[{"data":1,"prerenderedAt":954},["ShallowReactive",2],{"tag-KYC":3},[4,486],{"_path":5,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":9,"description":10,"slug":11,"date":12,"lastUpdated":13,"author":14,"readingTime":15,"category":16,"tags":17,"ogImage":24,"featured":7,"body":25,"_type":479,"_id":480,"_source":481,"_file":482,"_stem":483,"_extension":484,"sitemap":485},"\u002Farticles\u002F09-self-custody-vs-custodial-wallets","articles",false,"","Self-Custody vs. Custodial Wallets: What Attorneys Need to Know","How the distinction between self-custody and custodial cryptocurrency wallets drives discovery strategy, what records exist in each case, and how to prove control when no institution holds records.","self-custody-vs-custodial-wallets","2026-05-05","2025-05-05","Nick Kampe",8,"Education",[18,19,20,21,22,23],"custody","self-custody","hardware wallet","exchange","KYC","evidence","\u002Fog\u002Fself-custody-vs-custodial-wallets.png",{"type":26,"children":27,"toc":467},"root",[28,36,41,48,53,66,77,83,93,103,113,118,124,134,144,154,164,170,175,185,195,205,215,225,244,250,255,268,273,279,284,294,303,313,323,329,334,339,352,358,363,368,373,392,396,402,410,415,423,428,436,441,449,454,462],{"type":29,"tag":30,"props":31,"children":32},"element","p",{},[33],{"type":34,"value":35},"text","When attorneys first encounter cryptocurrency in a legal matter, one of the most practically significant questions is whether the assets are held with a financial institution or held independently by the individual. The answer determines what institutional records exist, what can be obtained through subpoena, and what investigative techniques are required to establish ownership and value.",{"type":29,"tag":30,"props":37,"children":38},{},[39],{"type":34,"value":40},"The distinction is not subtle. It is the fundamental design choice in cryptocurrency: either a third party holds the cryptographic key material and the user interacts with the assets through that party's platform, or the user holds the key material directly and controls the assets without any intermediary. These two arrangements have radically different evidence profiles.",{"type":29,"tag":42,"props":43,"children":45},"h2",{"id":44},"the-fundamental-distinction",[46],{"type":34,"value":47},"The Fundamental Distinction",{"type":29,"tag":30,"props":49,"children":50},{},[51],{"type":34,"value":52},"Every cryptocurrency asset on a public blockchain is controlled by whoever possesses the private key associated with the address where the asset is held. The private key is the cryptographic credential that authorizes spending. Nothing else matters technically. Courts, legal titles, and oral agreements about who should have access to cryptocurrency are beside the point until someone has the key.",{"type":29,"tag":30,"props":54,"children":55},{},[56,58,64],{"type":34,"value":57},"In a ",{"type":29,"tag":59,"props":60,"children":61},"strong",{},[62],{"type":34,"value":63},"custodial arrangement",{"type":34,"value":65},", the user does not possess the private key. A third party, typically a cryptocurrency exchange or institutional custodian, holds the private key and provides the user with an account interface. The user can view their balance, initiate trades, and request withdrawals, but they are relying on the custodian to execute all of that on their behalf. The custodian actually controls the blockchain assets. From a legal process perspective, this arrangement resembles a bank account: there is an institution with records, regulatory obligations, and the ability to respond to subpoenas.",{"type":29,"tag":30,"props":67,"children":68},{},[69,70,75],{"type":34,"value":57},{"type":29,"tag":59,"props":71,"children":72},{},[73],{"type":34,"value":74},"self-custody arrangement",{"type":34,"value":76},", the user holds the private key directly. There is no intermediary. The user controls the blockchain assets personally, using wallet software or hardware to manage the key material and sign transactions. From a legal process perspective, this arrangement has no institutional analog. There is no company to subpoena for records. The evidence must come from the blockchain itself, from the user's devices, and from whatever documentary evidence exists about the key material.",{"type":29,"tag":42,"props":78,"children":80},{"id":79},"types-of-custodial-custody",[81],{"type":34,"value":82},"Types of Custodial Custody",{"type":29,"tag":30,"props":84,"children":85},{},[86,91],{"type":29,"tag":59,"props":87,"children":88},{},[89],{"type":34,"value":90},"Cryptocurrency exchanges",{"type":34,"value":92}," are the most common custodial arrangement. Exchanges like Coinbase, Kraken, Gemini, and Binance allow users to buy, sell, and hold cryptocurrency in exchange-managed accounts. The exchange holds the private keys and maintains internal ledger entries representing each user's balance. The blockchain does not necessarily reflect each user's individual holding; many exchanges aggregate user funds in pooled wallets and maintain their own off-chain record of who holds what.",{"type":29,"tag":30,"props":94,"children":95},{},[96,101],{"type":29,"tag":59,"props":97,"children":98},{},[99],{"type":34,"value":100},"Cryptocurrency ETFs and investment products",{"type":34,"value":102}," hold digital assets through institutional custodians on behalf of shareholders. A person who owns shares in a Bitcoin ETF has exposure to Bitcoin price movements but does not hold Bitcoin on the blockchain and has no private key. The relevant records are with the fund and the brokerage through which the shares are held, not on a blockchain.",{"type":29,"tag":30,"props":104,"children":105},{},[106,111],{"type":29,"tag":59,"props":107,"children":108},{},[109],{"type":34,"value":110},"Institutional custody services",{"type":34,"value":112}," are used by high-net-worth individuals and institutional investors who want the security of a regulated custodian combined with the direct asset ownership that exchange accounts provide. These custodians maintain blockchain records but hold the keys and provide security infrastructure that individual users cannot easily replicate. They are subject to regulatory oversight and maintain records similar to other financial