The first records to keep after a digital-asset loss

Summary

The useful file is assembled in the first hours: transaction identifiers, wallet addresses, timestamps, platform names and the messages that induced the transfer. Informal ‘clean-up’ of devices and accounts often destroys more than it protects.

Context

Phishing, fake investment platforms, SIM-swap access to accounts, wallet compromise and authorised payments into a fraudster’s address leave different traces. The later legal question is what can still be shown. Screenshots help. They are not a substitute for the underlying identifiers.

Method

Write down every wallet address, transaction hash, exchange or broker name, date and amount you still have. Keep the emails, chats and invoices as they arrived. If a device or account may still be compromised, change passwords on remaining services and enable a second factor that is not SMS where you can. Do not send seed phrases, private keys or original identity documents through a website or a messaging app. Do not grant remote access to someone who offers to recover the funds.

Legal options

Once the record is stable, a solicitor can say whether urgent preservation, a platform notice, a report to Action Fraud or the police, or an application for relief is realistic. Reporting creates a record. It does not, by itself, freeze value or produce a defendant. The first conversation is an assessment of the file you already have, not a request for keys.

Limitations

Some losses leave almost no recoverable trail. Saying that early is part of the work. This note is general information. It is not a checklist that makes proceedings appropriate in every case.

Discuss a related matter