[{"data":1,"prerenderedAt":1537},["ShallowReactive",2],{"tag-kyc":3},[4,604,1062],{"_path":5,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":9,"description":10,"slug":11,"date":12,"lastUpdated":12,"author":13,"readingTime":14,"category":15,"tags":16,"ogImage":22,"featured":7,"body":23,"_type":598,"_id":599,"_source":600,"_file":601,"_stem":602,"_extension":603},"\u002Farticles\u002F31-crypto-wallet-exchange-device-discovery","articles",false,"","Discovery for wallets, exchanges, and devices: beyond the CSV","Draft discovery requests for native exchange data, device records, and authentication history, not bare CSVs, so your expert can tie transactions to users.","crypto-wallet-exchange-device-discovery","2026-07-11","Nick Kampe",13,"Legal Reference",[17,18,19,20,21],"discovery","exchange-records","wallet","device-forensics","kyc","\u002Fog\u002Fcrypto-wallet-exchange-device-discovery.png",{"type":24,"children":25,"toc":565},"root",[26,34,41,46,62,68,73,98,111,117,122,145,150,157,162,168,173,179,184,190,195,201,206,212,217,230,236,249,255,260,266,271,277,282,312,318,323,336,342,347,371,376,382,425,431,436,441,447,460,466,472,483,489,498,504,521,527,544],{"type":27,"tag":28,"props":29,"children":30},"element","p",{},[31],{"type":32,"value":33},"text","A party may produce a CSV labeled \"transaction history\" that lacks a timezone, field definitions, reconcilable identifiers, or documented fiat-conversion rates. Such an export may be inadequate for reconstruction. This article is about drafting discovery so that does not happen: requests to parties, exchanges, and devices that deliver native data, schemas, identifiers, timestamps, and authentication history. The working assumption is federal practice; state rules vary, so check the forum's counterpart.",{"type":27,"tag":35,"props":36,"children":38},"h2",{"id":37},"why-a-transaction-csv-is-not-enough",[39],{"type":32,"value":40},"Why a Transaction CSV Is Not Enough",{"type":27,"tag":28,"props":42,"children":43},{},[44],{"type":32,"value":45},"A recurring discovery failure is accepting a summary export as the production. A CSV from an exchange's reporting tab may be a curated customer view rather than a record set built for reconstruction: it may omit internal transfers or failed orders, convert amounts to fiat at undocumented rates, truncate identifiers, or log times in a local timezone.",{"type":27,"tag":28,"props":47,"children":48},{},[49,51,60],{"type":32,"value":50},"Rule 34(b)(1)(C) permits the request to specify the form or forms in which ESI will be produced (",{"type":27,"tag":52,"props":53,"children":57},"a",{"href":54,"rel":55},"https:\u002F\u002Fwww.uscourts.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fdocument\u002Ffederal-rules-of-civil-procedure.pdf",[56],"nofollow",[58],{"type":32,"value":59},"Federal Rules of Civil Procedure, amended through December 1, 2025",{"type":32,"value":61},"). If no form is specified, Rule 34(b)(2)(E) requires production in a form in which the information is ordinarily maintained or in a reasonably usable form. A party need not produce the same ESI in more than one form. If the request omits a form, or the responding party objects to the requested form, Rule 34(b)(2)(D) requires the responding party to state the form or forms it intends to use. Specify the form up front so the issue is addressed in the response, not after the expert receives an unusable production.",{"type":27,"tag":35,"props":63,"children":65},{"id":64},"start-with-the-disputed-propositions-then-map-each-to-a-record-source",[66],{"type":32,"value":67},"Start with the Disputed Propositions, Then Map Each to a Record Source",{"type":27,"tag":28,"props":69,"children":70},{},[71],{"type":32,"value":72},"Draft backward from what the case must prove, then name the record source for each proposition:",{"type":27,"tag":74,"props":75,"children":76},"ul",{},[77,83,88,93],{"type":27,"tag":78,"props":79,"children":80},"li",{},[81],{"type":32,"value":82},"\"X held the account\" maps to registration records, KYC verification steps with dates, linked payment methods, and assigned deposit addresses.",{"type":27,"tag":78,"props":84,"children":85},{},[86],{"type":32,"value":87},"\"X controlled the withdrawal destination\" maps to withdrawal records with destination addresses, address book and whitelist entries with add dates, and withdrawal approvals.",{"type":27,"tag":78,"props":89,"children":90},{},[91],{"type":32,"value":92},"\"The transfers were authorized by X\" maps to authentication history: logins, sessions, device identifiers, two-factor changes, API key usage.",{"type":27,"tag":78,"props":94,"children":95},{},[96],{"type":32,"value":97},"\"The amounts and values on the relevant dates\" maps to order and trade records with native timestamps; \"X knew about or directed the activity\" maps to support tickets, chat logs, and the party's own communications.",{"type":27,"tag":28,"props":99,"children":100},{},[101,103,109],{"type":32,"value":102},"That source list should come from an expert who knows which fields an export must contain and which records exist only internally; that expertise defines the categories a ",{"type":27,"tag":52,"props":104,"children":106},{"href":105},"\u002Fservices#evidence-review",[107],{"type":32,"value":108},"discovery and evidence review engagement",{"type":32,"value":110}," can verify before the RFP goes out, cheaper than a motion to compel after an unusable production.",{"type":27,"tag":35,"props":112,"children":114},{"id":113},"what-to-request-native-data-schemas-and-field-definitions",[115],{"type":32,"value":116},"What to Request: Native Data, Schemas, and Field Definitions",{"type":27,"tag":28,"props":118,"children":119},{},[120],{"type":32,"value":121},"Name actual record categories rather than asking for \"all documents relating to cryptocurrency.\" For each category, specify:",{"type":27,"tag":74,"props":123,"children":124},{},[125,130,135,140],{"type":27,"tag":78,"props":126,"children":127},{},[128],{"type":32,"value":129},"Structured export format (CSV or JSON with full precision) with a schema or data dictionary defining every field, not PDFs or screenshots.",{"type":27,"tag":78,"props":131,"children":132},{},[133],{"type":32,"value":134},"Field definitions for identifiers: account identifier, wallet address, transaction hash, order identifier, internal transfer identifier.",{"type":27,"tag":78,"props":136,"children":137},{},[138],{"type":32,"value":139},"All timestamps in UTC with the source timezone documented, plus block height where relevant.",{"type":27,"tag":78,"props":141,"children":142},{},[143],{"type":32,"value":144},"Amounts in the asset's base units or with the exchange's recorded rate, and chain and network identifiers so exports from different sources can be joined.",{"type":27,"tag":28,"props":146,"children":147},{},[148],{"type":32,"value":149},"This is not a demand for the exchange's internal database; it is a demand for exports plus the documentation that makes them legible. Where a party operates its own Ethereum node, name the block, transaction, and receipt objects and fields needed rather than accepting any flat export.",{"type":27,"tag":151,"props":152,"children":154},"h3",{"id":153},"form-specifications-that-survive-objections",[155],{"type":32,"value":156},"Form specifications that survive objections",{"type":27,"tag":28,"props":158,"children":159},{},[160],{"type":32,"value":161},"Three habits keep these requests defensible. Tie each form specification to usability: the specified form is needed to reconcile the production against blockchain data and other productions, and Rule 34(b)(1)(C) lets the request name that form. Ask for one form per category, since a party need not produce the same ESI in more than one form. Anticipate an objection that a source is not reasonably accessible because of undue burden or cost under Rule 26(b)(2)(B): scope requests to the disputed period and be ready to show good cause if the source is an encrypted legacy backup.",{"type":27,"tag":35,"props":163,"children":165},{"id":164},"beyond-transactions-account-authentication-and-device-records",[166],{"type":32,"value":167},"Beyond Transactions: Account, Authentication, and Device Records",{"type":27,"tag":28,"props":169,"children":170},{},[171],{"type":32,"value":172},"Transaction exports capture value movement, not the account-level facts that tie movement to a person.",{"type":27,"tag":151,"props":174,"children":176},{"id":175},"account-lifecycle-records",[177],{"type":32,"value":178},"Account lifecycle records",{"type":27,"tag":28,"props":180,"children":181},{},[182],{"type":32,"value":183},"Request registration data, KYC steps with dates and outcomes, linked payment methods, every deposit address assigned, and address book and whitelist entries with add dates, often correlating with the disputed transfers. Also request hold, freeze, and flag records with the reasons recorded; a compliance flag is itself a relevant fact about the account.",{"type":27,"tag":151,"props":185,"children":187},{"id":186},"authentication-and-access-history",[188],{"type":32,"value":189},"Authentication and access history",{"type":27,"tag":28,"props":191,"children":192},{},[193],{"type":32,"value":194},"Login events with IP addresses and device fingerprints, session records, password and two-factor changes, recovery code issuance, and new-device notifications. This separates \"the account was used\" from \"the party used the account,\" and the fingerprints later reconcile against the device production.",{"type":27,"tag":151,"props":196,"children":198},{"id":197},"api-keys-and-automated-activity",[199],{"type":32,"value":200},"API keys and automated activity",{"type":27,"tag":28,"props":202,"children":203},{},[204],{"type":32,"value":205},"Request API key creation, scopes, last-use timestamps, and, if retained, the hosts from which keys were used. These records can help test a claim that a bot initiated transfers the party denies authorizing.",{"type":27,"tag":151,"props":207,"children":209},{"id":208},"support-and-communications-records",[210],{"type":32,"value":211},"Support