[{"data":1,"prerenderedAt":3114},["ShallowReactive",2],{"article-preserving-crypto-native-esi":3,"content-query-vflvk2FekF":644,"related-preserving-crypto-native-esi":1102},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"slug":10,"date":11,"lastUpdated":11,"author":12,"readingTime":13,"category":14,"tags":15,"ogImage":21,"featured":6,"body":22,"_type":638,"_id":639,"_source":640,"_file":641,"_stem":642,"_extension":643},"\u002Farticles\u002F30-preserving-crypto-native-esi","articles",false,"","Preserving crypto-native ESI before it disappears","Preserve crypto-native evidence before it disappears: wallets, devices, exchange records, and browser data, with a defensible hold and Rule 37(e) context.","preserving-crypto-native-esi","2026-07-04","Nick Kampe",12,"Methodology",[16,17,18,19,20],"e-discovery","litigation-hold","spoliation","evidence-preservation","wallet","\u002Fog\u002Fpreserving-crypto-native-esi.png",{"type":23,"children":24,"toc":610},"root",[25,33,55,62,67,105,111,126,140,145,151,164,169,192,213,219,249,254,287,293,300,305,311,316,322,327,333,338,344,358,364,378,392,397,403,409,461,467,495,501,514,520,526,537,543,552,558,567,573,582,588,597],{"type":26,"tag":27,"props":28,"children":29},"element","p",{},[30],{"type":31,"value":32},"text","A wallet's transaction history can outlive the apps that produced it, but the evidence that gives it meaning rarely does: the wallet app, the browser extension, the exchange dashboard, the signed message, the device clock. This is crypto-native ESI: it exists only in software, with no paper equivalent. The public ledger may persist for decades; the context needed to interpret control, intent, and application state can disappear within days of a party learning they are under scrutiny.",{"type":26,"tag":27,"props":34,"children":35},{},[36,38,45,47,53],{"type":31,"value":37},"That ephemerality is the operational question: when the preservation duty attaches, what must be saved, in what order, and how, without mishandling private keys? ",{"type":26,"tag":39,"props":40,"children":42},"a",{"href":41},"\u002Fresources\u002Fcommon-mistakes-crypto-investigations",[43],{"type":31,"value":44},"Common Mistakes in Cryptocurrency Investigations",{"type":31,"value":46}," catalogs errors that compromise a case, and ",{"type":26,"tag":39,"props":48,"children":50},{"href":49},"\u002Fresources\u002Fself-custody-vs-custodial-wallets",[51],{"type":31,"value":52},"Self-Custody vs. Custodial Wallets",{"type":31,"value":54}," maps the evidence profile of each custody model; this article supplies the affirmative workflow both skip. The frame is U.S. federal civil practice; state courts, regulatory proceedings, and criminal matters apply different standards.",{"type":26,"tag":56,"props":57,"children":59},"h2",{"id":58},"what-counts-as-crypto-native-esi",[60],{"type":31,"value":61},"What Counts as Crypto-Native ESI",{"type":26,"tag":27,"props":63,"children":64},{},[65],{"type":31,"value":66},"Inventory all five evidence systems before any collection happens. Analysis can wait; the artifacts cannot.",{"type":26,"tag":68,"props":69,"children":70},"ul",{},[71,77,90,95,100],{"type":26,"tag":72,"props":73,"children":74},"li",{},[75],{"type":31,"value":76},"Public ledger infrastructure: chains, block explorers, archival nodes, indexers. Durable, pseudonymous, reproducible by anyone.",{"type":26,"tag":72,"props":78,"children":79},{},[80,82,88],{"type":31,"value":81},"Custodial platforms: exchanges, custodians, on-ramps and off-ramps. Internal ledgers (many exchanges pool customer funds and track balances off-chain), KYC files, IP logs, and support tickets are institutional records reached through legal process. See ",{"type":26,"tag":39,"props":83,"children":85},{"href":84},"\u002Fresources\u002Fsubpoenaing-cryptocurrency-exchange-records",[86],{"type":31,"value":87},"Subpoenaing Cryptocurrency Exchange Records",{"type":31,"value":89},".",{"type":26,"tag":72,"props":91,"children":92},{},[93],{"type":31,"value":94},"Client devices: phones, laptops, tablets, hardware wallets. Wallet app data, browser extensions, notes, password managers, and transaction files live here; the custody model decides how much exists on device versus platform.",{"type":26,"tag":72,"props":96,"children":97},{},[98],{"type":31,"value":99},"Application-layer records: dApp dashboards, portfolio trackers, tax exports, API responses.",{"type":26,"tag":72,"props":101,"children":102},{},[103],{"type":31,"value":104},"Communications: email, messaging, exchange support threads, where control, knowledge, and intent are expressed in plain language.",{"type":26,"tag":56,"props":106,"children":108},{"id":107},"what-the-chain-keeps-and-what-it-cannot",[109],{"type":31,"value":110},"What the Chain Keeps, and What It Cannot",{"type":26,"tag":27,"props":112,"children":113},{},[114,116,124],{"type":31,"value":115},"Public chain records are effectively permanent and reproducible from archival sources years later. That durability matters under Rule 37(e) of the ",{"type":26,"tag":39,"props":117,"children":121},{"href":118,"rel":119},"https:\u002F\u002Fwww.uscourts.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fdocument\u002Ffederal-rules-of-civil-procedure.pdf",[120],"nofollow",[122],{"type":31,"value":123},"Federal Rules of Civil Procedure, as amended through December 1, 2025",{"type":31,"value":125},", which governs ESI that \"cannot be restored or replaced through additional discovery.\" Since on-chain data can almost always be restored or replaced, spoliation disputes center on what the ledger never recorded: wallet app state, extension storage, cached balances, API responses, session data, and the local time and timezone settings that place activity in time.",{"type":26,"tag":27,"props":127,"children":128},{},[129,131,138],{"type":31,"value":130},"The collection-order principle is the order of volatility in ",{"type":26,"tag":39,"props":132,"children":135},{"href":133,"rel":134},"https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc3227.txt",[120],[136],{"type":31,"value":137},"RFC 3227",{"type":31,"value":139},", the IETF guideline on evidence collection: proceed from the most volatile to the least, minimize changes, record the device clock's drift, and keep notes detailed enough to testify from years later. For crypto that runs from live screens and signed outputs, to application databases, to device images, to chain data. Chain analysis can wait a month; a phone that auto-updates, a browser that syncs, or a managed device with remote wipe cannot.",{"type":26,"tag":27,"props":141,"children":142},{},[143],{"type":31,"value":144},"Hypothetical example: A dispute turns on whether a party ever received or controlled an airdropped token that later moved to an exchange. The chain proves the tokens arrived and moved within a week; the dispositive questions are when the party knew and who controlled the wallet. On the day the dispute becomes foreseeable, counsel issues a hold covering the phone, browser profiles, and exchange account; the phone goes to airplane mode; the app database and extension state are hashed; the device clock is recorded; preservation letters go to the exchange. Months later the chain is rebuilt from public indexes and the exchange produces its records; the phone yields the install date and activity logs. A screenshot at filing captures none of that.",{"type":26,"tag":56,"props":146,"children":148},{"id":147},"collecting-secrets-without-compromising-them",[149],{"type":31,"value":150},"Collecting Secrets Without Compromising Them",{"type":26,"tag":27,"props":152,"children":153},{},[154,156,162],{"type":31,"value":155},"A seed phrase is the master credential for a self-custody wallet: a fixed list of words, commonly 12 or 24 under the BIP-39 mnemonic standard, encoding the private keys so a holder can restore the wallet and spend it. The cardinal rule: never collect it by importing it; importing mutates application state and spreads the credential. How control is proven without key material is covered in ",{"type":26,"tag":39,"props":157,"children":159},{"href":158},"\u002Fresources\u002Funderstanding-wallet-ownership-evidence",[160],{"type":31,"value":161},"Understanding Wallet Ownership Evidence",{"type":31,"value":163},". If a phrase or key file is found, preserve the medium in place: photograph where it was found, note who had access, secure it physically, and never transcribe it into case files or email.",{"type":26,"tag":27,"props":165,"children":166},{},[167],{"type":31,"value":168},"What you can collect safely:",{"type":26,"tag":68,"props":170,"children":171},{},[172,177,182,187],{"type":26,"tag":72,"props":173,"children":174},{},[175],{"type":31,"value":176},"Signed messages: a cryptographic signature from an address proves control without revealing the key or moving funds. The most useful non-destructive step.",{"type":26,"tag":72,"props":178,"children":179},{},[180],{"type":31,"value":181},"Secret metadata: file names, modification dates, and which app or vault holds the material, without contents, and when a vault was created or last accessed if determinable without opening it.",{"type":26,"tag":72,"props":183,"children":184},{},[185],{"type":31,"value":186},"Hardware-wallet presence: model, serial, firmware version, connection history. Keys generally cannot be extracted by standard forensic means, and resetting the device destroys the association between it and the addresses it controlled.",{"type":26,"tag":72,"props":188,"children":189},{},[190],{"type":31,"value":191},"Wallet application configuration and logs, excluding key databases.",{"type":26,"tag":27,"props":193,"children":194},{},[195,197,203,205,211],{"type":31,"value":196},"Key material is the one category where production itself is a harm: any handler gains the ability to move the client's entire estate, so extraction should be court-sanctioned, performed by an examiner under a defined protocol, and produced under seal or to a neutral. Designate who may touch it: a forensic examiner in a controlled, documented environment, and no one else. ",{"type":26,"tag":39,"props":198,"children":200},{"href":199},"\u002Fservices#evidence-review",[201],{"type":31,"value":202},"ConsensusIntel's evidence review services",{"type":31,"value":204}," are structured so collection never requires counsel to hold the keys, and our ",{"type":26,"tag":39,"props":206,"children":208},{"href":207},"\u002Fmethodology",[209],{"type":31,"value":210},"methodology",{"type":31,"value":212}," documents acquisitions end to end.",{"type":26,"tag":56,"props":214,"children":216},{"id":215},"documentation-that-survives-cross-examination",[217],{"type":31,"value":218},"Documentation That Survives Cross-Examination",{"type":26,"tag":27,"props":220,"children":221},{},[222,224,229,231,238,240,247],{"type":31,"value":223},"A defensible collection is reproducible and explainable. ",{"type":26,"tag":39,"props":225,"children":227},{"href":133,"rel":226},[120],[228],{"type":31,"value":137},{"type":31,"value":230}," requires transparent, reproducible methods and documented chain of custody, with notes detailed enough to testify from years later. ",{"type":26,"tag":39,"props":232,"children":235},{"href":233,"rel":234},"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F86\u002Ffinal",[120],[236],{"type":31,"value":237},"NIST SP 800-86",{"type":31,"value":239},", the federal incident-response forensics guide (August 2006), applies the same discipline across hosts, applications, and network sources, from volatile to non-volatile data. ",{"type":26,"tag":39,"props":241,"children":244},{"href":242,"rel":243},"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F101\u002Fr1\u002Ffinal",[120],[245],{"type":31,"value":246},"NIST SP 800-101 Rev. 1",{"type":31,"value":248}," (May 2014) defines preservation for mobile devices as maintaining custody without altering data, treats it as the first step in recovery, and warns that tool support varies with the operating system version and device family.",{"type":26,"tag":27,"props":250,"children":251},{},[252],{"type":31,"value":253},"Every acquisition should record:",{"type":26,"tag":68,"props":255,"children":256},{},[257,262,267,272,277,282],{"type":26,"tag":72,"props":258,"children":259},{},[260],{"type":31,"value":261},"Who collected, what, when, where, and by what method.",{"type":26,"tag":72,"props":263,"children":264},{},[265],{"type":31,"value":266},"Device and software identifiers: operating system build, wallet app version, extension versions, firmware.",{"type":26,"tag":72,"props":268,"children":269},{},[270],{"type":31,"value":271},"Chain identifiers: mainnet versus testnet is a routine source of confusion; record the chain ID, block height range, and the source used.",{"type":26,"tag":72,"props":273,"children":274},{},[275],{"type":31,"value":276},"Time source: device clock, timezone, network time, and observed drift at acquisition. Block timestamps are consensus-claimed times, not precise clocks; correlating them with device logs requires both offsets.",{"type":26,"tag":72,"props":278,"children":279},{},[280],{"type":31,"value":281},"Hash digests, for example SHA-256, of every image and export, computed at collection and again at handoff.",{"type":26,"tag":72,"props":283,"children":284},{},[285],{"type":31,"value":286},"Custody history: who held each device or exhibit, when, and how transfers occurred.",{"type":26,"tag":56,"props":288,"children":290},{"id":289},"five-threats-between-the-hold-and-the-expert",[291],{"type":31,"value":292},"Five Threats Between the Hold and the Expert",{"type":26,"tag":294,"props":295,"children":297},"h3",{"id":296},"remote-wipe-and-managed-devices",[298],{"type":31,"value":299},"Remote wipe and managed devices",{"type":26,"tag":27,"props":301,"children":302},{},[303],{"type":31,"value":304},"Managed phones can be remotely wiped on command, and NIST SP 800-101 describes device applications written to trigger exactly that. Isolate devices from networks immediately, suspend remote-wipe commands with IT first, and record network state at seizure.",{"type":26,"tag":294,"props":306,"children":308},{"id":307},"automatic-updates",[309],{"type":31,"value":310},"Automatic updates",{"type":26,"tag":27,"props":312,"children":313},{},[314],{"type":31,"value":315},"Wallet apps and browser extensions update silently, rewriting local databases and changing versions. Where the user cooperates, disable auto-update before collection and snapshot the pre-update state; otherwise, ask about update history in discovery.",{"type":26,"tag":294,"props":317,"children":319},{"id":318},"cloud-sync",[320],{"type":31,"value":321},"Cloud sync",{"type":26,"tag":27,"props":323,"children":324},{},[325],{"type":31,"value":326},"Cloud services synchronize photos, notes, and vaults across devices; deletions propagate automatically, but backups are also a preservation source when a device is gone or reset. Map what syncs before anyone changes a setting, and cover the backup account in the hold.",{"type":26,"tag":294,"props":328,"children":330},{"id":329},"browser-extension-data",[331],{"type":31,"value":332},"Browser-extension data",{"type":26,"tag":27,"props":334,"children":335},{},[336],{"type":31,"value":337},"Wallet browser extensions keep authoritative state in local storage and profiles: connected sites, activity logs, account addresses, settings. That state is often the only surviving record of how a wallet was used. Preserve it in place or by forensic copy and record the extension version; popup screenshots are documentation, not collection.",{"type":26,"tag":294,"props":339,"children":341},{"id":340},"exchange-retention-and-account-closure",[342],{"type":31,"value":343},"Exchange retention and account closure",{"type":26,"tag":27,"props":345,"children":346},{},[347,349,356],{"type":31,"value":348},"Institutional records have their own clocks. Under ",{"type":26,"tag":39,"props":350,"children":353},{"href":351,"rel":352},"https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F31\u002F1010.430",[120],[354],{"type":31,"value":355},"31 C.F.R. § 1010.430(d)",{"type":31,"value":357},", records FinCEN's rules require covered financial institutions to retain must be kept five years, including amounts, execution dates, and payment instructions for transmittals of funds (31 C.F.R. § 1010.410(e)). Many platforms are not covered entities or are foreign, retaining for shorter contractual windows. Send a hold letter and serve process promptly; in federal practice, Rule 26(d)(2) lets a party deliver Rule 34 requests more than 21 days after service, treated as served at the first Rule 26(f) conference. Capture account state read-only with a witness, hash it, and treat it as supplementation, never a replacement: unilateral logins can trigger security holds.",{"type":26,"tag":56,"props":359,"children":361},{"id":360},"rule-26-and-rule-37e-the-legal-frame-around-preservation",[362],{"type":31,"value":363},"Rule 26 and Rule 37(e): The Legal Frame Around Preservation",{"type":26,"tag":27,"props":365,"children":366},{},[367,369,376],{"type":31,"value":368},"The duty to preserve arises when litigation is reasonably anticipated, before a complaint is filed. Rule 26(b)(1) shapes the scope: discovery is limited to nonprivileged matter relevant to a claim or defense and proportional to the needs of the case, weighing the issues at stake, the amount in controversy, the parties' relative access to information, their resources, and burden versus benefit (",{"type":26,"tag":39,"props":370,"children":373},{"href":371,"rel":372},"https:\u002F\u002Fwww.law.cornell.edu\u002Frules\u002Ffrcp\u002Frule_26",[120],[374],{"type":31,"value":375},"Rule 26",{"type":31,"value":377},"). Proportionality is both the tool for resisting over-collection and the justification for a scoped plan in a small matter; document why each step was taken.",{"type":26,"tag":27,"props":379,"children":380},{},[381,383,390],{"type":31,"value":382},"Rule 37(e) governs when preserved ESI is lost anyway. If ESI that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps, and it cannot be restored or replaced through additional discovery, the court may order measures no greater than necessary to cure resulting prejudice; adverse-inference instructions, dismissal, or default judgment are available only on a finding of intent to deprive (",{"type":26,"tag":39,"props":384,"children":387},{"href":385,"rel":386},"https:\u002F\u002Fwww.law.cornell.edu\u002Frules\u002Ffrcp\u002Frule_37",[120],[388],{"type":31,"value":389},"Rule 37(e)",{"type":31,"value":391},"). It is not a hold-issuance checklist; the advisory committee note to the 2015 amendment states that it \"recognizes that 'reasonable steps' to preserve suffice; it does not call for perfection.