[{"data":1,"prerenderedAt":3198},["ShallowReactive",2],{"tag-litigation":3},[4,750,1245,2023,2575],{"_path":5,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":9,"description":10,"slug":11,"date":12,"lastUpdated":12,"author":13,"readingTime":14,"category":15,"tags":16,"ogImage":22,"featured":7,"body":23,"_type":744,"_id":745,"_source":746,"_file":747,"_stem":748,"_extension":749},"\u002Farticles\u002F39-crypto-seizure-warrant-trace-hamas-2026","articles",false,"","What a seizure-warrant trace reveals about blockchain evidence","A case study of DOJ's September 2026 Hamas crypto seizures, showing how sworn warrant records layer blockchain paths with service-provider evidence.","crypto-seizure-warrant-trace-hamas-2026","2026-09-05","Nick Kampe",13,"Methodology",[17,18,19,20,21],"case-study","blockchain-tracing","seized-assets","evidence","litigation","\u002Fog\u002Fcrypto-seizure-warrant-trace-hamas-2026.png",{"type":24,"children":25,"toc":719},"root",[26,34,39,46,51,56,113,118,123,129,152,159,173,179,200,206,211,217,222,228,233,239,244,250,255,265,275,288,294,299,309,363,368,374,379,494,500,505,515,525,535,545,565,571,576,604,633,639,645,655,661,670,676,685,691,700,706],{"type":27,"tag":28,"props":29,"children":30},"element","p",{},[31],{"type":32,"value":33},"text","On September 1, 2026, the Justice Department announced that it had seized over $560,000 in cryptocurrency intended for Hamas and disrupted the domains and servers the group used to solicit donations and recruit supporters. The announcement was the cumulative public record of a longer investigation: seizure warrants issued in the District of Columbia on March 25, June 25, and October 10, 2025, followed by infrastructure warrants on July 29 and August 18, 2026. The government then posted the underlying sworn warrant materials online. The posted packets include AO 109 returns, but those return, inventory, and certification fields are blank, so the public file documents authorization, not the date of execution.",{"type":27,"tag":28,"props":35,"children":36},{},[37],{"type":32,"value":38},"This is a public, government-published example of a trace described in sworn warrant materials. This article walks through that record to extract a transferable method for litigators and forensic experts, while being careful about what the materials do and do not prove. The legal posture of a criminal seizure investigation differs substantially from a private civil dispute, and the value of this case study is methodological, not an invitation to import government conclusions wholesale.",{"type":27,"tag":40,"props":41,"children":43},"h2",{"id":42},"the-procedural-posture-allegations-probable-cause-and-seizure",[44],{"type":32,"value":45},"The Procedural Posture: Allegations, Probable Cause, and Seizure",{"type":27,"tag":28,"props":47,"children":48},{},[49],{"type":32,"value":50},"Before reading any warrant record, establish which legal conclusion the document supports. This case study is a useful lesson precisely because the September announcement reports a seizure premised on probable cause, not a judgment or conviction.",{"type":27,"tag":28,"props":52,"children":53},{},[54],{"type":32,"value":55},"These are the categories, in order of increasing legal weight:",{"type":27,"tag":57,"props":58,"children":59},"ul",{},[60,72,93,103],{"type":27,"tag":61,"props":62,"children":63},"li",{},[64,70],{"type":27,"tag":65,"props":66,"children":67},"strong",{},[68],{"type":32,"value":69},"Attributed allegations.",{"type":32,"value":71}," The government states that Hamas, a designated Foreign Terrorist Organization, used the addresses and infrastructure to raise funds and recruit. At the point of a seizure, these are the government's allegations resting on its investigation, not judicial findings of fact.",{"type":27,"tag":61,"props":73,"children":74},{},[75,80,82,91],{"type":27,"tag":65,"props":76,"children":77},{},[78],{"type":32,"value":79},"Probable cause.",{"type":32,"value":81}," The authorizing judge issued each warrant on a probable-cause showing. Under ",{"type":27,"tag":83,"props":84,"children":88},"a",{"href":85,"rel":86},"https:\u002F\u002Fwww.law.cornell.edu\u002Frules\u002Ffrcrmp\u002Frule_41",[87],"nofollow",[89],{"type":32,"value":90},"Federal Rule of Criminal Procedure 41",{"type":32,"value":92},", a judge must issue a warrant if probable cause is shown by affidavit or other information; the judge may also rely on sworn testimony.",{"type":27,"tag":61,"props":94,"children":95},{},[96,101],{"type":27,"tag":65,"props":97,"children":98},{},[99],{"type":32,"value":100},"The seizure itself.",{"type":32,"value":102}," The Department announced that the FBI seized the funds and infrastructure. A seizure does not itself resolve ownership; a completed forfeiture process is ordinarily needed for a final forfeiture determination.",{"type":27,"tag":61,"props":104,"children":105},{},[106,111],{"type":27,"tag":65,"props":107,"children":108},{},[109],{"type":32,"value":110},"Final adjudication.",{"type":32,"value":112}," Forfeiture, administrative or judicial, requires notice and an opportunity for claimants to contest before title finally vests. None of the materials in this announcement evidence an adjudicated finding against any person.",{"type":27,"tag":28,"props":114,"children":115},{},[116],{"type":32,"value":117},"For a private litigator, read a warrant document as a menu of investigative steps that were persuasive enough for a magistrate, and treat each fact asserted inside it as an allegation the government must still prove. That distinction matters enormously in civil work, where the burden of proof and the rules of evidence differ from a probable-cause determination.",{"type":27,"tag":28,"props":119,"children":120},{},[121],{"type":32,"value":122},"I have not and will not repeat specific unverified operational details from these affidavits here, because reproducing what an affidavit alleges about live infrastructure serves no legal-pedagogical purpose and can be inaccurate if read out of context. The lesson is in the structure.",{"type":27,"tag":40,"props":124,"children":126},{"id":125},"how-the-evidence-was-layered-not-just-traced",[127],{"type":32,"value":128},"How the Evidence Was Layered, Not Just Traced",{"type":27,"tag":28,"props":130,"children":131},{},[132,134,141,143,150],{"type":32,"value":133},"Reading the public record as a whole, the investigation assembled at least six distinct categories of evidence. Few are blockchain analysis alone. The ",{"type":27,"tag":83,"props":135,"children":138},{"href":136,"rel":137},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fpr\u002Fjustice-department-continues-disrupt-hamas-terrorist-financing-schemes-through-seizures",[87],[139],{"type":32,"value":140},"press release",{"type":32,"value":142}," describes cryptocurrency seizures, the seizure of domains and servers, and disruption of fundraising and recruitment platforms; industry reporting on the affidavits, such as ",{"type":27,"tag":83,"props":144,"children":147},{"href":145,"rel":146},"https:\u002F\u002Fwww.chainalysis.com\u002Fblog\u002Ffbi-seizes-hamas-crypto-fundraising-network\u002F",[87],[148],{"type":32,"value":149},"Chainalysis's review of the filings",{"type":32,"value":151},", adds detail on how the on-chain work connected to accounts and intermediaries.",{"type":27,"tag":153,"props":154,"children":156},"h3",{"id":155},"on-chain-transaction-paths",[157],{"type":32,"value":158},"On-Chain Transaction Paths",{"type":27,"tag":28,"props":160,"children":161},{},[162,164,171],{"type":32,"value":163},"The foundational layer is the public ledger record itself. The March 2025 warrant materials (25-sz-20, issued March 25, 2025, in the District of Columbia, in the ",{"type":27,"tag":83,"props":165,"children":168},{"href":166,"rel":167},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fmedia\u002F1459791\u002Fdl?inline",[87],[169],{"type":32,"value":170},"public media library",{"type":32,"value":172},") cover the initial action, which industry reporting describes as involving roughly $200,000 in stablecoins donated to Hamas. The blockchain showed what moved, when, in what amounts, and between which addresses.",{"type":27,"tag":153,"props":174,"children":176},{"id":175},"controlled-or-observed-transactions",[177],{"type":32,"value":178},"Controlled or Observed Transactions",{"type":27,"tag":28,"props":180,"children":181},{},[182,184,190,192,198],{"type":32,"value":183},"A distinctive feature in this record is that the government did not merely observe historical flows; it interposed itself. The June 25, 2025 warrant (25-sz-34, ",{"type":27,"tag":83,"props":185,"children":188},{"href":186,"rel":187},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fmedia\u002F1459796\u002Fdl?inline",[87],[189],{"type":32,"value":170},{"type":32,"value":191},") states in affidavit paragraph 1 that its subject matter is related to seizure 25-sz-20, approved March 25, 2025. Attachment A-1 of that packet is a Tether burn-and-reissue instruction listing USDT addresses; it has no footnotes. The June affidavit describes Tether freezing USDT at law-enforcement request, including a March 12, 2025 freeze of additional funds in accounts funded by an operational wallet, and a further freeze on or about April 15, 2025 of listed donation addresses. It also describes Binance independently freezing withdrawals from three target accounts on April 14, 2025. Those are issuer and exchange compliance actions, not a court restraining order. The October 10, 2025 warrant (25-sz-42, ",{"type":27,"tag":83,"props":193,"children":196},{"href":194,"rel":195},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fmedia\u002F1459801\u002Fdl?inline",[87],[197],{"type":32,"value":170},{"type":32,"value":199},") describes additional Tether freezes at FBI request on May 22, 2025 and June 14, 2025, and a Binance freeze of withdrawals from a listed account, likewise issuer and exchange actions. Controlled or blocked transactions create evidence that no purely passive observer could produce: the point at which value was diverted, frozen, or redirected is a documented event.",{"type":27,"tag":153,"props":201,"children":203},{"id":202},"communications-and-platform-content",[204],{"type":32,"value":205},"Communications and Platform Content",{"type":27,"tag":28,"props":207,"children":208},{},[209],{"type":32,"value":210},"The disruption of domains and servers gave investigators access to solicitation content and supporter interactions, not merely financial data. According to the DOJ, the action disrupted Hamas's fundraising and recruitment communication platforms and websites. Industry reporting on the filings adds that the seized domains and servers included infrastructure associated with the al-Qassam Brigades' main website, which investigators said allowed them to intercept intended donations and gather information about individuals attempting to contribute.",{"type":27,"tag":153,"props":212,"children":214},{"id":213},"service-provider-records",[215],{"type":32,"value":216},"Service-Provider Records",{"type":27,"tag":28,"props":218,"children":219},{},[220],{"type":32,"value":221},"Per industry reporting on the June 2025 affidavit, the investigators traced original donations through a web of new addresses and accounts, and identified service-provider accounts, including one believed to be associated with a Lebanon-based over-the-counter broker and another exhibiting patterns consistent with money mule activity. Those descriptions are attributed allegations within a probable-cause document, reported secondhand; the underlying records, subpoenas, or production requests are not public. The affidavit leans on service-provider records as a bridge from pseudonymous addresses to operating accounts.",{"type":27,"tag":153,"props":223,"children":225},{"id":224},"address-rotation-and-obfuscation",[226],{"type":32,"value":227},"Address Rotation and Obfuscation",{"type":27,"tag":28,"props":229,"children":230},{},[231],{"type":32,"value":232},"The same reporting describes Hamas adapting its techniques after the initial March 2025 seizure, moving funds through new addresses and, in the October 2025 affidavit, using bridging services and single-use donation wallets, with investigators following the trail despite the obfuscation. Address rotation is a fact pattern, not a dead end: every rotated address still transacts on a public ledger, and each new address can be examined for links to a cluster or a service provider.",{"type":27,"tag":153,"props":234,"children":236},{"id":235},"legal-process-as-evidence",[237],{"type":32,"value":238},"Legal Process as Evidence",{"type":27,"tag":28,"props":240,"children":241},{},[242],{"type":32,"value":243},"Finally, the warrant process itself is part of the record. Multiple sequentially authorized warrants support an inference of an iterative investigation, and the June affidavit's paragraph 1 reference to 25-sz-20 shows investigators expressly building a later application on the earlier one. In private cases, the analog is the discovery sequence: each subpoena response or production can become the foundation for the next.",{"type":27,"tag":40,"props":245,"children":247},{"id":246},"path-tracing-vs-actor-attribution",[248],{"type":32,"value":249},"Path Tracing vs. Actor Attribution",{"type":27,"tag":28,"props":251,"children":252},{},[253],{"type":32,"value":254},"Dissecting this record requires separating two questions that prosecutors and civil litigators constantly conflate.",{"type":27,"tag":28,"props":256,"children":257},{},[258,263],{"type":27,"tag":65,"props":259,"children":260},{},[261],{"type":32,"value":262},"Path tracing",{"type":32,"value":264}," asks where value went. It is answered almost entirely on-chain: the March 25, June 25, and October 10, 2025 seizure warrants set out alleged donation flow through successive addresses as investigators followed the funds.",{"type":27,"tag":28,"props":266,"children":267},{},[268,273],{"type":27,"tag":65,"props":269,"children":270},{},[271],{"type":32,"value":272},"Actor attribution",{"type":32,"value":274}," asks who controlled the addresses. On-chain data alone cannot answer this. The record answers it through everything off-chain: platform accounts, service-provider records, communications content, and the observable behavior of the infrastructure.",{"type":27,"tag":28,"props":276,"children":277},{},[278,280,286],{"type":32,"value":279},"A private civil expert should replicate this split explicitly in any report. The path analysis can be stated with high confidence; the attribution analysis should be stated with a confidence level tied to the caliber of the off-chain evidence actually obtained. When a proposed report merges the two, the opposing expert's job becomes easy. For a practical framework on this very division, see the discussion of address attribution in ",{"type":27,"tag":83,"props":281,"children":283},{"href":282},"\u002Fresources\u002Funderstanding-wallet-ownership-evidence",[284],{"type":32,"value":285},"wallet ownership evidence",{"type":32,"value":287},".",{"type":27,"tag":40,"props":289,"children":291},{"id":290},"a-worked-hypothetical-modeled-on-the-structure",[292],{"type":32,"value":293},"A Worked Hypothetical Modeled on the Structure",{"type":27,"tag":28,"props":295,"children":296},{},[297],{"type":32,"value":298},"The