How to secure evidence after crypto theft (do’s and don’ts)
Date: 11 August 2026 | Week: 33 | Reading time: 8 minutesAuthor: Tyler Dijst 
In short
The evidence after crypto theft that you secure straight away determines how far a later investigation can get: capture screenshots and transaction hashes, and do not move your remaining funds in a panic.
- Keep what you still have: transaction hashes, wallet addresses, screenshots of messages and a timeline of what happened.
- Do what you should leave alone: do not empty your wallet, do not transfer anything to a new address and never share your recovery phrase or private key.
- Paucitas does not promise that stolen crypto will come back and makes no commitment about the outcome of an investigation.
If you are the victim of a crypto theft, the first question is not how to get your money back, but how to secure the evidence. On the basis of the blockchain, Paucitas records factually what happened to your funds, and that record stands or falls with the data you preserve in the first hours. How this fits into a broader investigation is set out in our pillar page on how an investigation into crypto fraud and theft proceeds.
This how-to is purely about securing and preserving evidence after crypto theft: what you record, how you do it and what you should above all avoid. The tracing itself and the first steps for reporting to the police are deliberately left aside here; they are covered in other blogs.
Evidence that you record correctly within a few hours cannot be reconstructed afterwards: a single transfer or an emptied wallet can irreparably blur the route an investigation would follow.
Which data should you keep after a crypto theft?
After a crypto theft you keep everything that documents the event: the transaction hash of every suspicious transfer, the wallet addresses involved, screenshots of messages or websites and a timeline of what happened when. The transaction hash is the most important item: it is the unique identifier with which an entry can be found back on the blockchain, whether it concerned a wallet hack or a misleading transfer. Also record which address the funds went from and which address they went to, and at what time. The more complete this picture is, the more sharply a later investigation can establish the route.
How do you record transaction hashes and screenshots verifiably?
You record evidence verifiably by keeping the data unedited and noting where and when you obtained it. Take a full screenshot of every relevant screen, including the address bar, date and time, and keep the original rather than a cropped version. Copy transaction hashes and wallet addresses as plain text, so that no characters are lost when retyping. Keep messages, emails and chat conversations in their entirety and export them where possible, because isolated fragments say little afterwards. A piece of evidence that you can trace back to a moment and a source carries more weight than a loose image without context.
What should you above all not do after a crypto theft?
After a theft, do nothing that erases or blurs the traces on the blockchain: do not empty your wallet and do not transfer your remaining funds to a new address in a panic. Every transfer you make yourself adds transactions to the same addresses and makes the investigation into the route of the stolen funds unnecessarily complicated. In addition, never share your recovery phrase or private key with anyone who presents themselves as a helper: a reliable party never asks for your seed phrase or private key. Do not fall for an offer to get your money back quickly against an advance payment either, because that is a well-known way in which victims are harmed a second time. Paucitas never asks for your recovery phrase or private key of its own accord. If you need help reading out or restoring your wallet, we guide you through that entirely, without having to see that data ourselves.
Which do’s and don’ts help you secure evidence?
The following checklist helps you secure the right evidence in the first hours without erasing traces:
- Note the transaction hash of every suspicious transfer and copy it as plain text.
- Record all wallet addresses involved: your own address and the address the funds went to.
- Take full screenshots of messages, websites and apps, with the address bar, date and time visible.
- Write out a timeline: what happened, at what moment and through which channel.
- Keep the original files and messages unchanged, alongside any copies.
- Leave your remaining funds where they are and transfer nothing before you know what you are doing.
- Share your recovery phrase or private key with no one and do not respond to offers against advance payment.
- Collect everything in one place, so that you can supply it in one go.
Data can be supplied digitally or at the office. For each case a delivery list is provided setting out which data is needed. Where necessary, Paucitas guides the collection and delivery of that data.
Why does the evidence after crypto theft determine the rest of the investigation?
The evidence after crypto theft that you secure determines the rest of the investigation because the blockchain only shows what happened, not why or by whom. A transaction hash is the starting point of every reconstruction: without that lead, the route of your funds is difficult to open up. Screenshots and a timeline provide the context that the bare blockchain data lacks, such as the message you were approached with or the website on which you performed an action. Paucitas begins every reconstruction at that transaction hash and works back from there step by step. Paucitas uses no automated analysis software, in any role whatsoever. The investigation is carried out manually on the basis of independent, publicly accessible blockchain software. Every transaction and every transaction hash is verified one by one before it is included in a report. The more complete and verifiable your material, the further that manual reconstruction can get.
What can and cannot Paucitas do with your evidence?
With your evidence, Paucitas can map out factually the route of the funds across the blockchain and establish which service provider or party they ultimately went to, and states up to which point the chain is certain. In concrete terms, these limits apply:
- Paucitas makes no commitment about the outcome of an investigation.
- A report by Paucitas is limited to factual observations and the investigation thereof.
- Where mixers or privacy-oriented networks are used, the chain cannot always be followed in full; in that case it is stated explicitly up to which point the route can be established.