and communications records",{"type":27,"tag":28,"props":213,"children":214},{},[215],{"type":32,"value":216},"Support tickets, chat logs, and emails, including KYC appeals and fraud reports, often contain the party's own admissions about the account and activity.",{"type":27,"tag":28,"props":218,"children":219},{},[220,222,228],{"type":32,"value":221},"The mechanics of enforcing these categories against nonparties are covered in ",{"type":27,"tag":52,"props":223,"children":225},{"href":224},"\u002Fresources\u002Fsubpoenaing-cryptocurrency-exchange-records",[226],{"type":32,"value":227},"how to subpoena cryptocurrency exchange records",{"type":32,"value":229},"; the point here is that party discovery and nonparty subpoenas should be one system. Serve the party first for identifiers and device records, then feed those identifiers into the exchange subpoena so the exchange searches by email, phone, and wallet address. If the party cooperates, consider a signed authorization to the exchange as an additional avenue for requesting account records.",{"type":27,"tag":35,"props":231,"children":233},{"id":232},"device-and-app-records-the-self-custody-evidence-layer",[234],{"type":32,"value":235},"Device and App Records: The Self-Custody Evidence Layer",{"type":27,"tag":28,"props":237,"children":238},{},[239,241,247],{"type":32,"value":240},"For self-custody wallets there is no institution holding records; the evidence lives on devices and in the party's files. Device production is a Rule 34 request too: phones, computers, and hardware wallets are tangible things within the scope of ",{"type":27,"tag":52,"props":242,"children":244},{"href":54,"rel":243},[56],[245],{"type":32,"value":246},"Rule 34(a)(1)",{"type":32,"value":248},", and the ESI on them is within the same rule.",{"type":27,"tag":151,"props":250,"children":252},{"id":251},"wallet-software-and-browser-extensions",[253],{"type":32,"value":254},"Wallet software and browser extensions",{"type":27,"tag":28,"props":256,"children":257},{},[258],{"type":32,"value":259},"Request installed wallet applications, app data directories, local databases, configuration files, and logs, plus browser extension storage. App data may persist after uninstall, though a qualified examiner must determine whether any artifact is recoverable. Seed material in notes apps, password managers, photos, and cloud documents belongs in the same category, requested explicitly.",{"type":27,"tag":151,"props":261,"children":263},{"id":262},"hardware-wallets",[264],{"type":32,"value":265},"Hardware wallets",{"type":27,"tag":28,"props":267,"children":268},{},[269],{"type":32,"value":270},"The device itself can be produced for examination, and its companion application may leave address and transaction artifacts on the host computer. The most productive target is often that computer: request connection artifacts, app install history, and records of which addresses the party managed through the device.",{"type":27,"tag":151,"props":272,"children":274},{"id":273},"backups-seed-material-and-signed-messages",[275],{"type":32,"value":276},"Backups, seed material, and signed messages",{"type":27,"tag":28,"props":278,"children":279},{},[280],{"type":32,"value":281},"Request cloud backups of wallet data, password manager exports, encrypted containers, and any written or photographed seed phrase material. Where control of an address is disputed, request a signed message from it: a valid signature demonstrates that the signer controlled the relevant private key at the time of signing without disclosing the key. A refusal may become a factual issue, but it is not proof by itself.",{"type":27,"tag":28,"props":283,"children":284},{},[285,287,294,296,302,304,310],{"type":32,"value":286},"Collection integrity is the expert's prerequisite. The four-phase forensic process in ",{"type":27,"tag":52,"props":288,"children":291},{"href":289,"rel":290},"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F86\u002Ffinal",[56],[292],{"type":32,"value":293},"NIST SP 800-86",{"type":32,"value":295}," (published by NIST in August 2006) runs collection, examination, analysis, and reporting, with data integrity preserved through collection and examination. Devices should be imaged under a defensible protocol with hashing and documented chain of custody, and the request should permit that methodology rather than demanding raw devices with no safeguards. See ",{"type":27,"tag":52,"props":297,"children":299},{"href":298},"\u002Fresources\u002Funderstanding-wallet-ownership-evidence",[300],{"type":32,"value":301},"understanding wallet ownership evidence",{"type":32,"value":303}," for the evidence types that establish control, and ",{"type":27,"tag":52,"props":305,"children":307},{"href":306},"\u002Fresources\u002Fself-custody-vs-custodial-wallets",[308],{"type":32,"value":309},"self-custody vs. custodial wallets",{"type":32,"value":311}," for how custody changes what records exist.",{"type":27,"tag":35,"props":313,"children":315},{"id":314},"interrogatories-and-rule-30b6-depositions-explain-the-system",[316],{"type":32,"value":317},"Interrogatories and Rule 30(b)(6) Depositions: Explain the System",{"type":27,"tag":28,"props":319,"children":320},{},[321],{"type":32,"value":322},"Interrogatories describe; native ESI proves. Use interrogatories (Rule 33) to ask the party to identify every exchange account, wallet address, device, application, and key-storage location, and to state whether any data was deleted or migrated during the relevant period. The answers become the roadmap for the RFP. They do not substitute for production: responsive records still must come out in usable form under Rule 34, and describing records is not producing them.",{"type":27,"tag":28,"props":324,"children":325},{},[326,328,334],{"type":32,"value":327},"Rule 30(b)(6) depositions fill the explanatory gap for organizational parties. The notice must describe the matters for examination with reasonable particularity, and the named organization must designate one or more people to testify about information known or reasonably available to it. Useful topics for an exchange include schema, export methodology, retention periods, KYC process, key custody, and API logging. For an individual party, use an ordinary Rule 30(b)(1) deposition to cover which devices and applications were used, how keys were stored, and what happened to the account during the dispute window. Depose after production so the deponent can be walked through the actual exports. For nonparties, the same explanation can be compelled with a deposition subpoena under ",{"type":27,"tag":52,"props":329,"children":331},{"href":54,"rel":330},[56],[332],{"type":32,"value":333},"Rule 45",{"type":32,"value":335},", which also permits designating the form of production.",{"type":27,"tag":35,"props":337,"children":339},{"id":338},"model-request-categories-and-proportionality-limits",[340],{"type":32,"value":341},"Model Request Categories and Proportionality Limits",{"type":27,"tag":28,"props":343,"children":344},{},[345],{"type":32,"value":346},"A defensible RFP structure for a digital asset matter:",{"type":27,"tag":348,"props":349,"children":350},"ol",{},[351,356,361,366],{"type":27,"tag":78,"props":352,"children":353},{},[354],{"type":32,"value":355},"Native exports with schemas and field definitions for account, trade, order, deposit, withdrawal, and transfer records, in the specified form.",{"type":27,"tag":78,"props":357,"children":358},{},[359],{"type":32,"value":360},"Account, authentication, API key, and support records as specified in the sections above.",{"type":27,"tag":78,"props":362,"children":363},{},[364],{"type":32,"value":365},"Device records: wallet applications, app data, extension storage, backups, seed and key material in any form, and device production for imaging where self-custody control is disputed.",{"type":27,"tag":78,"props":367,"children":368},{},[369],{"type":32,"value":370},"Explanatory records: written procedures, export documentation, and any tool used to generate the production.",{"type":27,"tag":28,"props":372,"children":373},{},[374],{"type":32,"value":375},"Handle proportionality in the drafting. Rule 26(b)(1) limits discovery to nonprivileged matter that is relevant to any party's claim or defense and proportional to the needs of the case. Scope time periods to the dispute, limit imaging to the custodians that matter, and stagger requests so account records come first and device production follows only if the dispute turns on self-custody control. The proposed discovery plan under Rule 26(f) must state the parties' views and proposals on ESI issues, including the form or forms in which ESI should be produced, and the scheduling order may include ESI preservation terms under Rule 16(b). Issue a litigation hold early: Rule 37(e) applies when ESI that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery, so the preservation letter should name these categories rather than \"all records.