following is a hypothetical illustration built to mirror the layering technique described above, not a description of any actual investigation.",{"type":27,"tag":28,"props":300,"children":301},{},[302,307],{"type":27,"tag":65,"props":303,"children":304},{},[305],{"type":32,"value":306},"Hypothetical example:",{"type":32,"value":308}," You represent a judgment creditor whose debtor, a third-party vendor, is suspected of funneling kickbacks through cryptocurrency. You have a single lead: the vendor's tax return disclosed a wallet address used to receive client overpayments.",{"type":27,"tag":310,"props":311,"children":312},"ol",{},[313,323,333,343,353],{"type":27,"tag":61,"props":314,"children":315},{},[316,321],{"type":27,"tag":65,"props":317,"children":318},{},[319],{"type":32,"value":320},"Establish the seed address.",{"type":32,"value":322}," Query the disclosed address on a block explorer and capture the full transaction history, including inbound overpayments that match client remittance schedules. Document the queries and exports for reproducibility.",{"type":27,"tag":61,"props":324,"children":325},{},[326,331],{"type":27,"tag":65,"props":327,"children":328},{},[329],{"type":32,"value":330},"Follow the path.",{"type":32,"value":332}," Trace outbound value from the seed address to subsequent addresses using standard clustering (common input ownership and change output). Identify a pattern of same-day movements into a single consolidation wallet: the analog of the Hamas affidavits' consolidation pattern.",{"type":27,"tag":61,"props":334,"children":335},{},[336,341],{"type":27,"tag":65,"props":337,"children":338},{},[339],{"type":32,"value":340},"Find the service-provider touchpoint.",{"type":32,"value":342}," When the consolidation wallet funds are sent to a deposit address attributable to an exchange, subpoena the exchange for account records tied to that deposit address, including KYC documents.",{"type":27,"tag":61,"props":344,"children":345},{},[346,351],{"type":27,"tag":65,"props":347,"children":348},{},[349],{"type":32,"value":350},"Corroborate with communications and behavior.",{"type":32,"value":352}," Depose the vendor about the exchange account and the consolidation wallet. Correlate transaction timestamps with vendor travel or project milestones to create the attribution layer the ledger alone cannot supply.",{"type":27,"tag":61,"props":354,"children":355},{},[356,361],{"type":27,"tag":65,"props":357,"children":358},{},[359],{"type":32,"value":360},"Preserve the control evidence.",{"type":32,"value":362}," Move for production of device forensics or a signed message from the disputed addresses, exactly as the government's legal process secured the off-chain records in the seizure wave.",{"type":27,"tag":28,"props":364,"children":365},{},[366],{"type":32,"value":367},"This sequence is a scaled-down civil analog of the six evidence categories above: path, interposition (the discovery demand), communications, service-provider records, obfuscation detection, and legal process.",{"type":27,"tag":40,"props":369,"children":371},{"id":370},"a-checklist-for-reading-any-public-warrant-or-seizure-record",[372],{"type":32,"value":373},"A Checklist for Reading Any Public Warrant or Seizure Record",{"type":27,"tag":28,"props":375,"children":376},{},[377],{"type":32,"value":378},"When a client hands you a government warrant, press release, or affidavit, run this checklist before forming any opinion:",{"type":27,"tag":57,"props":380,"children":383},{"className":381},[382],"contains-task-list",[384,404,419,434,449,464,479],{"type":27,"tag":61,"props":385,"children":388},{"className":386},[387],"task-list-item",[389,395,397,402],{"type":27,"tag":390,"props":391,"children":394},"input",{"disabled":392,"type":393},true,"checkbox",[],{"type":32,"value":396}," ",{"type":27,"tag":65,"props":398,"children":399},{},[400],{"type":32,"value":401},"Identify the legal instrument.",{"type":32,"value":403}," Is it a warrant application, a returned warrant, an affidavit, a forfeiture complaint, or a press release? Each supports a different conclusion.",{"type":27,"tag":61,"props":405,"children":407},{"className":406},[387],[408,411,412,417],{"type":27,"tag":390,"props":409,"children":410},{"disabled":392,"type":393},[],{"type":32,"value":396},{"type":27,"tag":65,"props":413,"children":414},{},[415],{"type":32,"value":416},"Separate allegations from findings.",{"type":32,"value":418}," Flag every sentence the government asserts as investigatory belief rather than adjudicated fact.",{"type":27,"tag":61,"props":420,"children":422},{"className":421},[387],[423,426,427,432],{"type":27,"tag":390,"props":424,"children":425},{"disabled":392,"type":393},[],{"type":32,"value":396},{"type":27,"tag":65,"props":428,"children":429},{},[430],{"type":32,"value":431},"Locate the probable-cause foundation.",{"type":32,"value":433}," If an affidavit exists, identify which factual predicates support it and which are speculative or attributed.",{"type":27,"tag":61,"props":435,"children":437},{"className":436},[387],[438,441,442,447],{"type":27,"tag":390,"props":439,"children":440},{"disabled":392,"type":393},[],{"type":32,"value":396},{"type":27,"tag":65,"props":443,"children":444},{},[445],{"type":32,"value":446},"Map each evidence category.",{"type":32,"value":448}," Place every assertion into one of: on-chain path, interposed transaction, communications, service-provider records, obfuscation indicators, or legal process.",{"type":27,"tag":61,"props":450,"children":452},{"className":451},[387],[453,456,457,462],{"type":27,"tag":390,"props":454,"children":455},{"disabled":392,"type":393},[],{"type":32,"value":396},{"type":27,"tag":65,"props":458,"children":459},{},[460],{"type":32,"value":461},"Split path from attribution.",{"type":32,"value":463}," State what the record proves about value movement versus what it proves about persons.",{"type":27,"tag":61,"props":465,"children":467},{"className":466},[387],[468,471,472,477],{"type":27,"tag":390,"props":469,"children":470},{"disabled":392,"type":393},[],{"type":32,"value":396},{"type":27,"tag":65,"props":473,"children":474},{},[475],{"type":32,"value":476},"Note what is sealed or withheld.",{"type":32,"value":478}," Warrants are often unsealed only in part. Redactions and sealed exhibits leave gaps in the public record; they do not establish what the nonpublic material proves.",{"type":27,"tag":61,"props":480,"children":482},{"className":481},[387],[483,486,487,492],{"type":27,"tag":390,"props":484,"children":485},{"disabled":392,"type":393},[],{"type":32,"value":396},{"type":27,"tag":65,"props":488,"children":489},{},[490],{"type":32,"value":491},"Check the return.",{"type":32,"value":493}," The warrant's return, inventory, and certification are the place to look for what was actually taken, which may differ from what was authorized. In the posted March, June, and October packets, those AO 109 fields are blank, so reconstruct execution from provider production rather than treating the public return as a filled inventory.",{"type":27,"tag":40,"props":495,"children":497},{"id":496},"limitations-burdens-tools-and-sealed-material",[498],{"type":32,"value":499},"Limitations: Burdens, Tools, and Sealed Material",{"type":27,"tag":28,"props":501,"children":502},{},[503],{"type":32,"value":504},"A government seizure record is a persuasive and instructive document, but it is not a template to be transplanted into civil litigation without adaptation.",{"type":27,"tag":28,"props":506,"children":507},{},[508,513],{"type":27,"tag":65,"props":509,"children":510},{},[511],{"type":32,"value":512},"Lower