institutions.",{"type":29,"tag":30,"props":114,"children":115},{},[116],{"type":34,"value":117},"For litigation purposes, all forms of custodial custody share the key characteristic: there is an identifiable institution that holds records and can be compelled through legal process to produce them. The discovery approach for custodial assets is the same as for conventional financial assets, with the additional technical consideration of identifying the specific exchange or custodian.",{"type":29,"tag":42,"props":119,"children":121},{"id":120},"types-of-self-custody",[122],{"type":34,"value":123},"Types of Self-Custody",{"type":29,"tag":30,"props":125,"children":126},{},[127,132],{"type":29,"tag":59,"props":128,"children":129},{},[130],{"type":34,"value":131},"Software wallets",{"type":34,"value":133}," are applications installed on a computer or mobile device that generate and store private key material on the device. The user interacts with the wallet through the application's interface, which reads the blockchain and signs transactions using the locally stored key. Popular software wallets include MetaMask (primarily for Ethereum-based assets), various Bitcoin wallet applications, and multi-asset wallets supporting many different blockchains. Software wallets store key material on the device, which creates the possibility of recovering that material through device forensics even if the application itself has been deleted.",{"type":29,"tag":30,"props":135,"children":136},{},[137,142],{"type":29,"tag":59,"props":138,"children":139},{},[140],{"type":34,"value":141},"Hardware wallets",{"type":34,"value":143}," are dedicated physical devices designed specifically to store private key material in a secure chip that is isolated from internet-connected computers. When a user wants to sign a transaction, they connect the hardware wallet to a computer, review the transaction details on the hardware wallet's display, and physically confirm the transaction by pressing a button. The private key never leaves the device. Popular hardware wallets include devices made by Ledger and Trezor. A hardware wallet can hold essentially unlimited cryptocurrency value in a device the size of a USB drive.",{"type":29,"tag":30,"props":145,"children":146},{},[147,152],{"type":29,"tag":59,"props":148,"children":149},{},[150],{"type":34,"value":151},"Paper wallets",{"type":34,"value":153}," are printed records of a private key or seed phrase. At the time of creation, the user generates the key material on a device and then prints or writes it down. If the paper is stored securely, the funds are accessible to anyone who finds it. Paper wallets are less common today but were a popular storage method in earlier years of cryptocurrency adoption.",{"type":29,"tag":30,"props":155,"children":156},{},[157,162],{"type":29,"tag":59,"props":158,"children":159},{},[160],{"type":34,"value":161},"Multisignature wallets",{"type":34,"value":163}," (commonly called multisig) require authorization from multiple private keys to execute a transaction. A 2-of-3 multisig wallet, for example, requires any two of three specified private keys to sign before funds can be moved. This arrangement can be used for security, for shared control, or specifically to complicate attribution in litigation. Multisig wallets have important implications for ownership evidence, because no single key establishes control.",{"type":29,"tag":42,"props":165,"children":167},{"id":166},"identifying-which-type-a-party-uses",[168],{"type":34,"value":169},"Identifying Which Type a Party Uses",{"type":29,"tag":30,"props":171,"children":172},{},[173],{"type":34,"value":174},"The first investigative question in any matter involving cryptocurrency is determining what type of custody the party employed. Several sources of evidence are useful:",{"type":29,"tag":30,"props":176,"children":177},{},[178,183],{"type":29,"tag":59,"props":179,"children":180},{},[181],{"type":34,"value":182},"Financial records",{"type":34,"value":184}," may show purchases from or transfers to cryptocurrency exchanges. Credit card or bank statements showing payments to known exchange platforms are strong indicators of custodial holdings.",{"type":29,"tag":30,"props":186,"children":187},{},[188,193],{"type":29,"tag":59,"props":189,"children":190},{},[191],{"type":34,"value":192},"Tax records",{"type":34,"value":194}," may show cryptocurrency-related transactions reported by exchanges through Form 1099 or equivalent reporting, or capital gains reported on Schedule D that reference exchange-based transactions.",{"type":29,"tag":30,"props":196,"children":197},{},[198,203],{"type":29,"tag":59,"props":199,"children":200},{},[201],{"type":34,"value":202},"Device examination",{"type":34,"value":204}," may reveal installed wallet applications, browser history showing exchange account access, locally stored wallet data, or seed phrase material saved in notes or password managers.",{"type":29,"tag":30,"props":206,"children":207},{},[208,213],{"type":29,"tag":59,"props":209,"children":210},{},[211],{"type":34,"value":212},"Communications",{"type":34,"value":214}," including email, text messages, or messaging app records may reference specific wallets or exchanges, amounts, transactions, or recovery phrases.",{"type":29,"tag":30,"props":216,"children":217},{},[218,223],{"type":29,"tag":59,"props":219,"children":220},{},[221],{"type":34,"value":222},"Prior disclosures",{"type":34,"value":224}," in other proceedings or in tax filings may identify specific exchange accounts or addresses.",{"type":29,"tag":30,"props":226,"children":227},{},[228,233,235,242],{"type":29,"tag":59,"props":229,"children":230},{},[231],{"type":34,"value":232},"Blockchain analysis",{"type":34,"value":234}," of any known addresses can identify exchange interactions in the transaction history, pointing toward specific custodial platforms. See ",{"type":29,"tag":236,"props":237,"children":239},"a",{"href":238},"\u002Fresources\u002Fcan-blockchain-transactions-be-traced",[240],{"type":34,"value":241},"Can Blockchain Transactions Be Traced?",{"type":34,"value":243}," for how this analysis works.",{"type":29,"tag":42,"props":245,"children":247},{"id":246},"discovery-strategies-for-custodial-assets",[248],{"type":34,"value":249},"Discovery