\"",{"type":26,"tag":27,"props":393,"children":394},{},[395],{"type":31,"value":396},"In practice, Rule 37(e) disputes in crypto matters center on off-chain artifacts: the chain is restorable. A hold naming the specific apps, devices, extensions, accounts, and time settings, plus a log showing it was enforced, converts a technical loss into a defensible position or an indefensible one.",{"type":26,"tag":56,"props":398,"children":400},{"id":399},"the-litigation-hold-and-expert-handoff-checklist",[401],{"type":31,"value":402},"The Litigation-Hold and Expert Handoff Checklist",{"type":26,"tag":294,"props":404,"children":406},{"id":405},"preservation-checklist",[407],{"type":31,"value":408},"Preservation checklist",{"type":26,"tag":410,"props":411,"children":412},"ol",{},[413,418,423,428,433,446,451,456],{"type":26,"tag":72,"props":414,"children":415},{},[416],{"type":31,"value":417},"Issue the written hold the day the matter opens, naming custodians, devices, apps, wallets, exchanges, and communications; prohibit updates, resets, uninstalls, sync changes, and new transactions.",{"type":26,"tag":72,"props":419,"children":420},{},[421],{"type":31,"value":422},"Inventory all five evidence systems.",{"type":26,"tag":72,"props":424,"children":425},{},[426],{"type":31,"value":427},"Stabilize volatile items: suspend remote wipe, disable auto-update, map cloud sync, record the device clock.",{"type":26,"tag":72,"props":429,"children":430},{},[431],{"type":31,"value":432},"Serve process early: hold letters, subpoenas, and early Rule 34 requests where the Federal Rules apply.",{"type":26,"tag":72,"props":434,"children":435},{},[436,438,444],{"type":31,"value":437},"Capture the reproducible chain data once, recording chain identifiers, block heights, and the source. Capture, not analysis; tracing comes later (",{"type":26,"tag":39,"props":439,"children":441},{"href":440},"\u002Fservices#blockchain-tracing",[442],{"type":31,"value":443},"blockchain tracing",{"type":31,"value":445},").",{"type":26,"tag":72,"props":447,"children":448},{},[449],{"type":31,"value":450},"Collect ephemeral artifacts in order of volatility; request a signed message where control is at issue.",{"type":26,"tag":72,"props":452,"children":453},{},[454],{"type":31,"value":455},"Document every acquisition with hashes and custody history.",{"type":26,"tag":72,"props":457,"children":458},{},[459],{"type":31,"value":460},"Hand the expert a manifest: what was collected, from whom, when, under what authority, and what questions remain.",{"type":26,"tag":294,"props":462,"children":464},{"id":463},"questions-to-ask-at-first-contact",[465],{"type":31,"value":466},"Questions to ask at first contact",{"type":26,"tag":68,"props":468,"children":469},{},[470,475,480,485,490],{"type":26,"tag":72,"props":471,"children":472},{},[473],{"type":31,"value":474},"Which exchanges, wallets, addresses, apps, and extensions, on which devices?",{"type":26,"tag":72,"props":476,"children":477},{},[478],{"type":31,"value":479},"Where are recovery phrases stored: notes, password manager, paper, safe deposit box, or memory?",{"type":26,"tag":72,"props":481,"children":482},{},[483],{"type":31,"value":484},"Which devices are employer-managed or subject to remote wipe, auto-update, or cloud backup, and which cloud accounts sync wallet data?",{"type":26,"tag":72,"props":486,"children":487},{},[488],{"type":31,"value":489},"Has any device been updated, reset, replaced, or wiped since the trigger date, and what was the device clock set to?",{"type":26,"tag":72,"props":491,"children":492},{},[493],{"type":31,"value":494},"Who else had access: spouses, employees, business partners, or custodians?",{"type":26,"tag":56,"props":496,"children":498},{"id":497},"what-preservation-cannot-fix",[499],{"type":31,"value":500},"What Preservation Cannot Fix",{"type":26,"tag":27,"props":502,"children":503},{},[504,506,512],{"type":31,"value":505},"Preservation cannot resurrect overwritten data, recover a hardware wallet's secure element, decrypt a locked phone without the passcode, or compel a foreign platform beyond the reach of process. It cannot manufacture context that was never recorded, and it does not make material admissible; authentication and expert reliability are covered in ",{"type":26,"tag":39,"props":507,"children":509},{"href":508},"\u002Fresources\u002Fblockchain-evidence-admissibility",[510],{"type":31,"value":511},"Blockchain Evidence in Litigation",{"type":31,"value":513},". Criminal procedure, warrants, seizure authority, and compelled unlocking are outside this article's scope. Lose as little of the fragile layer as possible, and know exactly what was lost.",{"type":26,"tag":56,"props":515,"children":517},{"id":516},"frequently-asked-questions",[518],{"type":31,"value":519},"Frequently Asked Questions",{"type":26,"tag":294,"props":521,"children":523},{"id":522},"q-when-does-the-duty-to-preserve-crypto-evidence-begin",[524],{"type":31,"value":525},"Q: When does the duty to preserve crypto evidence begin?",{"type":26,"tag":27,"props":527,"children":528},{},[529,535],{"type":26,"tag":530,"props":531,"children":532},"strong",{},[533],{"type":31,"value":534},"A:",{"type":31,"value":536}," When litigation is reasonably anticipated, which can be months before a complaint is filed. The hold must cover the ephemeral artifacts, not just the chain: apps, extensions, devices, accounts, browser profiles, and time settings.",{"type":26,"tag":294,"props":538,"children":540},{"id":539},"q-is-a-screenshot-of-a-wallet-balance-or-a-recorded-seed-phrase-enough-preservation",[541],{"type":31,"value":542},"Q: Is a screenshot of a wallet balance, or a recorded seed phrase, enough preservation?",{"type":26,"tag":27,"props":544,"children":545},{},[546,550],{"type":26,"tag":530,"props":547,"children":548},{},[549],{"type":31,"value":534},{"type":31,"value":551}," No. A screenshot lacks the metadata, version context, and provenance needed to place it in time. A seed phrase should not be collected by counsel at all; preserve the medium in place and verify control through a signed message. Screenshots and phrases are documentation aids, not a collection protocol.",{"type":26,"tag":294,"props":553,"children":555},{"id":554},"q-we-found-a-seed-phrase-during-review-can-we-import-it-to-check-the-wallet",[556],{"type":31,"value":557},"Q: We found a seed phrase during review. Can we import it to check the wallet?",{"type":26,"tag":27,"props":559,"children":560},{},[561,565],{"type":26,"tag":530,"props":562,"children":563},{},[564],{"type":31,"value":534},{"type":31,"value":566}," Do not import it into a live wallet. Importing mutates application state, spreads the credential, and changes the evidentiary picture. If verification is essential, have a forensic examiner work in a controlled, offline, documented environment, or verify control with a signed message.",{"type":26,"tag":294,"props":568,"children":570},{"id":569},"q-the-other-side-wiped-a-phone-or-closed-an-exchange-account-what-now",[571],{"type":31,"value":572},"Q: The other side wiped a phone or closed an exchange account. What now?",{"type":26,"tag":27,"props":574,"children":575},{},[576,580],{"type":26,"tag":530,"props":577,"children":578},{},[579],{"type":31,"value":534},{"type":31,"value":581}," The chain data is still restorable, so the loss analysis turns on what the missing off-chain data could have shown. Document the loss with dates and known contents, check cloud backups, and preserve what does not require the lost device. If the loss followed a failure to take reasonable steps after the duty arose, that supports a spoliation argument; intent to deprive is required for the severe sanctions.",{"type":26,"tag":294,"props":583,"children":585},{"id":584},"q-in-a-small-case-does-preservation-cost-more-than-it-is-worth",[586],{"type":31,"value":587},"Q: In a small case, does preservation cost more than it is worth?",{"type":26,"tag":27,"props":589,"children":590},{},[591,595],{"type":26,"tag":530,"props":592,"children":593},{},[594],{"type":31,"value":534},{"type":31,"value":596}," The highest-value steps are cheap: a written hold, a hold letter to platforms, disabling auto-update and remote wipe, recording the device clock, and capturing a signed message. Rule 26(b)(1) proportionality lets the parties scope the work to the stakes, and documenting those decisions is part of a defensible record.",{"type":26,"tag":27,"props":598,"children":599},{},[600,602,608],{"type":31,"value":601},"Cases vary in facts, jurisdiction, and stakes, and preservation decisions are best made before artifacts vanish. If a matter is headed toward crypto evidence, a short conversation about the specific devices and timeline clarifies what must happen in the first days and what can wait. Nick Kampe is available through the ",{"type":26,"tag":39,"props":603,"children":605},{"href":604},"\u002Fcontact",[606],{"type":31,"value":607},"contact page",{"type":31,"value":609}," to discuss a preservation plan for a specific matter.",{"title":7,"searchDepth":611,"depth":611,"links":612},2,[613,614,615,616,617,625,626,630,631],{"id":58,"depth":611,"text":61},{"id":107,"depth":611,"text":110},{"id":147,"depth":611,"text":150},{"id":215,"depth":611,"text":218},{"id":289,"depth":611,"text":292,"children":618},[619,621,622,623,624],{"id":296,"depth":620,"text":299},3,{"id":307,"depth":620,"text":310},{"id":318,"depth":620,"text":321},{"id":329,"depth":620,"text":332},{"id":340,"depth":620,"text":343},{"id":360,"depth":611,"text":363},{"id":399,"depth":611,"text":402,"children":627},[628,629],{"id":405,"depth":620,"text":408},{"id":463,"depth":620,"text":466},{"id":497,"depth":611,"text":500},{"id":516,"depth":611,"text":519,"children":632},[633,634,635,636,637],{"id":522,"depth":620,"text":525},{"id":539,"depth":620,"text":542},{"id":554,"depth":620,"text":557},{"id":569,"depth":620,"text":572},{"id":584,"depth":620,"text":587},"markdown","content:articles:30-preserving-crypto-native-esi.md","content","articles\u002F30-preserving-crypto-native-esi.md","articles\u002F30-preserving-crypto-native-esi","md",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"slug":10,"date":11,"lastUpdated":11,"author":12,"readingTime":13,"category":14,"tags":645,"ogImage":21,"featured":6,"body":646,"_type":638,"_id":639,"_source":640,"_file":641,"_stem":642,"_extension":643},[16,17,18,19,20],{"type":23,"children":647,"toc":1076},[648,652,666,670,674,702,706,716,726,730,734,743,747,766,780,784,806,810,837,841,845,849,853,857,861,865,869,873,877,887,891,901,911,915,919,923,963,967,990,994,1003,1007,1011,1019,1023,1031,1035,1043,1047,1055,1059,1067],{"type":26,"tag":27,"props":649,"children":650},{},[651],{"type":31,"value":32},{"type":26,"tag":27,"props":653,"children":654},{},[655,656,660,661,665],{"type":31,"value":37},{"type":26,"tag":39,"props":657,"children":658},{"href":41},[659],{"type":31,"value":44},{"type":31,"value":46},{"type":26,"tag":39,"props":662,"children":663},{"href":49},[664],{"type":31,"value":52},{"type":31,"value":54},{"type":26,"tag":56,"props":667,"children":668},{"id":58},[669],{"type":31,"value":61},{"type":26,"tag":27,"props":671,"children":672},{},[673],{"type":31,"value":66},{"type":26,"tag":68,"props":675,"children":676},{},[677,681,690,694,698],{"type":26,"tag":72,"props":678,"children":679},{},[680],{"type":31,"value":76},{"type":26,"tag":72,"props":682,"children":683},{},[684,685,689],{"type":31,"value":81},{"type":26,"tag":39,"props":686,"children":687},{"href":84},[688],{"type":31,"value":87},{"type":31,"value":89},{"type":26,"tag":72,"props":691,"children":692},{},[693],{"type":31,"value":94},{"type":26,"tag":72,"props":695,"children":696},{},[697],{"type":31,"value":99},{"type":26,"tag":72,"props":699,"children":700},{},[701],{"type":31,"value":104},{"type":26,"tag":56,"props":703,"children":704},{"id":107},[705],{"type":31,"value":110},{"type":26,"tag":27,"props":707,"children":708},{},[709,710,715],{"type":31,"value":115},{"type":26,"tag":39,"props":711,"children":713},{"href":118,"rel":712},[120],[714],{"type":31,"value":123},{"type":31,"value":125},{"type":26,"tag":27,"props":717,"children":718},{},[719,720,725],{"type":31,"value":130},{"type":26,"tag":39,"props":721,"children":723},{"href":133,"rel":722},[120],[724],{"type":31,"value":137},{"type":31,"value":139},{"type":26,"tag":27,"props":727,"children":728},{},[729],{"type":31,"value":144},{"type":26,"tag":56,"props":731,"children":732},{"id":147},[733],{"type":31,"value":150},{"type":26,"tag":27,"props":735,"children":736},{},[737,738,742],{"type":31,"value":155},{"type":26,"tag":39,"props":739,"children":740},{"href":158},[741],{"type":31,"value":161},{"type":31,"value":163},{"type":26,"tag":27,"props":744,"children":745},{},[746],{"type":31,"value":168},{"type":26,"tag":68,"props":748,"children":749},{},[750,754,758,762],{"type":26,"tag":72,"props":751,"children":752},{},[753],{"type":31,"value":176},{"type":26,"tag":72,"props":755,"children":756},{},[757],{"type":31,"value":181},{"type":26,"tag":72,"props":759,"children":760},{},[761],{"type":31,"value":186},{"type":26,"tag":72,"props":763,"children":764},{},[765],{"type":31,"value":191},{"type":26,"tag":27,"props":767,"children":768},{},[769,770,774,775,779],{"type":31,"value":196},{"type":26,"tag":39,"props":771,"children":772},{"href":199},[773],{"type":31,"value":202},{"type":31,"value":204},{"type":26,"tag":39,"props":776,"children":777},{"href":207},[778],{"type":31,"value":210},{"type":31,"value":212},{"type":26,"tag":56,"props":781,"children":782},{"id":215},[783],{"type":31,"value":218},{"type":26,"tag":27,"props":785,"children":786},{},[787,788,793,794,799,800,805],{"type":31,"value":223},{"type":26,"tag":39,"props":789,"children":791},{"href":133,"rel":790},[120],[792],{"type":31,"value":137},{"type":31,"value":230},{"type":26,"tag":39,"props":795,"children":797},{"href":233,"rel":796},[120],[798],{"type":31,"value":237},{"type":31,"value":239},{"type":26,"tag":39,"props":801,"children":803},{"href":242,"rel":802},[120],[804],{"type":31,"value":246},{"type":31,"value":248},{"type":26,"tag":27,"props":807,"children":808},{},[809],{"type":31,"value":253},{"type":26,"tag":68,"props":811,"children":812},{},[813,817,821,825,829,833],{"type":26,"tag":72,"props":814,"children":815},{},[816],{"type":31,"value":261},{"type":26,"tag":72,"props":818,"children":819},{},[820],{"type":31,"value":266},{"type":26,"tag":72,"props":822,"children":823},{},[824],{"type":31,"value":271},{"type":26,"tag":72,"props":826,"children":827},{},[828],{"type":31,"value":276},{"type":26,"tag":72,"props":830,"children":831},{},[832],{"type":31,"value":281},{"type":26,"tag":72,"props":834,"children":835},{},[836],{"type":31,"value":286},{"type":26,"tag":56,"props":838,"children":839},{"id":289},[840],{"type":31,"value":292},{"type":26,"tag":294,"props":842,"children":843},{"id":296},[844],{"type":31,"value":299},{"type":26,"tag":27,"props":846,"children":847},{},[848],{"type":31,"value":304},{"type":26,"tag":294,"props":850,"children":851},{"id":307},[852],{"type":31,"value":310},{"type":26,"tag":27,"props":854,"children":855},{},[856],{"type":31,"value":315},{"type":26,"tag":294,"props":858,"children":859},{"id":318},[860],{"type":31,"value":321},{"type":26,"tag":27,"props":862,"children":863},{},[864],{"type":31,"value":326},{"type":26,"tag":294,"props":866,"children":867},{"id":329},[868],{"type":31,"value":332},{"type":26,"tag":27,"props":870,"children":871},{},[872],{"type":31,"value":337},{"type":26,"tag":294,"props":874,"children":875},{"id":340},[876],{"type":31,"value":343},{"type":26,"tag":27,"props":878,"children