Crypto scam evidence: wallet addresses and transaction hashes

Understand the two main references

A public address is a reference associated with activity on a blockchain network. A transaction hash identifies a particular transaction on that network. They answer different questions: an address helps identify the reference used for a payment, while a hash points to a specific transaction record. Ethereum's transaction documentation describes fields such as sender, recipient, value, and transaction data.

Always record the network. An address or token name on its own can be ambiguous, especially when an asset is available on more than one network. Copy references from your own wallet or exchange history where possible and note the source. If you only have a reference supplied by someone else, say so.

Sources: Ethereum documentation: Transactions

Create one record for each payment

Give the record an evidence reference, then link it to the corresponding event in your timeline. Keep the original exchange withdrawal confirmation as well as the public transaction reference. If an exchange shows an internal transfer rather than a blockchain transaction, record the internal reference exactly and explain that no public hash is available.

When the exchange record and explorer do not seem to match

These are checks to resolve a mismatch, not reasons to assume one explanation is correct. Ethereum's documentation explains the distinction between an ETH transfer and a call to contract code. Its field definitions apply to Ethereum; use the relevant network's records for another chain.

Read public records without connecting a wallet. Keep the original exchange export beside your notes. If you cannot reconcile an entry, preserve both versions and describe the question rather than editing the records to agree.

Sources: Ethereum documentation: Transactions

Worked example: a useful review question

Fictional example, with no live address: E-010 is my exchange withdrawal confirmation. It records the asset, network, amount and public hash. E-011 is the message that supplied the destination. The recipient reference on E-010 matches that message. Please explain what the public transaction supports and which identity or control claims remain unverified.

This links an instruction to a payment without naming the destination's owner as a proven fact. If the references differ, say that instead. A later screenshot of an address balance should have its own capture date and source; it cannot by itself identify your money within that balance or establish that anyone can return it.

Separate a visible trail from control of funds

A transaction record is not a finding that a named person owns an address. A screenshot showing funds at an address is not proof that those funds can be returned to you. Record what the evidence shows and leave conclusions about identity, control, and available action to a documented review.

The FBI warns that private recovery companies cannot issue cryptocurrency seizure orders. A tracing report and the legal or institutional steps needed to obtain funds are different things. Ask what evidence supports an assessment and which organization would need to act on it.

Sources: FBI IC3: Cryptocurrency recovery schemes

Use a consistent verification routine

Start from your own transaction history. Compare the full reference when copying it, rather than relying on the first and last characters. Save the record in your case file and note where you obtained it. If a reviewer asks you to clarify a network or amount, update your notes while keeping the original source.

Treat a transaction reference sent by the person you are reporting as a claim to check, not as confirmation on its own. Do not connect your wallet or sign a transaction merely to create a case report. Justice Point records public references; its reporting flow does not need the ability to move cryptocurrency.

Present the evidence with a clear question

For each payment, explain what you need the team to understand. For example: this was the exchange withdrawal used to fund the account; this message supplied the destination; this screenshot showed a claimed balance afterward. That context is more useful than a list of unexplained addresses.

In your client area, add the public wallet reference, upload the relevant transaction records, and use Messages to point the reviewer to the matching evidence. Keep reported loss, any traced amount, and confirmed returns separate. Your assessment should explain both the findings and their limits.