How to secure evidence after crypto theft (do’s and don’ts)
Date: 11 August 2026 | Week: 33 | Reading time: 7 minutes | Updated: Author: Tyler Dijst 
Paucitas is an independent expert firm in the Netherlands that investigates investment fraud and crypto fraud, establishes the origin and legitimacy of crypto assets and prepares expert reports for legal proceedings and compliance.
In short
Securing evidence after crypto theft is the first thing you can do, before you take any other step. Record transaction hashes, addresses and messages, and do not move your remaining crypto in a panic. What actually happened, a hack, a misleading transfer or something else, only becomes clear once someone looks at the route.
Paucitas is an independent expert firm in the Netherlands that investigates crypto fraud and theft, in hundreds of cases a year. The more complete the evidence, the further we can follow the route of your crypto.
Get in touch with Paucitas or ring +31 20 244 5774, also outside office hours. We will tell you straight away what is best to keep now.
In a nutshell
After a theft, it helps to be quick. What you record now determines how far an investigation gets later. Keep everything unedited, never share your recovery phrase, and then let Paucitas map the route of your crypto.
Your crypto has suddenly gone, or you see a transfer you do not recognise. That is a horrible moment, and it is understandable that you want to act at once. That is exactly when it helps to pause. What you keep now will help the most later.
This article is about securing evidence. How a full investigation works is explained in crypto fraud and theft investigation.
What should you keep after a crypto theft?
Everything that shows what happened. The most important item is the transaction hash of every suspicious transfer: the unique identifier that lets you find a booking on the blockchain. Add the wallet addresses involved, screenshots of messages or websites and a timeline of what happened when.
It does not matter whether it looks like a wallet hack, a transfer you were talked into or something you cannot yet place. Sometimes it later turns out that something else was going on. That is why it is so useful to record everything first.
Evidence after crypto theft: 8 points to secure
These points help you in the first hours, without wiping any traces:
- Note the transaction hash of every suspicious transfer and copy it as plain text.
- Record the addresses involved: your own address and the address the crypto went to.
- Take full screenshots of messages, websites and apps, with the date and time visible.
- Write out a timeline: what happened, when and through which channel.
- Keep original files and messages unchanged, alongside any copies.
- Leave your remaining crypto where it is and move nothing until you know what you are doing.
- Never share your recovery phrase or private key with anyone.
- Gather everything in one place so you can hand it over in one go.
Not sure you have everything? Let Paucitas take a look with you. You can ring us any time, 24/7, on +31 20 244 5774.
What is best avoided after a theft?
Do not empty your wallet in a panic and do not send your remaining crypto straight to a new address. Every transfer you make yourself adds transactions and makes the route harder to read. Better to wait a moment and ask for advice first.
Never share your recovery phrase or private key with anyone who offers to help. Do not accept an offer to get your money back quickly for an upfront fee either. That is a well-known form of follow-up fraud, a recovery scam. Paucitas will never ask for your recovery phrase or private key of its own accord. If you need help reading out or restoring your wallet, we guide you through it without needing to see that information ourselves.
Why does the evidence decide how far an investigation gets?
The blockchain shows which bookings were made, but not why. A transaction hash is the starting point of every reconstruction. Screenshots and a timeline give the context: the message you were approached with, or the website where you did something.
Paucitas does all tracing itself, without tracing tools. We work everything out: the transactions, the route of the money, the addresses, the documents and the timeline. Paucitas also reads through all the conversations, emails and other communication, so you get the full picture of where all the money went, step by step. Every step is checked separately before it goes into the report. The more complete your material, the further we get.
An example from practice
A man noticed on a Sunday evening that his wallet was almost empty. His first instinct was to send the rest quickly to an exchange. He rang Paucitas first and in the meantime saved the transaction hashes and his chats.
Paucitas followed the route of his crypto to the point where it reached an exchange. How that works is explained in stolen crypto traced to an exchange. With the report he could take targeted next steps, with the police and with the exchange.
Paucitas takes privacy very seriously and never shares clients’ personal details. This is a composite example: names, amounts and details have been changed. The situation is one we see in practice.
What does Paucitas do with your evidence?
Paucitas maps the route of your crypto and establishes which service provider it went to. The report states how far the route is established. Sometimes crypto turns out to still be in a recognisable place, sometimes you regain access to your own wallet, and sometimes it turns out to be something other than theft. In every case you then have a report that anyone can follow and understand step by step.
Under the European MiCA Regulation and anti-money laundering rules, crypto service providers must keep records of transactions and customers. With a clear overview of the route, you know which party holds that information. What can you do with the Paucitas report? It shows whether money is still available or where it went, and what the next steps are. In a case of theft or fraud, one of those steps is reporting it to Report Fraud, or in Scotland to Police Scotland, and the report is then a strong attachment that sets everything out fully and clearly.
- Costs: every investigation is tailored. You receive a quote in advance that we go through together, with no surprises.
- Turnaround: from the same day to around two weeks.
- Supplying documents: digitally or at our office. You receive a checklist, and where needed we help you gather everything.
Has crypto gone missing? Get in touch for a free intake, or ring +31 20 244 5774. Via the form you will hear from us within 1 to 3 hours. Further reading: a case in which stolen bitcoin was traced and frequently asked questions about stolen crypto.
Sources: Report Fraud; Police Scotland, scams and frauds; EUR-Lex, Regulation (EU) 2023/1114 (MiCA).
Questions about your own situation?
Call us directly, 24/7, or fill in the form below. You will hear from us within 1 to 3 hours. A free intake is without obligation.
Paucitas B.V.
Weesperstraat 107
1018 VN Amsterda
E: paucitas@paucitas.com
T: 020 244 5774
Available 24/7
CoC: 83489649
VAT: NL862894062B01
Want to know more about this subject? Contact us
"*" indicates required fields
Frequently asked questions about securing evidence after crypto theft
Short answers to the questions we are asked most often.
What should I keep after a crypto hack?
Paucitas advises keeping the transaction hash of every suspicious transfer, the addresses involved, full screenshots of messages or websites and a timeline. Keep everything unedited. The more complete it is, the further an investigation gets.
Should I move my remaining crypto straight away?
Paucitas advises against doing so in a panic. Every transfer adds transactions and makes the route harder to read. Ring Paucitas first and we will look together at what is sensible in your situation.
How do I keep a transaction hash safely?
Paucitas advises copying it as plain text so no characters get lost. Note the network and when the transaction took place. A screenshot from a public blockchain explorer helps too.
Who traces stolen crypto?
Paucitas does, as an independent expert firm in the Netherlands. We follow the route of your crypto to the point where it is established, for example an exchange, and record that in a report anyone can follow.
Someone is offering to recover my crypto. Can I trust that?
Paucitas advises caution. If someone asks for an upfront fee or for your recovery phrase, it is often follow-up fraud. If in doubt, ring us first. A free intake is without obligation.
Short answers
Is your question not covered here? See short answers to common questions about crypto investigation or the explanations of blockchain and cryptocurrency terms.
Your own situation
If you are reading this, you probably have a question about your own situation. That is exactly what Paucitas does.
The first step is contact by phone. You can book that call by phone or through the contact form, so you do not have to wait. In the call we look together at what can factually be established in your case and what Paucitas can examine for you.