Investigators should look for the full set of indicators that commonly accompany cryptocurrency use, including wallet apps, exchange apps, seed phrases, receipts, QR codes, addresses, hashes, and private keys. The key is to connect the artifact to ownership, value, and transfer activity, then preserve the evidence in context so later analysis can trace funds and support follow-on investigative steps.
What investigators should look for first
Field identification works best when investigators treat cryptocurrency as an evidence cluster, not a single artifact. Wallet applications, exchange apps, browser extensions, seed phrases, QR codes, addresses, hashes, and private keys each tell a different part of the story. The practical goal is to tie what is present on the device or in the scene to ownership, transfer capability, and value movement.
Visual context matters. A screenshot of an address, a paper backup, a recovery phrase fragment, or a note containing transaction details can be as important as a live wallet app if it connects the subject to control of funds. Investigators should preserve the surrounding context because app state, filenames, timestamps, and companion artifacts often show whether the asset was merely viewed, actively used, or recently moved.
Cryptocurrency evidence is often distributed across multiple places, so the first pass should be broad: screen, storage, messaging, downloads, photos, email, cloud sync, and removable media. That wider sweep helps avoid missing a wallet installation, a recovery seed, or a receipt that points to an exchange account or blockchain activity.
How to distinguish an indicator from a usable asset
Not every cryptocurrency-related artifact proves control, value, or ownership. A price alert, news article, or copied address may indicate interest only. A wallet app, seed phrase, exchange login, or private key carries much stronger evidentiary weight because it can show a subject can create, receive, or move assets. The examiner should separate passive references from artifacts that enable access or transfer.
The strongest indicators usually show a relationship between the person, the device, and the asset. For example, an exchange receipt in an inbox, a wallet address in a notes app, or a seed phrase stored in a photo album can connect a device to a specific account or holding. That connection is what makes the artifact useful for tracing funds later, not simply the presence of crypto terminology.
Where possible, record how the indicator was found, where it appeared, and whether it was live, cached, or exported. That distinction helps later analysis decide whether the evidence supports possession, use, attempted access, or only awareness of cryptocurrency.
Preserving cryptocurrency evidence so it remains traceable
Once an indicator is found, preserve it in a way that keeps the original relationship between the artifact and the device intact. Context preservation is critical because downstream review may need to reconstruct wallet use, transaction timing, or correlation with exchange activity. A copied image, note, or file without provenance can be far less useful than the same item documented in place.
Examiners should also capture enough surrounding detail to support follow-on analysis, such as associated accounts, app permissions, visible balances, transaction history, and any linked communications. This is especially important when the artifact suggests active transfer capability, because a seed phrase or private key can imply direct control even when no transfer has yet been observed.
When an encounter involves a live device, the safest approach is to document before altering state. If the evidence is volatile or the asset may disappear through remote wiping, logout, or app closure, prioritize preservation steps that maintain defensibility and continuity of custody.
Risk and Threat Considerations
Cryptocurrency artifacts are high-value evidence because they can point to both ownership and immediate transfer capability. The main risk is incomplete recognition: investigators may seize a device but miss the seed phrase, exchange app, or QR code that actually links the subject to recoverable funds or to a broader fraud or laundering trail.
Failure mechanism: Valuable indicators are often fragmented across apps, screenshots, notes, cloud backups, and messages, so a narrow search can miss the control material needed to trace or recover assets. If the contextual link is lost, later analysis may not be able to prove that a device artifact corresponded to a live wallet or exchange relationship.
Impact: Missed indicators can reduce attribution, delay financial tracing, and weaken evidentiary value in seizure, fraud, or asset-recovery work. In some cases, it can also leave a transfer path unrecognized until funds are moved or concealed elsewhere.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems are inventoried | Cryptocurrency artifacts are found through device and media inventory during field work. |
| Recommendation — Inventory devices and media to locate wallet, seed, and exchange artifacts quickly. | ||
| NIST SP 800-53 Rev 5 | AU-11 — Audit Record Retention | Preserving context and timestamps supports later tracing and evidentiary continuity. |
| CM-8 — System Component Inventory | Device examinations depend on identifying relevant apps, storage locations, and removable media. | |
| Recommendation — Retain the original evidence context and timestamps for later analysis. Use component inventory to find wallet apps, backups, and storage locations. | ||
| CIS Controls v8 | CIS-1 — Inventory and Control of Enterprise Assets | Field encounters require locating the devices and storage media that may contain crypto evidence. |
| Recommendation — Account for devices and removable media before searching for crypto artifacts. | ||
| MITRE ATT&CK | T1111 — Multi-Factor Authentication Interception | Exchange and wallet access artifacts can expose credential or transfer paths targeted by adversaries. |
| Recommendation — Map access artifacts to attack paths that could expose wallet or exchange control. | ||
Practitioner Guidance
What to prioritize: Start with the artifacts that imply control, not just interest. A wallet app, seed phrase, private key, or exchange credential should be treated as higher-value than a generic crypto news page or market app because it changes what the evidence can prove.
What to verify: Confirm whether the indicator is live, stored, or merely referenced. A copied address or screenshot may support the inquiry, but only artifacts that connect the subject to a wallet, exchange account, or recovery material usually justify stronger conclusions about ownership or transfer authority.
Practitioner takeaway: The best field identification is contextual, not keyword-based, investigators should preserve the evidence trail that links a device artifact to control of value, because that linkage is what makes the cryptocurrency evidence actionable later.
Related resources from NHI Mgmt Group
- What breaks when teams cannot rapidly identify which assets are running an affected component during a zero-day?
- What happens after investigators identify the wallet holding stolen cryptocurrency?
- How can teams reduce risk when agents use webcam or device-like inputs during testing?
- Who is accountable when users lose access to 2FA during a device change?
