If you have scheduled a call with a blockchain forensic investigator — or you are about to — this guide is the intake checklist. The single biggest predictor of how productive that first call is is how prepared you are. Showing up with the right materials cuts the call from an hour of "let me figure out what you have" to a tight scoping conversation that ends with a clear engagement plan. It also saves you money: less billable discovery time, faster scope, faster work.
This is the same checklist we send Wallet Witness clients before a free assessment call. Use it whether you are calling us, calling someone else, or just want to be ready.
Wallet addresses, transaction hashes, screenshots of communications, dates, the platform involved, ID of the asset stolen. If you have those six things in one document before the call, you are ahead of 90% of the people who book intake calls.
Contents
The Essential Six
Before anything else, gather these six items. Without them, the investigator cannot scope the case, and the call becomes a discovery exercise instead of a planning conversation.
The Essential Six
Where to find the transaction hash
This is the single piece of data people most often struggle with. Here is how to get it depending on where the transaction happened.
- MetaMask, Trust Wallet, Phantom, Rabby, etc. — click the transaction in your activity tab. There is a "View on explorer" link or a transaction hash field. Copy the full string.
- Coinbase, Kraken, Gemini, Binance.US — transaction history export (CSV) includes the hash. Or click an individual withdrawal and the hash will appear under "Details."
- Hardware wallets (Ledger, Trezor) — the companion app (Ledger Live, Trezor Suite) shows the hash for every transaction.
- If you cannot find it — take a screenshot of the transaction as it appears in your wallet. We can usually identify the hash from that combined with your wallet address and the timestamp.
If you have read our block explorer guide, you can also pull the hash directly from a block explorer once you know your wallet address and the date.
Evidence and Communications
Beyond the on-chain data, off-chain evidence is what turns a trace report into a recoverable case. Bring everything you have.
Communications and Records
If you sent a wire to a bank account in the course of buying crypto for the scammer, see our bank wire scam guide. The bank record matters because it sometimes opens a parallel chargeback or fraud claim.
If your scammer has personal information about you, see this guide for the immediate protective steps to take.
Build a Clear Timeline
A written timeline of events is the single most useful document you can prepare. It does not need to be long. Bullet points with dates are fine. Include:
- How you first encountered the scammer or platform (date, channel)
- The progression of the relationship or interaction
- Each transaction or transfer (date, amount, asset, destination)
- When you realized something was wrong
- What you have done since (filed a police report, contacted the exchange, etc.)
Investigators reading this timeline can immediately spot patterns: pig butchering, romance investment, fake recovery scam, social engineering, technical drain. Pattern recognition shapes the trace strategy and the recoverability assessment. Without a timeline, that recognition takes longer and costs more.
Legal and Reporting Status
The investigator needs to know what other parties are already involved in your case.
Status Checklist
Financial and Identity Documents
You do not need to send these on the first call, but be prepared to discuss them. They affect the engagement scope.
- Total amount lost in dollar terms at the time of theft, and at the time of the call (some assets have moved significantly)
- How the assets were originally acquired — purchased on Coinbase, mined, received as payment, etc. This matters for tax loss deductions and for KYC-based recovery paths.
- Whether the loss is insured — some homeowner policies, business policies, or specialized crypto insurance products cover theft. The carrier may require a forensic report.
- Your jurisdiction — state of residence, and whether the scammer is in a known jurisdiction. This affects civil and criminal options.
What You Do Not Need to Worry About
People often hold back on calling because they think they need to understand crypto first. You do not. The investigator's job is to translate. Here is what you do not need to bring:
- An understanding of how blockchains work technically
- An explanation of why the scammer did what they did
- A complete understanding of which exchange or chain was involved — we figure that out from the addresses
- A "theory" of who the scammer is — intuition is fine, but the trace tells the truth
If you do not know what a wallet address looks like or where to find one, send screenshots of your wallet and we will help you identify it on the call. The intake is collaborative.
How to Organize It
Put everything into one folder or one document. The format does not matter as much as the consolidation. Common approaches that work:
- A single Google Doc or PDF with sections labeled (Wallet Addresses, Transactions, Communications, Timeline, Status). Embed screenshots as inline images.
- A shared Google Drive or Dropbox folder with subfolders (1-Wallets, 2-Transactions, 3-Comms, 4-Documents, 5-Timeline.md).
- A simple email with the wallet addresses and TXIDs in the body, and screenshots attached. This is enough for a free assessment.
If you are working with an attorney, send them the same package. The same intake document serves both the legal and forensic engagements.
Send everything through a private channel — encrypted email, your attorney's secure portal, or a password-protected file share. Do not post wallet addresses or transaction hashes on public forums while a recovery is in progress. Public exposure can tip off the parties holding the funds and trigger movement before you can act.
FAQ
Ready to Schedule Your First Call?
If you have the essential six items ready, we can move quickly. Submit your case to Wallet Witness and we will respond within 24 hours with an honest scoping read. The assessment is free.
Start a Free Case Assessment