This article is a general operational framework for detectives at small departments who have not previously sent preservation requests to a cryptocurrency exchange. It is not legal advice and does not assert specific statutory authority. Before sending any preservation request, confirm with your prosecutor or department legal counsel which statutory citation applies in your jurisdiction, what scope of records you may request, and what disclosure restrictions apply. Statutory frameworks differ by state and by case posture.
If a victim of cryptocurrency theft has walked into your department and the funds have been traced to a wallet you can identify as exchange-controlled, sending a preservation request to that exchange is one of the highest-leverage actions available — usually within the first 24 hours of the case. This guide describes the general framework, what a preservation letter typically includes, where to send it, and how it fits into the broader case path. The legal authority and exact citation are decisions for your prosecutor.
What a Preservation Letter Generally Does
A preservation letter is a written request asking a service provider to hold records pending legal process for production. It does not compel the provider to produce records — that requires a subpoena, court order, or warrant. It also does not freeze the account. The user can typically continue to transact unless the agency separately obtains process restraining the funds.
What providers typically preserve on a properly framed letter (subject to the provider's policy and applicable statutory scope, which your prosecutor will confirm):
- Subscriber identification, including KYC records, government ID images, name, address, date of birth, phone, email
- Account history including registration data, IP/device login records, and 2FA history
- Transaction records — deposits, withdrawals, internal trades, with on-chain transaction hashes
- Customer support communications, KYC review messages
- Current balance and asset composition at the time of preservation
When to Send One
Send the preservation request the same day a forensic trace places stolen funds at an exchange-controlled wallet, even before the subpoena is drafted. The preservation window buys time to obtain legal process before records or accounts can be modified or closed.
Send a Preservation Letter When
For background on building the underlying trace see how blockchain forensic investigators trace crypto. For working a case with limited internal capacity see working a crypto case with no forensics budget.
What a Preservation Letter Typically Includes
The general elements (your prosecutor will confirm specifics for your jurisdiction):
- Department letterhead with case agent contact info — name, badge or agent number, phone, email
- Case number and brief offense description
- Citation to the applicable preservation statute (provided by your prosecutor)
- Account or wallet identifiers — username if known, email if known, deposit transaction hash, deposit wallet address
- Date range for the activity of interest
- Records to preserve — listed explicitly
- Non-disclosure request if appropriate (your prosecutor will advise on the applicable rule)
- Confirmation request — ask the exchange to email confirmation back to the case agent
Generic Template
The bracketed placeholders below should be filled in with your prosecutor's review of applicable authority and scope. Do not send this template without that review.
Exchange Submission Channels
Major US-based exchanges all have dedicated law enforcement compliance portals or contact addresses. Submit through the official channel; do not email general support. Channels change — verify the current address on the exchange's law enforcement information page before sending.
| Exchange | LE Submission Channel |
|---|---|
| Coinbase | Law Enforcement Portal (lawenforcement.coinbase.com) |
| Kraken | Law Enforcement Portal (lawenforcement.kraken.com) |
| Gemini | compliance@gemini.com or LE portal |
| Binance.US | le-request@binance.us or LE portal |
| Crypto.com | LE portal via crypto.com/legal-and-compliance |
| Robinhood Crypto | Robinhood Law Enforcement Portal |
| Cash App / Block | compliance@squareup.com or LE portal |
| Foreign exchanges (Binance.com, OKX, Bybit, etc.) | Compliance contact varies; cooperation outside US jurisdiction is voluntary in most cases. Compelled production typically requires MLAT or other international process — coordinate with federal partners. |
What Happens After You Send It
You should receive an email confirmation from the exchange's compliance team within a few business days, acknowledging receipt and confirming preservation. Note the date of receipt and any stated preservation period. If your prosecutor advises you may extend the period before it expires, document the extension in writing within the window.
Concurrently, begin drafting the subpoena or other process for production. For the broader subpoena framework, including what major exchanges typically produce in response, see our guide on subpoenaing crypto exchanges.
If you anticipate needing to freeze the account or restrain transactions in the account, that requires separate legal process. Consult your prosecutor on the appropriate vehicle (criminal seizure, civil TRO) for your case posture.
Foreign exchanges (Binance.com, OKX, Bybit, KuCoin, MEXC, HTX) may voluntarily honor preservation requests from US LE on a strong showing, but voluntary cooperation is not guaranteed. Compelled production from foreign providers typically requires MLAT process or coordination with a federal partner agency. Preservation requests to foreign providers should still be documented even when compliance is voluntary.
FAQ
Need Forensic Support on a Live LE Case?
Wallet Witness works with small-agency detectives and prosecutors on active crypto cases — trace reports, exchange identification, and expert declarations. If your department lacks in-house crypto forensic capacity, we can produce a court-ready report often within days. LE inquiries are prioritized.
Contact a Forensic Investigator