, warrants, court orders or jurisdiction-specific procedure.
Trace checklist
- Root transaction independently validated
- Asset and decimals confirmed
- All material branches reviewed
- Transformations documented
- Provenance breaks propagated
- Analysis cut-off recorded
Evidence checklist
- Original files preserved
- Hashes recorded
- Acquisition source and time logged
- Tool/version documented
- Analyst decisions versioned
- Sensitive data access controlled
Action checklist
- Endpoint attribution qualified
- Legal entity and jurisdiction identified
- Urgency and dissipation risk recorded
- Request scope technically precise
- Secure return/custody channel ready
- Prosecutor or counsel consulted
12 / PRACTITIONER FAQ
Questions teams ask under pressure.
Short answers to recurring operational questions in cryptocurrency tracing, evidence preservation and asset restraint.
Can cryptocurrency be frozen directly on a blockchain?
Usually there is no universal blockchain-level freeze function. A custodian or issuer may have technical controls, while law enforcement may seek restraint over assets held by a service or take control of keys under lawful authority. The exact route depends on the asset, protocol, custodian and jurisdiction.
Does identifying an exchange address prove the suspect owns an exchange account?
No. Attribution may identify service infrastructure, but account ownership requires provider records or other evidence. The traced transaction, deposit identifier, memo/tag and relevant account records must be connected carefully.
Is a block-explorer screenshot sufficient evidence?
It is useful context but is rarely the strongest form of preservation. Retain the transaction identifier, raw provider or node response, acquisition time, block reference, tool/version information and a reproducible normalized record.
What if funds cross a bridge or swap assets?
Reconstruct each economic event and preserve the evidence supporting any cross-chain or cross-asset link. Do not assume that similar timing or value establishes continuity when the bridge mechanism or recipient cannot be validated.
Does “no sanctions match” mean the wallet is low risk?
No. It only describes the result and coverage of sanctions screening at a stated time. Risk also depends on dataset freshness, source availability, behavioral indicators, other intelligence and investigative context.
When should an investigator contact a service provider?
As early as authorised policy and law permit when records or assets may dissipate. Coordinate with legal counsel or prosecutors, identify the correct provider entity, preserve exact identifiers and distinguish preservation from compulsory disclosure or restraint.
RESEARCH BASIS
Authoritative practitioner context.
This independent educational guide synthesizes recurring operational themes from public materials. Always apply current agency policy and jurisdiction-specific law.
- FATF - Asset Recovery Guidance and Best Practices (2025)
- U.S. Department of Justice - International law-enforcement cooperation for digital-asset crime
- Europol - Cryptocurrencies: tracing the evolution of criminal finances
- INTERPOL - Project Titanium: reproducible and legally compliant virtual-currency investigation tools
Last editorial review: September 2026. No section is legal advice or a substitute for authorised operational procedure.
Turn a transaction trail into a reviewable case record.
Discuss professional blockchain investigation workflows, evidence packages and institutional access.