Strategies for Custodial Assets",{"type":29,"tag":30,"props":251,"children":252},{},[253],{"type":34,"value":254},"For custodial assets, the discovery approach closely parallels conventional financial asset discovery:",{"type":29,"tag":30,"props":256,"children":257},{},[258,260,266],{"type":34,"value":259},"Identify the specific exchanges through the sources above. Serve subpoenas directly to domestic exchanges seeking KYC records, transaction history, deposit and withdrawal addresses, linked payment methods, and access logs. See ",{"type":29,"tag":236,"props":261,"children":263},{"href":262},"\u002Fresources\u002Fsubpoenaing-cryptocurrency-exchange-records",[264],{"type":34,"value":265},"Subpoenaing Cryptocurrency Exchange Records",{"type":34,"value":267}," for detailed guidance on structuring these requests.",{"type":29,"tag":30,"props":269,"children":270},{},[271],{"type":34,"value":272},"Interrogatories should require the party to identify all exchange accounts, all associated wallet addresses, and the existence of any self-custody wallets in addition to exchange accounts.",{"type":29,"tag":42,"props":274,"children":276},{"id":275},"discovery-strategies-for-self-custody-assets",[277],{"type":34,"value":278},"Discovery Strategies for Self-Custody Assets",{"type":29,"tag":30,"props":280,"children":281},{},[282],{"type":34,"value":283},"Self-custody assets require a different approach. There is no exchange to subpoena. The evidence must come from the blockchain, from the devices, and from documentary sources that establish the party's connection to specific addresses.",{"type":29,"tag":30,"props":285,"children":286},{},[287,292],{"type":29,"tag":59,"props":288,"children":289},{},[290],{"type":34,"value":291},"Device discovery",{"type":34,"value":293}," is the most important single step for self-custody assets. A court can order a party to produce devices, including phones, computers, and hardware wallets, for forensic examination. The forensic examination may recover wallet applications, locally stored wallet data, seed phrases saved in notes or password managers, transaction records, and other evidence connecting the party to specific addresses. Request device production early; devices get replaced, reset, or tampered with.",{"type":29,"tag":30,"props":295,"children":296},{},[297,301],{"type":29,"tag":59,"props":298,"children":299},{},[300],{"type":34,"value":232},{"type":34,"value":302}," begins from any confirmed wallet address and traces outward. If the party disclosed any exchange accounts, the withdrawal addresses from those accounts provide starting points for tracing funds that moved into self-custody wallets.",{"type":29,"tag":30,"props":304,"children":305},{},[306,311],{"type":29,"tag":59,"props":307,"children":308},{},[309],{"type":34,"value":310},"Seed phrase and key material discovery",{"type":34,"value":312}," should be addressed explicitly in discovery requests. Interrogatories should ask whether the party has written down, stored, or memorized seed phrases or private keys. Requests for production should seek any document, photograph, or record containing seed phrase or private key material.",{"type":29,"tag":30,"props":314,"children":315},{},[316,321],{"type":29,"tag":59,"props":317,"children":318},{},[319],{"type":34,"value":320},"Signed message requests",{"type":34,"value":322}," can be pursued through court order in some circumstances. A court can order a party to produce a cryptographic signed message from a disputed address, which proves control without requiring the party to disclose the private key itself.",{"type":29,"tag":42,"props":324,"children":326},{"id":325},"the-proving-self-custody-problem-in-specific-contexts",[327],{"type":34,"value":328},"The Proving Self-Custody Problem in Specific Contexts",{"type":29,"tag":30,"props":330,"children":331},{},[332],{"type":34,"value":333},"In divorce proceedings, a party who holds cryptocurrency in self-custody and denies owning it faces a specific evidentiary problem: the absence of institutional records creates a defense of plausible deniability that requires more investigative work to overcome. The combination of blockchain tracing from known addresses, device forensics, and seed phrase evidence is typically the path to overcoming that defense.",{"type":29,"tag":30,"props":335,"children":336},{},[337],{"type":34,"value":338},"In fraud cases, a defendant who received fraudulent proceeds into a self-custody wallet may argue that the wallet no longer holds the funds and that they cannot access the relevant addresses. Whether this argument is credible depends on the blockchain history of those addresses and any evidence of key material in the defendant's possession.",{"type":29,"tag":30,"props":340,"children":341},{},[342,344,350],{"type":34,"value":343},"See ",{"type":29,"tag":236,"props":345,"children":347},{"href":346},"\u002Fresources\u002Funderstanding-wallet-ownership-evidence",[348],{"type":34,"value":349},"Understanding Wallet Ownership Evidence",{"type":34,"value":351}," for a comprehensive treatment of the evidence types used to establish wallet control in litigation.",{"type":29,"tag":42,"props":353,"children":355},{"id":354},"seed-phrase-evidence-specifically",[356],{"type":34,"value":357},"Seed Phrase Evidence Specifically",{"type":29,"tag":30,"props":359,"children":360},{},[361],{"type":34,"value":362},"The seed phrase deserves particular attention because it is both the most complete form of ownership evidence and the most portable. A party who has memorized their seed phrase carries the controlling credential in their head. A party who has written it on paper carries it in a format that can be found, photographed, or subpoenaed.",{"type":29,"tag":30,"props":364,"children":365},{},[366],{"type":34,"value":367},"Finding a seed phrase in a party's possession, in any form, and connecting that seed phrase to a specific wallet address through cryptographic verification, is strong evidence of control. The connection is mathematical: given a seed phrase, the set of addresses that can be derived from it is deterministic. An analyst can verify that a specific seed phrase controls a specific address without spending any funds.",{"type":29,"tag":30,"props":369,"children":370},{},[371],{"type":34,"value":372},"Courts