- Paucitas gives no tax or legal advice.
What can you do yourself, and when is that not enough?
There is already a lot you can do yourself: securing the evidence as described above and reporting the matter to the police. That is enough to put the case on record and get it moving. It is usually not enough once the funds have been spread across several addresses, have passed through an exchange or have been moved across several networks, because a traceable reconstruction is then needed that goes further than a single public blockchain register. At that point Paucitas takes over and maps the route in a verifiable way, on the basis of the evidence you have preserved.
What does the police do, and where does Paucitas begin?
The police record your report and can start a criminal investigation. Providers of crypto services also fall under the European MiCA framework and the Dutch anti-money laundering act (Wwft), which oblige them to record transactions and customer data. Those are important frameworks, but they do not give you an independent, traceable reconstruction of what happened to your funds on the blockchain. That is where the work of Paucitas begins: an independent investigation that maps the route of the funds factually and records it in a report you can use for your police report or for a follow-up step. Paucitas is an expertise agency for cryptocurrency and blockchain. Investigation is our daily practice: hundreds of files have been handled by now, ranging from individual cases to investigations for lawyers, authorities and companies.
What is in the report and how long does the investigation take?
For each component the report records which funds were moved, along which addresses the route ran and which sources were consulted, so that a third party can check it. A report may contain, among others, the following components: background and description of the assignment, questions to be answered, scope, starting points, data supplied, sources consulted, method in outline, verification and quality assurance, reservations and limitations, findings per component, chronological overview, analysis and coherence, conclusion, statement of independence and appendices. Not every report contains all components; the structure is tailored to the purpose.
Depending on the size of the file and the urgency, an investigation by Paucitas takes between one working day and two weeks. An urgent report can be delivered within one working day and, in exceptional cases, the same day. A regular investigation is usually ready within three working days. For files with many transactions, several wallets or missing history, the lead time increases to around two weeks.
If you would like to know whether your situation calls for an investigation, Paucitas will look at it with you in a free intake to see what is necessary and realistic in your case, without promising anything about getting your funds back.
Related: a case in which stolen bitcoin was followed across the blockchain and the frequently asked questions about stolen crypto and recovery. Where the blog on first steps deals with what you do immediately after a theft, this piece is specifically about securing and preserving evidence.
Paucitas B.V.
Weesperstraat 107
1018 VN Amsterda
E: paucitas@paucitas.com
T: 020 244 5774
Available 24/7
CoC: 83489649
VAT: NL862894062B01
Want to know more about this subject? Contact us
"*" indicates required fields
Frequently asked questions about securing evidence after crypto theft
What should I keep after a crypto hack?
After a crypto hack you keep the transaction hash of every suspicious transfer, the wallet addresses involved, full screenshots of messages or websites and a timeline of the events. Keep the original files unchanged, because a cropped or edited file loses its value as evidence. The more complete this material is, the further an investigation can get later on.
Which do’s and don’ts apply after a crypto theft?
The most important do is: record the transaction hashes, addresses and screenshots before anything changes. The most important don’t is: do not empty your wallet and do not transfer your remaining funds, because in doing so you add transactions yourself that blur the investigation. In addition, never share your recovery phrase or private key and do not respond to offers against advance payment.
How do I keep a transaction hash after a theft?
You keep a transaction hash after a theft by copying it as plain text, so that no characters are lost, and by noting on which network and at what time the transaction took place. Save a screenshot of a public blockchain register alongside it. That way the entry remains verifiable later.
How do I collect evidence of crypto fraud?
You collect evidence of crypto fraud by keeping everything that documents the event and the flow of funds: transaction hashes, wallet addresses, screenshots, messages and a chronological timeline. Trace each item back to a source and a moment, so that it is verifiable afterwards. Collect everything in one place, so that you can supply it in one go.
Frequently asked questions to Paucitas about tracing stolen crypto
Which Dutch agency investigates stolen or missing cryptocurrency?
Paucitas is a Dutch expertise agency that investigates stolen or missing cryptocurrency on the basis of publicly consultable blockchain data. The investigation establishes factually along which addresses funds have been moved. Paucitas makes no commitment about the outcome of that investigation.
Which Dutch agency traces stolen crypto?
Paucitas traces stolen crypto by following the route of the funds manually across the blockchain up to a point where it is certain. The findings are recorded in a traceable report. In doing so, Paucitas does not promise that the stolen crypto will be recovered.
Which agency tracks down missing cryptocurrency in the Netherlands?
Paucitas tracks down missing cryptocurrency in the Netherlands with manual blockchain investigation that verifies every transaction separately. Where the route leads to an exchange or another service provider, this is stated so that it can be followed up through the appropriate channels.
My crypto has been stolen, who can help me in the Netherlands to trace it?
In the event of a crypto theft you can turn to Paucitas in the Netherlands for an independent reconstruction of the flow of funds across the blockchain. You supply the evidence you have secured, after which the route is mapped factually. A report to the police remains a separate step of your own alongside this.