burdens.",{"type":32,"value":514}," Probable cause is a lower standard than proof by a preponderance of the evidence, and both are lower than proof beyond a reasonable doubt. A magistrate's authorization does not constitute a finding that any defendant is liable or guilty.",{"type":27,"tag":28,"props":516,"children":517},{},[518,523],{"type":27,"tag":65,"props":519,"children":520},{},[521],{"type":32,"value":522},"Different tools.",{"type":32,"value":524}," The government can compel records from providers, request issuer or exchange freezes of stablecoin balances, and take control of infrastructure using authorities a civil litigant does not possess. A private party can pursue relevant nonprivileged discovery, but that process is subject to objections, privilege, and cross-jurisdictional enforcement problems.",{"type":27,"tag":28,"props":526,"children":527},{},[528,533],{"type":27,"tag":65,"props":529,"children":530},{},[531],{"type":32,"value":532},"Sealed and incomplete records.",{"type":32,"value":534}," The affidavits posted by the DOJ are partial views. Significant portions of the underlying investigation, including provider communications and foreign records, are not public. An expert who builds a civil case on a partial warrant record without confirming the evidentiary foundation is building on sand. When the record is incomplete, the correct response is narrow analysis, not confidence.",{"type":27,"tag":28,"props":536,"children":537},{},[538,543],{"type":27,"tag":65,"props":539,"children":540},{},[541],{"type":32,"value":542},"No adjudication.",{"type":32,"value":544}," None of the September 2026 materials reflect a conviction, a forfeiture order, or a finding against any individual. Any use of this case study must preserve that distinction.",{"type":27,"tag":28,"props":546,"children":547},{},[548,550,556,558,564],{"type":32,"value":549},"For the civil analog of these methods as applied to Ponzi and fraud structures, see the ",{"type":27,"tag":83,"props":551,"children":553},{"href":552},"\u002Fresources\u002Fdeconstructing-ponzi-blockchain-methodology",[554],{"type":32,"value":555},"methodological walkthrough of blockchain Ponzi reconstruction",{"type":32,"value":557},", and for the foundational question of what tracing can and cannot establish, see ",{"type":27,"tag":83,"props":559,"children":561},{"href":560},"\u002Fresources\u002Fcan-blockchain-transactions-be-traced",[562],{"type":32,"value":563},"can blockchain transactions be traced",{"type":32,"value":287},{"type":27,"tag":40,"props":566,"children":568},{"id":567},"discovery-and-evidence-questions-worth-asking",[569],{"type":32,"value":570},"Discovery and Evidence Questions Worth Asking",{"type":27,"tag":28,"props":572,"children":573},{},[574],{"type":32,"value":575},"If you are building or challenging a trace modeled on this record, these are the questions to ask of your own expert, or of the opposing expert in deposition if the opinion rests on a warrant or government filing:",{"type":27,"tag":310,"props":577,"children":578},{},[579,584,589,594,599],{"type":27,"tag":61,"props":580,"children":581},{},[582],{"type":32,"value":583},"Which addresses are claimed to be connected, and which clustering heuristic supports each connection?",{"type":27,"tag":61,"props":585,"children":586},{},[587],{"type":32,"value":588},"What is the confidence level attached to the path analysis versus the attribution analysis?",{"type":27,"tag":61,"props":590,"children":591},{},[592],{"type":32,"value":593},"Which service-provider records were obtained, from whom, and by what legal authority?",{"type":27,"tag":61,"props":595,"children":596},{},[597],{"type":32,"value":598},"Were any transactions observed, frozen, or redirected by an investigator or third party, and what effect does that interposition have on the integrity of the trace?",{"type":27,"tag":61,"props":600,"children":601},{},[602],{"type":32,"value":603},"Which assertions in the opinion trace to a publicly available primary source, and which rest on sealed or secondhand material?",{"type":27,"tag":28,"props":605,"children":606},{},[607,609,615,617,623,625,631],{"type":32,"value":608},"An expert who cannot answer each of these questions with a specific, verifiable response has not yet completed the analysis. If you need to build this evidence layer yourself, ",{"type":27,"tag":83,"props":610,"children":612},{"href":611},"\u002Fservices#blockchain-tracing",[613],{"type":32,"value":614},"ConsensusIntel's blockchain tracing services",{"type":32,"value":616}," cover the path and attribution work, and ",{"type":27,"tag":83,"props":618,"children":620},{"href":619},"\u002Fservices#expert-witness",[621],{"type":32,"value":622},"expert witness services",{"type":32,"value":624}," cover the report and testimony stage. The ",{"type":27,"tag":83,"props":626,"children":628},{"href":627},"\u002Fmethodology",[629],{"type":32,"value":630},"methodology page",{"type":32,"value":632}," explains how evidence produced in this layered fashion is documented for litigation.",{"type":27,"tag":40,"props":634,"children":636},{"id":635},"frequently-asked-questions",[637],{"type":32,"value":638},"Frequently Asked Questions",{"type":27,"tag":153,"props":640,"children":642},{"id":641},"q-can-i-rely-on-a-doj-seizure-warrant-as-proof-in-my-civil-case",[643],{"type":32,"value":644},"Q: Can I rely on a DOJ seizure warrant as proof in my civil case?",{"type":27,"tag":28,"props":646,"children":647},{},[648,653],{"type":27,"tag":65,"props":649,"children":650},{},[651],{"type":32,"value":652},"A:",{"type":32,"value":654}," Not directly. A warrant establishes that a magistrate found probable cause to seize property, which is a lower threshold than civil proof and carries no finding of liability. You can use the warrant as a roadmap for what evidence exists and where it came from, then obtain and verify the underlying records yourself. Treat the government's factual assertions as allegations supported by an investigation you have not seen in full.",{"type":27,"tag":153,"props":656,"children":658},{"id":657},"q-what-is-the-difference-between-path-tracing-and-actor-attribution-in-these-affidavits",[659],{"type":32,"value":660},"Q: What is the difference between path tracing and actor attribution in these affidavits?",{"type":27,"tag":28,"props":662,"children":663},{},[664,668],{"type":27,"tag":65,"props":665,"children":666},{},[667],{"type":32,"value":652},{"type":32,"value":669}," Path tracing shows where value moved on-chain: addresses, amounts, and timestamps, which is directly observable on the public ledger. Actor attribution connects addresses to persons or organizations, which the ledger cannot do alone. In the Hamas seizure record, attribution rests on the off-chain layers: platform accounts, service-provider records, communications content, and the government's control of infrastructure. Any expert report that merges the two without labeling the confidence of each will be vulnerable on cross-examination.",{"type":27,"tag":153,"props":671,"children":673},{"id":672},"q-why-did-the-government-release-these-warrant-materials-to-the-public",[674],{"type":32,"value":675},"Q: Why did the government release these warrant materials to the public?",{"type":27,"tag":28,"props":677,"children":678},{},[679,683],{"type":27,"tag":65,"props":680,"children":681},{},[682],{"type":32,"value":652},{"type":32,"value":684}," The Department did not state a separate reason for publication. It posted the seizure warrants and related materials through its Office of Public Affairs with the September 1, 2026 announcement. The applications were filed under seal, and the posted packets are redacted, so the