have treated seed phrase evidence seriously. The challenge in cases where seed phrase evidence has not been found is establishing control through other means. The absence of recovered seed phrase evidence does not mean the party does not control the wallet; it means the investigation must rely more heavily on device forensics, exchange records, transaction patterns, and the party's prior conduct and statements.",{"type":29,"tag":30,"props":374,"children":375},{},[376,382,384,390],{"type":29,"tag":236,"props":377,"children":379},{"href":378},"\u002Fservices",[380],{"type":34,"value":381},"ConsensusIntel's services",{"type":34,"value":383}," cover both the technical analysis needed to establish wallet ownership and the preparation of expert testimony explaining custody structures and ownership evidence in terms that a court can evaluate. For matters where self-custody is suspected or at issue, ",{"type":29,"tag":236,"props":385,"children":387},{"href":386},"\u002Fcontact",[388],{"type":34,"value":389},"contact us",{"type":34,"value":391}," to discuss the specific evidence picture and the most productive investigative approach.",{"type":29,"tag":393,"props":394,"children":395},"hr",{},[],{"type":29,"tag":42,"props":397,"children":399},{"id":398},"frequently-asked-questions",[400],{"type":34,"value":401},"Frequently Asked Questions",{"type":29,"tag":30,"props":403,"children":404},{},[405],{"type":29,"tag":59,"props":406,"children":407},{},[408],{"type":34,"value":409},"Can a hardware wallet be forensically examined?",{"type":29,"tag":30,"props":411,"children":412},{},[413],{"type":34,"value":414},"Hardware wallets are purpose-built security devices and are designed to be resistant to physical extraction of the key material. In most cases, the private key cannot be extracted from a hardware wallet through standard forensic methods. However, the device's transaction history and associated addresses may be recoverable, and the device's presence in a party's possession is itself evidence relevant to the ownership question. The most useful forensic work for hardware wallets typically focuses on the associated device (the computer the hardware wallet was connected to) rather than the hardware wallet itself.",{"type":29,"tag":30,"props":416,"children":417},{},[418],{"type":29,"tag":59,"props":419,"children":420},{},[421],{"type":34,"value":422},"What if a party says they lost their seed phrase and cannot access the wallet?",{"type":29,"tag":30,"props":424,"children":425},{},[426],{"type":34,"value":427},"A claimed loss of seed phrase access is a factual question. The party's testimony about loss is not dispositive. Evidence inconsistent with the claim, such as on-chain activity from the wallet after the claimed loss date, device records showing wallet access, or communications referencing the wallet, can be offered to challenge the claim. Courts draw credibility inferences from the totality of the evidence, and a convenient inability to access a wallet at the time of disclosure warrants scrutiny.",{"type":29,"tag":30,"props":429,"children":430},{},[431],{"type":29,"tag":59,"props":432,"children":433},{},[434],{"type":34,"value":435},"Can multisig wallets be used to hide assets from a court?",{"type":29,"tag":30,"props":437,"children":438},{},[439],{"type":34,"value":440},"A multisig wallet requires multiple keys to spend, and the arrangement can be structured so that the party holding one key argues they cannot access the funds unilaterally. While technically true that a multisig requires cooperation of keyholders, the legal question is whether the party's interest in the wallet is an asset subject to disclosure, which it typically is regardless of the access mechanics. Courts can order parties to disclose interests in multisig arrangements even if unilateral spending is not possible.",{"type":29,"tag":30,"props":442,"children":443},{},[444],{"type":29,"tag":59,"props":445,"children":446},{},[447],{"type":34,"value":448},"Are cryptocurrency assets held in an ETF or investment account self-custody?",{"type":29,"tag":30,"props":450,"children":451},{},[452],{"type":34,"value":453},"No. Assets held through an ETF or investment product are custodial: the fund's custodian holds the actual cryptocurrency, and the investor holds a financial interest in the fund. From a litigation perspective, these are treated like any other investment account: the brokerage or fund can be subpoenaed for records, and the assets appear on conventional account statements.",{"type":29,"tag":30,"props":455,"children":456},{},[457],{"type":29,"tag":59,"props":458,"children":459},{},[460],{"type":34,"value":461},"How does self-custody affect the valuation of cryptocurrency in divorce?",{"type":29,"tag":30,"props":463,"children":464},{},[465],{"type":34,"value":466},"Self-custody assets are valued based on the blockchain balance at the relevant date and the applicable cryptocurrency price at that time. The valuation method is the same as for custodially held assets; the difference is that obtaining the balance information requires blockchain analysis rather than requesting an account statement from an exchange.",{"title":8,"searchDepth":468,"depth":468,"links":469},2,[470,471,472,473,474,475,476,477,478],{"id":44,"depth":468,"text":47},{"id":79,"depth":468,"text":82},{"id":120,"depth":468,"text":123},{"id":166,"depth":468,"text":169},{"id":246,"depth":468,"text":249},{"id":275,"depth":468,"text":278},{"id":325,"depth":468,"text":328},{"id":354,"depth":468,"text":357},{"id":398,"depth":468,"text":401},"markdown","content:articles:09-self-custody-vs-custodial-wallets.md","content","articles\u002F09-self-custody-vs-custodial-wallets.md","articles\u002F09-self-custody-vs-custodial-wallets","md",{"loc":5},{"_path":487,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":488,"description":489,"slug":490,"date":491,"lastUpdated":492,"author":14,"readingTime":493,"category":494,"tags":495,"ogImage":501,"featured":7,"body":502,"_type":479,"_id":950,"_source":481,"_file":951,"_stem":952,"_extension":484,"sitemap":953},"\u002Farticles\u002F07-subpoenaing-cryptocurrency-exchange-records","How to Subpoena Cryptocurrency Exchange Records","A practical guide for