":879},{},[880,881,886],{"type":31,"value":348},{"type":26,"tag":39,"props":882,"children":884},{"href":351,"rel":883},[120],[885],{"type":31,"value":355},{"type":31,"value":357},{"type":26,"tag":56,"props":888,"children":889},{"id":360},[890],{"type":31,"value":363},{"type":26,"tag":27,"props":892,"children":893},{},[894,895,900],{"type":31,"value":368},{"type":26,"tag":39,"props":896,"children":898},{"href":371,"rel":897},[120],[899],{"type":31,"value":375},{"type":31,"value":377},{"type":26,"tag":27,"props":902,"children":903},{},[904,905,910],{"type":31,"value":382},{"type":26,"tag":39,"props":906,"children":908},{"href":385,"rel":907},[120],[909],{"type":31,"value":389},{"type":31,"value":391},{"type":26,"tag":27,"props":912,"children":913},{},[914],{"type":31,"value":396},{"type":26,"tag":56,"props":916,"children":917},{"id":399},[918],{"type":31,"value":402},{"type":26,"tag":294,"props":920,"children":921},{"id":405},[922],{"type":31,"value":408},{"type":26,"tag":410,"props":924,"children":925},{},[926,930,934,938,942,951,955,959],{"type":26,"tag":72,"props":927,"children":928},{},[929],{"type":31,"value":417},{"type":26,"tag":72,"props":931,"children":932},{},[933],{"type":31,"value":422},{"type":26,"tag":72,"props":935,"children":936},{},[937],{"type":31,"value":427},{"type":26,"tag":72,"props":939,"children":940},{},[941],{"type":31,"value":432},{"type":26,"tag":72,"props":943,"children":944},{},[945,946,950],{"type":31,"value":437},{"type":26,"tag":39,"props":947,"children":948},{"href":440},[949],{"type":31,"value":443},{"type":31,"value":445},{"type":26,"tag":72,"props":952,"children":953},{},[954],{"type":31,"value":450},{"type":26,"tag":72,"props":956,"children":957},{},[958],{"type":31,"value":455},{"type":26,"tag":72,"props":960,"children":961},{},[962],{"type":31,"value":460},{"type":26,"tag":294,"props":964,"children":965},{"id":463},[966],{"type":31,"value":466},{"type":26,"tag":68,"props":968,"children":969},{},[970,974,978,982,986],{"type":26,"tag":72,"props":971,"children":972},{},[973],{"type":31,"value":474},{"type":26,"tag":72,"props":975,"children":976},{},[977],{"type":31,"value":479},{"type":26,"tag":72,"props":979,"children":980},{},[981],{"type":31,"value":484},{"type":26,"tag":72,"props":983,"children":984},{},[985],{"type":31,"value":489},{"type":26,"tag":72,"props":987,"children":988},{},[989],{"type":31,"value":494},{"type":26,"tag":56,"props":991,"children":992},{"id":497},[993],{"type":31,"value":500},{"type":26,"tag":27,"props":995,"children":996},{},[997,998,1002],{"type":31,"value":505},{"type":26,"tag":39,"props":999,"children":1000},{"href":508},[1001],{"type":31,"value":511},{"type":31,"value":513},{"type":26,"tag":56,"props":1004,"children":1005},{"id":516},[1006],{"type":31,"value":519},{"type":26,"tag":294,"props":1008,"children":1009},{"id":522},[1010],{"type":31,"value":525},{"type":26,"tag":27,"props":1012,"children":1013},{},[1014,1018],{"type":26,"tag":530,"props":1015,"children":1016},{},[1017],{"type":31,"value":534},{"type":31,"value":536},{"type":26,"tag":294,"props":1020,"children":1021},{"id":539},[1022],{"type":31,"value":542},{"type":26,"tag":27,"props":1024,"children":1025},{},[1026,1030],{"type":26,"tag":530,"props":1027,"children":1028},{},[1029],{"type":31,"value":534},{"type":31,"value":551},{"type":26,"tag":294,"props":1032,"children":1033},{"id":554},[1034],{"type":31,"value":557},{"type":26,"tag":27,"props":1036,"children":1037},{},[1038,1042],{"type":26,"tag":530,"props":1039,"children":1040},{},[1041],{"type":31,"value":534},{"type":31,"value":566},{"type":26,"tag":294,"props":1044,"children":1045},{"id":569},[1046],{"type":31,"value":572},{"type":26,"tag":27,"props":1048,"children":1049},{},[1050,1054],{"type":26,"tag":530,"props":1051,"children":1052},{},[1053],{"type":31,"value":534},{"type":31,"value":581},{"type":26,"tag":294,"props":1056,"children":1057},{"id":584},[1058],{"type":31,"value":587},{"type":26,"tag":27,"props":1060,"children":1061},{},[1062,1066],{"type":26,"tag":530,"props":1063,"children":1064},{},[1065],{"type":31,"value":534},{"type":31,"value":596},{"type":26,"tag":27,"props":1068,"children":1069},{},[1070,1071,1075],{"type":31,"value":601},{"type":26,"tag":39,"props":1072,"children":1073},{"href":604},[1074],{"type":31,"value":607},{"type":31,"value":609},{"title":7,"searchDepth":611,"depth":611,"links":1077},[1078,1079,1080,1081,1082,1089,1090,1094,1095],{"id":58,"depth":611,"text":61},{"id":107,"depth":611,"text":110},{"id":147,"depth":611,"text":150},{"id":215,"depth":611,"text":218},{"id":289,"depth":611,"text":292,"children":1083},[1084,1085,1086,1087,1088],{"id":296,"depth":620,"text":299},{"id":307,"depth":620,"text":310},{"id":318,"depth":620,"text":321},{"id":329,"depth":620,"text":332},{"id":340,"depth":620,"text":343},{"id":360,"depth":611,"text":363},{"id":399,"depth":611,"text":402,"children":1091},[1092,1093],{"id":405,"depth":620,"text":408},{"id":463,"depth":620,"text":466},{"id":497,"depth":611,"text":500},{"id":516,"depth":611,"text":519,"children":1096},[1097,1098,1099,1100,1101],{"id":522,"depth":620,"text":525},{"id":539,"depth":620,"text":542},{"id":554,"depth":620,"text":557},{"id":569,"depth":620,"text":572},{"id":584,"depth":620,"text":587},[1103,1819,2527],{"_path":1104,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":1105,"description":1106,"slug":1107,"date":1108,"lastUpdated":1108,"author":12,"readingTime":1109,"category":14,"tags":1110,"ogImage":1116,"featured":6,"body":1117,"_type":638,"_id":1816,"_source":640,"_file":1817,"_stem":1818,"_extension":643},"\u002Farticles\u002F39-crypto-seizure-warrant-trace-hamas-2026","What a seizure-warrant trace reveals about blockchain evidence","A case study of DOJ's September 2026 Hamas crypto seizures, showing how sworn warrant records layer blockchain paths with service-provider evidence.","crypto-seizure-warrant-trace-hamas-2026","2026-09-05",13,[1111,1112,1113,1114,1115],"case-study","blockchain-tracing","seized-assets","evidence","litigation","\u002Fog\u002Fcrypto-seizure-warrant-trace-hamas-2026.png",{"type":23,"children":1118,"toc":1793},[1119,1124,1129,1135,1140,1145,1197,1202,1207,1213,1236,1242,1256,1262,1283,1289,1294,1300,1305,1311,1316,1322,1327,1333,1338,1348,1358,1369,1375,1380,1390,1443,1448,1454,1459,1574,1580,1585,1595,1605,1615,1625,1645,1651,1656,1684,1711,1715,1721,1730,1736,1745,1751,1760,1766,1775,1781],{"type":26,"tag":27,"props":1120,"children":1121},{},[1122],{"type":31,"value":1123},"On September 1, 2026, the Justice Department announced that it had seized over $560,000 in cryptocurrency intended for Hamas and disrupted the domains and servers the group used to solicit donations and recruit supporters. The announcement was the cumulative public record of a longer investigation: seizure warrants issued in the District of Columbia on March 25, June 25, and October 10, 2025, followed by infrastructure warrants on July 29 and August 18, 2026. The government then posted the underlying sworn warrant materials online. The posted packets include AO 109 returns, but those return, inventory, and certification fields are blank, so the public file documents authorization, not the date of execution.",{"type":26,"tag":27,"props":1125,"children":1126},{},[1127],{"type":31,"value":1128},"This is a public, government-published example of a trace described in sworn warrant materials. This article walks through that record to extract a transferable method for litigators and forensic experts, while being careful about what the materials do and do not prove. The legal posture of a criminal seizure investigation differs substantially from a private civil dispute, and the value of this case study is methodological, not an invitation to import government conclusions wholesale.",{"type":26,"tag":56,"props":1130,"children":1132},{"id":1131},"the-procedural-posture-allegations-probable-cause-and-seizure",[1133],{"type":31,"value":1134},"The Procedural Posture: Allegations, Probable Cause, and Seizure",{"type":26,"tag":27,"props":1136,"children":1137},{},[1138],{"type":31,"value":1139},"Before reading any warrant record, establish which legal conclusion the document supports. This case study is a useful lesson precisely because the September announcement reports a seizure premised on probable cause, not a judgment or conviction.",{"type":26,"tag":27,"props":1141,"children":1142},{},[1143],{"type":31,"value":1144},"These are the categories, in order of increasing legal weight:",{"type":26,"tag":68,"props":1146,"children":1147},{},[1148,1158,1177,1187],{"type":26,"tag":72,"props":1149,"children":1150},{},[1151,1156],{"type":26,"tag":530,"props":1152,"children":1153},{},[1154],{"type":31,"value":1155},"Attributed allegations.",{"type":31,"value":1157}," The government states that Hamas, a designated Foreign Terrorist Organization, used the addresses and infrastructure to raise funds and recruit. At the point of a seizure, these are the government's allegations resting on its investigation, not judicial findings of fact.",{"type":26,"tag":72,"props":1159,"children":1160},{},[1161,1166,1168,1175],{"type":26,"tag":530,"props":1162,"children":1163},{},[1164],{"type":31,"value":1165},"Probable cause.",{"type":31,"value":1167}," The authorizing judge issued each warrant on a probable-cause showing. Under ",{"type":26,"tag":39,"props":1169,"children":1172},{"href":1170,"rel":1171},"https:\u002F\u002Fwww.law.cornell.edu\u002Frules\u002Ffrcrmp\u002Frule_41",[120],[1173],{"type":31,"value":1174},"Federal Rule of Criminal Procedure 41",{"type":31,"value":1176},", a judge must issue a warrant if probable cause is shown by affidavit or other information; the judge may also rely on sworn testimony.",{"type":26,"tag":72,"props":1178,"children":1179},{},[1180,1185],{"type":26,"tag":530,"props":1181,"children":1182},{},[1183],{"type":31,"value":1184},"The seizure itself.",{"type":31,"value":1186}," The Department announced that the FBI seized the funds and infrastructure. A seizure does not itself resolve ownership; a completed forfeiture process is ordinarily needed for a final forfeiture determination.",{"type":26,"tag":72,"props":1188,"children":1189},{},[1190,1195],{"type":26,"tag":530,"props":1191,"children":1192},{},[1193],{"type":31,"value":1194},"Final adjudication.",{"type":31,"value":1196}," Forfeiture, administrative or judicial, requires notice and an opportunity for claimants to contest before title finally vests. None of the materials in this announcement evidence an adjudicated finding against any person.",{"type":26,"tag":27,"props":1198,"children":1199},{},[1200],{"type":31,"value":1201},"For a private litigator, read a warrant document as a menu of investigative steps that were persuasive enough for a magistrate, and treat each fact asserted inside it as an allegation the government must still prove. That distinction matters enormously in civil work, where the burden of proof and the rules of evidence differ from a probable-cause determination.",{"type":26,"tag":27,"props":1203,"children":1204},{},[1205],{"type":31,"value":1206},"I have not and will not repeat specific unverified operational details from these affidavits here, because reproducing what an affidavit alleges about live infrastructure serves no legal-pedagogical purpose and can be inaccurate if read out of context. The lesson is in the structure.",{"type":26,"tag":56,"props":1208,"children":1210},{"id":1209},"how-the-evidence-was-layered-not-just-traced",[1211],{"type":31,"value":1212},"How the Evidence Was Layered, Not Just Traced",{"type":26,"tag":27,"props":1214,"children":1215},{},[1216,1218,1225,1227,1234],{"type":31,"value":1217},"Reading the public record as a whole, the investigation assembled at least six distinct categories of evidence. Few are blockchain analysis alone. The ",{"type":26,"tag":39,"props":1219,"children":1222},{"href":1220,"rel":1221},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fpr\u002Fjustice-department-continues-disrupt-hamas-terrorist-financing-schemes-through-seizures",[120],[1223],{"type":31,"value":1224},"press release",{"type":31,"value":1226}," describes cryptocurrency seizures, the seizure of domains and servers, and disruption of fundraising and recruitment platforms; industry reporting on the affidavits, such as ",{"type":26,"tag":39,"props":1228,"children":1231},{"href":1229,"rel":1230},"https:\u002F\u002Fwww.chainalysis.com\u002Fblog\u002Ffbi-seizes-hamas-crypto-fundraising-network\u002F",[120],[1232],{"type":31,"value":1233},"Chainalysis's review of the filings",{"type":31,"value":1235},", adds detail on how the on-chain work connected to accounts and intermediaries.",{"type":26,"tag":294,"props":1237,"children":1239},{"id":1238},"on-chain-transaction-paths",[1240],{"type":31,"value":1241},"On-Chain Transaction Paths",{"type":26,"tag":27,"props":1243,"children":1244},{},[1245,1247,1254],{"type":31,"value":1246},"The foundational layer is the public ledger record itself. The March 2025 warrant materials (25-sz-20, issued March 25, 2025, in the District of Columbia, in the ",{"type":26,"tag":39,"props":1248,"children":1251},{"href":1249,"rel":1250},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fmedia\u002F1459791\u002Fdl?inline",[120],[1252],{"type":31,"value":1253},"public media library",{"type":31,"value":1255},") cover the initial action, which industry reporting describes as involving roughly $200,000 in stablecoins donated to Hamas. The blockchain showed what moved, when, in what amounts, and between which addresses.",{"type":26,"tag":294,"props":1257,"children":1259},{"id":1258},"controlled-or-observed-transactions",[1260],{"type":31,"value":1261},"Controlled or Observed Transactions",{"type":26,"tag":27,"props":1263,"children":1264},{},[1265,1267,1273,1275,1281],{"type":31,"value":1266},"A distinctive feature in this record is that the government did not merely observe historical flows; it interposed itself. The June 25, 2025 warrant (25-sz-34, ",{"type":26,"tag":39,"props":1268,"children":1271},{"href":1269,"rel":1270},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fmedia\u002F1459796\u002Fdl?inline",[120],[1272],{"type":31,"value":1253},{"type":31,"value":1274},") states in affidavit paragraph 1 that its subject matter is related to seizure 25-sz-20, approved March 25, 2025. Attachment A-1 of that packet is a Tether burn-and-reissue instruction listing USDT addresses; it has no footnotes. The June affidavit describes Tether freezing USDT at law-enforcement request, including a March 12, 2025 freeze of additional funds in accounts funded by an operational wallet, and a further freeze on or about April 15, 2025 of listed donation addresses. It also describes Binance independently freezing withdrawals from three target accounts on April 14, 2025. Those are issuer and exchange compliance actions, not a court restraining order. The October 10, 2025 warrant (25-sz-42, ",{"type":26,"tag":39,"props":1276,"children":1279},{"href":1277,"rel":1278},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fmedia\u002F1459801\u002Fdl?inline",[120],[1280],{"type":31,"value":1253},{"type":31,"value":1282},") describes additional Tether freezes at FBI request on May 22, 2025 and June 14, 2025, and a Binance freeze of withdrawals from a listed account, likewise issuer and exchange actions. Controlled or blocked transactions create evidence that no purely passive observer could produce: the point at which value was diverted, frozen, or redirected is a documented event.",{"type":26,"tag":294,"props":1284,"children":1286},{"id":1285},"communications-and-platform-content",[1287],{"type":31,"value":1288},"Communications and Platform Content",{"type":26,"tag":27,"props":1290,"children":1291},{},[1292],{"type":31,"value":1293},"The disruption of domains and servers gave investigators access to solicitation content and supporter interactions, not merely financial data. According to the DOJ, the action disrupted Hamas's fundraising and recruitment communication platforms and websites. Industry reporting on the filings adds that the seized domains and servers included infrastructure associated with the al-Qassam Brigades' main website, which investigators said allowed them to intercept intended donations and gather information about individuals attempting to contribute.",{"type":26,"tag":294,"props":1295,"children":1297},{"id":1296},"service-provider-records",[1298],{"type":31,"value":1299},"Service-Provider Records",{"type":26,"tag":27,"props":1301,"children":1302},{},[1303],{"type":31,"value":1304},"Per industry reporting on the June 2025 affidavit, the investigators traced original donations through a web of new addresses and accounts, and identified service-provider accounts, including one believed to be associated with a Lebanon-based over-the-counter broker and another exhibiting patterns consistent with money mule activity. Those descriptions are attributed allegations within a probable-cause document, reported secondhand; the underlying records, subpoenas, or production requests are not public. The affidavit leans on service-provider records as a bridge from pseudonymous addresses to operating