\"",{"type":27,"tag":151,"props":377,"children":379},{"id":378},"practitioner-checklist",[380],{"type":32,"value":381},"Practitioner checklist",{"type":27,"tag":348,"props":383,"children":384},{},[385,390,395,400,405,410,415,420],{"type":27,"tag":78,"props":386,"children":387},{},[388],{"type":32,"value":389},"Build the proposition-to-source map with the expert before any RFP.",{"type":27,"tag":78,"props":391,"children":392},{},[393],{"type":32,"value":394},"Serve a preservation notice covering the categories above.",{"type":27,"tag":78,"props":396,"children":397},{},[398],{"type":32,"value":399},"Serve RFPs with explicit form specifications, schema demands, and date ranges.",{"type":27,"tag":78,"props":401,"children":402},{},[403],{"type":32,"value":404},"Serve interrogatories requiring identification of accounts, addresses, devices, applications, and deletions.",{"type":27,"tag":78,"props":406,"children":407},{},[408],{"type":32,"value":409},"Designate Rule 30(b)(6) topics against an organizational party and any custodial exchange.",{"type":27,"tag":78,"props":411,"children":412},{},[413],{"type":32,"value":414},"Coordinate nonparty subpoenas using produced identifiers, with party authorizations.",{"type":27,"tag":78,"props":416,"children":417},{},[418],{"type":32,"value":419},"Have the expert reconcile exchange exports against the blockchain and both against device evidence.",{"type":27,"tag":78,"props":421,"children":422},{},[423],{"type":32,"value":424},"If productions arrive without schemas or in unusable form, move to compel on the form specification.",{"type":27,"tag":35,"props":426,"children":428},{"id":427},"reconciling-productions-a-worked-hypothetical",[429],{"type":32,"value":430},"Reconciling Productions: A Worked Hypothetical",{"type":27,"tag":28,"props":432,"children":433},{},[434],{"type":32,"value":435},"Hypothetical example: In a business divorce, the company's exchange account shows a withdrawal of 40 ETH to a wallet address, and the other side claims the address belongs to an unrelated third party repaying a loan. The native export shows the withdrawal with a transaction hash, a UTC timestamp, and an address book entry the account holder added for that destination 11 days earlier. The exchange's Rule 30(b)(6) deponent confirms address book entries are added only through authenticated sessions. Blockchain data confirms the hash and the recipient's later activity. Device production from the company laptop shows a browser extension vault and a photo of a seed phrase, and the expert verifies the derived addresses match the recipient. Each layer checks against the others: exchange records tie the company to the withdrawal, the address book ties the destination to the holder's action, and the device evidence ties it to the party personally.",{"type":27,"tag":28,"props":437,"children":438},{},[439],{"type":32,"value":440},"Now the same case with a badly drafted production: a PDF statement with local times, dollar-converted amounts, and no hashes. The expert cannot match the withdrawal to the blockchain, the address connects to no one, and the gap becomes a factual fight. That outcome was decided when the RFP was drafted.",{"type":27,"tag":151,"props":442,"children":444},{"id":443},"limitations-what-discovery-cannot-fix",[445],{"type":32,"value":446},"Limitations: what discovery cannot fix",{"type":27,"tag":28,"props":448,"children":449},{},[450,452,458],{"type":32,"value":451},"Requests cannot manufacture records that never existed. Foreign and non-KYC platforms may sit beyond domestic process, decentralized protocols leave no record-holder to subpoena, retention windows may already have closed for login logs, and an encrypted device can block examination until the court addresses it. Shared keys and multisig arrangements complicate attribution even with perfect records. Where these limits bind, the case narrows to what the blockchain shows and what disclosure obligations require, which is one more reason to run ",{"type":27,"tag":52,"props":453,"children":455},{"href":454},"\u002Fservices#blockchain-tracing",[456],{"type":32,"value":457},"blockchain tracing",{"type":32,"value":459}," in parallel with discovery rather than waiting for productions.",{"type":27,"tag":35,"props":461,"children":463},{"id":462},"frequently-asked-questions",[464],{"type":32,"value":465},"Frequently Asked Questions",{"type":27,"tag":151,"props":467,"children":469},{"id":468},"q-can-i-compel-production-of-a-phone-computer-or-hardware-wallet-for-forensic-examination-in-civil-discovery",[470],{"type":32,"value":471},"Q: Can I compel production of a phone, computer, or hardware wallet for forensic examination in civil discovery?",{"type":27,"tag":28,"props":473,"children":474},{},[475,481],{"type":27,"tag":476,"props":477,"children":478},"strong",{},[479],{"type":32,"value":480},"A:",{"type":32,"value":482}," Devices are tangible things within the scope of Rule 34(a)(1), and the ESI on them is discoverable like any other electronically stored information, subject to relevance and proportionality under Rule 26(b)(1). Courts manage privacy and burden through protective orders, search protocols, special masters, or limits on custodians and timeframes. Because devices get replaced or wiped, request device production early and pair it with a preservation notice.",{"type":27,"tag":151,"props":484,"children":486},{"id":485},"q-what-if-the-exchange-produces-a-csv-with-no-field-definitions-or-timezone-information",[487],{"type":32,"value":488},"Q: What if the exchange produces a CSV with no field definitions or timezone information?",{"type":27,"tag":28,"props":490,"children":491},{},[492,496],{"type":27,"tag":476,"props":493,"children":494},{},[495],{"type":32,"value":480},{"type":32,"value":497}," If you specified a structured form, it may be the wrong form. Rule 34(b)(1)(C) lets the request name the form, for example a structured CSV or JSON rather than a PDF statement. If you requested schemas, documented timezones, and full identifiers as their own categories, assess any response or objection to those categories against the rules and the case-specific order. Have the expert document which fields are missing and why they cannot be joined to the blockchain or to other productions; that turns a format dispute into a concrete showing.",{"type":27,"tag":151,"props":499,"children":501},{"id":500},"q-are-interrogatory-answers-enough-to-establish-who-controlled-a-wallet",[502],{"type":32,"value":503},"Q: Are interrogatory answers enough to establish who controlled a wallet?",{"type":27,"tag":28,"props":505,"children":506},{},[507,511,513,519],{"type":27,"tag":476,"props":508,"children":509},{},[510],{"type":32,"value":480},{"type":32,"value":512}," No. Answers are useful evidence and can be used to impeach if contradicted, but they describe facts; they do not substitute for responsive records that must be produced in native, usable form under Rule 34. That form lets the expert verify addresses, hashes, and timestamps against the blockchain. Treat interrogatories as the map and the production as the territory. For how control is proven once records exist, see ",{"type":27,"tag":52,"props":514,"children":516},{"href":515},"\u002Fresources\u002Fblockchain-analyst-vs-expert-witness",[517],{"type":32,"value":518},"the difference between a blockchain analyst and an expert witness",{"type":32,"value":520},".",{"type":27,"tag":151,"props":522,"children":524},{"id":523},"q-when-should-i-bring-a-forensic-expert-into-the-discovery-process",[525],{"type":32,"value":526},"Q: When should I bring a forensic expert into the discovery process?",{"type":27,"tag":28,"props":528,"children":529},{},[530,534,536,542],{"type":27,"tag":476,"props":531,"children":532},{},[533],{"type":32,"value":480},{"type":32,"value":535}," At the drafting stage, not after the first production. The expert determines which fields an exchange export must contain, which records exist only internally, and what form the data needs to reconcile against the chain and device evidence. Early engagement converts vague requests into specific ones, shortens the meet-and-confer, and strengthens a motion to compel if the production still comes back unusable. For custody disputes over self-custody assets, an early ",{"type":27,"tag":52,"props":537,"children":539},{"href":538},"\u002Fservices#expert-witness",[540],{"type":32,"value":541},"expert witness consultation",{"type":32,"value":543}," also shapes the Rule 30(b)(6) topics before depositions are noticed.",{"type":27,"tag":28,"props":545,"children":546},{},[547,549,555,557,563],{"type":32,"value":548},"Rules differ by court and by state: Missouri's general provision governing discovery, for example, is in Rule 56.01, and federal districts impose their own ESI protocols. The right request set depends on the disputes and the exchanges and devices involved. If you are drafting discovery in a matter that touches wallets, exchanges, or devices, I am available to discuss the request categories and the ",{"type":27,"tag":52,"props":550,"children":552},{"href":551},"\u002Fmethodology",[553],{"type":32,"value":554},"ConsensusIntel methodology",{"type":32,"value":556}," for this kind of reconstruction. ",{"type":27,"tag":52,"props":558,"children":560},{"href":559},"\u002Fcontact",[561],{"type":32,"value":562},"Contact me",{"type":32,"value":564}," with the facts of your matter.",{"title":8,"searchDepth":566,"depth":566,"links":567},2,[568,569,570,574,580,585,586,589,592],{"id":37,"depth":566,"text":40},{"id":64,"depth":566,"text":67},{"id":113,"depth":566,"text":116,"children":571},[572],{"id":153,"depth":573,"text":156},3,{"id":164,"depth":566,"text":167,"children":575},[576,577,578,579],{"id":175,"depth":573,"text":178},{"id":186,"depth":573,"text":189},{"id":197,"depth":573,"text":200},{"id":208,"depth":573,"text":211},{"id":232,"depth":566,"text":235,"children":581},[582,583,584],{"id":251,"depth":573,"text":254},{"id":262,"depth":573,"text":265},{"id":273,"depth":573,"text":276},{"id":314,"depth":566,"text":317},{"id":338,"depth":566,"text":341,"children":587},[588],{"id":378,"depth":573,"text":381},{"id":427,"depth":566,"text":430,"children":590},[591],{"id":443,"depth":573,"text":446},{"id":462,"depth":566,"text":465,"children":593},[594,595,596,597],{"id":468,"depth":573,"text":471},{"id":485,"depth":573,"text":488},{"id":500,"depth":573,"text":503},{"id":523,"depth":573,"text":526},"markdown","content:articles:31-crypto-wallet-exchange-device-discovery.md","content","articles\u002F31-crypto-wallet-exchange-device-discovery.md","articles\u002F31-crypto-wallet-exchange-device-discovery","md",{"_path":605,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":606,"description":607,"slug":608,"date":609,"lastUpdated":609,"author":13,"readingTime":610,"category":611,"tags":612,"ogImage":618,"featured":7,"body":619,"_type":598,"_id":1059,"_source":600,"_file":1060,"_stem":1061,"_extension":603},"\u002Farticles\u002F09-self-custody-vs-custodial-wallets","Self-custody vs. custodial wallets: what attorneys need to know","A guide to custodial and self-custody cryptocurrency wallets, the records each leaves behind, and how attorneys can establish control in