public record is partial. Practitioners should treat the posted documents as the evidentiary window the government chose to open, not the complete file.",{"type":27,"tag":153,"props":686,"children":688},{"id":687},"q-do-blockchain-seizure-warrants-identify-real-people",[689],{"type":32,"value":690},"Q: Do blockchain seizure warrants identify real people?",{"type":27,"tag":28,"props":692,"children":693},{},[694,698],{"type":27,"tag":65,"props":695,"children":696},{},[697],{"type":32,"value":652},{"type":32,"value":699}," Sometimes, but their focus is property, not persons. Warrants name addresses, accounts, and infrastructure as the items to be seized, and affidavits describe the investigation supporting probable cause. Names can appear where service-provider records or communications tie an account to an individual, but a warrant is not a charging document or a conviction. Do not read an uncharged name in an affidavit as an adjudicated finding.",{"type":27,"tag":40,"props":701,"children":703},{"id":702},"closing",[704],{"type":32,"value":705},"Closing",{"type":27,"tag":28,"props":707,"children":708},{},[709,711,717],{"type":32,"value":710},"This case study is a particularly clean example of investigative layering in a real enforcement record, but every matter differs in its facts, jurisdictions, and available evidence. If you are evaluating a trace, preparing to challenge an opposing expert, or considering whether a public seizure record can advance your client's interests, a consultation is the right next step. ",{"type":27,"tag":83,"props":712,"children":714},{"href":713},"\u002Fcontact",[715],{"type":32,"value":716},"Contact ConsensusIntel",{"type":32,"value":718}," to discuss the specifics of your matter.",{"title":8,"searchDepth":720,"depth":720,"links":721},2,[722,723,732,733,734,735,736,737,743],{"id":42,"depth":720,"text":45},{"id":125,"depth":720,"text":128,"children":724},[725,727,728,729,730,731],{"id":155,"depth":726,"text":158},3,{"id":175,"depth":726,"text":178},{"id":202,"depth":726,"text":205},{"id":213,"depth":726,"text":216},{"id":224,"depth":726,"text":227},{"id":235,"depth":726,"text":238},{"id":246,"depth":720,"text":249},{"id":290,"depth":720,"text":293},{"id":370,"depth":720,"text":373},{"id":496,"depth":720,"text":499},{"id":567,"depth":720,"text":570},{"id":635,"depth":720,"text":638,"children":738},[739,740,741,742],{"id":641,"depth":726,"text":644},{"id":657,"depth":726,"text":660},{"id":672,"depth":726,"text":675},{"id":687,"depth":726,"text":690},{"id":702,"depth":720,"text":705},"markdown","content:articles:39-crypto-seizure-warrant-trace-hamas-2026.md","content","articles\u002F39-crypto-seizure-warrant-trace-hamas-2026.md","articles\u002F39-crypto-seizure-warrant-trace-hamas-2026","md",{"_path":751,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":752,"description":753,"slug":754,"date":755,"lastUpdated":755,"author":13,"readingTime":756,"category":757,"tags":758,"ogImage":762,"featured":7,"body":763,"_type":744,"_id":1242,"_source":746,"_file":1243,"_stem":1244,"_extension":749},"\u002Farticles\u002F28-crypto-prejudgment-asset-freeze","A trace is not an asset freeze: Choosing a prejudgment remedy","Blockchain tracing locates crypto but restrains nothing. Choosing the prejudgment attachment, injunction, or receivership that actually preserves assets.","crypto-prejudgment-asset-freeze","2026-06-20",14,"Legal Reference",[759,760,761,21],"asset-freeze","prejudgment-remedies","attachment","\u002Fog\u002Fcrypto-prejudgment-asset-freeze.png",{"type":24,"children":764,"toc":1222},[765,770,776,788,793,821,834,840,854,860,865,897,902,908,913,918,923,929,943,948,966,989,995,1014,1019,1025,1030,1035,1047,1053,1096,1102,1107,1112,1118,1131,1135,1141,1150,1156,1165,1171,1180,1186,1195,1201,1210],{"type":27,"tag":28,"props":766,"children":767},{},[768],{"type":32,"value":769},"The forensic report is finished, and the analyst has followed the funds to a custodial account with a fixed balance. Nothing has changed on the ledger, and nothing will change until a court acts: a blockchain trace is an evidentiary picture, not a restraint. This article maps the prejudgment mechanisms available to a private plaintiff in U.S. courts, explains the federal limits on freezing assets, and lays out the sequence that turns a trace into an enforceable hold.",{"type":27,"tag":40,"props":771,"children":773},{"id":772},"what-a-trace-establishes-and-what-it-does-not",[774],{"type":32,"value":775},"What a Trace Establishes and What It Does Not",{"type":27,"tag":28,"props":777,"children":778},{},[779,781,786],{"type":32,"value":780},"A trace answers evidentiary questions: which addresses received and sent which assets, in what amounts and at what times, and through which exchange deposit addresses the funds flowed (",{"type":27,"tag":83,"props":782,"children":783},{"href":560},[784],{"type":32,"value":785},"how blockchain transactions can be traced",{"type":32,"value":787},"). It does not restrain anyone. The private key still works and the exchange account is still liquid, so the defendant can move the balance seconds after learning the investigation exists.",{"type":27,"tag":28,"props":789,"children":790},{},[791],{"type":32,"value":792},"Five functions lead to final recovery, and conflating them is the common error:",{"type":27,"tag":57,"props":794,"children":795},{},[796,801,806,811,816],{"type":27,"tag":61,"props":797,"children":798},{},[799],{"type":32,"value":800},"Locate: the trace identifies addresses, accounts, and protocol positions.",{"type":27,"tag":61,"props":802,"children":803},{},[804],{"type":32,"value":805},"Custody: the asset sits with an exchange, an issuer, a custodian, or the defendant's own keys.",{"type":27,"tag":61,"props":807,"children":808},{},[809],{"type":32,"value":810},"Restrain: a court order bars the defendant or a custodian from moving specific assets.",{"type":27,"tag":61,"props":812,"children":813},{},[814],{"type":32,"value":815},"Seize: the government or a levy officer takes possession under statutory authority.",{"type":27,"tag":61,"props":817,"children":818},{},[819],{"type":32,"value":820},"Recover: the plaintiff obtains a judgment and executes or receives a turnover.",{"type":27,"tag":28,"props":822,"children":823},{},[824,826,832],{"type":32,"value":825},"A stablecoin issuer's blacklist is a compliance function, not a judicial restraint, and is covered separately in ",{"type":27,"tag":83,"props":827,"children":829},{"href":828},"\u002Fresources\u002Fstablecoins-freeze-option-usdt-usdc",[830],{"type":32,"value":831},"stablecoins and the freeze option for USDT and USDC",{"type":32,"value":833},". For a private plaintiff, only a court order creates the restraint, and it must be served and implemented while the trace is still current.",{"type":27,"tag":40,"props":835,"children":837},{"id":836},"jurisdiction-and-the-two-federal-rules-that-matter",[838],{"type":32,"value":839},"Jurisdiction and the Two Federal Rules That Matter",{"type":27,"tag":28,"props":841,"children":842},{},[843,845,852],{"type":32,"value":844},"This article addresses U.S. federal court practice; state-court procedure differs and must be checked in the forum. Two rules govern what a plaintiff can do before judgment: Federal Rule of Civil Procedure 64, which borrows state seizure remedies, and Rule 65, which governs temporary restraining orders and preliminary injunctions. Both appear in the ",{"type":27,"tag":83,"props":846,"children":849},{"href":847,"rel":848},"https:\u002F\u002Fwww.uscourts.