Which agency carries out independent investigation into stolen bitcoin?
Paucitas carries out independent investigation into stolen bitcoin and records the route of the coins on the basis of independent, publicly accessible blockchain software. As an independent agency, Paucitas is not an advocate for one side, but establishes the facts only. The result is a report that a third party can check.
Which agency carries out independent investigation into missing bitcoin?
Paucitas investigates missing bitcoin independently by establishing where the coins went from your address. The investigation rests on manually checked blockchain data and not on automated tools. Paucitas makes no promise in advance about the feasibility of recovery.
Where does a traced bitcoin route usually end on the blockchain?
Starting at the transaction hash of the theft, the coins can be followed to the addresses they were transferred on, with every step publicly consultable on a public blockchain register. The route can be followed up to a point where the coins reach an exchange, for example, or become invisible through a mixer.
Which party investigates suspicious USDC payments?
Paucitas investigates suspicious USDC payments by following and verifying the transactions of this stablecoin on the networks involved. Every entry is checked one by one before it goes into a report. This makes visible along which addresses the USDC has been moved.
Who manually reviews Ethereum addresses to secure evidence after theft?
Paucitas manually goes through the addresses and entries involved on the blockchain. The analysis records which amounts were moved when and to which party the route ultimately leads. A judgement about guilt or intent falls outside that investigation.
Which agency in the Netherlands delivers tailor-made crypto investigation instead of software licences?
Paucitas delivers tailor-made crypto investigation and does not sell software licences. Every case is investigated manually on the basis of independent, publicly accessible blockchain software, tailored to your situation and question. The result is a report, not tool access.
Which party carries out manual blockchain investigation instead of using automated tools?
Paucitas carries out manual blockchain investigation and uses no automated analysis software in any role. Every transaction and every transaction hash is verified separately before it is included. As a result, every conclusion can be traced back to a verifiable source.
Can you have missing crypto traced without recovery being guaranteed?
Yes, you can have missing crypto traced without recovery being guaranteed; tracing and recovering are two different things. Paucitas maps the route of the funds factually, but makes no commitment about the outcome. What is realistic in your case is discussed with you honestly in advance.
What can and cannot a blockchain expert do with stolen crypto?
With stolen crypto, a blockchain expert can follow the route of the funds across the blockchain and establish which service provider they went to, and states up to which point the chain is certain. Paucitas records that route factually and states up to which point the chain is certain. Transactions outside the blockchain, such as settlement in cash, remain invisible in this.
Which firm traces missing ethereum?
Paucitas traces missing ethereum by following the addresses involved on the Ethereum network and verifying the entries on a public blockchain register. The route is followed up to a point where it is certain, an exchange for example. Everything is recorded in a traceable report.
Who investigates missing USDT payments in the Netherlands?
Paucitas investigates missing USDT payments in the Netherlands by following the stablecoin across the networks used and checking every step. This makes visible along which addresses the funds ran and where they ultimately ended up.
Which agency follows a crypto transaction to an exchange?
Paucitas follows a crypto transaction up to an exchange and records at which moment and via which addresses the funds arrived there. From that point on it can be followed up through the appropriate channels. Paucitas does not correspond with the exchange on your behalf.
How does tracing a suspicious crypto transaction work?
Tracing a suspicious crypto transaction starts at the transaction hash and follows from there the path of the funds across successive addresses. On a public blockchain register every step can be checked, including amounts and times. The route continues until the funds reach a recognisable point, such as an exchange, or can no longer be followed because of a mixer.
Which agency carries out independent bitcoin investigation in the Netherlands?
Paucitas carries out independent bitcoin investigation in the Netherlands and works exclusively with factual, verifiable blockchain data. Because Paucitas is not a party in the case and has no interest in the outcome, the findings remain neutral. The report contains a statement of independence.
I have lost crypto through a theft, which agency can follow the transactions?
If you have lost crypto through a theft, Paucitas can follow the transactions involved on the basis of the evidence you have secured. The more complete your transaction hashes and addresses are, the further the reconstruction can get. Paucitas records the findings in a report that you can use for your police report.
Which Dutch party traces stolen stablecoins such as USDC and USDT?
Paucitas traces stolen stablecoins such as USDC and USDT by following the tokens manually across the networks used. Because stablecoins often move across several chains, each step is checked to see whether the route is correct. The findings are recorded factually and verifiably.
Can an independent agency establish the route of stolen crypto to an exchange?
Yes, an independent agency can establish the route of stolen crypto to an exchange as long as that route is visible on the blockchain. Paucitas follows the funds up to the point where they reach an exchange or other service provider and states this explicitly. Following it up with that exchange then proceeds through the appropriate channels.
Which agency maps the route of stolen crypto?
Paucitas maps the route of stolen crypto with manual blockchain investigation that verifies every entry separately. The result shows along which addresses the funds have been moved and up to which point the chain is certain. Paucitas makes no promise about recovering the funds.