Evidence Preservation After Sending Cryptocurrency to a Fraud Address

You have a ten-minute window. Grab the chat history and the phishing page now. Those vanish first. The blockchain record is durable and will outlast both, so the transaction hash and the full scam wallet address come next. Save them. Then capture every message from the fraudster before the account gets banned or the chat is deleted. Screenshots are not enough. You need the raw text, the full email headers if communication happened by email, and the exact URL if a fake page was involved. Speed matters. Chat platforms and hosted phishing kits become unavailable in hours, not days.

Continue with the section overview or a closely related question:

• After exposure
• What if I downloaded a suspicious file?
• What if a scammer threatens to expose me?

Export the Transaction Hash and Receiving Address

A wallet drain happens when malware rewrites a copied address or when you authorize a transfer to a fraudster directly. Export the transaction hash from your wallet software immediately. Copy the receiving address into a plain text file. Do not rely on the exchange or wallet interface remaining accessible. If a clipboard hijacker is involved, note the exact time you copied the address and the address you intended to send to. The mismatch is the proof. Info-stealer infections that enable wallet drains often run undetected for weeks, so preserving the evidence also means capturing any unusual process names or scheduled tasks you notice, even if you do not understand them yet.

Why the Full Address Matters

Chainalysis and CipherTrace both publish typologies confirming that address reuse is one of the strongest clustering signals for investigators. One scam address appearing across multiple victim reports ties incidents together. That is why the full address, not a truncated version, must be saved. If the scammer used address poisoning, you will see a tiny incoming transfer from a lookalike address in your history. Save that too. The attacker initiated contact on-chain to seed a copy-paste error, and the poisoned address is the fingerprint.

An advance-fee scam demands repeated payments before a promised payout or shipment materializes. The loss per incident is smaller than a wallet drain, but the fee escalation count can run to five or six demands before refusal. Each payment produces a new transaction hash and a new piece of evidence. Preserve every one of them in sequence. The chat log showing the escalating demands is the critical context. Without it, the ledger shows only a series of payments that could be voluntary.

Getting funds back is rare. The design of the payment rail means no central authority can reverse a confirmed transfer. Anyone who contacts you offering guaranteed recovery for an upfront fee is running a recovery scam. The advance-fee logic is constant: the promise of a larger payout justifies a smaller upfront payment, and each payment justifies the next. The moment you pay a recovery scammer, you enter a second fraud cycle on top of the first.

Where to File

Official reporting is jurisdiction-bound. In the United States, the primary intake is the IC3. In the United Kingdom, it is Action Fraud. Both agencies aggregate reports to identify patterns, but a single report rarely triggers an investigation unless the loss exceeds a threshold that shifts with policy and funding. Report anyway. The victim reporting rate for darknet-adjacent fraud is suppressed by shame and low expectations of getting money back, which skews public aggregate data and hides the true scale of the problem.

What to Include

When you file, provide the transaction hash, the scam wallet address, the platform where the address was provided, and the full communication history. Screenshots without metadata are weak. If you have email headers, include them. If the fraudster used an impersonator account on a social or forum platform, note the exact username and the channel where contact moved off-platform. Attribution is difficult because infrastructure often crosses jurisdictions, but address reuse and off-platform contact pressure are durable signals that help investigators cluster cases.

Address poisoning is a specific attack where a scammer sends a small transfer from a wallet crafted to look like one you recently interacted with. The goal is to trick you into copying the lookalike address from your transaction history instead of your own address book. The distinguishing feature is the lookalike address itself, which will match the first and last few characters of a legitimate counterparty address but differ in the middle. Ordinary dust transfers are random and not designed to resemble a known address.

The response is threefold. First, save the poisoned transaction hash and the scammer's address. Second, hide or ignore the poisoned entry in your wallet interface so you do not accidentally copy it later. Third, never copy wallet addresses from transaction history. Always use a saved address book entry or verify every character manually. Clipboard hijacker malware exploits the same copy-paste moment, making visual verification the only reliable control.

