Organizing records after a suspected crypto loss

Preserve the original context

Keep original records where possible. Save communications with dates, sender details and the surrounding conversation. A cropped screenshot may omit information that later helps explain the event. Keep originals separate from annotated working copies.

Build a simple chronology

• Record when contact began and the platform or account used.
• List relevant payments with dates, amounts, currency and transaction identifiers where available.
• Note promises, withdrawal requests, additional payment demands and changes in account access.
• Record any reports already made and the reference provided by the receiving organization.

Keep identifiers accurate

Copy transaction identifiers and wallet addresses carefully. Preserve exact domains and profile links rather than substituting a similar brand name. If a site impersonated another business, record both the impersonating address and the distinction from the legitimate entity.

Limit initial disclosure

An assessment enquiry needs a short summary, not your full evidence archive. Do not upload wallet secrets, account passwords or identity documents to an unsolicited link. Agree the recipient, purpose and transfer method before sending detailed records.

Avoid editing away useful evidence

Preserve original files and note any annotations or conversions. If a device or account may be compromised, consider appropriate independent technical advice before taking actions that could destroy relevant records.