litigation.","self-custody-vs-custodial-wallets","2026-05-05",11,"Education",[613,614,615,616,21,617],"custody","self-custody","hardware-wallet","exchange","evidence","\u002Fog\u002Fself-custody-vs-custodial-wallets.png",{"type":24,"children":620,"toc":1042},[621,626,631,637,642,654,665,671,681,691,701,706,712,722,731,741,751,757,762,772,782,792,802,812,830,836,841,853,858,864,869,879,888,898,908,913,919,924,929,941,947,952,957,962,979,983,987,993,998,1004,1009,1015,1020,1026,1031,1037],{"type":27,"tag":28,"props":622,"children":623},{},[624],{"type":32,"value":625},"When attorneys first encounter cryptocurrency in a legal matter, one of the most practically significant questions is whether the assets are held with a financial institution or held independently by the individual. The answer determines what institutional records exist, what can be obtained through subpoena, and what investigative techniques are required to establish ownership and value.",{"type":27,"tag":28,"props":627,"children":628},{},[629],{"type":32,"value":630},"The distinction is not subtle. It is the fundamental design choice in cryptocurrency: either a third party holds the cryptographic key material and the user interacts with the assets through that party's platform, or the user holds the key material directly and controls the assets without any intermediary. These two arrangements have radically different evidence profiles.",{"type":27,"tag":35,"props":632,"children":634},{"id":633},"the-fundamental-distinction",[635],{"type":32,"value":636},"The Fundamental Distinction",{"type":27,"tag":28,"props":638,"children":639},{},[640],{"type":32,"value":641},"Every cryptocurrency asset on a public blockchain is controlled by whoever possesses the private key associated with the address where the asset is held. The private key is the cryptographic credential that authorizes spending. Nothing else matters technically. Courts, legal titles, and oral agreements about who should have access to cryptocurrency are beside the point until someone has the key.",{"type":27,"tag":28,"props":643,"children":644},{},[645,647,652],{"type":32,"value":646},"In a ",{"type":27,"tag":476,"props":648,"children":649},{},[650],{"type":32,"value":651},"custodial arrangement",{"type":32,"value":653},", the user does not possess the private key. A third party, typically a cryptocurrency exchange or institutional custodian, holds the private key and provides the user with an account interface. The user can view their balance, initiate trades, and request withdrawals, but they are relying on the custodian to execute all of that on their behalf. The custodian actually controls the blockchain assets. From a legal process perspective, this arrangement resembles a bank account: there is an institution with records, regulatory obligations, and the ability to respond to subpoenas.",{"type":27,"tag":28,"props":655,"children":656},{},[657,658,663],{"type":32,"value":646},{"type":27,"tag":476,"props":659,"children":660},{},[661],{"type":32,"value":662},"self-custody arrangement",{"type":32,"value":664},", the user holds the private key directly. There is no intermediary. The user controls the blockchain assets personally, using wallet software or hardware to manage the key material and sign transactions. From a legal process perspective, this arrangement has no institutional analog. There is no company to subpoena for records. The evidence must come from the blockchain itself, from the user's devices, and from whatever documentary evidence exists about the key material.",{"type":27,"tag":35,"props":666,"children":668},{"id":667},"types-of-custodial-custody",[669],{"type":32,"value":670},"Types of Custodial Custody",{"type":27,"tag":28,"props":672,"children":673},{},[674,679],{"type":27,"tag":476,"props":675,"children":676},{},[677],{"type":32,"value":678},"Cryptocurrency exchanges",{"type":32,"value":680}," are the most common custodial arrangement. Exchanges like Coinbase, Kraken, Gemini, and Binance allow users to buy, sell, and hold cryptocurrency in exchange-managed accounts. The exchange holds the private keys and maintains internal ledger entries representing each user's balance. The blockchain does not necessarily reflect each user's individual holding; many exchanges aggregate user funds in pooled wallets and maintain their own off-chain record of who holds what.",{"type":27,"tag":28,"props":682,"children":683},{},[684,689],{"type":27,"tag":476,"props":685,"children":686},{},[687],{"type":32,"value":688},"Cryptocurrency ETFs and investment products",{"type":32,"value":690}," hold digital assets through institutional custodians on behalf of shareholders. A person who owns shares in a Bitcoin ETF has exposure to Bitcoin price movements but does not hold Bitcoin on the blockchain and has no private key. The relevant records are with the fund and the brokerage through which the shares are held, not on a blockchain.",{"type":27,"tag":28,"props":692,"children":693},{},[694,699],{"type":27,"tag":476,"props":695,"children":696},{},[697],{"type":32,"value":698},"Institutional custody services",{"type":32,"value":700}," are used by high-net-worth individuals and institutional investors who want the security of a regulated custodian combined with the direct asset ownership that exchange accounts provide. These custodians maintain blockchain records but hold the keys and provide security infrastructure that individual users cannot easily replicate. They are subject to regulatory oversight and maintain records similar to other financial institutions.",{"type":27,"tag":28,"props":702,"children":703},{},[704],{"type":32,"value":705},"For litigation purposes, all forms of custodial custody share the key characteristic: there is an identifiable institution that holds records and can be compelled through legal process to produce them. The discovery approach for custodial assets is the same as for conventional financial assets, with the additional technical consideration of identifying the specific exchange or custodian.",{"type":27,"tag":35,"props":707,"children":709},{"id":708},"types-of-self-custody",[710],{"type":32,"value":711},"Types of Self-Custody",{"type":27,"tag":28,"props":713,"children":714},{},[715,720],{"type":27,"tag":476,"props":716,"children":717},{},[718],{"type":32,"value":719},"Software wallets",{"type":32,"value":721}," are applications installed on a computer or mobile device that generate and store private key material on the device. The user interacts with the wallet through the application's interface, which reads the blockchain and signs transactions using the locally stored key. Popular software wallets include MetaMask (primarily for Ethereum-based assets), various Bitcoin wallet applications, and multi-asset wallets supporting many different blockchains. Software wallets store key material on the device, which creates the possibility of recovering that material through device forensics even if the application itself has been deleted.",{"type":27,"tag":28,"props":723,"children":724},{},[725,729],{"type":27,"tag":476,"props":726,"children":727},{},[728],{"type":32,"value":265},{"type":32,"value":730}," are dedicated physical devices designed specifically to store private key material in a secure chip that is isolated from internet-connected computers. When a user wants to sign a transaction, they connect the hardware wallet to a computer, review the transaction details on the hardware wallet's display, and physically confirm the transaction by pressing a button. The private key never leaves the device. Popular hardware wallets include devices made by Ledger and Trezor. A hardware wallet can hold essentially unlimited cryptocurrency value in a device the size of a USB drive.",{"type":27,"tag":28,"props":732,"children":733},{},[734,739],{"type":27,"tag":476,"props":735,"children":736},{},[737],{"type":32,"value":738},"Paper wallets",{"type":32,"value":740}," are printed records of a private key or seed phrase. At the time of creation, the user generates the key material on a device and then prints or writes it down. If the paper is stored securely, the funds are accessible to anyone who finds it. Paper wallets are less common today but were a popular storage method in earlier years of cryptocurrency adoption.",{"type":27,"tag":28,"props":742,"children":743},{},[744,749],{"type":27,"tag":476,"props":745,"children":746},{},[747],{"type":32,"value":748},"Multisignature wallets",{"type":32,"value":750}," (commonly called multisig) require authorization from multiple private keys to execute a transaction. A 2-of-3 multisig wallet, for example, requires any two of three specified private keys to sign before funds can be moved. This arrangement can be used for security, for shared control, or specifically to complicate attribution in litigation. Multisig wallets have important implications for ownership evidence, because no single key establishes control.",{"type":27,"tag":35,"props":752,"children":754},{"id":753},"identifying-which-type-a-party-uses",[755],{"type":32,"value":756},"Identifying Which Type a Party Uses",{"type":27,"tag":28,"props":758,"children":759},{},[760],{"type":32,"value":761},"The first investigative question in any matter involving cryptocurrency is determining what type of custody the party employed. Several sources of evidence are useful:",{"type":27,"tag":28,"props":763,"children":764},{},[765,770],{"type":27,"tag":476,"props":766,"children":767},{},[768],{"type":32,"value":769},"Financial records",{"type":32,"value":771}," may show purchases from or transfers to cryptocurrency exchanges. Credit card or bank statements showing payments to known exchange platforms are strong indicators of custodial holdings.",{"type":27,"tag":28,"props":773,"children":774},{},[775,780],{"type":27,"tag":476,"props":776,"children":777},{},[778],{"type":32,"value":779},"Tax records",{"type":32,"value":781}," may show cryptocurrency-related transactions reported by exchanges through Form 1099 or equivalent reporting, or capital gains reported on Schedule D that reference exchange-based