attorneys on subpoenaing cryptocurrency exchanges: what records exist, how to request them, jurisdictional complications, and how to work with a forensic expert.","subpoenaing-cryptocurrency-exchange-records","2026-04-28","2025-04-28",10,"Legal Reference",[496,497,22,498,499,500],"subpoena","exchange records","discovery","Coinbase","Kraken","\u002Fog\u002Fsubpoenaing-cryptocurrency-exchange-records.png",{"type":26,"children":503,"toc":939},[504,509,514,520,525,535,545,555,565,575,585,595,601,606,611,616,621,626,631,636,641,646,651,656,662,667,672,685,691,696,701,706,712,717,722,727,732,737,743,748,753,766,772,777,790,803,809,814,819,824,829,834,854,857,861,869,874,882,887,895,900,908,913,921,926,934],{"type":29,"tag":30,"props":505,"children":506},{},[507],{"type":34,"value":508},"Cryptocurrency exchanges are among the most valuable sources of evidence in any matter involving digital assets. When a party has used a regulated exchange, the records that exchange holds can be comprehensive: verified identity documents, the complete transaction history, records of linked bank accounts, IP addresses used to log in, device identifiers, and records of any customer support interactions that might contain relevant communications.",{"type":29,"tag":30,"props":510,"children":511},{},[512],{"type":34,"value":513},"Knowing how to obtain these records, what to request, and what to do when the exchange is foreign or the party used a non-KYC platform is essential knowledge for any attorney handling a matter where cryptocurrency is a significant issue.",{"type":29,"tag":42,"props":515,"children":517},{"id":516},"what-exchanges-actually-hold",[518],{"type":34,"value":519},"What Exchanges Actually Hold",{"type":29,"tag":30,"props":521,"children":522},{},[523],{"type":34,"value":524},"Understanding what records exist before drafting a subpoena is the prerequisite to drafting a useful one.",{"type":29,"tag":30,"props":526,"children":527},{},[528,533],{"type":29,"tag":59,"props":529,"children":530},{},[531],{"type":34,"value":532},"Know Your Customer (KYC) documentation",{"type":34,"value":534}," is the set of identity verification records that regulated exchanges collect when users open accounts. In the United States, regulated exchanges are required under the Bank Secrecy Act and applicable FinCEN guidance to verify user identities. KYC records typically include government-issued identification (a driver's license or passport), a selfie or photograph used for biometric matching, the user's name and date of birth, their address, their Social Security number or equivalent tax identification number, and the records of the verification process itself.",{"type":29,"tag":30,"props":536,"children":537},{},[538,543],{"type":29,"tag":59,"props":539,"children":540},{},[541],{"type":34,"value":542},"Transaction history",{"type":34,"value":544}," is the exchange's internal record of every buy, sell, deposit, withdrawal, and transfer the account has ever executed. This is different from the on-chain record. The exchange's transaction history includes internal transfers, trades between cryptocurrencies on the exchange platform that may not appear as separate on-chain transactions, and the exact timestamps and values of every action. For accounts that have traded for years, this history can run to thousands of transactions.",{"type":29,"tag":30,"props":546,"children":547},{},[548,553],{"type":29,"tag":59,"props":549,"children":550},{},[551],{"type":34,"value":552},"Deposit addresses",{"type":34,"value":554}," are the blockchain addresses the exchange assigned to the user for receiving cryptocurrency. When a user wanted to move cryptocurrency onto the exchange, the exchange provided a specific address for that purpose. The subpoena response should include the complete list of deposit addresses assigned to the account, across all supported cryptocurrencies. These addresses are critical for blockchain forensic analysis because they connect the on-chain record to the account.",{"type":29,"tag":30,"props":556,"children":557},{},[558,563],{"type":29,"tag":59,"props":559,"children":560},{},[561],{"type":34,"value":562},"Withdrawal addresses",{"type":34,"value":564}," are the blockchain addresses the user designated to receive funds when withdrawing. A complete withdrawal history, including the destination addresses, allows an analyst to trace where funds went after leaving the exchange.",{"type":29,"tag":30,"props":566,"children":567},{},[568,573],{"type":29,"tag":59,"props":569,"children":570},{},[571],{"type":34,"value":572},"Linked payment methods",{"type":34,"value":574}," are the bank accounts, credit cards, and other payment instruments the user associated with their account. These records connect the cryptocurrency account to the traditional financial system and may reveal assets or financial relationships not otherwise identified.",{"type":29,"tag":30,"props":576,"children":577},{},[578,583],{"type":29,"tag":59,"props":579,"children":580},{},[581],{"type":34,"value":582},"IP and device records",{"type":34,"value":584}," are the technical logs of where and how the account was accessed. Login IP addresses can be used to establish geographic location during relevant periods. Device identifiers, browser fingerprints, and session records may be relevant to establishing that a specific person accessed the account, particularly in cases involving disputed account ownership or unauthorized access.",{"type":29,"tag":30,"props":586,"children":587},{},[588,593],{"type":29,"tag":59,"props":589,"children":590},{},[591],{"type":34,"value":592},"Customer support communications",{"type":34,"value":594}," are any messages exchanged between the account holder and the exchange's support team. These can contain admissions, explanations, or disclosures relevant to the matter.",{"type":29,"tag":42,"props":596,"children":598},{"id":597},"what-a-subpoena-should-request",[599],{"type":34,"value":600},"What a Subpoena Should Request",{"type":29,"tag":30,"props":602,"children":603},{},[604],{"type":34,"value":605},"A subpoena to a cryptocurrency exchange should be specific about the categories of records sought. Overly broad requests may be resisted as burdensome; overly narrow requests may miss critical