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fdocument\u002Ffederal-rules-of-civil-procedure.pdf",[87],[850],{"type":32,"value":851},"official Federal Rules of Civil Procedure pamphlet",{"type":32,"value":853}," (amended through December 1, 2025).",{"type":27,"tag":153,"props":855,"children":857},{"id":856},"rule-64-seizure-remedies-borrowed-from-state-law",[858],{"type":32,"value":859},"Rule 64: Seizure Remedies Borrowed from State Law",{"type":27,"tag":28,"props":861,"children":862},{},[863],{"type":32,"value":864},"Rule 64(a) provides that \"at the commencement of and throughout an action, every remedy is available that, under the law of the state where the court is located, provides for seizing a person or property to secure satisfaction of the potential judgment.\" Rule 64(b) names them: arrest, attachment, garnishment, replevin, sequestration, and corresponding or equivalent remedies.",{"type":27,"tag":28,"props":866,"children":867},{},[868,870,877,879,886,888,895],{"type":32,"value":869},"The translation to crypto is direct where a custodian exists: if funds sit in an account at a custodial exchange, the exchange is the garnishee. Missouri's attachment statute, for example, reaches \"the lands, tenements, goods, moneys, effects and credits of the defendant in whose hands soever the same may be\" (",{"type":27,"tag":83,"props":871,"children":874},{"href":872,"rel":873},"https:\u002F\u002Frevisor.mo.gov\u002Fmain\u002FOneSection.aspx?section=521.050",[87],[875],{"type":32,"value":876},"Mo. Rev. Stat. § 521.050",{"type":32,"value":878},"). Missouri permits attachment only on grounds enumerated in ",{"type":27,"tag":83,"props":880,"children":883},{"href":881,"rel":882},"https:\u002F\u002Frevisor.mo.gov\u002Fmain\u002FOneSection.aspx?section=521.010",[87],[884],{"type":32,"value":885},"Mo. Rev. Stat. § 521.010",{"type":32,"value":887},", generally with an affidavit and bond (Mo. Rev. Stat. § 521.050). Where assets were transferred to defeat creditors, Missouri's fraudulent-transfer chapter expressly authorizes \"an attachment or other provisional remedy against the asset transferred or other property of the transferee\" (",{"type":27,"tag":83,"props":889,"children":892},{"href":890,"rel":891},"https:\u002F\u002Frevisor.mo.gov\u002Fmain\u002FOneSection.aspx?section=428.039",[87],[893],{"type":32,"value":894},"Mo. Rev. Stat. § 428.039.1(2)",{"type":32,"value":896},").",{"type":27,"tag":28,"props":898,"children":899},{},[900],{"type":32,"value":901},"Two cautions. State law controls what Rule 64 can borrow, and states differ: some restrict prejudgment garnishment, some require proof the defendant is nonresident, departing, or concealing assets. Confirm the forum statute covers intangible personal property and accounts, since crypto is neither tangible goods nor a bank balance. And attachment is a vehicle; the pleadings must still state a claim that reaches the specific assets.",{"type":27,"tag":153,"props":903,"children":905},{"id":904},"rule-65-injunctions-restrain-conduct-not-the-ledger",[906],{"type":32,"value":907},"Rule 65: Injunctions Restrain Conduct, Not the Ledger",{"type":27,"tag":28,"props":909,"children":910},{},[911],{"type":32,"value":912},"A preliminary injunction requires notice to the adverse party (Rule 65(a)(1)) and satisfaction of the four-part standard: likelihood of success on the merits, irreparable injury absent relief, balance of equities, and the public interest (Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7 (2008)). A temporary restraining order can issue without notice only if an affidavit or verified complaint shows specific facts of \"immediate and irreparable injury\" before the adverse party can be heard, with the attorney certifying in writing the efforts to give notice and why none should be required (Rule 65(b)(1)). A no-notice TRO expires after entry, not to exceed 14 days, unless extended for good cause or the adverse party consents (Rule 65(b)(2)).",{"type":27,"tag":28,"props":914,"children":915},{},[916],{"type":32,"value":917},"Three features matter in crypto cases. Security is mandatory: a TRO or preliminary injunction issues \"only if the movant gives security in an amount that the court considers proper to pay the costs and damages sustained by any party found to have been wrongfully enjoined or restrained\" (Rule 65(c)). The order must describe \"in reasonable detail,\" not by referring to the complaint, the acts restrained or required (Rule 65(d)(1)(C)), so vague asset language fails. And the order binds parties, their officers and agents, and \"other persons who are in active concert or participation with\" them who receive actual notice (Rule 65(d)(2)); that is how a TRO reaches a custodian that is not a named party, and a custodian that honors a withdrawal despite notice risks contempt.",{"type":27,"tag":28,"props":919,"children":920},{},[921],{"type":32,"value":922},"The trap is treating an injunction as an attachment. Rule 65 restrains behavior; it does not seize or secure property. A motion asking a federal court to freeze \"all assets\" pending a contract claim runs directly into the Supreme Court's limit in Grupo Mexicano.",{"type":27,"tag":40,"props":924,"children":926},{"id":925},"grupo-mexicano-and-the-line-between-specific-property-and-a-general-claim",[927],{"type":32,"value":928},"Grupo Mexicano and the Line Between Specific Property and a General Claim",{"type":27,"tag":28,"props":930,"children":931},{},[932,934,941],{"type":32,"value":933},"In ",{"type":27,"tag":83,"props":935,"children":938},{"href":936,"rel":937},"https:\u002F\u002Fwww.govinfo.gov\u002Fcontent\u002Fpkg\u002FUSREPORTS-527\u002Fpdf\u002FUSREPORTS-527-308.pdf",[87],[939],{"type":32,"value":940},"Grupo Mexicano de Desarrollo, S.A. v. Alliance Bond Fund, Inc., 527 U.S. 308 (1999)",{"type":32,"value":942},", decided June 17, 1999, investment funds holding roughly $75 million in notes sued a Mexican toll-road developer on a contract claim and obtained a preliminary injunction freezing the defendant's U.S. assets to secure a potential money judgment. The Supreme Court reversed, holding that federal courts have no equitable power to freeze a defendant's assets pending an unsecured money claim. The reasoning is the creditor's-lien point: a general creditor holds no judgment lien, the debtor retains dominion before judgment, and a freeze hands the plaintiff a priority it has not earned.",{"type":27,"tag":28,"props":944,"children":945},{},[946],{"type":32,"value":947},"The holding channels relief rather than eliminating it. The Court noted that an equitable claim to specific property stands on different ground, observing that a creditor asserting an equitable lien \"presents a different case from that of the unsecured general creditor.