Evidence Collection Guide
When reporting crypto-related incidents, the verifiability of data is more important than the volume of text.
Use this guide to organize your evidence into a format that law enforcement can act upon.
This guide is designed to help you present a neutral, technical baseline that maximizes the chances of legal action.
Important Notice
Before gathering your data, review the Avoiding Distraction Narratives.
Ensure your evidence is based on proven on-chain events, not speculative social media claims.
Privacy vs Disclosure: The Balance
Providing your wallet address is essential for verifying your loss, but you must understand that a wallet address is a permanent link to your on-chain history.
Be Mindful: Investigators (and any parties with access to the report) will see all past and future transactions associated with that wallet.
The Trade-off: While sharing your wallet address is technically optional, omitting it may cause investigators to disregard your report due to a lack of verifiable standing.
If you prefer not to disclose your on-chain history in the initial filing, you may provide only the transaction amounts and dates, stating:
Detailed transaction hashes, specific wallet addresses, and ownership verification will be provided directly to the investigator upon request to maintain financial privacy.
This maintains a balance between privacy and cooperation, though it may slightly delay the verification process.
What to Include
Specific Asset Details
Clearly state the asset name and exact amount (e.g., "450.25 SOL").
Visual Evidence
Optionally, attach screenshots of your protocol "Portfolio" view.
Note: You may optionally blur or redact sensitive personal information (such as wallet address or account name) as long as other data and amounts remain clearly legible.
Do NOT Include
Private Keys / Seed Phrases: NEVER share these. Law enforcement will never ask for them. If someone does, they are attempting to scam you.
Speculative Accusations: Do not guess the identity of the perpetrators.
Irrelevant Personal History: Avoid detailing your personal life or general feelings about the crypto market. Keep the description strictly financial and technical.
Community Resources
A collective effort has been made to document the technical forensics of incident.
All data in this repository is based on publicly verifiable on-chain movements.
If you have reviewed the findings and agree with the documented evidence, you may reference our technical repo Community Investigation Repository to help investigators understand the broader scope of the exploit.
If you find the community-led technical analysis consistent with your experience, you may include the following statement:
For a comprehensive technical analysis and related verifiable evidence concerning this incident, which I have reviewed and believe to be accurate, please refer to the affected users' community-led forensics repository:
https://github.com/DriftVictimsCommittee/drift-forensicsPractical Advice
Mass-Victim Context
When filing, explicitly state that this is part of a "mass-victim cryptocurrency exploit." This helps agencies group your report with others, significantly increasing the priority of the case.