accounts.",{"type":26,"tag":294,"props":1306,"children":1308},{"id":1307},"address-rotation-and-obfuscation",[1309],{"type":31,"value":1310},"Address Rotation and Obfuscation",{"type":26,"tag":27,"props":1312,"children":1313},{},[1314],{"type":31,"value":1315},"The same reporting describes Hamas adapting its techniques after the initial March 2025 seizure, moving funds through new addresses and, in the October 2025 affidavit, using bridging services and single-use donation wallets, with investigators following the trail despite the obfuscation. Address rotation is a fact pattern, not a dead end: every rotated address still transacts on a public ledger, and each new address can be examined for links to a cluster or a service provider.",{"type":26,"tag":294,"props":1317,"children":1319},{"id":1318},"legal-process-as-evidence",[1320],{"type":31,"value":1321},"Legal Process as Evidence",{"type":26,"tag":27,"props":1323,"children":1324},{},[1325],{"type":31,"value":1326},"Finally, the warrant process itself is part of the record. Multiple sequentially authorized warrants support an inference of an iterative investigation, and the June affidavit's paragraph 1 reference to 25-sz-20 shows investigators expressly building a later application on the earlier one. In private cases, the analog is the discovery sequence: each subpoena response or production can become the foundation for the next.",{"type":26,"tag":56,"props":1328,"children":1330},{"id":1329},"path-tracing-vs-actor-attribution",[1331],{"type":31,"value":1332},"Path Tracing vs. Actor Attribution",{"type":26,"tag":27,"props":1334,"children":1335},{},[1336],{"type":31,"value":1337},"Dissecting this record requires separating two questions that prosecutors and civil litigators constantly conflate.",{"type":26,"tag":27,"props":1339,"children":1340},{},[1341,1346],{"type":26,"tag":530,"props":1342,"children":1343},{},[1344],{"type":31,"value":1345},"Path tracing",{"type":31,"value":1347}," asks where value went. It is answered almost entirely on-chain: the March 25, June 25, and October 10, 2025 seizure warrants set out alleged donation flow through successive addresses as investigators followed the funds.",{"type":26,"tag":27,"props":1349,"children":1350},{},[1351,1356],{"type":26,"tag":530,"props":1352,"children":1353},{},[1354],{"type":31,"value":1355},"Actor attribution",{"type":31,"value":1357}," asks who controlled the addresses. On-chain data alone cannot answer this. The record answers it through everything off-chain: platform accounts, service-provider records, communications content, and the observable behavior of the infrastructure.",{"type":26,"tag":27,"props":1359,"children":1360},{},[1361,1363,1368],{"type":31,"value":1362},"A private civil expert should replicate this split explicitly in any report. The path analysis can be stated with high confidence; the attribution analysis should be stated with a confidence level tied to the caliber of the off-chain evidence actually obtained. When a proposed report merges the two, the opposing expert's job becomes easy. For a practical framework on this very division, see the discussion of address attribution in ",{"type":26,"tag":39,"props":1364,"children":1365},{"href":158},[1366],{"type":31,"value":1367},"wallet ownership evidence",{"type":31,"value":89},{"type":26,"tag":56,"props":1370,"children":1372},{"id":1371},"a-worked-hypothetical-modeled-on-the-structure",[1373],{"type":31,"value":1374},"A Worked Hypothetical Modeled on the Structure",{"type":26,"tag":27,"props":1376,"children":1377},{},[1378],{"type":31,"value":1379},"The following is a hypothetical illustration built to mirror the layering technique described above, not a description of any actual investigation.",{"type":26,"tag":27,"props":1381,"children":1382},{},[1383,1388],{"type":26,"tag":530,"props":1384,"children":1385},{},[1386],{"type":31,"value":1387},"Hypothetical example:",{"type":31,"value":1389}," You represent a judgment creditor whose debtor, a third-party vendor, is suspected of funneling kickbacks through cryptocurrency. You have a single lead: the vendor's tax return disclosed a wallet address used to receive client overpayments.",{"type":26,"tag":410,"props":1391,"children":1392},{},[1393,1403,1413,1423,1433],{"type":26,"tag":72,"props":1394,"children":1395},{},[1396,1401],{"type":26,"tag":530,"props":1397,"children":1398},{},[1399],{"type":31,"value":1400},"Establish the seed address.",{"type":31,"value":1402}," Query the disclosed address on a block explorer and capture the full transaction history, including inbound overpayments that match client remittance schedules. Document the queries and exports for reproducibility.",{"type":26,"tag":72,"props":1404,"children":1405},{},[1406,1411],{"type":26,"tag":530,"props":1407,"children":1408},{},[1409],{"type":31,"value":1410},"Follow the path.",{"type":31,"value":1412}," Trace outbound value from the seed address to subsequent addresses using standard clustering (common input ownership and change output). Identify a pattern of same-day movements into a single consolidation wallet: the analog of the Hamas affidavits' consolidation pattern.",{"type":26,"tag":72,"props":1414,"children":1415},{},[1416,1421],{"type":26,"tag":530,"props":1417,"children":1418},{},[1419],{"type":31,"value":1420},"Find the service-provider touchpoint.",{"type":31,"value":1422}," When the consolidation wallet funds are sent to a deposit address attributable to an exchange, subpoena the exchange for account records tied to that deposit address, including KYC documents.",{"type":26,"tag":72,"props":1424,"children":1425},{},[1426,1431],{"type":26,"tag":530,"props":1427,"children":1428},{},[1429],{"type":31,"value":1430},"Corroborate with communications and behavior.",{"type":31,"value":1432}," Depose the vendor about the exchange account and the consolidation wallet. Correlate transaction timestamps with vendor travel or project milestones to create the attribution layer the ledger alone cannot supply.",{"type":26,"tag":72,"props":1434,"children":1435},{},[1436,1441],{"type":26,"tag":530,"props":1437,"children":1438},{},[1439],{"type":31,"value":1440},"Preserve the control evidence.",{"type":31,"value":1442}," Move for production of device forensics or a signed message from the disputed addresses, exactly as the government's legal process secured the off-chain records in the seizure wave.",{"type":26,"tag":27,"props":1444,"children":1445},{},[1446],{"type":31,"value":1447},"This sequence is a scaled-down civil analog of the six evidence categories above: path, interposition (the discovery demand), communications, service-provider records, obfuscation detection, and legal process.",{"type":26,"tag":56,"props":1449,"children":1451},{"id":1450},"a-checklist-for-reading-any-public-warrant-or-seizure-record",[1452],{"type":31,"value":1453},"A Checklist for Reading Any Public Warrant or Seizure Record",{"type":26,"tag":27,"props":1455,"children":1456},{},[1457],{"type":31,"value":1458},"When a client hands you a government warrant, press release, or affidavit, run this checklist before forming any opinion:",{"type":26,"tag":68,"props":1460,"children":1463},{"className":1461},[1462],"contains-task-list",[1464,1484,1499,1514,1529,1544,1559],{"type":26,"tag":72,"props":1465,"children":1468},{"className":1466},[1467],"task-list-item",[1469,1475,1477,1482],{"type":26,"tag":1470,"props":1471,"children":1474},"input",{"disabled":1472,"type":1473},true,"checkbox",[],{"type":31,"value":1476}," ",{"type":26,"tag":530,"props":1478,"children":1479},{},[1480],{"type":31,"value":1481},"Identify the legal instrument.",{"type":31,"value":1483}," Is it a warrant application, a returned warrant, an affidavit, a forfeiture complaint, or a press release? Each supports a different conclusion.",{"type":26,"tag":72,"props":1485,"children":1487},{"className":1486},[1467],[1488,1491,1492,1497],{"type":26,"tag":1470,"props":1489,"children":1490},{"disabled":1472,"type":1473},[],{"type":31,"value":1476},{"type":26,"tag":530,"props":1493,"children":1494},{},[1495],{"type":31,"value":1496},"Separate allegations from findings.",{"type":31,"value":1498}," Flag every sentence the government asserts as investigatory belief rather than adjudicated fact.",{"type":26,"tag":72,"props":1500,"children":1502},{"className":1501},[1467],[1503,1506,1507,1512],{"type":26,"tag":1470,"props":1504,"children":1505},{"disabled":1472,"type":1473},[],{"type":31,"value":1476},{"type":26,"tag":530,"props":1508,"children":1509},{},[1510],{"type":31,"value":1511},"Locate the probable-cause foundation.",{"type":31,"value":1513}," If an affidavit exists, identify which factual predicates support it and which are speculative or attributed.",{"type":26,"tag":72,"props":1515,"children":1517},{"className":1516},[1467],[1518,1521,1522,1527],{"type":26,"tag":1470,"props":1519,"children":1520},{"disabled":1472,"type":1473},[],{"type":31,"value":1476},{"type":26,"tag":530,"props":1523,"children":1524},{},[1525],{"type":31,"value":1526},"Map each evidence category.",{"type":31,"value":1528}," Place every assertion into one of: on-chain path, interposed transaction, communications, service-provider records, obfuscation indicators, or legal process.",{"type":26,"tag":72,"props":1530,"children":1532},{"className":1531},[1467],[1533,1536,1537,1542],{"type":26,"tag":1470,"props":1534,"children":1535},{"disabled":1472,"type":1473},[],{"type":31,"value":1476},{"type":26,"tag":530,"props":1538,"children":1539},{},[1540],{"type":31,"value":1541},"Split path from attribution.",{"type":31,"value":1543}," State what the record proves about value movement versus what it proves about persons.",{"type":26,"tag":72,"props":1545,"children":1547},{"className":1546},[1467],[1548,1551,1552,1557],{"type":26,"tag":1470,"props":1549,"children":1550},{"disabled":1472,"type":1473},[],{"type":31,"value":1476},{"type":26,"tag":530,"props":1553,"children":1554},{},[1555],{"type":31,"value":1556},"Note what is sealed or withheld.",{"type":31,"value":1558}," Warrants are often unsealed only in part. Redactions and sealed exhibits leave gaps in the public record; they do not establish what the nonpublic material proves.",{"type":26,"tag":72,"props":1560,"children":1562},{"className":1561},[1467],[1563,1566,1567,1572],{"type":26,"tag":1470,"props":1564,"children":1565},{"disabled":1472,"type":1473},[],{"type":31,"value":1476},{"type":26,"tag":530,"props":1568,"children":1569},{},[1570],{"type":31,"value":1571},"Check the return.",{"type":31,"value":1573}," The warrant's return, inventory, and certification are the place to look for what was actually taken, which may differ from what was authorized. In the posted March, June, and October packets, those AO 109 fields are blank, so reconstruct execution from provider production rather than treating the public return as a filled inventory.",{"type":26,"tag":56,"props":1575,"children":1577},{"id":1576},"limitations-burdens-tools-and-sealed-material",[1578],{"type":31,"value":1579},"Limitations: Burdens, Tools, and Sealed Material",{"type":26,"tag":27,"props":1581,"children":1582},{},[1583],{"type":31,"value":1584},"A government seizure record is a persuasive and instructive document, but it is not a template to be transplanted into civil litigation without adaptation.",{"type":26,"tag":27,"props":1586,"children":1587},{},[1588,1593],{"type":26,"tag":530,"props":1589,"children":1590},{},[1591],{"type":31,"value":1592},"Lower burdens.",{"type":31,"value":1594}," Probable cause is a lower standard than proof by a preponderance of the evidence, and both are lower than proof beyond a reasonable doubt. A magistrate's authorization does not constitute a finding that any defendant is liable or guilty.",{"type":26,"tag":27,"props":1596,"children":1597},{},[1598,1603],{"type":26,"tag":530,"props":1599,"children":1600},{},[1601],{"type":31,"value":1602},"Different tools.",{"type":31,"value":1604}," The government can compel records from providers, request issuer or exchange freezes of stablecoin balances, and take control of infrastructure using authorities a civil litigant does not possess. A private party can pursue relevant nonprivileged discovery, but that process is subject to objections, privilege, and cross-jurisdictional enforcement problems.",{"type":26,"tag":27,"props":1606,"children":1607},{},[1608,1613],{"type":26,"tag":530,"props":1609,"children":1610},{},[1611],{"type":31,"value":1612},"Sealed and incomplete records.",{"type":31,"value":1614}," The affidavits posted by the DOJ are partial views. Significant portions of the underlying investigation, including provider communications and foreign records, are not public. An expert who builds a civil case on a partial warrant record without confirming the evidentiary foundation is building on sand. When the record is incomplete, the correct response is narrow analysis, not confidence.",{"type":26,"tag":27,"props":1616,"children":1617},{},[1618,1623],{"type":26,"tag":530,"props":1619,"children":1620},{},[1621],{"type":31,"value":1622},"No adjudication.",{"type":31,"value":1624}," None of the September 2026 materials reflect a conviction, a forfeiture order, or a finding against any individual. Any use of this case study must preserve that distinction.",{"type":26,"tag":27,"props":1626,"children":1627},{},[1628,1630,1636,1638,1644],{"type":31,"value":1629},"For the civil analog of these methods as applied to Ponzi and fraud structures, see the ",{"type":26,"tag":39,"props":1631,"children":1633},{"href":1632},"\u002Fresources\u002Fdeconstructing-ponzi-blockchain-methodology",[1634],{"type":31,"value":1635},"methodological walkthrough of blockchain Ponzi reconstruction",{"type":31,"value":1637},", and for the foundational question of what tracing can and cannot establish, see ",{"type":26,"tag":39,"props":1639,"children":1641},{"href":1640},"\u002Fresources\u002Fcan-blockchain-transactions-be-traced",[1642],{"type":31,"value":1643},"can blockchain transactions be traced",{"type":31,"value":89},{"type":26,"tag":56,"props":1646,"children":1648},{"id":1647},"discovery-and-evidence-questions-worth-asking",[1649],{"type":31,"value":1650},"Discovery and Evidence Questions Worth Asking",{"type":26,"tag":27,"props":1652,"children":1653},{},[1654],{"type":31,"value":1655},"If you are building or challenging a trace modeled on this record, these are the questions to ask of your own expert, or of the opposing expert in deposition if the opinion rests on a warrant or government filing:",{"type":26,"tag":410,"props":1657,"children":1658},{},[1659,1664,1669,1674,1679],{"type":26,"tag":72,"props":1660,"children":1661},{},[1662],{"type":31,"value":1663},"Which addresses are claimed to be connected, and which clustering heuristic supports each connection?",{"type":26,"tag":72,"props":1665,"children":1666},{},[1667],{"type":31,"value":1668},"What is the confidence level attached to the path analysis versus the attribution analysis?",{"type":26,"tag":72,"props":1670,"children":1671},{},[1672],{"type":31,"value":1673},"Which service-provider records were obtained, from whom, and by what legal authority?",{"type":26,"tag":72,"props":1675,"children":1676},{},[1677],{"type":31,"value":1678},"Were any transactions observed, frozen, or redirected by an investigator or third party, and what effect does that interposition have on the integrity of the trace?",{"type":26,"tag":72,"props":1680,"children":1681},{},[1682],{"type":31,"value":1683},"Which assertions in the opinion trace to a publicly available primary source, and which rest on sealed or secondhand material?",{"type":26,"tag":27,"props":1685,"children":1686},{},[1687,1689,1694,1696,1702,1704,1709],{"type":31,"value":1688},"An expert who cannot answer each of these questions with a specific, verifiable response has not yet completed the analysis. If you need to build this evidence layer yourself, ",{"type":26,"tag":39,"props":1690,"children":1691},{"href":440},[1692],{"type":31,"value":1693},"ConsensusIntel's blockchain tracing services",{"type":31,"value":1695}," cover the path and attribution work, and ",{"type":26,"tag":39,"props":1697,"children":1699},{"href":1698},"\u002Fservices#expert-witness",[1700],{"type":31,"value":1701},"expert witness services",{"type":31,"value":1703}," cover the report and testimony stage. The ",{"type":26,"tag":39,"props":1705,"children":1706},{"href":207},[1707],{"type":31,"value":1708},"methodology page",{"type":31,"value":1710}," explains how evidence produced in this layered fashion is documented for litigation.",{"type":26,"tag":56,"props":1712,"children":1713},{"id":516},[1714],{"type":31,"value":519},{"type":26,"tag":294,"props":1716,"children":1718},{"id":1717},"q-can-i-rely-on-a-doj-seizure-warrant-as-proof-in-my-civil-case",[1719],{"type":31,"value":1720},"Q: Can I rely on a DOJ seizure warrant as proof in my civil case?",{"type":26,"tag":27,"props":1722,"children":1723},{},[1724,1728],{"type":26,"tag":530,"props":1725,"children":1726},{},[1727],{"type":31,"value":534},{"type":31,"value":1729}," Not directly. A warrant establishes that a magistrate found probable cause to seize property, which is a lower threshold than civil proof and carries no finding of liability. You can