records.",{"type":29,"tag":30,"props":607,"children":608},{},[609],{"type":34,"value":610},"A well-structured subpoena to a domestic exchange should request, at minimum:",{"type":29,"tag":30,"props":612,"children":613},{},[614],{"type":34,"value":615},"All account records, including registration information, KYC documentation, and identity verification records, for any account associated with the named individual or with specific identifiers (email addresses, phone numbers, wallet addresses) provided in the subpoena.",{"type":29,"tag":30,"props":617,"children":618},{},[619],{"type":34,"value":620},"Complete transaction history for all accounts identified, including buy and sell orders, deposits and withdrawals, internal transfers, and any other account activity.",{"type":29,"tag":30,"props":622,"children":623},{},[624],{"type":34,"value":625},"All blockchain addresses associated with the account, including all deposit addresses and all withdrawal addresses used throughout the account's history.",{"type":29,"tag":30,"props":627,"children":628},{},[629],{"type":34,"value":630},"All linked payment methods, including bank account numbers, routing numbers, credit card numbers, and any other payment instruments.",{"type":29,"tag":30,"props":632,"children":633},{},[634],{"type":34,"value":635},"All IP addresses and device identifiers associated with account logins, with timestamps.",{"type":29,"tag":30,"props":637,"children":638},{},[639],{"type":34,"value":640},"Any account holds, restrictions, or flags applied to the account by the exchange, and the reasons recorded for those actions.",{"type":29,"tag":30,"props":642,"children":643},{},[644],{"type":34,"value":645},"Any customer support tickets, chat logs, or email communications associated with the account.",{"type":29,"tag":30,"props":647,"children":648},{},[649],{"type":34,"value":650},"Any related accounts identified by the exchange as being linked to the account through common identifying information, device, or IP address.",{"type":29,"tag":30,"props":652,"children":653},{},[654],{"type":34,"value":655},"Including specific email addresses, phone numbers, or wallet addresses as known identifiers in the subpoena, rather than relying solely on the subject's name, substantially improves the response by giving the exchange a means to identify the account reliably.",{"type":29,"tag":42,"props":657,"children":659},{"id":658},"how-exchanges-typically-respond",[660],{"type":34,"value":661},"How Exchanges Typically Respond",{"type":29,"tag":30,"props":663,"children":664},{},[665],{"type":34,"value":666},"Domestic regulated exchanges generally comply with properly served subpoenas in civil matters, though their responses vary in completeness and timeliness. Most major domestic exchanges have legal compliance teams that handle subpoena requests routinely. Response times typically run from two to six weeks, though some exchanges move faster for matters with demonstrated urgency.",{"type":29,"tag":30,"props":668,"children":669},{},[670],{"type":34,"value":671},"The format of the response matters for usability. Request that records be produced in machine-readable formats where applicable (CSV or JSON for transaction histories, for example) rather than as PDF printouts. Machine-readable transaction histories integrate more easily with blockchain forensic analysis tools.",{"type":29,"tag":30,"props":673,"children":674},{},[675,677,683],{"type":34,"value":676},"Some exchanges produce a declaration or affidavit authenticating the records at the time of production. If the exchange does not offer this automatically, request it. Authenticated records are more straightforwardly admissible, and the authentication may support self-authentication arguments under FRE 902(13) or (14). See ",{"type":29,"tag":236,"props":678,"children":680},{"href":679},"\u002Fresources\u002Fblockchain-evidence-admissibility",[681],{"type":34,"value":682},"Blockchain Evidence Admissibility",{"type":34,"value":684}," for the evidentiary framework.",{"type":29,"tag":42,"props":686,"children":688},{"id":687},"timing-and-data-retention",[689],{"type":34,"value":690},"Timing and Data Retention",{"type":29,"tag":30,"props":692,"children":693},{},[694],{"type":34,"value":695},"Data retention policies at major exchanges generally cover five to seven years of account records, but this varies by exchange and by record type. Some types of records, particularly IP and device logs, may be retained for shorter periods than transaction history. Account documentation tied to regulatory compliance requirements tends to be retained longer.",{"type":29,"tag":30,"props":697,"children":698},{},[699],{"type":34,"value":700},"The practical implication is time pressure. A matter where cryptocurrency activity occurred three to four years ago is still well within the retention window for most major exchanges. A matter where the relevant activity is six or more years old may find that some records are no longer available. Serving the subpoena early, before records are purged according to the exchange's retention schedule, reduces this risk.",{"type":29,"tag":30,"props":702,"children":703},{},[704],{"type":34,"value":705},"When matters are time-sensitive, some attorneys request emergency or expedited responses from exchanges, documenting the urgency in the subpoena or in accompanying correspondence. Whether exchanges honor those requests varies; many have formal processes for law enforcement emergency disclosures that do not directly apply in civil matters, but the request may nonetheless accelerate the response timeline.",{"type":29,"tag":42,"props":707,"children":709},{"id":708},"jurisdictional-complications",[710],{"type":34,"value":711},"Jurisdictional Complications",{"type":29,"tag":30,"props":713,"children":714},{},[715],{"type":34,"value":716},"The landscape of cryptocurrency exchanges includes many that are not incorporated in the United States and that may not be subject to direct domestic subpoena power. Some of the most widely used exchanges globally are organized in offshore jurisdictions including the Cayman Islands, the British Virgin Islands, Seychelles, and similar locations. These exchanges may serve U.S. customers while structuring their legal entities specifically to