The most common reason investigators can't help victims isn't that the trail has gone cold — it's that the victim doesn't have the evidence in usable form. Screenshots of notifications, paraphrased messages, and "I think the hash was something like 0xabc…" aren't enough.
If you preserve the right artifacts in the first few hours, even a year-old case can be revived. If you don't, a recent case can be unworkable. Start with the first 72 hours checklist to make sure you're acting in the right order.
The Core Evidence Every Case Needs
At minimum, every investigation needs these five items:
- Your wallet address(es) — the public address or addresses of the wallet(s) from which funds were stolen.
- Transaction hashes — the unique IDs of every unauthorized outgoing transaction, and of the deposit transactions that funded the scam.
- The destination address(es) — where the funds went (usually contained in the transaction record).
- Timestamps — when each transaction happened, in UTC or with timezone noted.
- Amounts and token types — exact figures, including which blockchain and which token contract.
Everything else builds on this core. Preserve these five items first, in text form (not screenshots), and the rest of the evidence gathering becomes easier.
MetaMask and Browser-Extension Wallets
MetaMask, Rabby, Phantom, and similar wallets all have an activity tab that shows your transaction history. What to export:
From MetaMask
- In the extension, go to the Activity tab.
- Click into each unauthorized transaction. Copy the transaction hash (under "Details").
- Use the "View on block explorer" link — this opens the authoritative record. Screenshot it and save the URL.
- Record the account address shown at the top of the wallet (long string starting with
0x). - If multiple accounts are in the wallet, note which account is affected.
MetaMask doesn't offer a native CSV export. For that, use Etherscan (see below).
From Rabby Wallet
Rabby has a built-in approvals manager that Metamask lacks. Before anything else, screenshot the Approvals page for the affected wallet — this captures what was approved to whom, a critical piece of evidence for approval phishing cases.
Hardware Wallets (Ledger, Trezor, Keystone)
The hardware device itself doesn't store history — you access it through its companion software.
From Ledger Live
- Open Ledger Live → Accounts.
- Click the affected account → Operations.
- Right-click → Export operations → save as CSV.
- For each unauthorized operation, also note the transaction hash and open it in the explorer.
From Trezor Suite
- Accounts → affected account → Transactions.
- Use the export-to-CSV button at the top of the transactions list.
In both cases, also screenshot the receive address tab confirming ownership of the address in question — this helps tie the on-chain evidence to you personally.
Mobile Wallets (Trust Wallet, Exodus, Coinbase Wallet)
- Open the app → wallet → transaction history.
- Tap each unauthorized transaction → copy transaction hash.
- Most mobile wallets offer a "View in explorer" button — use it and screenshot the result.
- Trust Wallet has a CSV export under Settings → Wallets → [wallet] → Export.
- Also screenshot the public address / receive page — confirms ownership.
Block Explorers (The Authoritative Source)
Wallets are UIs — block explorers are the source of truth. Even if your wallet app loses data, the explorer will always have the full history for any address.
Etherscan and its cousins
For any EVM chain, the Etherscan-family explorer exposes the full history. For any address:
- Visit
etherscan.io/address/[your-address](or bscscan.com, polygonscan.com, arbiscan.io, snowtrace.io, etc.). - Above the transactions list, click Download Page Data — gives CSV downloads for normal transactions, internal transactions, ERC-20 transfers, and ERC-721 transfers.
- Download all four CSVs. Attackers often move ERC-20 tokens via
transferFromcalls that don't appear in the normal transaction list. - Save the full page as a PDF or use the Wayback Machine to archive the current state.
Other chains
- Bitcoin — blockchain.com, blockstream.info, mempool.space. All allow full history export.
- Tron — tronscan.org. Particularly important: USDT on Tron is the largest-volume stablecoin transfer rail. Many scam flows use it.
- Solana — solscan.io, solana.fm.
- Cosmos chains — mintscan.io.
Centralized Exchanges
If any portion of the fund flow involved a centralized exchange — either because you bought the crypto there before the scam, or because you suspect the funds landed there — exchange records are essential.
What to export
- Full account history — most exchanges offer an "Export statement" or "Tax CSV" option covering all activity.
- Deposit and withdrawal logs — usually a separate export. Include the full wallet addresses for each withdrawal.
- Trade history — for every crypto-to-crypto conversion.
- Account-opening KYC records (if available) — confirms your identity tied to the account.
- Any support ticket correspondence — screenshot every exchange-side communication about the incident.
Exchange-specific quick paths
- Coinbase — Profile → Taxes/Reports → Generate report (CSV).
- Binance — Wallet → Transaction History → Export.
- Kraken — History → Export.
- Bybit, OKX, Bitfinex — similar; look under Reports, Statements, or Transaction History.
Communication Evidence
Attribution often comes from off-chain metadata, and the scammer's own messages are the richest source of it. Preserve:
- Full chat histories — not cropped screenshots. Scroll back to the first contact. Screenshot the entire conversation, then export it if the platform allows (Telegram's chat export, WhatsApp's email chat feature, Discord's full message history).
- Profile screenshots of every account that contacted you — avatar, username, display name, bio, any linked accounts.
- URLs of any websites involved — including the specific path and query string, not just the domain.
- Wayback Machine captures of those URLs (web.archive.org). Save a snapshot now before the site is taken down.
- Email headers of any phishing emails — "View Original" in Gmail, "Show Raw" in most other clients. Full headers include sender IP and routing data.
- Voice or video recordings if any calls happened, and transcripts if recordings are unavailable.
Device and Environmental Evidence
For attacks that may have involved malware, device compromise, or credential theft, also preserve:
- Any suspicious files, installers, or PDFs received (saved to a secure location, not deleted). See our breakdown of malicious PDF crypto attacks.
- Browser extension list — screenshot at
chrome://extensionsor equivalent. - Recent downloads log — especially if a fake wallet update or "support tool" was installed.
- System event logs if an IT-level incident is suspected.
If malware is suspected, stop using the device for any crypto or financial activity and work from a clean device for all subsequent steps.
The Evidence Package — How to Organize It
Dump everything into a single folder, labeled by case. Inside, create subfolders:
/wallets/— screenshots and exports from each wallet, named by wallet type/exchanges/— exports and screenshots per exchange/on-chain/— CSVs downloaded from block explorers, one per chain/communications/— chat exports, emails, call notes/websites/— screenshots, saved HTML, Wayback links/reports-filed/— copies of police report, IC3 submission, any exchange tickets/summary.txt— one-page narrative: what happened, when, which wallet, approximate loss, key transaction hashes
Share this folder with your investigator through a secure channel (Signal attachments, encrypted email, or a dedicated file-sharing link with expiry). Don't use Google Drive links without access controls, and don't post anything in public forums.
The Bottom Line
Evidence preservation is the difference between a workable case and a dead end. Spend the first two to three hours after a theft methodically preserving every artifact listed above — it pays for itself many times over in investigation quality and speed.
If you're beyond the first 72 hours and some evidence is no longer available, don't assume the case is unworkable. On-chain data is permanent, and a capable investigator can often reconstruct the trail from the wallet addresses alone. Gather what you can and book a consultation.