\" That distinction is the roadmap:",{"type":27,"tag":57,"props":949,"children":950},{},[951,956,961],{"type":27,"tag":61,"props":952,"children":953},{},[954],{"type":32,"value":955},"Claims that reach specific property can support pretrial orders: conversion or fraud where the plaintiff identifies the wallet or account holding the proceeds, constructive trust over identifiable assets, and fraudulent-transfer claims aimed at specific transferred assets.",{"type":27,"tag":61,"props":957,"children":958},{},[959],{"type":32,"value":960},"Claims that merely seek money, with no identified res, cannot justify a federal freeze as a matter of course. The remedy is state-law attachment or garnishment under Rule 64.",{"type":27,"tag":61,"props":962,"children":963},{},[964],{"type":32,"value":965},"Statutory authorization changes the analysis: where a statute empowers an agency to freeze assets, the Grupo Mexicano objection does not apply, which is why enforcement actions routinely include asset freezes.",{"type":27,"tag":28,"props":967,"children":968},{},[969,971,978,980,987],{"type":32,"value":970},"A public example shows the difference between seizure authority and civil restraint. On February 8, 2022, the ",{"type":27,"tag":83,"props":972,"children":975},{"href":973,"rel":974},"https:\u002F\u002Fwww.justice.gov\u002Fusao-dc\u002Fpr\u002Ftwo-arrested-alleged-conspiracy-launder-45-billion-stolen-cryptocurrency",[87],[976],{"type":32,"value":977},"Department of Justice announced",{"type":32,"value":979}," that two individuals were arrested for an alleged conspiracy to launder bitcoin stolen in the 2016 Bitfinex hack, and that law enforcement had seized over $3.6 billion in cryptocurrency linked to the hack, which Deputy Attorney General Monaco described as the department's largest financial seizure ever. On August 3, 2023, the ",{"type":27,"tag":83,"props":981,"children":984},{"href":982,"rel":983},"https:\u002F\u002Fwww.justice.gov\u002Farchives\u002Fopa\u002Fpr\u002Fbitfinex-hacker-and-wife-plead-guilty-money-laundering-conspiracy-involving-billions",[87],[985],{"type":32,"value":986},"DOJ announced guilty pleas",{"type":32,"value":988}," in the same matter. That power runs on warrants and forfeiture authority; a private creditor has none of it.",{"type":27,"tag":40,"props":990,"children":992},{"id":991},"turning-the-trace-into-declarations-exhibits-and-order-language",[993],{"type":32,"value":994},"Turning the Trace into Declarations, Exhibits, and Order Language",{"type":27,"tag":28,"props":996,"children":997},{},[998,1000,1005,1007,1012],{"type":32,"value":999},"The forensic package must be built for the motion, not for the analyst's own report. It should contain the addresses and chains, token types and quantities, transaction timestamps, exchange deposit addresses, clustering and attribution evidence, and a clear separation between on-chain facts and the inference that a person controls a wallet (",{"type":27,"tag":83,"props":1001,"children":1002},{"href":627},[1003],{"type":32,"value":1004},"our methodology",{"type":32,"value":1006}," describes how ConsensusIntel structures litigation analyses). The declaration should present the on-chain facts, the basis for attributing control to the defendant, and any behavioral evidence of dissipation risk such as rapid prior liquidations, mixing, or chain-hopping, labeled for what it is: behavior from which intent is inferred, not a confirmed fact. A ",{"type":27,"tag":83,"props":1008,"children":1009},{"href":611},[1010],{"type":32,"value":1011},"blockchain tracing",{"type":32,"value":1013}," engagement should produce this package in the form a motion needs.",{"type":27,"tag":28,"props":1015,"children":1016},{},[1017],{"type":32,"value":1018},"The proposed order must name the asset with the specificity Rule 65(d)(1)(C) demands: chain, token contract where relevant, address or account identifier, and quantity, plus language reaching \"all proceeds and replacements\" so a swap does not defeat the order mid-stream. Where a custodian holds the funds, the order should direct the custodian by name to restrain the account and refuse withdrawals. Where the target is a stablecoin address, the order can direct the issuer to execute its blacklist function. File the verified complaint, the TRO papers, any attachment or garnishment applications, and the issuer request in parallel; sequential processing is how the asset leaves.",{"type":27,"tag":40,"props":1020,"children":1022},{"id":1021},"where-the-remedy-actually-lands",[1023],{"type":32,"value":1024},"Where the Remedy Actually Lands",{"type":27,"tag":28,"props":1026,"children":1027},{},[1028],{"type":32,"value":1029},"Custodial exchange accounts are the most tractable target: the exchange is a third party holding the defendant's property, so it is the natural garnishee and the natural recipient of a served order. Expect compliance to require a complete order, a case caption, and an account identifier; nothing replaces direct service and a written acknowledgment of the hold.",{"type":27,"tag":28,"props":1031,"children":1032},{},[1033],{"type":32,"value":1034},"Stablecoin issuers operate a separate freeze mechanism through their token contracts, which is why USDT and USDC behave differently from Bitcoin or Ether in preserve-and-hold situations. A court order strengthens a freeze request but the issuer executes it, and the mechanism exists only for centralized stablecoins. The limits of that tool are covered in our discussion of stablecoin freezes.",{"type":27,"tag":28,"props":1036,"children":1037},{},[1038,1040,1046],{"type":32,"value":1039},"Self-custodied wallets are the hard case: no custodian to serve, the order binds the defendant personally, enforcement runs through contempt and discovery of keys and seed phrases, and the realistic function of the order is to preserve the status quo and set up later execution or turnover. Multisig and protocol positions complicate the picture: value may sit in a vault or DeFi position, so the order should identify the position and the parties who control its keys. Mapping which custodial posture applies, and what process each holder will accept, is a standard part of ",{"type":27,"tag":83,"props":1041,"children":1043},{"href":1042},"\u002Fservices#litigation-consulting",[1044],{"type":32,"value":1045},"litigation consulting",{"type":32,"value":287},{"type":27,"tag":40,"props":1048,"children":1050},{"id":1049},"the-same-day-sequence",[1051],{"type":32,"value":1052},"The Same-Day Sequence",{"type":27,"tag":57,"props":1054,"children":1055},{},[1056,1061,1066,1071,1076,1081,1086,1091],{"type":27,"tag":61,"props":1057,"children":1058},{},[1059],{"type":32,"value":1060},"Before filing, take a live snapshot of balances at every target address and exchange account; the report's historical balance is not the filing-day balance.",{"type":27,"tag":61,"props":1062,"children":1063},{},[1064],{"type":32,"value":1065},"Draft the verified complaint around a specific-property theory so the requested restraint matches the Grupo Mexicano exception.",{"type":27,"tag":61,"props":1067,"children":1068},{},[1069],{"type":32,"value":1070},"Prepare the TRO papers, any attachment or garnishment applications, and the issuer freeze request as one package, drafted to Rule 65(d) specificity.",{"type":27,"tag":61,"props":1072,"children":1073},{},[1074],{"type":32,"value":1075},"Have the bond figure ready: Rule 65(c) security, plus any state bond required for attachment.",{"type":27,"tag":61,"props":1077,"children":1078},{},[1079],{"type":32,"value":1080},"File, obtain the order, and serve the defendant and every custodian in the same window, requesting written acknowledgment.",{"type":27,"tag":61,"props":1082,"children":1083},{},[1084],{"type":32,"value":1085},"Submit the issuer freeze request for any USDT or USDC addresses, with the order attached.",{"type":27,"tag":61,"props":1087,"children":1088},{},[1089],{"type":32,"value":1090},"Calendar the preliminary injunction hearing inside the TRO's 14-day life, and have the expert re-snapshot balances on the hearing eve.",{"type":27,"tag":61,"props":1092,"children":1093},{},[1094],{"type":32,"value":1095},"Monitor the target addresses on-chain after service; post-service movements are both a contempt problem and evidence.",{"type":27,"tag":40,"props":1097,"children":1099},{"id":1098},"hypothetical-example-from-trace-to-tro-in-one-day",[1100],{"type":32,"value":1101},"Hypothetical Example: From Trace to TRO in One Day",{"type":27,"tag":28,"props":1103,"children":1104},{},[1105],{"type":32,"value":1106},"Hypothetical example, constructed for illustration, not a real matter: a Missouri company pays a $415,000 invoice that turns