Before you submit a case: organise the facts

When a digital asset loss occurs, the quality of the information you preserve can make a significant difference to the investigation that follows. Good digital asset case preparation does not require you to understand every technical detail. It means organising the information you already have so an investigator can understand what happened, identify relevant transactions, and determine what should be examined next.

Even if some details are missing, begin with what you can verify. Avoid filling gaps with assumptions. A clear record of known facts is generally more useful than a complicated account containing information that cannot be confirmed.

Digital Asset Case Preparation Starts With a Timeline

Begin by creating a simple chronological account of what happened.

Record when you first encountered the person, platform, website, investment opportunity, or service involved. Include important dates such as when an account was created, when deposits were made, when withdrawals were attempted, and when you first suspected there was a problem.

If you do not remember an exact date, mark it as approximate rather than guessing.

A timeline helps investigators understand the sequence of events and may reveal connections between communications, payments, wallet transactions, and changes in the behaviour of the parties involved.

Keep Transaction References Together

Transaction information can be particularly important in cryptocurrency-related cases.

Preserve any available transaction hashes, public wallet addresses, cryptocurrency amounts, dates, timestamps, and blockchain networks used. If cryptocurrency was purchased through an exchange before being transferred elsewhere, retain the corresponding exchange records as well.

Do not edit screenshots or transaction records unnecessarily. Original records can provide context that cropped or modified versions may remove.

For blockchain transactions, a public wallet address or transaction hash can sometimes allow investigators to independently examine activity recorded on the blockchain.

Preserve Communications and Account Information

Save communications connected to the matter.

These may include emails, text messages, WhatsApp or Telegram conversations, social-media messages, support tickets, account notifications, and conversations with supposed brokers, advisers, account managers, or recovery representatives.

Where possible, preserve information showing dates, usernames, telephone numbers, email addresses, and account names.

Website addresses are also worth recording. If several domains or platforms were involved, list them separately and explain how each one relates to the case.

Separate Evidence From Assumptions

One of the most useful parts of digital asset case preparation is distinguishing what you know from what you suspect.

For example, you may be able to verify that cryptocurrency was transferred to a particular wallet address. You may suspect that another wallet belongs to the same operator, but unless evidence establishes that connection, it should be presented as a possibility rather than a fact.

The same principle applies to identities.

A name, photograph, company description, licence number, office address, or identification document supplied online does not necessarily establish who was actually operating an account.

Clear distinctions between evidence and assumptions make an investigation easier to evaluate.

Record Traditional Payments Too

Not every digital asset case begins with cryptocurrency.

If payments were made by bank transfer, debit or credit card, wire transfer, payment application, or another method, preserve those records as well. Relevant information can include payment dates, amounts, beneficiary names, bank details, reference numbers, receipts, and correspondence relating to the payment.

Avoid sending additional money simply because someone claims another payment is necessary to release existing funds.

Protect Sensitive Wallet Information

Evidence collection should never require you to expose credentials that control your assets.

Do not include wallet seed phrases, private keys, passwords, authentication codes, or other sensitive login credentials in a case submission.

Public wallet addresses and transaction hashes can be used for blockchain analysis without providing control over your wallet.

If anyone claims they require your seed phrase or private key merely to trace transactions, treat that request with extreme caution.

Organise the Evidence Before Submission

You do not need an elaborate filing system. A few clearly named folders can make the material considerably easier to review.

For example, separate documents into categories such as:

• Transaction records
• Wallet addresses and transaction hashes
• Emails and messages
• Platform screenshots
• Bank or exchange records
• Identification or company documents received
• Timeline and written notes

Avoid submitting dozens of duplicate screenshots when one clear original record contains the necessary information.

What Happens After the Information Is Reviewed?

Once the initial material is organised, an investigator can begin determining what evidence is available and what additional information may be required.

In cryptocurrency-related matters, this can include reviewing transaction paths and identifying relevant wallet activity. However, tracing transactions should not be confused with guaranteed recovery. Identifying where assets moved is only one part of assessing what options may exist.

For a broader explanation of this process, TopMatters’ Digital Asset Recovery: What It Is, How It Works, and What Victims Should Know guide explains how blockchain tracing, evidence review, and recovery assessment can fit together.

Preparing a Clear Case Submission

Effective digital asset case preparation is ultimately about clarity.

Before submitting a matter, try to answer four basic questions: What happened? When did it happen? How were funds transferred? What evidence remains?

You do not need to solve the investigation yourself. Your role is to preserve and organise the facts so they can be assessed properly.

At TopMatters, an initial case assessment begins with the available evidence rather than assumptions or promises. A well-organised submission can help establish the transaction history, identify important information, and determine realistic next investigative steps.

If you are preparing information concerning a suspected digital asset or investment fraud matter, you can submit your case for an initial assessment once your available records have been organised.