A recovery scam is a secondary fraud targeting victims with promises to recover lost funds. The distinguishing feature is the upfront fee demand before any action is taken. Legitimate blockchain analysis firms like Chainalysis and CipherTrace do not offer recovery services to individuals, and no legitimate investigator guarantees results. A victim population guarantees a secondary fraud population offering recovery, and the promise of on-chain tracing sounds plausible enough to extract another payment.

Recovery scammers pose as law enforcement, exchange support, or tracing firms. They use fake support ticket replies that arrive faster than a real team would respond, and they demand off-platform contact or payment to resolve the case. Real support does not ask for fees to process a fraud report. If you have already paid a recovery scammer, preserve that trail too and include it in your report to the IC3 or Action Fraud. It forms part of the same victimisation pattern.

Official reporting will not reverse your transfer. The ledger is visible, but tracing is often blocked by chain-hopping, mixers, and exchange non-cooperation. What reporting can do is add your incident to a growing pattern. When the same wallet appears across twenty IC3 complaints, the FBI has a cluster. When a phishing kit backend exfiltrates credentials to the same server across hundreds of victims, the National Crime Agency has a target. The public report granularity in annual fraud reports from these agencies lags incidents by months, but the aggregate data shapes policy and resource allocation.

Report to the agency in your jurisdiction even if the scammer appears to be overseas. The IC3 forwards reports to relevant field offices and international partners where thresholds are met. Action Fraud passes actionable intelligence to the National Fraud Intelligence Bureau. The process is slow. Most individual reports will not receive a follow-up. The alternative is a victim reporting rate so low that darknet-adjacent fraud is systematically undercounted.

Impersonation follows trust. Fraudsters clone whatever or whoever users already trust, so the attack surface moves with reputation rather than being fixed. The distinguishing feature of an impersonator vendor or support agent is the channel of contact. Legitimate market or service staff rarely initiate off-platform payment or credential requests. If someone claiming to be support asks you to move to a messaging app and demands a fee to release funds or resolve a ticket, that is a fake support ticket or advance-fee scam.

Impersonator accounts use aged profiles, stolen verification badges, or cloned legitimate profiles to appear credible. Verification checks identity documents, not intent. The only durable defense is to initiate contact through a saved, verified channel yourself, never through a link or handle someone else provides. Takedown is not disruption. Removing an impersonator account does not stop the actor, who re-registers with new infrastructure within days.

Export Chat Logs Immediately

Chat platforms strip metadata and delete messages, making preservation time-critical. Export the entire conversation as a text file or PDF from within the app before the other party deletes it or the account is banned. If the platform does not offer an export feature, take full-page scrolling screenshots that capture timestamps, usernames, and the full message text. Screenshots alone are weak because they lack metadata, but they are better than nothing when the original messages are gone.

Save the Phishing Page Source

For a phishing mirror, save the full URL and the page source. Right-click the page and select "Save As" to capture the HTML and associated files while the domain is still live. Phishing domains are taken down in hours or days, but the takedown responsiveness depends more on reporter authority than on technical merit. A saved page source can be analyzed later for the phishing kit backend address, which is often reused across many mirrors and provides a stronger attribution signal than the front-end domain.

If a wallet drain or credential theft involved malware, evidence preservation includes the device itself. Do not reinstall the operating system or run aggressive cleanup tools before capturing forensic artifacts. An info-stealer or remote access trojan persists through scheduled tasks or registry keys that survive reboots. The infection may have exfiltrated session tokens that bypassed your two-factor authentication entirely. Session token theft works while the token remains valid and may not trigger a login alert, because no password change occurred.

Disconnect the device from the network to stop further exfiltration, but leave it powered on. A forensic examiner can capture memory artifacts that are lost on shutdown. If professional forensics is not an option, at minimum note the date you first noticed unusual account activity, any unfamiliar processes in Task Manager, and any unexpected password reset notifications. Those timestamps correlate with the malware deployment window and help investigators narrow the infection vector.