Most local police departments will never have a Chainalysis Reactor license, a trained crypto detective, or a digital evidence response team specializing in blockchain. That does not mean a crypto case is dead on arrival at a small department. There is meaningful investigative work that can be done with free tools and standard process — and there is a clear point at which a scoped private forensic engagement (often a few thousand dollars per case) outperforms trying to build internal capacity. This guide walks through both.
Written for sheriff's offices, township police, and detective bureaus that get a crypto theft report and need to know what to do today.
This article describes general operational practice. Statutory citations, scope of legal process, and disclosure restrictions vary by jurisdiction and case posture — confirm with your prosecutor before acting on anything below. Where this article references specific statutes (e.g., preservation requests, seizure warrants), treat those as directional only.
A trained investigator using only free public tools can: trace simple single-hop transactions, identify deposits to major US exchanges, send a 2703(f) preservation letter, draft a subpoena, and refer to federal partners. That is real progress on a case. What free tools cannot do well: multi-hop attribution, mixer analysis, multi-chain bridge tracing, wallet clustering, or producing an admissible expert declaration.
Contents
What to Do on Day One
The first 24 hours of a crypto case set the trajectory of recoverability. Stolen cryptocurrency typically moves through several wallets within hours and reaches an exchange within 1–3 days. Action while the funds are still in transit is meaningfully different from action a week later.
- Capture the basics from the victim: sending wallet address, receiving wallet address, transaction hash (TXID), date and time, asset type and amount, the platform or context of the theft. See our intake checklist for what to collect.
- Open a block explorer appropriate to the asset (Etherscan for ETH/ERC-20, Tronscan for TRX/USDT-TRC20, Blockchain.com or Mempool.space for BTC). Paste the receiving address. Confirm the deposit and look at outbound transactions.
- Follow one or two hops outbound. Note any address that receives a deposit you recognize as belonging to a centralized exchange. Public lists and labels (Etherscan, Arkham, Tronscan) tag many major exchange addresses.
- If you see an exchange-controlled deposit address in the trace, immediately draft and send a 2703(f) preservation letter to that exchange. This is the single highest-leverage action available in the first 24 hours.
- File an IC3 complaint on the victim's behalf or have the victim do so — this creates the federal record and feeds aggregate analysis at the FBI.
- Open a department case file with the wallet addresses, TXIDs, and screenshots of the block explorer views. Good documentation now saves grief later.
Free Tools That Get You Far
Every tool in this section is free and accessible from any browser. None require account creation or purchase orders.
| Tool | Use | Limit |
|---|---|---|
| Etherscan | Ethereum and ERC-20 trace, address labels, contract analysis | Paid tools needed for clustering at scale |
| Tronscan | Tron and TRC-20 trace; Tron is the dominant scam chain | Less aggressive labeling than Etherscan |
| Mempool.space / Blockchain.com | Bitcoin trace and visualization | UTXO model takes practice; clustering is not free |
| Arkham Intelligence (free tier) | Address labels, entity attribution, basic graph view | Free tier is rate-limited; depth requires paid plan |
| OFAC SDN List | Check if a wallet appears on US sanctions list | Only sanctioned addresses; misses non-sanctioned criminal actors |
| Tether / Circle blacklist databases | Confirm whether USDT or USDC at a given address has already been frozen by issuer | Reactive only; does not initiate freezes |
| Chainabuse | Community-reported scam address database | Crowdsourced, not authoritative |
| Reverse-image search and OSINT | Identify scam platform domains, profile photos, recurring scammer profiles | Time-intensive; not blockchain-specific |
A Simple Trace Workflow
The single workflow below handles the majority of crypto theft cases that land at a small department: scam-induced transfer, wallet drain, or platform "you can't withdraw" fraud. The goal is to determine whether the funds reached a centralized exchange — that is the legal-process target.
- Open the appropriate block explorer for the asset.
- Search the receiving wallet address (where the victim sent the funds, or where the drain went).
- Confirm the deposit transaction — match TXID, amount, asset, timestamp.
- View outbound transactions from that wallet. Sort by date.
- For each outbound transaction, note the destination address and the amount.
- Click into the destination address. Does it have a public label (e.g., "Binance.US Hot Wallet 17")? Does it have hundreds of incoming transactions per day from many counterparties? Both are signals of an exchange-controlled deposit address.
- If yes — stop and send a preservation letter to that exchange. The trace is sufficient to identify the holder.