use the warrant as a roadmap for what evidence exists and where it came from, then obtain and verify the underlying records yourself. Treat the government's factual assertions as allegations supported by an investigation you have not seen in full.",{"type":26,"tag":294,"props":1731,"children":1733},{"id":1732},"q-what-is-the-difference-between-path-tracing-and-actor-attribution-in-these-affidavits",[1734],{"type":31,"value":1735},"Q: What is the difference between path tracing and actor attribution in these affidavits?",{"type":26,"tag":27,"props":1737,"children":1738},{},[1739,1743],{"type":26,"tag":530,"props":1740,"children":1741},{},[1742],{"type":31,"value":534},{"type":31,"value":1744}," Path tracing shows where value moved on-chain: addresses, amounts, and timestamps, which is directly observable on the public ledger. Actor attribution connects addresses to persons or organizations, which the ledger cannot do alone. In the Hamas seizure record, attribution rests on the off-chain layers: platform accounts, service-provider records, communications content, and the government's control of infrastructure. Any expert report that merges the two without labeling the confidence of each will be vulnerable on cross-examination.",{"type":26,"tag":294,"props":1746,"children":1748},{"id":1747},"q-why-did-the-government-release-these-warrant-materials-to-the-public",[1749],{"type":31,"value":1750},"Q: Why did the government release these warrant materials to the public?",{"type":26,"tag":27,"props":1752,"children":1753},{},[1754,1758],{"type":26,"tag":530,"props":1755,"children":1756},{},[1757],{"type":31,"value":534},{"type":31,"value":1759}," The Department did not state a separate reason for publication. It posted the seizure warrants and related materials through its Office of Public Affairs with the September 1, 2026 announcement. The applications were filed under seal, and the posted packets are redacted, so the public record is partial. Practitioners should treat the posted documents as the evidentiary window the government chose to open, not the complete file.",{"type":26,"tag":294,"props":1761,"children":1763},{"id":1762},"q-do-blockchain-seizure-warrants-identify-real-people",[1764],{"type":31,"value":1765},"Q: Do blockchain seizure warrants identify real people?",{"type":26,"tag":27,"props":1767,"children":1768},{},[1769,1773],{"type":26,"tag":530,"props":1770,"children":1771},{},[1772],{"type":31,"value":534},{"type":31,"value":1774}," Sometimes, but their focus is property, not persons. Warrants name addresses, accounts, and infrastructure as the items to be seized, and affidavits describe the investigation supporting probable cause. Names can appear where service-provider records or communications tie an account to an individual, but a warrant is not a charging document or a conviction. Do not read an uncharged name in an affidavit as an adjudicated finding.",{"type":26,"tag":56,"props":1776,"children":1778},{"id":1777},"closing",[1779],{"type":31,"value":1780},"Closing",{"type":26,"tag":27,"props":1782,"children":1783},{},[1784,1786,1791],{"type":31,"value":1785},"This case study is a particularly clean example of investigative layering in a real enforcement record, but every matter differs in its facts, jurisdictions, and available evidence. If you are evaluating a trace, preparing to challenge an opposing expert, or considering whether a public seizure record can advance your client's interests, a consultation is the right next step. ",{"type":26,"tag":39,"props":1787,"children":1788},{"href":604},[1789],{"type":31,"value":1790},"Contact ConsensusIntel",{"type":31,"value":1792}," to discuss the specifics of your matter.",{"title":7,"searchDepth":611,"depth":611,"links":1794},[1795,1796,1804,1805,1806,1807,1808,1809,1815],{"id":1131,"depth":611,"text":1134},{"id":1209,"depth":611,"text":1212,"children":1797},[1798,1799,1800,1801,1802,1803],{"id":1238,"depth":620,"text":1241},{"id":1258,"depth":620,"text":1261},{"id":1285,"depth":620,"text":1288},{"id":1296,"depth":620,"text":1299},{"id":1307,"depth":620,"text":1310},{"id":1318,"depth":620,"text":1321},{"id":1329,"depth":611,"text":1332},{"id":1371,"depth":611,"text":1374},{"id":1450,"depth":611,"text":1453},{"id":1576,"depth":611,"text":1579},{"id":1647,"depth":611,"text":1650},{"id":516,"depth":611,"text":519,"children":1810},[1811,1812,1813,1814],{"id":1717,"depth":620,"text":1720},{"id":1732,"depth":620,"text":1735},{"id":1747,"depth":620,"text":1750},{"id":1762,"depth":620,"text":1765},{"id":1777,"depth":611,"text":1780},"content:articles:39-crypto-seizure-warrant-trace-hamas-2026.md","articles\u002F39-crypto-seizure-warrant-trace-hamas-2026.md","articles\u002F39-crypto-seizure-warrant-trace-hamas-2026",{"_path":1820,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":1821,"description":1822,"slug":1823,"date":1824,"lastUpdated":1824,"author":12,"readingTime":13,"category":14,"tags":1825,"ogImage":1829,"featured":6,"body":1830,"_type":638,"_id":2524,"_source":640,"_file":2525,"_stem":2526,"_extension":643},"\u002Farticles\u002F38-multisig-contract-wallet-attribution","One address, many actors: contract wallet attribution","Contract wallets and multisigs are not one-person accounts. Experts reconstruct owners, signers, modules, and relayers to attribute on-chain activity.","multisig-contract-wallet-attribution","2026-08-29",[1826,20,1827,1828,1114],"multisig","account-abstraction","smart-contracts","\u002Fog\u002Fmultisig-contract-wallet-attribution.png",{"type":23,"children":1831,"toc":2501},[1832,1837,1843,1857,1880,1885,1890,1896,1902,1907,1913,1918,1924,1937,1943,1964,1970,1993,1999,2004,2037,2049,2055,2060,2066,2080,2085,2091,2096,2295,2300,2306,2311,2322,2328,2333,2338,2376,2395,2399,2405,2414,2420,2429,2435,2444,2450,2459,2465,2474],{"type":26,"tag":27,"props":1833,"children":1834},{},[1835],{"type":31,"value":1836},"When a disputed wallet is a smart contract, the address is an execution account, not a person. Authority over it is defined by code: an owner list, a signature threshold, enabled modules, guards, and sometimes delegation or account-abstraction infrastructure. For fraud, corporate, and probate counsel the question is therefore not \"who owns this address\" but \"whose authorization moved these assets,\" and where that answer stops being a chain fact and becomes inference.",{"type":26,"tag":56,"props":1838,"children":1840},{"id":1839},"contract-wallets-are-not-ordinary-accounts",[1841],{"type":31,"value":1842},"Contract Wallets Are Not Ordinary Accounts",{"type":26,"tag":27,"props":1844,"children":1845},{},[1846,1848,1855],{"type":31,"value":1847},"Ethereum distinguishes externally owned accounts (EOAs) from contract accounts. An EOA is controlled by its private key; a contract account has no private key and acts according to its code when called. EIP-7702 adds a third fact an analyst may need to account for: an EOA can carry a delegation indicator that causes calls to execute delegated code. The ",{"type":26,"tag":39,"props":1849,"children":1852},{"href":1850,"rel":1851},"https:\u002F\u002Fethereum.org\u002Fdevelopers\u002Fdocs\u002Faccounts\u002F",[120],[1853],{"type":31,"value":1854},"ethereum.org account documentation",{"type":31,"value":1856}," describes the EOA and contract-account distinction.",{"type":26,"tag":27,"props":1858,"children":1859},{},[1860,1862,1869,1871,1878],{"type":31,"value":1861},"A transaction that appears \"signed by the wallet\" is signed by whatever actors the wallet's code accepts. Contracts cannot sign the way key-based accounts do, which is why the ",{"type":26,"tag":39,"props":1863,"children":1866},{"href":1864,"rel":1865},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-1271",[120],[1867],{"type":31,"value":1868},"ERC-1271 standard",{"type":31,"value":1870}," exists: a contract exposes ",{"type":26,"tag":1872,"props":1873,"children":1875},"code",{"className":1874},[],[1876],{"type":31,"value":1877},"isValidSignature(hash, signature)",{"type":31,"value":1879}," and returns a fixed magic value when the signature is valid for it. Validation can be context dependent, keyed to time, state, or a signer's authorization level.",{"type":26,"tag":27,"props":1881,"children":1882},{},[1883],{"type":31,"value":1884},"An analyst who treats a contract-wallet address as an EOA misattributes everything downstream, because the assumption of one key, one signer, one person does not hold.",{"type":26,"tag":27,"props":1886,"children":1887},{},[1888],{"type":31,"value":1889},"Safe Smart Account, formerly Gnosis Safe, is a common multisig implementation. A Safe stores an owner list and a threshold, the minimum number of owner approvals needed to execute, on-chain. Changes to the owner set or threshold are Safe transactions, so the same address can have different control arrangements at different times.",{"type":26,"tag":56,"props":1891,"children":1893},{"id":1892},"the-actors-behind-a-single-address",[1894],{"type":31,"value":1895},"The Actors Behind a Single Address",{"type":26,"tag":294,"props":1897,"children":1899},{"id":1898},"owners-and-signers",[1900],{"type":31,"value":1901},"Owners and Signers",{"type":26,"tag":27,"props":1903,"children":1904},{},[1905],{"type":31,"value":1906},"Owners are the addresses permitted to approve transactions; each approval is a signature over the transaction hash. Owners can themselves be contracts, a configuration ERC-1271 anticipated, so owner lists can nest. In Safe's standard execution path, transaction input contains a packed signature value that can include an ECDSA signature, an ERC-1271 contract signature identifying its verifying contract, or a pre-validated hash. For that execution path, the analyst can often enumerate which approving addresses were presented: a chain fact.",{"type":26,"tag":294,"props":1908,"children":1910},{"id":1909},"the-threshold",[1911],{"type":31,"value":1912},"The Threshold",{"type":26,"tag":27,"props":1914,"children":1915},{},[1916],{"type":31,"value":1917},"The threshold is a control setting, not a person; a change from 2-of-3 to 1-of-1 is a concentration-of-control event that leaves its own signed record. The threshold in force on the transfer date is usually the first thing to pin down.",{"type":26,"tag":294,"props":1919,"children":1921},{"id":1920},"modules",[1922],{"type":31,"value":1923},"Modules",{"type":26,"tag":27,"props":1925,"children":1926},{},[1927,1929,1935],{"type":31,"value":1928},"Modules are contracts an owner set enables through an approved wallet transaction. Once enabled, a module can execute transactions through the wallet without collecting the owner-threshold signatures used in ordinary Safe execution. Evidentiary significance: a transfer executed through a module does not carry owner signatures in the standard ",{"type":26,"tag":1872,"props":1930,"children":1932},{"className":1931},[],[1933],{"type":31,"value":1934},"execTransaction",{"type":31,"value":1936}," encoding, and whether owners approved depends on the module logic rather than the threshold.",{"type":26,"tag":294,"props":1938,"children":1940},{"id":1939},"guards",[1941],{"type":31,"value":1942},"Guards",{"type":26,"tag":27,"props":1944,"children":1945},{},[1946,1948,1954,1956,1962],{"type":31,"value":1947},"Guards add pre- and post-execution checks; unlike modules they cannot originate transactions, only pass or block them. A guard change is recorded on-chain, including the ",{"type":26,"tag":1872,"props":1949,"children":1951},{"className":1950},[],[1952],{"type":31,"value":1953},"ChangedGuard",{"type":31,"value":1955}," event emitted by Safe's ",{"type":26,"tag":1872,"props":1957,"children":1959},{"className":1958},[],[1960],{"type":31,"value":1961},"setGuard",{"type":31,"value":1963}," function. That interface is a transaction guard on ordinary Safe execution. A module-executed transfer is a different path, so a claim that the guard should have stopped it requires showing the guard actually ran on that execution.",{"type":26,"tag":294,"props":1965,"children":1967},{"id":1966},"relayers-bundlers-paymasters-and-delegated-code",[1968],{"type":31,"value":1969},"Relayers, Bundlers, Paymasters, and Delegated Code",{"type":26,"tag":27,"props":1971,"children":1972},{},[1973,1975,1982,1984,1991],{"type":31,"value":1974},"Submission is not approval. Safe contracts allow relayed execution, so the account submitting an execution can differ from the owners who signed it. Under account abstraction the separation is structural: ",{"type":26,"tag":39,"props":1976,"children":1979},{"href":1977,"rel":1978},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-4337",[120],[1980],{"type":31,"value":1981},"ERC-4337",{"type":31,"value":1983}," defines UserOperations, a pseudo-transaction naming the sender account, factory data, gas limits and fees, optional paymaster data, and a signature the account itself validates. Bundlers collect valid UserOperations and submit them to a shared EntryPoint contract, so the on-chain transaction's sender is the bundler, not the smart-account address. Paymasters can sponsor fees. A related mechanism is ",{"type":26,"tag":39,"props":1985,"children":1988},{"href":1986,"rel":1987},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-7702",[120],[1989],{"type":31,"value":1990},"EIP-7702",{"type":31,"value":1992},", under which an EOA signs an authorization tuple writing a persistent delegation indicator into its account code. The authorization list is processed before that transaction's execution, and the indicator remains in effect on later calls until it is updated, so attribution requires reading the delegation indicator in effect at the disputed date along with the delegate contract.",{"type":26,"tag":56,"props":1994,"children":1996},{"id":1995},"reconstructing-configuration-at-the-disputed-time",[1997],{"type":31,"value":1998},"Reconstructing Configuration at the Disputed Time",{"type":26,"tag":27,"props":2000,"children":2001},{},[2002],{"type":31,"value":2003},"For an identified wallet implementation, configuration changes may be recoverable from its transactions, event logs, and historical state. The analyst must establish from the code and records which changes are observable, then reconstruct the configuration to the relevant date rather than reading today's state. The reconstruction runs in six layers:",{"type":26,"tag":410,"props":2005,"children":2006},{},[2007,2012,2017,2022,2027,2032],{"type":26,"tag":72,"props":2008,"children":2009},{},[2010],{"type":31,"value":2011},"Classify the account: EOA or contract, including any EIP-7702 delegation indicator, and the implementation behind any proxy.",{"type":26,"tag":72,"props":2013,"children":2014},{},[2015],{"type":31,"value":2016},"Rebuild the configuration history to the disputed date.",{"type":26,"tag":72,"props":2018,"children":2019},{},[2020],{"type":31,"value":2021},"Classify each execution path: owner-signed, module-executed, or delegated call.",{"type":26,"tag":72,"props":2023,"children":2024},{},[2025],{"type":31,"value":2026},"Extract approving addresses from signature data where the execution path encodes it.",{"type":26,"tag":72,"props":2028,"children":2029},{},[2030],{"type":31,"value":2031},"Identify infrastructure actors: submitter, gas payer, refund receiver, bundler, paymaster.",{"type":26,"tag":72,"props":2033,"children":2034},{},[2035],{"type":31,"value":2036},"Map addresses to persons or entities using off-chain evidence.",{"type":26,"tag":27,"props":2038,"children":2039},{},[2040,2042,2047],{"type":31,"value":2041},"What is not on-chain deserves equal emphasis. Which human held each key is almost always an off-chain question, and confirmations collected before a transaction reached threshold may live only in the wallet provider's services. The ",{"type":26,"tag":39,"props":2043,"children":2044},{"href":158},[2045],{"type":31,"value":2046},"evidence methods used to tie keys to people",{"type":31,"value":2048}," apply here with one twist: a single key is only part of the authorization.",{"type":26,"tag":56,"props":2050,"children":2052},{"id":2051},"account-abstraction-and-the-erc-4337-pipeline",[2053],{"type":31,"value":2054},"Account Abstraction and the ERC-4337 Pipeline",{"type":26,"tag":27,"props":2056,"children":2057},{},[2058],{"type":31,"value":2059},"ERC-4337 changes how wallets are created and run. The sender account can be deployed for the first time inside the UserOperation via factory data, so the wallet can be created and transacted in one flow. The EntryPoint contract validates gas, calls the account's validation function, then calls it to execute; what counts as a valid signature is defined by the account's own code. Safe's ERC-4337 integration uses a module that validates a UserOperation against Safe owner signatures, then executes a module transaction. The forensic consequence: the chain identifies the account and the executor infrastructure, while authority lives in the account's code.",{"type":26,"tag":56,"props":2061,"children":2063},{"id":2062},"counterfactual-accounts-authorization-before-the-contract-exists",[2064],{"type":31,"value":2065},"Counterfactual Accounts: Authorization Before the Contract