transactions.",{"type":27,"tag":28,"props":783,"children":784},{},[785,790],{"type":27,"tag":476,"props":786,"children":787},{},[788],{"type":32,"value":789},"Device examination",{"type":32,"value":791}," may reveal installed wallet applications, browser history showing exchange account access, locally stored wallet data, or seed phrase material saved in notes or password managers.",{"type":27,"tag":28,"props":793,"children":794},{},[795,800],{"type":27,"tag":476,"props":796,"children":797},{},[798],{"type":32,"value":799},"Communications",{"type":32,"value":801}," including email, text messages, or messaging app records may reference specific wallets or exchanges, amounts, transactions, or recovery phrases.",{"type":27,"tag":28,"props":803,"children":804},{},[805,810],{"type":27,"tag":476,"props":806,"children":807},{},[808],{"type":32,"value":809},"Prior disclosures",{"type":32,"value":811}," in other proceedings or in tax filings may identify specific exchange accounts or addresses.",{"type":27,"tag":28,"props":813,"children":814},{},[815,820,822,828],{"type":27,"tag":476,"props":816,"children":817},{},[818],{"type":32,"value":819},"Blockchain analysis",{"type":32,"value":821}," of any known addresses can identify exchange interactions in the transaction history, pointing toward specific custodial platforms. See ",{"type":27,"tag":52,"props":823,"children":825},{"href":824},"\u002Fresources\u002Fcan-blockchain-transactions-be-traced",[826],{"type":32,"value":827},"Can Blockchain Transactions Be Traced?",{"type":32,"value":829}," for how this analysis works.",{"type":27,"tag":35,"props":831,"children":833},{"id":832},"discovery-strategies-for-custodial-assets",[834],{"type":32,"value":835},"Discovery Strategies for Custodial Assets",{"type":27,"tag":28,"props":837,"children":838},{},[839],{"type":32,"value":840},"For custodial assets, the discovery approach closely parallels conventional financial asset discovery:",{"type":27,"tag":28,"props":842,"children":843},{},[844,846,851],{"type":32,"value":845},"Identify the specific exchanges through the sources above. Serve subpoenas directly to domestic exchanges seeking KYC records, transaction history, deposit and withdrawal addresses, linked payment methods, and access logs. See ",{"type":27,"tag":52,"props":847,"children":848},{"href":224},[849],{"type":32,"value":850},"Subpoenaing Cryptocurrency Exchange Records",{"type":32,"value":852}," for detailed guidance on structuring these requests.",{"type":27,"tag":28,"props":854,"children":855},{},[856],{"type":32,"value":857},"Interrogatories should require the party to identify all exchange accounts, all associated wallet addresses, and the existence of any self-custody wallets in addition to exchange accounts.",{"type":27,"tag":35,"props":859,"children":861},{"id":860},"discovery-strategies-for-self-custody-assets",[862],{"type":32,"value":863},"Discovery Strategies for Self-Custody Assets",{"type":27,"tag":28,"props":865,"children":866},{},[867],{"type":32,"value":868},"Self-custody assets require a different approach. There is no exchange to subpoena. The evidence must come from the blockchain, from the devices, and from documentary sources that establish the party's connection to specific addresses.",{"type":27,"tag":28,"props":870,"children":871},{},[872,877],{"type":27,"tag":476,"props":873,"children":874},{},[875],{"type":32,"value":876},"Device discovery",{"type":32,"value":878}," is the most important single step for self-custody assets. A court can order a party to produce devices, including phones, computers, and hardware wallets, for forensic examination. The forensic examination may recover wallet applications, locally stored wallet data, seed phrases saved in notes or password managers, transaction records, and other evidence connecting the party to specific addresses. Request device production early; devices get replaced, reset, or tampered with.",{"type":27,"tag":28,"props":880,"children":881},{},[882,886],{"type":27,"tag":476,"props":883,"children":884},{},[885],{"type":32,"value":819},{"type":32,"value":887}," begins from any confirmed wallet address and traces outward. If the party disclosed any exchange accounts, the withdrawal addresses from those accounts provide starting points for tracing funds that moved into self-custody wallets.",{"type":27,"tag":28,"props":889,"children":890},{},[891,896],{"type":27,"tag":476,"props":892,"children":893},{},[894],{"type":32,"value":895},"Seed phrase and key material discovery",{"type":32,"value":897}," should be addressed explicitly in discovery requests. Interrogatories should ask whether the party has written down, stored, or memorized seed phrases or private keys. Requests for production should seek any document, photograph, or record containing seed phrase or private key material.",{"type":27,"tag":28,"props":899,"children":900},{},[901,906],{"type":27,"tag":476,"props":902,"children":903},{},[904],{"type":32,"value":905},"Signed message requests",{"type":32,"value":907}," can be pursued through court order in some circumstances. A court can order a party to produce a cryptographic signed message from a disputed address, which proves control without requiring the party to disclose the private key itself.",{"type":27,"tag":28,"props":909,"children":910},{},[911],{"type":32,"value":912},"Hypothetical example: Assume a party denies control of a disclosed address but produces a court-ordered signed message from it. The signature can establish control of that address without revealing the private key or moving any assets.",{"type":27,"tag":35,"props":914,"children":916},{"id":915},"the-proving-self-custody-problem-in-specific-contexts",[917],{"type":32,"value":918},"The Proving Self-Custody Problem in Specific Contexts",{"type":27,"tag":28,"props":920,"children":921},{},[922],{"type":32,"value":923},"In divorce proceedings, a party who holds cryptocurrency in self-custody and denies owning it faces a specific evidentiary problem: the absence of institutional records creates a defense of plausible deniability that requires more investigative work to overcome. The combination of blockchain tracing from known addresses, device forensics, and seed phrase evidence is typically the path to overcoming that defense.",{"type":27,"tag":28,"props":925,"children":926},{},[927],{"type":32,"value":928},"In fraud cases, a defendant who received fraudulent proceeds into a self-custody wallet may argue that the wallet no longer holds the funds and that they cannot access the relevant addresses. Whether this argument is credible depends on the blockchain history of those addresses and any evidence of key material in the defendant's possession.",{"type":27,"tag":28,"props":930,"children":931},{},[932,934,939],{"type":32,"value":933},"See ",{"type":27,"tag":52,"props":935,"children":936},{"href":298},[937],{"type":32,"value":938},"Understanding Wallet Ownership Evidence",{"type":32,"value":940}," for a comprehensive treatment of the evidence types used to establish wallet control in litigation.",{"type":27,"tag":35,"props":942,"children":944},{"id":943},"seed-phrase-evidence-specifically",[945],{"type":32,"value":946},"Seed Phrase Evidence Specifically",{"type":27,"tag":28,"props":948,"children":949},{},[950],{"type":32,"value":951},"The seed phrase deserves particular attention because it is both the most complete form of ownership evidence and the most portable. A party who has memorized their seed phrase carries the controlling credential in their head. A party who has written it on paper carries it in a format that can be found, photographed, or subpoenaed.",{"type":27,"tag":28,"props":953,"children":954},{},[955],{"type":32,"value":956},"Finding a seed phrase in a party's possession, in any form, and connecting that seed phrase to a specific wallet address through cryptographic verification, is strong evidence of control. The connection is mathematical: given a seed phrase, the set of addresses that can be derived from it is deterministic. An analyst can verify that a specific seed phrase controls a specific address without spending any funds.",{"type":27,"tag":28,"props":958,"children":959},{},[960],{"type":32,"value":961},"Courts have treated seed phrase evidence seriously. The challenge in cases where seed phrase evidence has not been found is establishing control through other means. The absence of recovered seed phrase evidence does not mean the party does not control the wallet; it means the investigation must rely more heavily on device forensics, exchange records, transaction patterns, and the party's prior conduct and statements.",{"type":27,"tag":28,"props":963,"children":964},{},[965,970,972,977],{"type":27,"tag":52,"props":966,"children":967},{"href":454},[968],{"type":32,"value":969},"ConsensusIntel's blockchain tracing services",{"type":32,"value":971}," cover both the technical analysis needed to establish wallet ownership and the preparation of expert testimony explaining custody structures and ownership evidence in terms that a court can evaluate. For matters where self-custody is suspected or at issue, ",{"type":27,"tag":52,"props":973,"children":974},{"href":559},[975],{"type":32,"value":976},"contact us",{"type":32,"value":978}," to discuss the specific evidence picture and the most productive investigative approach.",{"type":27,"tag":980,"props":981,"children":982},"hr",{},[],{"type":27,"tag":35,"props":984,"children":985},{"id":462},[986],{"type":32,"value":465},{"type":27,"tag":151,"props":988,"children":990},{"id":989},"q-can-a-hardware-wallet-be-forensically-examined",[991],{"type":32,"value":992},"Q: Can a hardware wallet be forensically examined?",{"type":27,"tag":28,"props":994,"children":995},{},[996],{"type":32,"value":997},"Hardware wallets are purpose-built security devices and are designed to be resistant to physical extraction of the key material. In most cases, the private key cannot be extracted from a hardware wallet through standard forensic methods. However, the device's transaction history and associated addresses may be recoverable, and the device's presence in a party's possession is itself evidence relevant to the ownership question. The