minimize exposure to U.S. civil process.",{"type":29,"tag":30,"props":718,"children":719},{},[720],{"type":34,"value":721},"When the target used a foreign exchange, the subpoena options are different. Letters rogatory, or formal requests through the Mutual Legal Assistance Treaty (MLAT) process, are the standard mechanisms for obtaining evidence from foreign entities in civil matters. These processes are substantially slower and less certain than a domestic subpoena. MLAT requests can take months to years.",{"type":29,"tag":30,"props":723,"children":724},{},[725],{"type":34,"value":726},"Some foreign exchanges cooperate voluntarily with properly documented requests, particularly if they have U.S. subsidiaries or U.S. legal counsel. A formal letter from counsel, explaining the legal proceedings and requesting voluntary production, is worth attempting before committing to the MLAT process.",{"type":29,"tag":30,"props":728,"children":729},{},[730],{"type":34,"value":731},"Terms of service arbitration clauses in exchange user agreements are a separate complication. Some exchanges argue that any disputes, including subpoena compliance disputes, must be addressed through the arbitration process specified in their terms of service. Courts have not uniformly accepted this argument in third-party subpoena contexts, but it may add delay and complexity.",{"type":29,"tag":30,"props":733,"children":734},{},[735],{"type":34,"value":736},"The practical approach when facing a foreign exchange is to first pursue blockchain forensic analysis to understand the full scope of the party's exchange activity before committing to the most difficult subpoena targets. If forensic analysis reveals that a party also used domestic exchanges, start with those.",{"type":29,"tag":42,"props":738,"children":740},{"id":739},"when-the-party-used-a-non-kyc-exchange-or-dex",[741],{"type":34,"value":742},"When the Party Used a Non-KYC Exchange or DEX",{"type":29,"tag":30,"props":744,"children":745},{},[746],{"type":34,"value":747},"Not all cryptocurrency trading activity goes through KYC exchanges. Non-KYC peer-to-peer platforms, Bitcoin ATMs (many of which have minimal verification requirements below certain transaction thresholds), and decentralized exchanges (DEXs) are all options that a party seeking to minimize their KYC footprint might use.",{"type":29,"tag":30,"props":749,"children":750},{},[751],{"type":34,"value":752},"For non-KYC exchanges and peer-to-peer platforms, the records that exist are typically more limited, but some still exist. Bitcoin ATM operators are subject to reporting requirements above certain transaction thresholds and often collect phone numbers or other minimal identification. Peer-to-peer platforms may maintain account records even without formal KYC, and a subpoena to the platform may produce useful information.",{"type":29,"tag":30,"props":754,"children":755},{},[756,758,764],{"type":34,"value":757},"For DEXs, there is no institution to subpoena in the conventional sense. Tracing funds that went through a DEX requires reading the on-chain smart contract interaction record directly. See ",{"type":29,"tag":236,"props":759,"children":761},{"href":760},"\u002Fresources\u002Fwhat-lawyers-need-to-know-about-defi",[762],{"type":34,"value":763},"What Lawyers Need to Know About DeFi",{"type":34,"value":765}," for a detailed treatment of how DEX activity is analyzed.",{"type":29,"tag":42,"props":767,"children":769},{"id":768},"working-with-a-forensic-expert-to-identify-targets",[770],{"type":34,"value":771},"Working with a Forensic Expert to Identify Targets",{"type":29,"tag":30,"props":773,"children":774},{},[775],{"type":34,"value":776},"The question of which exchange to subpoena first, or whether a party used an exchange at all, is one where blockchain forensic analysis and legal strategy intersect. A forensic analyst who can trace known wallet addresses on the blockchain may be able to identify which exchanges received funds from those addresses before the subpoenas are served. That identification narrows the field and allows subpoenas to be directed at the most productive targets first.",{"type":29,"tag":30,"props":778,"children":779},{},[780,782,788],{"type":34,"value":781},"The ",{"type":29,"tag":236,"props":783,"children":785},{"href":784},"\u002Fmethodology",[786],{"type":34,"value":787},"ConsensusIntel methodology",{"type":34,"value":789}," includes this kind of pre-subpoena analysis as a standard early step in investigations. Identifying likely exchange accounts through on-chain analysis, then confirming them through subpoena, is more efficient than subpoenaing all known exchanges hoping to find the relevant accounts. It also produces a stronger evidentiary foundation, because the blockchain analysis provides independent support for the connection between the address and the exchange.",{"type":29,"tag":30,"props":791,"children":792},{},[793,795,801],{"type":34,"value":794},"For guidance on how exchange subpoenas fit into the broader investigation strategy, see ",{"type":29,"tag":236,"props":796,"children":798},{"href":797},"\u002Fresources\u002Fcommon-mistakes-crypto-investigations",[799],{"type":34,"value":800},"Common Mistakes in Cryptocurrency Investigations",{"type":34,"value":802},", which addresses the specific error of over-relying on exchange responses without supplementing them with on-chain analysis.",{"type":29,"tag":42,"props":804,"children":806},{"id":805},"practical-recommendations",[807],{"type":34,"value":808},"Practical Recommendations",{"type":29,"tag":30,"props":810,"children":811},{},[812],{"type":34,"value":813},"Serve exchange subpoenas early. The data retention clock is running, and the sooner records are preserved, the better the completeness of the production.",{"type":29,"tag":30,"props":815,"children":816},{},[817],{"type":34,"value":818},"Include all known identifiers in the subpoena, not just the party's name. Email addresses, phone numbers, and wallet addresses that the party has disclosed or that have been identified through other discovery are all useful identifiers.",{"type":29,"tag":30,"props":820,"children":821},{},[822],{"type":34,"value":823},"Request machine-readable formats for transaction histories. The ability to analyze