Exists",{"type":26,"tag":27,"props":2067,"children":2068},{},[2069,2071,2078],{"type":31,"value":2070},"Deterministic deployment means an account's address can be computed before any code exists at it, using a factory and a salt; funds can sit at an address with no bytecode. ",{"type":26,"tag":39,"props":2072,"children":2075},{"href":2073,"rel":2074},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-6492",[120],[2076],{"type":31,"value":2077},"ERC-6492",{"type":31,"value":2079}," standardizes signature validation for predeploy contracts: the signature is wrapped with the factory address, deployment calldata, and the underlying ERC-1271 signature, ending in magic bytes that cannot collide with a key-based signature. The specification requires a verifier to detect the magic bytes first and, when they are present, call the factory with the deployment calldata (deploying if the wallet is not already deployed) before validating the inner ERC-1271 signature; then perform standard ERC-1271 checks if code exists; if that ERC-1271 call failed and the factory call was skipped because the wallet already had code, execute the factory calldata and retry; and attempt ecrecover only as a final step.",{"type":26,"tag":27,"props":2081,"children":2082},{},[2083],{"type":31,"value":2084},"The evidentiary upshot: a party can produce a signature for a counterfactual wallet before that wallet exists on-chain. The intended configuration may then be reconstructed from the factory address and deployment calldata in the ERC-6492 wrap, from any later on-chain deployment if one exists, and from off-chain records of the planned owner set; on-chain state alone may under-describe what happened.",{"type":26,"tag":56,"props":2086,"children":2088},{"id":2087},"an-attribution-matrix-for-expert-reports-and-deposition",[2089],{"type":31,"value":2090},"An Attribution Matrix for Expert Reports and Deposition",{"type":26,"tag":27,"props":2092,"children":2093},{},[2094],{"type":31,"value":2095},"The table below is the organizing device I use in expert reports and at deposition; it forces a separate answer for each actor type and labels each as fact or inference.",{"type":26,"tag":2097,"props":2098,"children":2099},"table",{},[2100,2129],{"type":26,"tag":2101,"props":2102,"children":2103},"thead",{},[2104],{"type":26,"tag":2105,"props":2106,"children":2107},"tr",{},[2108,2114,2119,2124],{"type":26,"tag":2109,"props":2110,"children":2111},"th",{},[2112],{"type":31,"value":2113},"Actor",{"type":26,"tag":2109,"props":2115,"children":2116},{},[2117],{"type":31,"value":2118},"What the chain shows",{"type":26,"tag":2109,"props":2120,"children":2121},{},[2122],{"type":31,"value":2123},"Off-chain evidence needed",{"type":26,"tag":2109,"props":2125,"children":2126},{},[2127],{"type":31,"value":2128},"Typical dispute question",{"type":26,"tag":2130,"props":2131,"children":2132},"tbody",{},[2133,2157,2180,2203,2226,2249,2272],{"type":26,"tag":2105,"props":2134,"children":2135},{},[2136,2142,2147,2152],{"type":26,"tag":2137,"props":2138,"children":2139},"td",{},[2140],{"type":31,"value":2141},"Owner signer",{"type":26,"tag":2137,"props":2143,"children":2144},{},[2145],{"type":31,"value":2146},"Approving address in executed signature data",{"type":26,"tag":2137,"props":2148,"children":2149},{},[2150],{"type":31,"value":2151},"Which person controlled the key",{"type":26,"tag":2137,"props":2153,"children":2154},{},[2155],{"type":31,"value":2156},"Did this person approve?",{"type":26,"tag":2105,"props":2158,"children":2159},{},[2160,2165,2170,2175],{"type":26,"tag":2137,"props":2161,"children":2162},{},[2163],{"type":31,"value":2164},"Threshold",{"type":26,"tag":2137,"props":2166,"children":2167},{},[2168],{"type":31,"value":2169},"Current value and every change, each with signatures",{"type":26,"tag":2137,"props":2171,"children":2172},{},[2173],{"type":31,"value":2174},"Who pushed the change and why",{"type":26,"tag":2137,"props":2176,"children":2177},{},[2178],{"type":31,"value":2179},"Was control concentrated?",{"type":26,"tag":2105,"props":2181,"children":2182},{},[2183,2188,2193,2198],{"type":26,"tag":2137,"props":2184,"children":2185},{},[2186],{"type":31,"value":2187},"Module",{"type":26,"tag":2137,"props":2189,"children":2190},{},[2191],{"type":31,"value":2192},"Module executions and enable\u002Fdisable records; signatures depend on the module",{"type":26,"tag":2137,"props":2194,"children":2195},{},[2196],{"type":31,"value":2197},"Module code and operator",{"type":26,"tag":2137,"props":2199,"children":2200},{},[2201],{"type":31,"value":2202},"Who could move funds without threshold signers?",{"type":26,"tag":2105,"props":2204,"children":2205},{},[2206,2211,2216,2221],{"type":26,"tag":2137,"props":2207,"children":2208},{},[2209],{"type":31,"value":2210},"Guard",{"type":26,"tag":2137,"props":2212,"children":2213},{},[2214],{"type":31,"value":2215},"Guard address and change events; whether that guard ran on this execution path",{"type":26,"tag":2137,"props":2217,"children":2218},{},[2219],{"type":31,"value":2220},"Guard code and operator",{"type":26,"tag":2137,"props":2222,"children":2223},{},[2224],{"type":31,"value":2225},"Why did no check stop it?",{"type":26,"tag":2105,"props":2227,"children":2228},{},[2229,2234,2239,2244],{"type":26,"tag":2137,"props":2230,"children":2231},{},[2232],{"type":31,"value":2233},"Relayer or bundler",{"type":26,"tag":2137,"props":2235,"children":2236},{},[2237],{"type":31,"value":2238},"Submitter and gas records on the execution",{"type":26,"tag":2137,"props":2240,"children":2241},{},[2242],{"type":31,"value":2243},"Operator identity and logs",{"type":26,"tag":2137,"props":2245,"children":2246},{},[2247],{"type":31,"value":2248},"Does submission equal authorization?",{"type":26,"tag":2105,"props":2250,"children":2251},{},[2252,2257,2262,2267],{"type":26,"tag":2137,"props":2253,"children":2254},{},[2255],{"type":31,"value":2256},"Paymaster",{"type":26,"tag":2137,"props":2258,"children":2259},{},[2260],{"type":31,"value":2261},"UserOperation paymaster data and EntryPoint deposits",{"type":26,"tag":2137,"props":2263,"children":2264},{},[2265],{"type":31,"value":2266},"Sponsorship terms and operator",{"type":26,"tag":2137,"props":2268,"children":2269},{},[2270],{"type":31,"value":2271},"Who paid for the move?",{"type":26,"tag":2105,"props":2273,"children":2274},{},[2275,2280,2285,2290],{"type":26,"tag":2137,"props":2276,"children":2277},{},[2278],{"type":31,"value":2279},"Deployer or factory",{"type":26,"tag":2137,"props":2281,"children":2282},{},[2283],{"type":31,"value":2284},"Deployment transaction and factory parameters",{"type":26,"tag":2137,"props":2286,"children":2287},{},[2288],{"type":31,"value":2289},"Factory operator records",{"type":26,"tag":2137,"props":2291,"children":2292},{},[2293],{"type":31,"value":2294},"What configuration was fixed at creation?",{"type":26,"tag":27,"props":2296,"children":2297},{},[2298],{"type":31,"value":2299},"This matrix operationalizes the six-layer reconstruction order. Each step yields either an on-chain fact or an inference needing its own evidence, and the expert report must state which.",{"type":26,"tag":56,"props":2301,"children":2303},{"id":2302},"hypothetical-the-two-of-three-corporate-wallet",[2304],{"type":31,"value":2305},"Hypothetical: The Two-of-Three Corporate Wallet",{"type":26,"tag":27,"props":2307,"children":2308},{},[2309],{"type":31,"value":2310},"Illustrative scenario: a company runs a 2-of-3 Safe holding operating funds. The owners are keys held by two officers and one outside investor. Over ten months the threshold is raised to 3, then lowered to 2, and a spending-limit module is enabled. The disputed transfer, a large payment to a new address, executes with two signatures: one key-based and one ERC-1271 contract signature from a second Safe added as an owner eight months prior. Gas is paid by a relayer address that is not an owner.",{"type":26,"tag":27,"props":2312,"children":2313},{},[2314,2316,2321],{"type":31,"value":2315},"Replaying the Safe's history shows the second Safe entering the owner set, the threshold change that made two approvals sufficient, and the module enable with its authorizing transaction. Parsing the disputed transaction's signature data shows the two approving addresses and their types, including the nested Safe's verifying contract address. What the chain does not show is which humans held the officer keys or whether the module was operated by an employee with no owner status; those answers require device forensics, exchange records, custody policies, and depositions, following the ",{"type":26,"tag":39,"props":2317,"children":2318},{"href":49},[2319],{"type":31,"value":2320},"self-custody discovery playbook",{"type":31,"value":89},{"type":26,"tag":56,"props":2323,"children":2325},{"id":2324},"limitations-and-the-questions-to-ask",[2326],{"type":31,"value":2327},"Limitations and the Questions to Ask",{"type":26,"tag":27,"props":2329,"children":2330},{},[2331],{"type":31,"value":2332},"Proposals that never reached threshold exist only off-chain. Recovered signature addresses can identify an approving key or verifying contract, not a human. Implementations can be upgraded through proxies, so authority can change without the address changing; the upgrade is on-chain, but its effect requires code review. The same address can be deployed deterministically across chains with different states, so each chain is analyzed separately. ERC-1271 validation is context dependent by design: a signature valid on one date may be invalid on another, so validity at the relevant date, not today, is the question. A smart account has no native KYC record comparable to an exchange account, although a related service may hold records.",{"type":26,"tag":27,"props":2334,"children":2335},{},[2336],{"type":31,"value":2337},"The discovery questions that follow:",{"type":26,"tag":410,"props":2339,"children":2340},{},[2341,2346,2351,2356,2361,2366,2371],{"type":26,"tag":72,"props":2342,"children":2343},{},[2344],{"type":31,"value":2345},"Was the address an EOA or a contract at the relevant date, including any EIP-7702 delegation indicator, and what implementation is behind it?",{"type":26,"tag":72,"props":2347,"children":2348},{},[2349],{"type":31,"value":2350},"Produce the full configuration history: every owner, threshold, module, and guard change, with transaction hashes.",{"type":26,"tag":72,"props":2352,"children":2353},{},[2354],{"type":31,"value":2355},"Produce raw transaction input data and event logs for each disputed transaction, not block explorer summaries.",{"type":26,"tag":72,"props":2357,"children":2358},{},[2359],{"type":31,"value":2360},"Which disputed transactions ran through modules, and what code was each module running?",{"type":26,"tag":72,"props":2362,"children":2363},{},[2364],{"type":31,"value":2365},"Who submitted each execution and who paid gas, including bundler and paymaster activity?",{"type":26,"tag":72,"props":2367,"children":2368},{},[2369],{"type":31,"value":2370},"Produce confirmation and signing records from any wallet provider interface used before execution.",{"type":26,"tag":72,"props":2372,"children":2373},{},[2374],{"type":31,"value":2375},"Document key custody for every owner address: devices, seed phrases, corporate policy, personnel changes.",{"type":26,"tag":27,"props":2377,"children":2378},{},[2379,2381,2387,2389,2393],{"type":31,"value":2380},"These are forensic facts and methods that apply in any U.S. forum. How a court weighs them depends on the jurisdiction's evidence rules, and the legal responsibility of each actor is a conclusion built on the factual record under corporate, agency, probate, or criminal law. Conduct executed through code is still conduct; the ",{"type":26,"tag":39,"props":2382,"children":2384},{"href":2383},"\u002Fresources\u002Fsmart-contract-disputes",[2385],{"type":31,"value":2386},"smart contract disputes article",{"type":31,"value":2388}," covers how courts treat it. Our ",{"type":26,"tag":39,"props":2390,"children":2391},{"href":207},[2392],{"type":31,"value":1708},{"type":31,"value":2394}," explains how expert reports separate chain facts from inference.",{"type":26,"tag":56,"props":2396,"children":2397},{"id":516},[2398],{"type":31,"value":519},{"type":26,"tag":294,"props":2400,"children":2402},{"id":2401},"q-is-a-multisig-address-owned-by-any-single-person",[2403],{"type":31,"value":2404},"Q: Is a multisig address owned by any single person?",{"type":26,"tag":27,"props":2406,"children":2407},{},[2408,2412],{"type":26,"tag":530,"props":2409,"children":2410},{},[2411],{"type":31,"value":534},{"type":31,"value":2413}," No, not in the way an ordinary wallet is. The address is a contract with an owner list and threshold stored on-chain; control is defined by code, by the threshold number of owner approvals or the module's rules. \"Ownership\" is a legal characterization, resolved by who holds which key and what the parties agreed. No single owner key is sufficient unless the threshold is one.",{"type":26,"tag":294,"props":2415,"children":2417},{"id":2416},"q-if-a-transaction-was-signed-by-enough-owners-who-is-responsible-for-it",[2418],{"type":31,"value":2419},"Q: If a transaction was signed by enough owners, who is responsible for it?",{"type":26,"tag":27,"props":2421,"children":2422},{},[2423,2427],{"type":26,"tag":530,"props":2424,"children":2425},{},[2426],{"type":31,"value":534},{"type":31,"value":2428}," The approvals are on-chain facts, but responsibility is a legal question depending on the signers' relationships. Signature evidence shows which addresses approved and the exact approval set; mapping those to persons, and deciding whether an approval binds the entity, the signer, or both, requires off-chain evidence and applicable law. The forensic contribution is pinning down who approved, when, and through which mechanism.",{"type":26,"tag":294,"props":2430,"children":2432},{"id":2431},"q-can-activity-from-an-erc-4337-smart-account-be-traced-to-the-person-who-initiated-it",[2433],{"type":31,"value":2434},"Q: Can activity from an ERC-4337 smart account be traced to the person who initiated it?",{"type":26,"tag":27,"props":2436,"children":2437},{},[2438,2442],{"type":26,"tag":530,"props":2439,"children":2440},{},[2441],{"type":31,"value":534},{"type":31,"value":2443}," Only partially, and not from the chain alone. Under ERC-4337 the on-chain transaction is submitted by a bundler; the actor is the sender account, a contract whose code defines what signatures it accepts. The UserOperation contains signature data, but whether that data identifies approving keys depends on the account implementation. Connecting any approving address to a human, and separating the initiator from the infrastructure, requires the same off-chain evidence used for any self-custody wallet.",{"type":26,"tag":294,"props":2445,"children":2447},{"id":2446},"q-what-does-it-mean-if-a-wallet-was-not-deployed-when-the-disputed-authorization-happened",[2448],{"type":31,"value":2449},"Q: What does it mean if a wallet was not deployed when the disputed authorization happened?",{"type":26,"tag":27,"props":2451,"children":2452},{},[2453,2457],{"type":26,"tag":530,"props":2454,"children":2455},{},[2456],{"type":31,"value":534},{"type":31,"value":2458}," The address existed as a computation, a deterministic deployment waiting to happen, with no bytecode on-chain at the time. ERC-6492 standardizes validating signatures for such predeploy accounts by wrapping the signature with factory and deployment data. For attribution, the intended owner set must be reconstructed from the factory address and deployment calldata in that wrap, from any later on-chain deployment if one exists, and from off-chain records, because the chain holds no configuration for a contract that did not yet exist.",{"type":26,"tag":294,"props":2460,"children":2462},{"id":2461},"q-what-discovery-should-you-request-when-the-other-side-controls-a-contract-wallet",[2463],{"type":31,"value":2464},"Q: What discovery should you request when the other side controls a contract wallet?",{"type":26,"tag":27,"props":2466,"children":2467},{},[2468,2472],{"type":26,"tag":530,"props":2469,"children":2470},{},[2471],{"type":31,"value":534},{"type":31,"value":2473}," Go beyond the address. Request the implementation and proxy records, the full history of owner, threshold, module, and guard changes with transaction hashes, raw input data for each disputed transaction, module code, submission and gas records, wallet provider confirmation logs, and key custody documentation for every owner address. Without that layer, a contract-wallet attribution rests on the false premise that one address equals one person.",{"type":26,"tag":27,"props":2475,"children":2476},{},[2477,2479,2484,2486,2491,2493,2499],{"type":31,"value":2478},"Each matter turns on its own facts, and the line between what the chain proves and what must be proven around it varies with the wallet design and the parties' records. If you are facing that line, ",{"type":26,"tag":39,"props":2480,"children":2481},{"href":604},[2482],{"type":31,"value":2483},"contact us",{"type":31,"value":2485}," to discuss the evidence picture, or see how ",{"type":26,"tag":39,"props":2487,"children":2488},{"href":440},[2489],{"type":31,"value":2490},"blockchain tracing engagements",{"type":31,"value":2492}," and ",{"type":26,"tag":39,"props":2494,"children":2496},{"href":2495},"\u002Fservices#litigation-consulting",[2497],{"type":31,"value":2498},"litigation consulting",{"type":31,"value":2500}," are structured.",{"title":7,"searchDepth":611,"depth":611,"links":2502},[2503,2504,2511,2512,2513,2514,2515,2516,2517],{"id":1839,"depth":611,"text":1842},{"id":1892,"depth":611,"text":1895,"children":2505},[2506,2507,2508,2509,2510],{"id":1898,"depth":620,"text":1901},{"id":1909,"depth":620,"text":1912},{"id":1920,"depth":620,"text":1923},{"id":1939,"depth":620,"text":1942},{"id":1966,"depth":620,"text":1969},{"id":1995,"depth":611,"text":1998},{"id":2051,"depth":611,"text":2054},{"id":2062,"depth":611,"text":2065},{"id":2087,"depth":611,"text":2090},{"id":2302,"depth":611,"text":2305},{"id":2324,"depth":611,"text":2327},{"id":516,"depth":611,"text":519,"children":2518},[2519,2520,2521,2522,2523],{"id":2401,"depth":620,"text":2404},{"id":2416,"depth":620,"text":2419},{"id":2431,"depth":620,"text":2434},{"id":2446,"depth":620,"text":2449},{"id":2461,"depth":620,"text":2464},"content:articles:38-multisig-contract-wallet-attribution.md","articles\u002F38-multisig-contract-wallet-attribution.md","articles\u002F38-multisig-contract-wallet-attribution",{"_path":2528,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":2529,"description":2530,"slug":2531,"date":2532,"lastUpdated":2532,"author":12,"readingTime":2533,"category":14,"tags":2534,"ogImage":2538,"featured":6,"body":2539,"_type":638,"_id":3111,"_source":640,"_file":3112,"_stem":3113,"_extension":643},"\u002Farticles\u002F37-reproducible-blockchain-evidence","Reproducible blockchain evidence beyond the explorer screenshot","Collecting blockchain evidence that another qualified analyst can reproduce: provenance fields, raw response hashes, query documentation, and label provenance.","reproducible-blockchain-evidence","2026-08-22",16,[1114,2535,210,2536,2537],"blockchain","expert-witness","digital-forensics","\u002Fog\u002Freproducible-blockchain-evidence.png",{"type":23,"children":2540,"toc":3086},[2541,2546,2565,2571,2576,2581,2604,2610,2615,2621,2626,2632,2637,2643,2648,2654,2684,2690,2695,2701,2714,2720,2733,2738,2744,2749,2762,2768,2780,2807,2812,2817,2823,2828,2833,2839,2844,2907,2912,2918,2923,2971,2977,2996,3000,3006,3015,3021,3030,3036,3045,3051,3060,3066,3075],{"type":26,"tag":27,"props":2542,"children":2543},{},[2544],{"type":31,"value":2545},"Every blockchain record offered in litigation is the output of a query. Someone asked a node, a provider, or a third-party website to return a slice of a distributed database, and the record in the exhibit file is what came back, usually after the interface reformatted it. That means the evidentiary question is rarely about the blockchain itself, which is verifiable by anyone. The question is whether the collection process that produced the exhibit is documented well enough that another qualified person can reproduce the result after the explorer, the label, or the API has changed.",{"type":26,"tag":27,"props":2547,"children":2548},{},[2549,2551,2556,2558,2564],{"type":31,"value":2550},"This article is a technical acquisition protocol, not another admissibility survey. It defines the minimum provenance fields for a defensible collection package, explains how to preserve raw outputs and hash them before any normalization, separates protocol-derived facts from third-party labels, and provides a reproducibility appendix template for expert reports. For the legal framework around authentication, see ",{"type":26,"tag":39,"props":2552,"children":2553},{"href":508},[2554],{"type":31,"value":2555},"how blockchain records are authenticated under FRE 901 and 902",{"type":31,"value":2557}," and the ",{"type":26,"tag":39,"props":2559,"children":2561},{"href":2560},"\u002Fresources\u002Fblockchain-evidence-federal-missouri-rules",[2562],{"type":31,"value":2563},"federal and Missouri admissibility rules",{"type":31,"value":89},{"type":26,"tag":56,"props":2566,"children":2568},{"id":2567},"why-an-explorer-screenshot-is-not-an-acquisition-record",[2569],{"type":31,"value":2570},"Why an Explorer Screenshot Is Not an Acquisition Record",{"type":26,"tag":27,"props":2572,"children":2573},{},[2574],{"type":31,"value":2575},"A screenshot of a block explorer records pixels, not provenance. It captures what a third-party interface chose to display at one moment: a decoded value, an applied label, a converted time zone, a color-coded flow diagram. What it does not capture is everything the record needs to be reproduced later.",{"type":26,"tag":27,"props":2577,"children":2578},{},[2579],{"type":31,"value":2580},"The missing information is not exotic. A screenshot does not tell you which node or API answered the request, what query method and parameters produced the view, whether the displayed value is a protocol field or an assembled inference, what time source the interface used, or what the raw response contained before the interface normalized it. Copied text from an explorer is worse in one respect: the copy loses the structure of the underlying response, so decimals, hex encodings, and log positions that the interface already decoded are unrecoverable from the paste itself. A live link to an explorer page is the least durable of the three, because the page can be re-rendered, relabeled, or taken down, and the URL records only the query, not the answer.",{"type":26,"tag":27,"props":2582,"children":2583},{},[2584,2586,2593,2595,2602],{"type":31,"value":2585},"The rules point in the same direction. Under the ",{"type":26,"tag":39,"props":2587,"children":2590},{"href":2588,"rel":2589},"https:\u002F\u002Fwww.uscourts.gov\u002Fsites\u002Fdefault\u002Ffiles\u002F2025-02\u002Ffederal-rules-of-evidence-dec-1-2024.pdf",[120],[2591],{"type":31,"value":2592},"Federal Rules of Evidence pamphlet effective December 1, 2024",{"type":31,"value":2594},", self-authentication under Rule 902(13) or 902(14) requires a qualified person's certification, plus written notice under Rule 902(11). As the 2017 ",{"type":26,"tag":39,"props":2596,"children":2599},{"href":2597,"rel":2598},"https:\u002F\u002Fwww.law.cornell.edu\u002Frules\u002Ffre\u002Frule_902",[120],[2600],{"type":31,"value":2601},"Advisory Committee Note to Rule 902(13)",{"type":31,"value":2603}," explains, that certification must contain \"information that would be sufficient to establish authenticity were that information provided by a witness at trial.\" A witness can only describe what was actually recorded during collection. A screenshot alone does not supply that information, and it would be wrong to suggest that an unadorned screenshot satisfies Rule 902(13) or 902(14), which require a qualified person's certification describing the electronic process or the copying process, plus notice under Rule 902(11). The practical takeaway: treat the screenshot as a demonstrative exhibit and the collection package as the evidence.",{"type":26,"tag":56,"props":2605,"children":2607},{"id":2606},"what-a-reproducible-collection-package-must-contain",[2608],{"type":31,"value":2609},"What a Reproducible Collection Package Must Contain",{"type":26,"tag":27,"props":2611,"children":2612},{},[2613],{"type":31,"value":2614},"A collection package is the set of raw outputs, identifiers, and documentation captured at collection time. The goal is that a second analyst, given the package, can regenerate every exhibit in the report and confirm each recorded value. Six groups of provenance fields cover nearly every blockchain data type.",{"type":26,"tag":294,"props":2616,"children":2618},{"id":2617},"chain-identity",[2619],{"type":31,"value":2620},"Chain Identity",{"type":26,"tag":27,"props":2622,"children":2623},{},[2624],{"type":31,"value":2625},"Record the network by name and by numeric chain identifier, distinguish mainnet from testnet, and note whether the chain uses proof of work, proof of stake, or another consensus rule. Ethereum mainnet uses chain ID 1; Bitcoin has no chain ID equivalent, so the network name and the genesis block hash serve the same purpose of disambiguating which chain is at issue. Screenshots routinely omit this, and a transaction that looks identical on a testnet is not evidence of anything.",{"type":26,"tag":294,"props":2627,"children":2629},{"id":2628},"block-and-transaction-identifiers",[2630],{"type":31,"value":2631},"Block and Transaction Identifiers",{"type":26,"tag":27,"props":2633,"children":2634},{},[2635],{"type":31,"value":2636},"Record the block number and block hash, the transaction hash, the transaction's position within the block, and the block timestamp as reported by the chain. Also record how many confirmations the block had at collection time and whether the chain's finality mechanism had already marked it final. These fields let a later analyst locate the exact record even if an explorer has changed its display entirely.",{"type":26,"tag":294,"props":2638,"children":2640},{"id":2639},"contract-token-and-log-data",[2641],{"type":31,"value":2642},"Contract, Token, and Log Data",{"type":26,"tag":27,"props":2644,"children":2645},{},[2646],{"type":31,"value":2647},"For token transfers and smart contract activity, record the contract address, the token standard (for example ERC-20 or ERC-721 on EVM chains), the event signature, the receipt log position alongside the block-scoped log index, and the decoder that was used. Decoding is a transformation, not raw data: the raw log is hex, and the readable \"250,000 USDC\" is the output of an ABI decoder. The package needs both the raw log and the decoder version so the decode can be re-run.",{"type":26,"tag":294,"props":2649,"children":2651},{"id":2650},"query-and-endpoint-records",[2652],{"type":31,"value":2653},"Query and Endpoint Records",{"type":26,"tag":27,"props":2655,"children":2656},{},[2657,2659,2665,2667,2673,2675,2682],{"type":31,"value":2658},"Document the exact request: the RPC method (such as ",{"type":26,"tag":1872,"props":2660,"children":2662},{"className":2661},[],[2663],{"type":31,"value":2664},"eth_getBlockByNumber",{"type":31,"value":2666}," or ",{"type":26,"tag":1872,"props":2668,"children":2670},{"className":2669},[],[2671],{"type":31,"value":2672},"eth_getTransactionReceipt",{"type":31,"value":2674},"), every parameter, the endpoint URL, whether the node is a full node or archive node, the client software and version (for example geth or Nethermind by name and release), and the provider if data came through a commercial API rather than a self-run node. The ",{"type":26,"tag":39,"props":2676,"children":2679},{"href":2677,"rel":2678},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-1474",[120],[2680],{"type":31,"value":2681},"EIP-1474 remote procedure call specification",{"type":31,"value":2683},", created in 2018 and marked Stagnant, documents these method shapes. Citing the specification that defines the request format is part of reproducibility, but it is not a substitute for recording the request you actually sent.",{"type":26,"tag":294,"props":2685,"children":2687},{"id":2686},"time-and-time-source",[2688],{"type":31,"value":2689},"Time and Time Source",{"type":26,"tag":27,"props":2691,"children":2692},{},[2693],{"type":31,"value":2694},"Record capture time in UTC, note the clock source (system clock, NTP-synchronized host, or the provider's response header), and record any time zone conversion as a separate presentation step. Blockchain timestamps are second-granularity values set by block producers, not investigator observation times, and the two must never be conflated in a report. Chain timestamps are protocol data; the time you pressed \"collect\" is an observation fact; each has its own field.",{"type":26,"tag":294,"props":2696,"children":2698},{"id":2697},"raw-outputs-and-hashes",[2699],{"type":31,"value":2700},"Raw Outputs and Hashes",{"type":26,"tag":27,"props":2702,"children":2703},{},[2704,2706,2712],{"type":31,"value":2705},"Save the raw response verbatim, in the format the API returned it, before any parsing, decoding, or visualization. Compute a cryptographic hash of each saved file at the moment of save and record the algorithm and the hash value. The 2017 ",{"type":26,"tag":39,"props":2707,"children":2709},{"href":2597,"rel":2708},[120],[2710],{"type":31,"value":2711},"Advisory Committee Note to Rule 902(14)",{"type":31,"value":2713}," explains why this is the accepted practice for copied electronic data: if the hash values for the original and the copy are the same, \"it is highly improbable that the original and copy are not identical.\" The collection-time hash lets the analyst verify the integrity of the saved artifact later by hashing the exhibit or copy and comparing it with the recorded value. Subsequent multi-source verification addresses a different question, whether the response matches canonical chain state.",{"type":26,"tag":56,"props":2715,"children":2717},{"id":2716},"preserve-raw-outputs-before-normalization",[2718],{"type":31,"value":2719},"Preserve Raw Outputs Before Normalization",{"type":26,"tag":27,"props":2721,"children":2722},{},[2723,2725,2731],{"type":31,"value":2724},"Forensic process guidance does not change because the data source is a blockchain. ",{"type":26,"tag":39,"props":2726,"children":2728},{"href":233,"rel":2727},[120],[2729],{"type":31,"value":2730},"NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response",{"type":31,"value":2732}," (August 2006), frames the work in phases, starting with collection and examination before analysis and reporting, and its core discipline is that the collector preserves the data as found and documents integrity. Applied to blockchain evidence, the rule is simple: raw first, derived second, and every derivation logged.",{"type":26,"tag":27,"props":2734,"children":2735},{},[2736],{"type":31,"value":2737},"Concretely, the JSON response from an RPC call is the \"as found\" artifact. The pretty-printed CSV, the chart, and the report table are derived products. If the analyst only saves the CSV, the original hex values, error fields, and unmodified response object are gone. Keep the raw file in a directory that is never edited, record its hash there, and build the derived products from copies. If a transformation script is involved, record the script's name and version and hash the script too, so a later analyst can confirm the transformation that produced the exhibit. This is a methodological recommendation, not a legal obligation; what the law requires is whatever authentication standard governs your forum, but the recording discipline is what makes certification under Rules 902(13) and (14), or live testimony under Rule 901, actually supportable.",{"type":26,"tag":56,"props":2739,"children":2741},{"id":2740},"separate-protocol-facts-from-third-party-labels",[2742],{"type":31,"value":2743},"Separate Protocol Facts From Third-Party Labels",{"type":26,"tag":27,"props":2745,"children":2746},{},[2747],{"type":31,"value":2748},"A recurring weakness in blockchain exhibits is presenting a label as if it were a chain fact. \"Funds arrived at Binance\" mixes two different claims: the protocol fact that funds moved to a specific address, and the inference, drawn from a third party's directory, that the address is controlled by Binance. The address is on the chain. The label is someone else's research product, and it can be wrong, stale, or contested.",{"type":26,"tag":27,"props":2750,"children":2751},{},[2752,2754,2760],{"type":31,"value":2753},"Record labels separately from protocol data, and record the label's own provenance: which service assigned it, when it was captured, what the service advertises as its methodology, and whether it agrees with any independent check. Recommendation, not a rule: verify high-stakes labels against a second source, such as a published wallet list, an exchange's deposit address, or records produced in discovery. The ",{"type":26,"tag":39,"props":2755,"children":2757},{"href":2756},"\u002Fresources\u002Fwhy-blockchain-forensic-reports-fail-daubert",[2758],{"type":31,"value":2759},"Daubert failure analysis",{"type":31,"value":2761}," of blockchain reports treats unverified platform attribution as the first failure pattern; the collection package is the place to prevent that. In the report, state plainly which sentences are protocol facts, which are inferences, and which are recommendations, because the three have very different evidentiary lives.",{"type":26,"tag":56,"props":2763,"children":2765},{"id":2764},"a-worked-hypothetical-collecting-one-transfer",[2766],{"type":31,"value":2767},"A Worked Hypothetical: Collecting One Transfer",{"type":26,"tag":27,"props":2769,"children":2770},{},[2771,2773,2779],{"type":31,"value":2772},"Hypothetical example: an analyst needs to preserve the record of a 250,000 USDC transfer on Ethereum mainnet. Assume the transaction hash is 0x3f9a1c2e (illustrative), the block number is 25,300,672 (mined approximately four hours earlier), and collection happens on June 12, 2026 at 14:05 UTC from the analyst's own archive node running geth version 1.15, accessed over local RPC at ",{"type":26,"tag":39,"props":2774,"children":2777},{"href":2775,"rel":2776},"http:\u002F\u002F127.0.0.1:8545",[120],[2778],{"type":31,"value":2775},{"type":31,"value":89},{"type":26,"tag":27,"props":2781,"children":2782},{},[2783,2785,2791,2793,2798,2800,2805],{"type":31,"value":2784},"The analyst issues ",{"type":26,"tag":1872,"props":2786,"children":2788},{"className":2787},[],[2789],{"type":31,"value":2790},"eth_getTransactionByHash",{"type":31,"value":2792}," with the transaction hash and ",{"type":26,"tag":1872,"props":2794,"children":2796},{"className":2795},[],[2797],{"type":31,"value":2672},{"type":31,"value":2799}," with the same hash, and saves both raw JSON responses verbatim into the raw directory, recording sha256 hashes of each file immediately (illustrative values: 1f4b7c2e... and 9a03d8f1...). The receipt shows the transfer occurred at position 2 in the transaction's logs array (with its corresponding block logIndex), and the analyst decodes that log with a specific ABI decoder version to produce \"250,000 USDC from 0xA1B2... to 0xC3D4...