most useful forensic work for hardware wallets typically focuses on the associated device (the computer the hardware wallet was connected to) rather than the hardware wallet itself.",{"type":27,"tag":151,"props":999,"children":1001},{"id":1000},"q-what-if-a-party-says-they-lost-their-seed-phrase-and-cannot-access-the-wallet",[1002],{"type":32,"value":1003},"Q: What if a party says they lost their seed phrase and cannot access the wallet?",{"type":27,"tag":28,"props":1005,"children":1006},{},[1007],{"type":32,"value":1008},"A claimed loss of seed phrase access is a factual question. The party's testimony about loss is not dispositive. Evidence inconsistent with the claim, such as on-chain activity from the wallet after the claimed loss date, device records showing wallet access, or communications referencing the wallet, can be offered to challenge the claim. Courts draw credibility inferences from the totality of the evidence, and a convenient inability to access a wallet at the time of disclosure warrants scrutiny.",{"type":27,"tag":151,"props":1010,"children":1012},{"id":1011},"q-can-multisig-wallets-be-used-to-hide-assets-from-a-court",[1013],{"type":32,"value":1014},"Q: Can multisig wallets be used to hide assets from a court?",{"type":27,"tag":28,"props":1016,"children":1017},{},[1018],{"type":32,"value":1019},"A multisig wallet requires multiple keys to spend, and the arrangement can be structured so that the party holding one key argues they cannot access the funds unilaterally. While technically true that a multisig requires cooperation of keyholders, the legal question is whether the party's interest in the wallet is an asset subject to disclosure, which it typically is regardless of the access mechanics. Courts can order parties to disclose interests in multisig arrangements even if unilateral spending is not possible.",{"type":27,"tag":151,"props":1021,"children":1023},{"id":1022},"q-are-cryptocurrency-assets-held-in-an-etf-or-investment-account-self-custody",[1024],{"type":32,"value":1025},"Q: Are cryptocurrency assets held in an ETF or investment account self-custody?",{"type":27,"tag":28,"props":1027,"children":1028},{},[1029],{"type":32,"value":1030},"No. Assets held through an ETF or investment product are custodial: the fund's custodian holds the actual cryptocurrency, and the investor holds a financial interest in the fund. From a litigation perspective, these are treated like any other investment account: the brokerage or fund can be subpoenaed for records, and the assets appear on conventional account statements.",{"type":27,"tag":151,"props":1032,"children":1034},{"id":1033},"q-how-does-self-custody-affect-the-valuation-of-cryptocurrency-in-divorce",[1035],{"type":32,"value":1036},"Q: How does self-custody affect the valuation of cryptocurrency in divorce?",{"type":27,"tag":28,"props":1038,"children":1039},{},[1040],{"type":32,"value":1041},"Self-custody assets are valued based on the blockchain balance at the relevant date and the applicable cryptocurrency price at that time. The valuation method is the same as for custodially held assets; the difference is that obtaining the balance information requires blockchain analysis rather than requesting an account statement from an exchange.",{"title":8,"searchDepth":566,"depth":566,"links":1043},[1044,1045,1046,1047,1048,1049,1050,1051,1052],{"id":633,"depth":566,"text":636},{"id":667,"depth":566,"text":670},{"id":708,"depth":566,"text":711},{"id":753,"depth":566,"text":756},{"id":832,"depth":566,"text":835},{"id":860,"depth":566,"text":863},{"id":915,"depth":566,"text":918},{"id":943,"depth":566,"text":946},{"id":462,"depth":566,"text":465,"children":1053},[1054,1055,1056,1057,1058],{"id":989,"depth":573,"text":992},{"id":1000,"depth":573,"text":1003},{"id":1011,"depth":573,"text":1014},{"id":1022,"depth":573,"text":1025},{"id":1033,"depth":573,"text":1036},"content:articles:09-self-custody-vs-custodial-wallets.md","articles\u002F09-self-custody-vs-custodial-wallets.md","articles\u002F09-self-custody-vs-custodial-wallets",{"_path":1063,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":1064,"description":1065,"slug":1066,"date":1067,"lastUpdated":1067,"author":13,"readingTime":1068,"category":15,"tags":1069,"ogImage":1073,"featured":7,"body":1074,"_type":598,"_id":1534,"_source":600,"_file":1535,"_stem":1536,"_extension":603},"\u002Farticles\u002F07-subpoenaing-cryptocurrency-exchange-records","How to subpoena cryptocurrency exchange records","A practical guide to subpoenaing cryptocurrency exchanges, covering available records, request terms, cross-border hurdles, and forensic analysis.","subpoenaing-cryptocurrency-exchange-records","2026-04-28",12,[1070,18,21,17,1071,1072],"subpoena","coinbase","kraken","\u002Fog\u002Fsubpoenaing-cryptocurrency-exchange-records.png",{"type":24,"children":1075,"toc":1517},[1076,1081,1086,1092,1097,1107,1117,1127,1137,1147,1157,1167,1173,1178,1183,1188,1193,1198,1203,1208,1213,1218,1223,1228,1233,1239,1244,1249,1262,1268,1273,1278,1283,1289,1294,1299,1304,1309,1314,1320,1325,1330,1343,1349,1360,1371,1384,1390,1395,1400,1405,1410,1415,1435,1438,1442,1448,1457,1463,1472,1478,1487,1493,1502,1508],{"type":27,"tag":28,"props":1077,"children":1078},{},[1079],{"type":32,"value":1080},"Cryptocurrency exchanges are among the most valuable sources of evidence in any matter involving digital assets. When a party has used a regulated exchange, the records that exchange holds can be comprehensive: verified identity documents, the complete transaction history, records of linked bank accounts, IP addresses used to log in, device identifiers, and records of any customer support interactions that might contain relevant communications.",{"type":27,"tag":28,"props":1082,"children":1083},{},[1084],{"type":32,"value":1085},"Knowing how to obtain these records, what to request, and what to do when the exchange is foreign or the party used a non-KYC platform is essential knowledge for any attorney handling a matter where cryptocurrency is a significant issue.",{"type":27,"tag":35,"props":1087,"children":1089},{"id":1088},"what-exchanges-actually-hold",[1090],{"type":32,"value":1091},"What Exchanges Actually Hold",{"type":27,"tag":28,"props":1093,"children":1094},{},[1095],{"type":32,"value":1096},"Understanding what records exist before drafting a subpoena is the prerequisite to drafting a useful one.",{"type":27,"tag":28,"props":1098,"children":1099},{},[1100,1105],{"type":27,"tag":476,"props":1101,"children":1102},{},[1103],{"type":32,"value":1104},"Know Your Customer (KYC) documentation",{"type":32,"value":1106}," is the set of identity verification records that regulated exchanges collect when users open accounts. In the United States, regulated exchanges are required under the Bank Secrecy Act and applicable FinCEN guidance to verify user identities. KYC records typically include government-issued identification (a driver's license or passport), a selfie or photograph used for biometric matching, the user's name and date of birth, their address, their Social Security number or equivalent tax identification number, and the records of the verification process itself.",{"type":27,"tag":28,"props":1108,"children":1109},{},[1110,1115],{"type":27,"tag":476,"props":1111,"children":1112},{},[1113],{"type":32,"value":1114},"Transaction history",{"type":32,"value":1116}," is the exchange's internal record of every buy, sell, deposit, withdrawal, and transfer the account has ever executed. This is different from the on-chain record. The exchange's transaction history includes internal transfers, trades between cryptocurrencies on the exchange platform that may not appear as separate on-chain transactions, and the exact timestamps and values of every action. For accounts that have traded for years, this history can run to thousands of transactions.",{"type":27,"tag":28,"props":1118,"children":1119},{},[1120,1125],{"type":27,"tag":476,"props":1121,"children":1122},{},[1123],{"type":32,"value":1124},"Deposit addresses",{"type":32,"value":1126}," are the blockchain addresses the exchange assigned to the user for receiving cryptocurrency. When a user wanted to move cryptocurrency onto the exchange, the exchange provided a specific address for that purpose. The subpoena response should include the complete list of deposit addresses assigned to the account, across all supported cryptocurrencies. These addresses are critical for blockchain forensic analysis because they connect the on-chain record to the account.",{"type":27,"tag":28,"props":1128,"children":1129},{},[1130,1135],{"type":27,"tag":476,"props":1131,"children":1132},{},[1133],{"type":32,"value":1134},"Withdrawal addresses",{"type":32,"value":1136}," are the blockchain addresses the user designated to receive funds when withdrawing. A complete withdrawal history, including the destination addresses, allows an analyst to trace where funds went after leaving the exchange.",{"type":27,"tag":28,"props":1138,"children":1139},{},[1140,1145],{"type":27,"tag":476,"props":1141,"children":1142},{},[1143],{"type":32,"value":1144},"Linked payment methods",{"type":32,"value":1146}," are the bank accounts, credit cards, and other payment instruments the user associated with their account. These records connect the cryptocurrency account to the traditional financial system and may reveal assets or financial relationships not otherwise identified.",{"type":27,"tag":28,"props":1148,"children":1149},{},[1150,1155],{"type":27,"tag":476,"props":1151,"children":1152},{},[1153],{"type":32,"value":1154},"IP and device records",{"type":32,"value":1156}," are the technical logs of where and how the account was accessed. Login IP addresses can be used to establish geographic location during relevant periods. Device identifiers, browser fingerprints, and session records may be relevant to establishing that a specific person accessed the account, particularly in cases involving disputed account ownership or unauthorized access.",{"type":27,"tag":28,"props":1158,"children":1159},{},[1160,1165],{"type":27,"tag":476,"props":1161,"children":1162},{},[1163],{"type":32,"value":1164},"Customer