- If no — the destination is likely an intermediate hop. Continue tracing. Most stolen funds reach an exchange within 2–5 hops.
- If the trace passes through a smart contract that is a known mixer (Tornado Cash, Wasabi, Samourai), document the entry and stop tracing through it. Mixer breakthrough is paid-tools territory.
For more on the underlying methodology see how blockchain investigators trace crypto and our block explorer guide.
Legal Process You Can Send Today
The major legal mechanisms available to a local department on a crypto case do not require special authority. They use standard tools.
| Mechanism | Authority | What It Does |
|---|---|---|
| 2703(f) preservation letter | 18 U.S.C. § 2703(f) — agency letterhead, no court order | Locks down records at a US exchange for 90 days (renewable to 180) |
| Subpoena to exchange | State grand jury, state criminal subpoena, or federal grand jury subpoena via federal partner | Compels production of subscriber information, KYC, transaction logs, IPs |
| 2703(d) order | Court order on specific articulable facts | For non-content records when a subpoena is insufficient (varies by content scope) |
| State seizure warrant | State court, probable cause | Seizes funds at exchange or self-custodial wallet (custody question still applies — see our seizure guide) |
| Search warrant for digital evidence | State court, probable cause, particularity | Authorizes search of suspect's residence and devices for keys, seed phrases, hardware wallets |
None of these require a forensic budget. They require a competent investigator with documented probable cause.
Federal Partners and When to Call Them
Federal task forces provide tooling, expertise, and (sometimes) case adoption. Knowing who to call shortens the path to action.
- FBI Cyber Squad — local field office, primary federal partner for crypto theft and fraud. Adopt cases with a federal nexus (interstate wire fraud, ransomware, larger-loss fraud). IC3 referrals route through here for analysis.
- USSS Electronic Crimes Task Force (ECTF) — strong on payment fraud, financial crimes, and crypto theft. Many ECTFs have crypto-trained agents and Chainalysis access. Local LE can typically join ECTFs as task force agents.
- IRS-Criminal Investigation — often surprisingly active in crypto cases (tax-tied fraud, money laundering). IRS-CI has substantial crypto tracing capability and works state cases when there is a tax angle.
- HSI (Homeland Security Investigations) — strong in crypto cases tied to international fraud, narcotics, and trafficking.
- USPIS — postal mail fraud nexus; some crypto fraud cases involve mail and qualify.
- State AG cyber units — many state attorneys general have cyber and financial crime units that take crypto cases. Underused.
Adoption is most likely when: (1) there is a clear federal nexus, (2) the loss exceeds the typical federal threshold (varies by office, often $50K+), (3) the case fits a pattern federal partners are already tracking, or (4) the local department is willing to embed a detective on the federal task force.
When a Paid Engagement Is the Right Call
A scoped private forensic engagement makes sense at a small department when the case requires capability the department does not have and federal adoption is not happening. The economics are usually favorable. A focused trace report tied to one specific objective (e.g., identifying which exchange holds the funds and producing a probable cause exhibit) typically runs $1,500–$5,000. That is less than one detective-week.
Common LE engagement scopes:
- Confirmation trace — confirm where the funds went and identify the exchange. Output: short report with addresses, TXIDs, and exchange identification suitable for a probable cause affidavit.
- Multi-hop trace — trace funds through intermediate wallets and bridges where a free-tools trace dead-ends. Output: trace report with full transaction chain and current location.
- Attribution analysis — link an anonymous wallet to a real-world identity through clustering, OSINT, and platform leaks. Output: attribution memo for affidavit support.
- Expert declaration — sworn statement by the investigator describing methodology, qualifications, and findings. Required for trial admissibility.
For a deeper view of when private engagement makes sense from the LE side specifically, see our companion piece on when state and local police should call a private blockchain investigator.
Victims who reach out to LE will sometimes have already engaged or been contacted by a "recovery service" — almost always a second-stage scam. Direct victims to our recovery scam guide before they pay anyone. Anyone charging a percentage of recovered funds, demanding "gas fees," or contacting the victim through Telegram or Instagram is not a legitimate investigator.
FAQ
LE Forensic Support — Scoped to Your Case
Wallet Witness offers scoped trace reports for law enforcement starting at a few thousand dollars, with fast turnaround for active cases. We work directly with detectives and prosecutors, produce court-ready exhibits, and provide expert declarations when needed. LE inquiries are prioritized.
Contact a Forensic Investigator