\". The block is retrieved with ",{"type":26,"tag":1872,"props":2801,"children":2803},{"className":2802},[],[2804],{"type":31,"value":2664},{"type":31,"value":2806}," at the noted height with the full-transactions flag, confirming the timestamp and the transaction's position in the block. At 14:05 UTC the block has 1,193 confirmations and the chain has already finalized it through proof of stake finality, both recorded.",{"type":26,"tag":27,"props":2808,"children":2809},{},[2810],{"type":31,"value":2811},"An explorer page for the receiving address displays the label \"Exchange X\" next to 0xC3D4.... The analyst records the label separately, with the explorer name, the capture timestamp, and a note that the label is an unverified third-party attribution. Six weeks later, the explorer reclassifies the address and removes the label. The protocol-derived portion of the exhibit, backed by the raw responses and hashes, is unaffected; only the label has decayed, and the package shows precisely where the label sat in the analysis.",{"type":26,"tag":27,"props":2813,"children":2814},{},[2815],{"type":31,"value":2816},"If the analyst had only taken the screenshot, the reclassification would silently change what the exhibit appeared to show. With the package, the report can state what the chain said at collection, what a third party labeled at collection, and what the label says now, which is a far stronger position on both direct and cross.",{"type":26,"tag":56,"props":2818,"children":2820},{"id":2819},"test-the-package-before-you-need-it",[2821],{"type":31,"value":2822},"Test the Package Before You Need It",{"type":26,"tag":27,"props":2824,"children":2825},{},[2826],{"type":31,"value":2827},"A reproducible package is worthless until someone has actually reproduced from it. Before the report is served, run a verification pass that does not reuse the same node, provider, or session: re-query the same transactions from a different provider or a second self-run node, compare the raw fields field by field, and recalculate the recorded hashes from the saved files. Differences are not automatically errors. During a chain reorganization, or before a proof of stake chain has finalized a block, different nodes can legitimately return different block contents for the same height, which is why confirmation count and finality status must be in the package in the first place. Mempool observations are not chain data at all and belong in a clearly separate category.",{"type":26,"tag":27,"props":2829,"children":2830},{},[2831],{"type":31,"value":2832},"Two practical tests catch most failures. First, hand the package to a colleague with no memory of the analysis and ask them to regenerate one exhibit from raw files alone; if they cannot, the package is missing a step. Second, re-query the data after a lag of weeks, when explorer labels, API versions, and provider defaults have had time to drift, and confirm every protocol-derived field is stable. If the second test changes the exhibit, the drift is a feature of the package: it shows exactly what depended on a mutable third party.",{"type":26,"tag":56,"props":2834,"children":2836},{"id":2835},"reproducibility-appendix-template",[2837],{"type":31,"value":2838},"Reproducibility Appendix Template",{"type":26,"tag":27,"props":2840,"children":2841},{},[2842],{"type":31,"value":2843},"For the expert report, include a reproducibility appendix with one entry per collected item, each containing all of the following fields:",{"type":26,"tag":410,"props":2845,"children":2846},{},[2847,2852,2857,2862,2867,2872,2877,2882,2887,2892,2897,2902],{"type":26,"tag":72,"props":2848,"children":2849},{},[2850],{"type":31,"value":2851},"Network name, chain ID or genesis identity, and mainnet or testnet designation.",{"type":26,"tag":72,"props":2853,"children":2854},{},[2855],{"type":31,"value":2856},"Block number, block hash, and block timestamp as reported by the chain.",{"type":26,"tag":72,"props":2858,"children":2859},{},[2860],{"type":31,"value":2861},"Transaction hash and position within the block.",{"type":26,"tag":72,"props":2863,"children":2864},{},[2865],{"type":31,"value":2866},"Contract address, token standard, event signature, receipt log position, and block log index where applicable.",{"type":26,"tag":72,"props":2868,"children":2869},{},[2870],{"type":31,"value":2871},"RPC method and complete request parameters.",{"type":26,"tag":72,"props":2873,"children":2874},{},[2875],{"type":31,"value":2876},"Endpoint URL, node type, client software and version, or provider name and plan.",{"type":26,"tag":72,"props":2878,"children":2879},{},[2880],{"type":31,"value":2881},"Capture timestamp in UTC and the clock source.",{"type":26,"tag":72,"props":2883,"children":2884},{},[2885],{"type":31,"value":2886},"Confirmation count and finality status at capture.",{"type":26,"tag":72,"props":2888,"children":2889},{},[2890],{"type":31,"value":2891},"File names of the saved raw responses and the hash algorithm and value for each.",{"type":26,"tag":72,"props":2893,"children":2894},{},[2895],{"type":31,"value":2896},"Decoder or transformation tool, version, and its own hash if a script.",{"type":26,"tag":72,"props":2898,"children":2899},{},[2900],{"type":31,"value":2901},"Every third-party label used, its source, its capture date, and its verification status.",{"type":26,"tag":72,"props":2903,"children":2904},{},[2905],{"type":31,"value":2906},"The independent verification pass: second source queried, date, and result.",{"type":26,"tag":27,"props":2908,"children":2909},{},[2910],{"type":31,"value":2911},"Keeping this appendix current is a report discipline, not a one-time act. Every time a new address, block, or token enters the analysis, the corresponding entry should be created at collection, not reconstructed at drafting. A contemporaneous appendix is a methodology record; a retroactive one is a story.",{"type":26,"tag":56,"props":2913,"children":2915},{"id":2914},"questions-to-ask-the-collecting-expert",[2916],{"type":31,"value":2917},"Questions to Ask the Collecting Expert",{"type":26,"tag":27,"props":2919,"children":2920},{},[2921],{"type":31,"value":2922},"Whether the expert is yours or the opposing party's, these questions expose whether the underlying record is reproducible:",{"type":26,"tag":68,"props":2924,"children":2925},{},[2926,2931,2936,2941,2946,2951,2956,2961,2966],{"type":26,"tag":72,"props":2927,"children":2928},{},[2929],{"type":31,"value":2930},"Which node, provider, or explorer answered each query, and which software version?",{"type":26,"tag":72,"props":2932,"children":2933},{},[2934],{"type":31,"value":2935},"What was the exact RPC method and parameter set for each exhibit?",{"type":26,"tag":72,"props":2937,"children":2938},{},[2939],{"type":31,"value":2940},"Where are the raw responses, and what are their hashes, recorded at collection time?",{"type":26,"tag":72,"props":2942,"children":2943},{},[2944],{"type":31,"value":2945},"How many confirmations did each block have, and was the chain's finality mechanism satisfied?",{"type":26,"tag":72,"props":2947,"children":2948},{},[2949],{"type":31,"value":2950},"What clock produced the timestamps, and were they converted from UTC?",{"type":26,"tag":72,"props":2952,"children":2953},{},[2954],{"type":31,"value":2955},"Which displayed values are protocol fields, and which are third-party labels with what provenance?",{"type":26,"tag":72,"props":2957,"children":2958},{},[2959],{"type":31,"value":2960},"What scripts, spreadsheets, or tools transformed raw data into the exhibit, and what versions?",{"type":26,"tag":72,"props":2962,"children":2963},{},[2964],{"type":31,"value":2965},"What changed between the collection date and the report date: explorer versions, labels, or API behavior?",{"type":26,"tag":72,"props":2967,"children":2968},{},[2969],{"type":31,"value":2970},"Did anyone independently re-query a sample, from a different source, and what did the comparison show?",{"type":26,"tag":56,"props":2972,"children":2974},{"id":2973},"limitations-of-the-acquisition-approach",[2975],{"type":31,"value":2976},"Limitations of the Acquisition Approach",{"type":26,"tag":27,"props":2978,"children":2979},{},[2980,2982,2987,2989,2994],{"type":31,"value":2981},"The collection package documents provenance; it does not by itself authenticate conclusions. It records what the chain returned and what was collected, not who controlled a wallet or whether a label is correct, and those attribution questions still depend on off-chain evidence and the analytical methods covered separately in the admissibility articles. Reorganization risk is real on proof of work chains, where the confirmation-depth convention exists precisely because short chains can be replaced, and finality on proof of stake chains takes effect only after the chain's finality gadget runs. Testnet and forked data replicate the mechanics without the evidentiary weight of the production chain. Provider responses can differ during reorgs, so multi-source divergence should be expected and documented rather than hidden. And none of this is jurisdiction-specific advice in the form of a rule: federal courts apply the Federal Rules of Evidence, Missouri state courts apply rules that closely parallel them with their own case law, and the practitioner should confirm the applicable authentication and certification requirements in the specific forum before relying on any of these practices. The ",{"type":26,"tag":39,"props":2983,"children":2984},{"href":207},[2985],{"type":31,"value":2986},"ConsensusIntel methodology",{"type":31,"value":2988}," describes how this collection discipline is applied in engagement work, and ",{"type":26,"tag":39,"props":2990,"children":2991},{"href":199},[2992],{"type":31,"value":2993},"evidence review services",{"type":31,"value":2995}," cover structured assessment of another expert's package.",{"type":26,"tag":56,"props":2997,"children":2998},{"id":516},[2999],{"type":31,"value":519},{"type":26,"tag":294,"props":3001,"children":3003},{"id":3002},"q-is-an-explorer-screenshot-ever-sufficient-as-blockchain-evidence",[3004],{"type":31,"value":3005},"Q: Is an explorer screenshot ever sufficient as blockchain evidence?",{"type":26,"tag":27,"props":3007,"children":3008},{},[3009,3013],{"type":26,"tag":530,"props":3010,"children":3011},{},[3012],{"type":31,"value":534},{"type":31,"value":3014}," A screenshot is a demonstrative record of a third-party interface; it is not a complete acquisition record, because it does not show which node answered, what query was run, what the raw response contained, or whether displayed labels were verified. By itself, a screenshot does not supply the qualified person's certification or written notice required to use Rule 902(13) or (14). In a contested matter, treat the screenshot as a visual aid and rely on a collection package that another analyst can reproduce.",{"type":26,"tag":294,"props":3016,"children":3018},{"id":3017},"q-what-is-a-chain-id-and-why-does-it-matter-for-evidence",[3019],{"type":31,"value":3020},"Q: What is a chain ID and why does it matter for evidence?",{"type":26,"tag":27,"props":3022,"children":3023},{},[3024,3028],{"type":26,"tag":530,"props":3025,"children":3026},{},[3027],{"type":31,"value":534},{"type":31,"value":3029}," A chain ID is the numeric identifier that distinguishes one EVM-compatible network from another; Ethereum mainnet uses chain ID 1, and test networks and forks use different values. Chains without a chain ID, like Bitcoin, are identified by network name and genesis hash. Recording this field prevents a testnet or forked transaction from being presented, or challenged, as if it occurred on the production chain.",{"type":26,"tag":294,"props":3031,"children":3033},{"id":3032},"q-should-blockchain-data-be-collected-from-my-own-node-or-from-a-commercial-provider",[3034],{"type":31,"value":3035},"Q: Should blockchain data be collected from my own node or from a commercial provider?",{"type":26,"tag":27,"props":3037,"children":3038},{},[3039,3043],{"type":26,"tag":530,"props":3040,"children":3041},{},[3042],{"type":31,"value":534},{"type":31,"value":3044}," Either can be defensible, but the package must document which one was used. A self-run node gives the analyst direct control over the client version and query, while a commercial provider is faster but adds a third party whose response is itself part of the chain of custody. The reproducible standard is the same for both: record the endpoint, the client or provider, the version, the exact query, and the raw response with its hash, and verify a sample against an independent source.",{"type":26,"tag":294,"props":3046,"children":3048},{"id":3047},"q-what-does-reproducible-require-of-an-expert-report",[3049],{"type":31,"value":3050},"Q: What does \"reproducible\" require of an expert report?",{"type":26,"tag":27,"props":3052,"children":3053},{},[3054,3058],{"type":26,"tag":530,"props":3055,"children":3056},{},[3057],{"type":31,"value":534},{"type":31,"value":3059}," A reproducible report lets a second qualified analyst regenerate each exhibit from the recorded inputs: raw responses, hashes, query parameters, software versions, and transformation steps, with the appendix fields listed above. Reproducibility is a methodology requirement separate from admissibility. A report that describes conclusions without the underlying package cannot be independently tested and may invite a reliability challenge under Daubert; the admissibility decision remains for the court in the applicable forum.",{"type":26,"tag":294,"props":3061,"children":3063},{"id":3062},"q-how-do-hash-values-fit-into-the-collection-record",[3064],{"type":31,"value":3065},"Q: How do hash values fit into the collection record?",{"type":26,"tag":27,"props":3067,"children":3068},{},[3069,3073],{"type":26,"tag":530,"props":3070,"children":3071},{},[3072],{"type":31,"value":534},{"type":31,"value":3074}," Hashing each raw file at collection records a value for its contents at that moment. Hash a later exhibit or copy with the same algorithm and compare the result to the recorded value; a mismatch shows that the files differ, while a match makes it highly improbable that they differ. The 2017 Advisory Committee Note to FRE 902(14) describes this practice for copied electronic data. Record the algorithm, the value, and the time of hashing alongside the file.",{"type":26,"tag":27,"props":3076,"children":3077},{},[3078,3080,3084],{"type":31,"value":3079},"This article explains one part of a broader question, and the right answer always depends on the specific matter: the chain, the data type, and the forum's authentication requirements all affect what a court will require. If you are preparing or challenging blockchain evidence in a specific case, ",{"type":26,"tag":39,"props":3081,"children":3082},{"href":604},[3083],{"type":31,"value":2483},{"type":31,"value":3085}," to discuss the collection and review process for your matter.",{"title":7,"searchDepth":611,"depth":611,"links":3087},[3088,3089,3097,3098,3099,3100,3101,3102,3103,3104],{"id":2567,"depth":611,"text":2570},{"id":2606,"depth":611,"text":2609,"children":3090},[3091,3092,3093,3094,3095,3096],{"id":2617,"depth":620,"text":2620},{"id":2628,"depth":620,"text":2631},{"id":2639,"depth":620,"text":2642},{"id":2650,"depth":620,"text":2653},{"id":2686,"depth":620,"text":2689},{"id":2697,"depth":620,"text":2700},{"id":2716,"depth":611,"text":2719},{"id":2740,"depth":611,"text":2743},{"id":2764,"depth":611,"text":2767},{"id":2819,"depth":611,"text":2822},{"id":2835,"depth":611,"text":2838},{"id":2914,"depth":611,"text":2917},{"id":2973,"depth":611,"text":2976},{"id":516,"depth":611,"text":519,"children":3105},[3106,3107,3108,3109,3110],{"id":3002,"depth":620,"text":3005},{"id":3017,"depth":620,"text":3020},{"id":3032,"depth":620,"text":3035},{"id":3047,"depth":620,"text":3050},{"id":3062,"depth":620,"text":3065},"content:articles:37-reproducible-blockchain-evidence.md","articles\u002F37-reproducible-blockchain-evidence.md","articles\u002F37-reproducible-blockchain-evidence",1790145013677]