support communications",{"type":32,"value":1166}," are any messages exchanged between the account holder and the exchange's support team. These can contain admissions, explanations, or disclosures relevant to the matter.",{"type":27,"tag":35,"props":1168,"children":1170},{"id":1169},"what-a-subpoena-should-request",[1171],{"type":32,"value":1172},"What a Subpoena Should Request",{"type":27,"tag":28,"props":1174,"children":1175},{},[1176],{"type":32,"value":1177},"A subpoena to a cryptocurrency exchange should be specific about the categories of records sought. Overly broad requests may be resisted as burdensome; overly narrow requests may miss critical records.",{"type":27,"tag":28,"props":1179,"children":1180},{},[1181],{"type":32,"value":1182},"A well-structured subpoena to a domestic exchange should request, at minimum:",{"type":27,"tag":28,"props":1184,"children":1185},{},[1186],{"type":32,"value":1187},"All account records, including registration information, KYC documentation, and identity verification records, for any account associated with the named individual or with specific identifiers (email addresses, phone numbers, wallet addresses) provided in the subpoena.",{"type":27,"tag":28,"props":1189,"children":1190},{},[1191],{"type":32,"value":1192},"Complete transaction history for all accounts identified, including buy and sell orders, deposits and withdrawals, internal transfers, and any other account activity.",{"type":27,"tag":28,"props":1194,"children":1195},{},[1196],{"type":32,"value":1197},"All blockchain addresses associated with the account, including all deposit addresses and all withdrawal addresses used throughout the account's history.",{"type":27,"tag":28,"props":1199,"children":1200},{},[1201],{"type":32,"value":1202},"All linked payment methods, including bank account numbers, routing numbers, credit card numbers, and any other payment instruments.",{"type":27,"tag":28,"props":1204,"children":1205},{},[1206],{"type":32,"value":1207},"All IP addresses and device identifiers associated with account logins, with timestamps.",{"type":27,"tag":28,"props":1209,"children":1210},{},[1211],{"type":32,"value":1212},"Any account holds, restrictions, or flags applied to the account by the exchange, and the reasons recorded for those actions.",{"type":27,"tag":28,"props":1214,"children":1215},{},[1216],{"type":32,"value":1217},"Any customer support tickets, chat logs, or email communications associated with the account.",{"type":27,"tag":28,"props":1219,"children":1220},{},[1221],{"type":32,"value":1222},"Any related accounts identified by the exchange as being linked to the account through common identifying information, device, or IP address.",{"type":27,"tag":28,"props":1224,"children":1225},{},[1226],{"type":32,"value":1227},"Including specific email addresses, phone numbers, or wallet addresses as known identifiers in the subpoena, rather than relying solely on the subject's name, substantially improves the response by giving the exchange a means to identify the account reliably.",{"type":27,"tag":28,"props":1229,"children":1230},{},[1231],{"type":32,"value":1232},"Hypothetical example: An attorney has a client's disclosed email address and a wallet address identified in discovery. Including both identifiers in the subpoena gives the exchange more than the client's name alone to locate the relevant account.",{"type":27,"tag":35,"props":1234,"children":1236},{"id":1235},"how-exchanges-typically-respond",[1237],{"type":32,"value":1238},"How Exchanges Typically Respond",{"type":27,"tag":28,"props":1240,"children":1241},{},[1242],{"type":32,"value":1243},"Domestic regulated exchanges generally comply with properly served subpoenas in civil matters, though their responses vary in completeness and timeliness. Most major domestic exchanges have legal compliance teams that handle subpoena requests routinely. Response times typically run from two to six weeks, though some exchanges move faster for matters with demonstrated urgency.",{"type":27,"tag":28,"props":1245,"children":1246},{},[1247],{"type":32,"value":1248},"The format of the response matters for usability. Request that records be produced in machine-readable formats where applicable (CSV or JSON for transaction histories, for example) rather than as PDF printouts. Machine-readable transaction histories integrate more easily with blockchain forensic analysis tools.",{"type":27,"tag":28,"props":1250,"children":1251},{},[1252,1254,1260],{"type":32,"value":1253},"Some exchanges produce a declaration or affidavit authenticating the records at the time of production. If the exchange does not offer this automatically, request it. Authenticated records are more straightforwardly admissible, and the authentication may support self-authentication arguments under FRE 902(13) or (14). See ",{"type":27,"tag":52,"props":1255,"children":1257},{"href":1256},"\u002Fresources\u002Fblockchain-evidence-admissibility",[1258],{"type":32,"value":1259},"Blockchain Evidence Admissibility",{"type":32,"value":1261}," for the evidentiary framework.",{"type":27,"tag":35,"props":1263,"children":1265},{"id":1264},"timing-and-data-retention",[1266],{"type":32,"value":1267},"Timing and Data Retention",{"type":27,"tag":28,"props":1269,"children":1270},{},[1271],{"type":32,"value":1272},"Data retention policies at major exchanges generally cover five to seven years of account records, but this varies by exchange and by record type. Some types of records, particularly IP and device logs, may be retained for shorter periods than transaction history. Account documentation tied to regulatory compliance requirements tends to be retained longer.",{"type":27,"tag":28,"props":1274,"children":1275},{},[1276],{"type":32,"value":1277},"The practical implication is time pressure. A matter where cryptocurrency activity occurred three to four years ago is still well within the retention window for most major exchanges. A matter where the relevant activity is six or more years old may find that some records are no longer available. Serving the subpoena early, before records are purged according to the exchange's retention schedule, reduces this risk.",{"type":27,"tag":28,"props":1279,"children":1280},{},[1281],{"type":32,"value":1282},"When matters are time-sensitive, some attorneys request emergency or expedited responses from exchanges, documenting the urgency in the subpoena or in accompanying correspondence. Whether exchanges honor those requests varies; many have formal processes for law enforcement emergency disclosures that do not directly apply in civil matters, but the request may nonetheless accelerate the response timeline.",{"type":27,"tag":35,"props":1284,"children":1286},{"id":1285},"jurisdictional-complications",[1287],{"type":32,"value":1288},"Jurisdictional Complications",{"type":27,"tag":28,"props":1290,"children":1291},{},[1292],{"type":32,"value":1293},"Many cryptocurrency exchanges are not incorporated in the United States and may not be subject to direct domestic subpoena power. Some of the most widely used exchanges globally are organized in offshore jurisdictions including the Cayman Islands, the British Virgin Islands, Seychelles, and similar locations. These exchanges may serve U.S. customers while structuring their legal entities specifically to minimize exposure to U.S. civil process.",{"type":27,"tag":28,"props":1295,"children":1296},{},[1297],{"type":32,"value":1298},"When the target used a foreign exchange, the subpoena options are different. Letters rogatory, or formal requests through the Mutual Legal Assistance Treaty (MLAT) process, are the standard mechanisms for obtaining evidence from foreign entities in civil matters. These processes are substantially slower and less certain than a domestic subpoena. MLAT requests can take months to years.",{"type":27,"tag":28,"props":1300,"children":1301},{},[1302],{"type":32,"value":1303},"Some foreign exchanges cooperate voluntarily with properly documented requests, particularly if they have U.S. subsidiaries or U.S. legal counsel. A formal letter from counsel, explaining the legal proceedings and requesting voluntary production, is worth attempting before committing to the MLAT process.",{"type":27,"tag":28,"props":1305,"children":1306},{},[1307],{"type":32,"value":1308},"Terms of service arbitration clauses in exchange user agreements are a separate complication. Some exchanges argue that any disputes, including subpoena compliance disputes, must be addressed through the arbitration process specified in their terms of service. Courts have not uniformly accepted this argument in third-party subpoena contexts, but it may add delay and complexity.",{"type":27,"tag":28,"props":1310,"children":1311},{},[1312],{"type":32,"value":1313},"The practical approach when facing a foreign exchange is to first pursue blockchain forensic analysis to understand the full scope of the party's exchange activity before committing to the most difficult subpoena targets. If forensic analysis reveals that a party also used domestic exchanges, start with those.",{"type":27,"tag":35,"props":1315,"children":1317},{"id":1316},"when-the-party-used-a-non-kyc-exchange-or-dex",[1318],{"type":32,"value":1319},"When the Party Used a Non-KYC Exchange or DEX",{"type":27,"tag":28,"props":1321,"children":1322},{},[1323],{"type":32,"value":1324},"Not all cryptocurrency trading activity goes through KYC exchanges. Non-KYC peer-to-peer platforms, Bitcoin ATMs (many of which have minimal verification requirements below certain transaction thresholds), and decentralized exchanges (DEXs) are all options that a party seeking to minimize their KYC footprint might use.",{"type":27,"tag":28,"props":1326,"children":1327},{},[1328],{"type":32,"value":1329},"For non-KYC exchanges and peer-to-peer platforms, the records that exist are typically more limited, but some still exist. Bitcoin ATM operators are subject to reporting requirements above certain transaction thresholds and often collect phone numbers or other minimal identification. Peer-to-peer platforms may maintain