thousands of transactions programmatically is only available if the data is in a usable format.",{"type":29,"tag":30,"props":825,"children":826},{},[827],{"type":34,"value":828},"Request an authenticating declaration with the production. The authentication step is easier to handle at the time of production than after the fact.",{"type":29,"tag":30,"props":830,"children":831},{},[832],{"type":34,"value":833},"Coordinate with a forensic analyst before and after the exchange response. Before, to identify the right targets and inform the subpoena content. After, to integrate the exchange records with the blockchain analysis and build the complete picture of the party's activity.",{"type":29,"tag":30,"props":835,"children":836},{},[837,839,845,847,852],{"type":34,"value":838},"For matters where exchange subpoenas are a central part of the investigation, ",{"type":29,"tag":236,"props":840,"children":842},{"href":841},"\u002Fabout",[843],{"type":34,"value":844},"ConsensusIntel",{"type":34,"value":846}," supports the full cycle from pre-subpoena blockchain analysis through post-response forensic integration. ",{"type":29,"tag":236,"props":848,"children":849},{"href":386},[850],{"type":34,"value":851},"Contact us",{"type":34,"value":853}," to discuss how that work fits into your case timeline.",{"type":29,"tag":393,"props":855,"children":856},{},[],{"type":29,"tag":42,"props":858,"children":859},{"id":398},[860],{"type":34,"value":401},{"type":29,"tag":30,"props":862,"children":863},{},[864],{"type":29,"tag":59,"props":865,"children":866},{},[867],{"type":34,"value":868},"Do cryptocurrency exchanges report to the IRS?",{"type":29,"tag":30,"props":870,"children":871},{},[872],{"type":34,"value":873},"Yes. U.S.-based cryptocurrency exchanges file Form 1099 reports with the IRS for customers who meet applicable thresholds, and the Infrastructure Investment and Jobs Act of 2021 expanded these reporting requirements. The IRS treats cryptocurrency as property, and exchanges are required to report proceeds from sales. IRS records may be a useful supplemental source in civil matters, though obtaining them requires appropriate process.",{"type":29,"tag":30,"props":875,"children":876},{},[877],{"type":29,"tag":59,"props":878,"children":879},{},[880],{"type":34,"value":881},"Can I subpoena an exchange in a state court proceeding?",{"type":29,"tag":30,"props":883,"children":884},{},[885],{"type":34,"value":886},"Yes, subject to the civil procedure rules of the applicable state. Most states have discovery rules that allow subpoenas to non-party businesses operating within the state. For exchanges incorporated in other states or foreign jurisdictions, the subpoena mechanism depends on the specific jurisdiction and whether the exchange has registered to do business in the forum state.",{"type":29,"tag":30,"props":888,"children":889},{},[890],{"type":29,"tag":59,"props":891,"children":892},{},[893],{"type":34,"value":894},"What if the party used multiple email addresses to open exchange accounts?",{"type":29,"tag":30,"props":896,"children":897},{},[898],{"type":34,"value":899},"The party's disclosure obligations require them to identify all accounts. If there is evidence suggesting multiple accounts (such as through blockchain analysis identifying exchange interactions that do not correspond to the disclosed accounts), the subpoena can be issued to the exchange with all known identifiers, including wallet addresses that interacted with the exchange's deposit addresses. The exchange can then search its records for any account associated with those identifiers.",{"type":29,"tag":30,"props":901,"children":902},{},[903],{"type":29,"tag":59,"props":904,"children":905},{},[906],{"type":34,"value":907},"How does the exchange verify that a subpoena is legitimate before responding?",{"type":29,"tag":30,"props":909,"children":910},{},[911],{"type":34,"value":912},"Exchanges have legal teams that review subpoenas for proper form, jurisdiction, and compliance with applicable law. A defectively served or poorly formed subpoena may be rejected or result in a limited response. Having legal counsel review the subpoena, or working with counsel experienced in cryptocurrency litigation, reduces the risk of technical objections.",{"type":29,"tag":30,"props":914,"children":915},{},[916],{"type":29,"tag":59,"props":917,"children":918},{},[919],{"type":34,"value":920},"What if the exchange is acquired or goes bankrupt?",{"type":29,"tag":30,"props":922,"children":923},{},[924],{"type":34,"value":925},"Exchange records are often among the most valuable assets in a bankruptcy estate and are typically preserved through insolvency proceedings. The bankruptcy trustee or receiver may be the appropriate party to whom subsequent subpoenas should be directed. Note that the timing of a subpoena in relation to an exchange's financial difficulties may affect both the availability of records and the process for obtaining them.",{"type":29,"tag":30,"props":927,"children":928},{},[929],{"type":29,"tag":59,"props":930,"children":931},{},[932],{"type":34,"value":933},"Is there a way to determine what exchange a wallet used without serving a subpoena?",{"type":29,"tag":30,"props":935,"children":936},{},[937],{"type":34,"value":938},"Blockchain forensic analysis can often attribute exchange interactions to specific platforms based on databases of exchange deposit addresses that have been compiled over time. This allows an analyst to identify likely exchange targets before serving the subpoena. The subpoena then confirms the account and produces the account-level records that the blockchain alone cannot provide.",{"title":8,"searchDepth":468,"depth":468,"links":940},[941,942,943,944,945,946,947,948,949],{"id":516,"depth":468,"text":519},{"id":597,"depth":468,"text":600},{"id":658,"depth":468,"text":661},{"id":687,"depth":468,"text":690},{"id":708,"depth":468,"text":711},{"id":739,"depth":468,"text":742},{"id":768,"depth":468,"text":771},{"id":805,"depth":468,"text":808},{"id":398,"depth":468,"text":401},"content:articles:07-subpoenaing-cryptocurrency-exchange-records.md","articles\u002F07-subpoenaing-cryptocurrency-exchange-records.md","articles\u002F07-subpoenaing-cryptocurrency-exchange-records",{"loc":487},1779289486699]