account records even without formal KYC, and a subpoena to the platform may produce useful information.",{"type":27,"tag":28,"props":1331,"children":1332},{},[1333,1335,1341],{"type":32,"value":1334},"For DEXs, there is no institution to subpoena in the conventional sense. Tracing funds that went through a DEX requires reading the on-chain smart contract interaction record directly. See ",{"type":27,"tag":52,"props":1336,"children":1338},{"href":1337},"\u002Fresources\u002Fwhat-lawyers-need-to-know-about-defi",[1339],{"type":32,"value":1340},"What Lawyers Need to Know About DeFi",{"type":32,"value":1342}," for a detailed treatment of how DEX activity is analyzed.",{"type":27,"tag":35,"props":1344,"children":1346},{"id":1345},"working-with-a-forensic-expert-to-identify-targets",[1347],{"type":32,"value":1348},"Working with a Forensic Expert to Identify Targets",{"type":27,"tag":28,"props":1350,"children":1351},{},[1352,1354,1358],{"type":32,"value":1353},"The question of which exchange to subpoena first, or whether a party used an exchange at all, is one where blockchain forensic analysis and legal strategy intersect. A forensic analyst providing ",{"type":27,"tag":52,"props":1355,"children":1356},{"href":454},[1357],{"type":32,"value":457},{"type":32,"value":1359}," can trace known wallet addresses on the blockchain and may be able to identify which exchanges received funds from those addresses before the subpoenas are served. That identification narrows the field and allows subpoenas to be directed at the most productive targets first.",{"type":27,"tag":28,"props":1361,"children":1362},{},[1363,1365,1369],{"type":32,"value":1364},"The ",{"type":27,"tag":52,"props":1366,"children":1367},{"href":551},[1368],{"type":32,"value":554},{"type":32,"value":1370}," includes this kind of pre-subpoena analysis as a standard early step in investigations. Identifying likely exchange accounts through on-chain analysis, then confirming them through subpoena, is more efficient than subpoenaing all known exchanges hoping to find the relevant accounts. It also produces a stronger evidentiary foundation, because the blockchain analysis provides independent support for the connection between the address and the exchange.",{"type":27,"tag":28,"props":1372,"children":1373},{},[1374,1376,1382],{"type":32,"value":1375},"For guidance on how exchange subpoenas fit into the broader investigation strategy, see ",{"type":27,"tag":52,"props":1377,"children":1379},{"href":1378},"\u002Fresources\u002Fcommon-mistakes-crypto-investigations",[1380],{"type":32,"value":1381},"Common Mistakes in Cryptocurrency Investigations",{"type":32,"value":1383},", which addresses the specific error of over-relying on exchange responses without supplementing them with on-chain analysis.",{"type":27,"tag":35,"props":1385,"children":1387},{"id":1386},"practical-recommendations",[1388],{"type":32,"value":1389},"Practical Recommendations",{"type":27,"tag":28,"props":1391,"children":1392},{},[1393],{"type":32,"value":1394},"Serve exchange subpoenas early. The data retention clock is running, and the sooner records are preserved, the better the completeness of the production.",{"type":27,"tag":28,"props":1396,"children":1397},{},[1398],{"type":32,"value":1399},"Include all known identifiers in the subpoena, not just the party's name. Email addresses, phone numbers, and wallet addresses that the party has disclosed or that have been identified through other discovery are all useful identifiers.",{"type":27,"tag":28,"props":1401,"children":1402},{},[1403],{"type":32,"value":1404},"Request machine-readable formats for transaction histories. The ability to analyze thousands of transactions programmatically is only available if the data is in a usable format.",{"type":27,"tag":28,"props":1406,"children":1407},{},[1408],{"type":32,"value":1409},"Request an authenticating declaration with the production. The authentication step is easier to handle at the time of production than after the fact.",{"type":27,"tag":28,"props":1411,"children":1412},{},[1413],{"type":32,"value":1414},"Coordinate with a forensic analyst before and after the exchange response. Before, to identify the right targets and inform the subpoena content. After, to integrate the exchange records with the blockchain analysis and build the complete picture of the party's activity.",{"type":27,"tag":28,"props":1416,"children":1417},{},[1418,1420,1426,1428,1433],{"type":32,"value":1419},"For matters where exchange subpoenas are a central part of the investigation, ",{"type":27,"tag":52,"props":1421,"children":1423},{"href":1422},"\u002Fabout",[1424],{"type":32,"value":1425},"ConsensusIntel",{"type":32,"value":1427}," supports the full cycle from pre-subpoena blockchain analysis through post-response forensic integration. ",{"type":27,"tag":52,"props":1429,"children":1430},{"href":559},[1431],{"type":32,"value":1432},"Contact us",{"type":32,"value":1434}," to discuss how that work fits into your case timeline.",{"type":27,"tag":980,"props":1436,"children":1437},{},[],{"type":27,"tag":35,"props":1439,"children":1440},{"id":462},[1441],{"type":32,"value":465},{"type":27,"tag":151,"props":1443,"children":1445},{"id":1444},"q-can-i-subpoena-an-exchange-in-a-state-court-proceeding",[1446],{"type":32,"value":1447},"Q: Can I subpoena an exchange in a state court proceeding?",{"type":27,"tag":28,"props":1449,"children":1450},{},[1451,1455],{"type":27,"tag":476,"props":1452,"children":1453},{},[1454],{"type":32,"value":480},{"type":32,"value":1456}," Yes, subject to the civil procedure rules of the applicable state. Most states have discovery rules that allow subpoenas to non-party businesses operating within the state. For exchanges incorporated in other states or foreign jurisdictions, the subpoena mechanism depends on the specific jurisdiction and whether the exchange has registered to do business in the forum state.",{"type":27,"tag":151,"props":1458,"children":1460},{"id":1459},"q-what-if-the-party-used-multiple-email-addresses-to-open-exchange-accounts",[1461],{"type":32,"value":1462},"Q: What if the party used multiple email addresses to open exchange accounts?",{"type":27,"tag":28,"props":1464,"children":1465},{},[1466,1470],{"type":27,"tag":476,"props":1467,"children":1468},{},[1469],{"type":32,"value":480},{"type":32,"value":1471}," The party's disclosure obligations require them to identify all accounts. If there is evidence suggesting multiple accounts (such as through blockchain analysis identifying exchange interactions that do not correspond to the disclosed accounts), the subpoena can be issued to the exchange with all known identifiers, including wallet addresses that interacted with the exchange's deposit addresses. The exchange can then search its records for any account associated with those identifiers.",{"type":27,"tag":151,"props":1473,"children":1475},{"id":1474},"q-how-does-the-exchange-verify-that-a-subpoena-is-legitimate-before-responding",[1476],{"type":32,"value":1477},"Q: How does the exchange verify that a subpoena is legitimate before responding?",{"type":27,"tag":28,"props":1479,"children":1480},{},[1481,1485],{"type":27,"tag":476,"props":1482,"children":1483},{},[1484],{"type":32,"value":480},{"type":32,"value":1486}," Exchanges have legal teams that review subpoenas for proper form, jurisdiction, and compliance with applicable law. A defectively served or poorly formed subpoena may be rejected or result in a limited response. Having legal counsel review the subpoena, or working with counsel experienced in cryptocurrency litigation, reduces the risk of technical objections.",{"type":27,"tag":151,"props":1488,"children":1490},{"id":1489},"q-what-if-the-exchange-is-acquired-or-goes-bankrupt",[1491],{"type":32,"value":1492},"Q: What if the exchange is acquired or goes bankrupt?",{"type":27,"tag":28,"props":1494,"children":1495},{},[1496,1500],{"type":27,"tag":476,"props":1497,"children":1498},{},[1499],{"type":32,"value":480},{"type":32,"value":1501}," Exchange records are often among the most valuable assets in a bankruptcy estate and are typically preserved through insolvency proceedings. The bankruptcy trustee or receiver may be the appropriate party to whom subsequent subpoenas should be directed. Note that the timing of a subpoena in relation to an exchange's financial difficulties may affect both the availability of records and the process for obtaining them.",{"type":27,"tag":151,"props":1503,"children":1505},{"id":1504},"q-is-there-a-way-to-determine-what-exchange-a-wallet-used-without-serving-a-subpoena",[1506],{"type":32,"value":1507},"Q: Is there a way to determine what exchange a wallet used without serving a subpoena?",{"type":27,"tag":28,"props":1509,"children":1510},{},[1511,1515],{"type":27,"tag":476,"props":1512,"children":1513},{},[1514],{"type":32,"value":480},{"type":32,"value":1516}," Blockchain forensic analysis can often attribute exchange interactions to specific platforms based on databases of exchange deposit addresses that have been compiled over time. This allows an analyst to identify likely exchange targets before serving the subpoena. The subpoena then confirms the account and produces the account-level records that the blockchain alone cannot provide.",{"title":8,"searchDepth":566,"depth":566,"links":1518},[1519,1520,1521,1522,1523,1524,1525,1526,1527],{"id":1088,"depth":566,"text":1091},{"id":1169,"depth":566,"text":1172},{"id":1235,"depth":566,"text":1238},{"id":1264,"depth":566,"text":1267},{"id":1285,"depth":566,"text":1288},{"id":1316,"depth":566,"text":1319},{"id":1345,"depth":566,"text":1348},{"id":1386,"depth":566,"text":1389},{"id":462,"depth":566,"text":465,"children":1528},[1529,1530,1531,1532,1533],{"id":1444,"depth":573,"text":1447},{"id":1459,"depth":573,"text":1462},{"id":1474,"depth":573,"text":1477},{"id":1489,"depth":573,"text":1492},{"id":1504,"depth":573,"text":1507},"content:articles:07-subpoenaing-cryptocurrency-exchange-records.md","articles\u002F07-subpoenaing-cryptocurrency-exchange-records.md","articles\u002F07-subpoenaing-cryptocurrency-exchange-records",1790145013677]