out to be a fraud. The funds move from the company's bank to an exchange, convert to USDC, pass through a private wallet, and land in an account at a second exchange under the fraudster's name. An analyst completes the flow map on a Monday: wallet addresses, an Ethereum transaction table, the second exchange's deposit address, and a live USDC balance of roughly $407,000 after fees.",{"type":27,"tag":28,"props":1108,"children":1109},{},[1110],{"type":32,"value":1111},"The case is filed Tuesday in federal court in Missouri. The verified complaint pleads conversion, fraud, and constructive trust over the specific USDC; the TRO motion attaches the analyst's declaration and block-explorer exports; a separate application seeks prejudgment attachment under Rule 64 borrowing Missouri's Chapter 521 procedures, with a $25,000 bond tendered (all figures hypothetical). The TRO restrains the defendant from disposing of the identified USDC, directs the second exchange by name to hold the account, and the plaintiff simultaneously sends the order to Circle requesting a blacklist freeze of the specific address. The exchange acknowledges the hold Wednesday, and monitoring confirms no movement. Nothing here requires a general asset freeze; every restraint is tied to specific property, the only posture Grupo Mexicano tolerates.",{"type":27,"tag":40,"props":1113,"children":1115},{"id":1114},"limitations-and-the-questions-that-decide-the-motion",[1116],{"type":32,"value":1117},"Limitations and the Questions That Decide the Motion",{"type":27,"tag":28,"props":1119,"children":1120},{},[1121,1123,1129],{"type":32,"value":1122},"The honest limitations: federal courts lack equitable power to freeze assets for unsecured money claims; state remedies vary and some are bond-heavy; self-custodied assets cannot be restrained on-chain; issuer cooperation is discretionary; jurisdiction over foreign exchanges is uncertain; and if the defendant is in bankruptcy the automatic stay preempts most of this (the ",{"type":27,"tag":83,"props":1124,"children":1126},{"href":1125},"\u002Fresources\u002Fcryptocurrency-bankruptcy-trustee-checklist",[1127],{"type":32,"value":1128},"bankruptcy trustee investigation checklist",{"type":32,"value":1130}," covers that regime). Beyond Rules 64 and 65, a court can appoint a receiver over identified property in danger of dissipation, generally on notice and best suited to a business entity controlling the wallets. The discovery questions that decide whether a remedy will work: what did each custodian hold at the relevant time and what do they hold now; what KYC and withdrawal-address records exist; does the issuer log freeze requests; where are the keys, devices, and seed phrases; who controls each multisig key; and what jurisdiction facts connect each custodian to a court that can order it. Answer those questions in the same week as the trace, because each answer determines which remedy is even available.",{"type":27,"tag":40,"props":1132,"children":1133},{"id":635},[1134],{"type":32,"value":638},{"type":27,"tag":153,"props":1136,"children":1138},{"id":1137},"q-does-a-blockchain-trace-itself-freeze-or-restrain-the-defendants-crypto",[1139],{"type":32,"value":1140},"Q: Does a blockchain trace itself freeze or restrain the defendant's crypto?",{"type":27,"tag":28,"props":1142,"children":1143},{},[1144,1148],{"type":27,"tag":65,"props":1145,"children":1146},{},[1147],{"type":32,"value":652},{"type":32,"value":1149}," No. A trace identifies addresses, amounts, and flow; it has no effect on anyone's ability to transact. Until a court order is served on the defendant and any custodian, the funds remain movable. The near-exception is a stablecoin issuer's own blacklist freeze for USDT or USDC, which is a compliance action rather than a judicial restraint.",{"type":27,"tag":153,"props":1151,"children":1153},{"id":1152},"q-can-i-get-a-federal-tro-freezing-crypto-pending-a-money-judgment",[1154],{"type":32,"value":1155},"Q: Can I get a federal TRO freezing crypto pending a money judgment?",{"type":27,"tag":28,"props":1157,"children":1158},{},[1159,1163],{"type":27,"tag":65,"props":1160,"children":1161},{},[1162],{"type":32,"value":652},{"type":32,"value":1164}," Not as a general matter. Grupo Mexicano de Desarrollo, S.A. v. Alliance Bond Fund, Inc., 527 U.S. 308 (1999), holds that federal courts lack equity power to freeze assets to secure an unsecured money claim. A TRO can restrain specific assets where the plaintiff asserts an equitable claim to identifiable property, such as conversion, fraud with traced proceeds, constructive trust, or fraudulent transfer, or where a statute authorizes the freeze. Otherwise, the route is state-law attachment or garnishment borrowed through Rule 64.",{"type":27,"tag":153,"props":1166,"children":1168},{"id":1167},"q-what-is-the-difference-between-rule-64-and-rule-65-remedies",[1169],{"type":32,"value":1170},"Q: What is the difference between Rule 64 and Rule 65 remedies?",{"type":27,"tag":28,"props":1172,"children":1173},{},[1174,1178],{"type":27,"tag":65,"props":1175,"children":1176},{},[1177],{"type":32,"value":652},{"type":32,"value":1179}," Rule 64 makes state seizure remedies available in federal court: attachment, garnishment, replevin, sequestration, and equivalents, reaching property held by a third party such as an exchange. Rule 65 governs injunctions and TROs, which restrain conduct, require notice (with a narrow no-notice TRO capped at 14 days), require security, and must describe the restrained acts in reasonable detail. A pure money claim belongs under Rule 64; Rule 65 restrains people and specific property.",{"type":27,"tag":153,"props":1181,"children":1183},{"id":1182},"q-what-bond-or-security-will-the-court-require",[1184],{"type":32,"value":1185},"Q: What bond or security will the court require?",{"type":27,"tag":28,"props":1187,"children":1188},{},[1189,1193],{"type":27,"tag":65,"props":1190,"children":1191},{},[1192],{"type":32,"value":652},{"type":32,"value":1194}," Rule 65(c) conditions any TRO or preliminary injunction on security \"in an amount that the court considers proper\" to cover costs and damages from a wrongful restraint. Courts set the figure case by case, and state attachment statutes impose their own bond requirements, as Missouri does in Mo. Rev. Stat. § 521.050. Budget the bond before filing; the court may adjust it at the preliminary injunction stage.",{"type":27,"tag":153,"props":1196,"children":1198},{"id":1197},"q-can-a-court-order-an-exchange-or-stablecoin-issuer-to-freeze-assets",[1199],{"type":32,"value":1200},"Q: Can a court order an exchange or stablecoin issuer to freeze assets?",{"type":27,"tag":28,"props":1202,"children":1203},{},[1204,1208],{"type":27,"tag":65,"props":1205,"children":1206},{},[1207],{"type":32,"value":652},{"type":32,"value":1209}," Yes, with limits. An order may name a custodian as the directed party, and Rule 65(d)(2) binds non-parties in active concert or participation who receive actual notice, which is why service and a written acknowledgment matter. Stablecoin issuers can freeze specific USDT or USDC addresses through their token contracts when presented with a court order, but the mechanism exists only for centralized stablecoins, the issuer executes it, and a freeze preserves rather than recovers.",{"type":27,"tag":28,"props":1211,"children":1212},{},[1213,1215,1220],{"type":32,"value":1214},"Every matter differs in forum, claim, and custodial posture, and the choice among attachment, injunction, and receivership is a legal judgment that turns on the specifics. If you are litigating a matter where crypto sits on the other side, ",{"type":27,"tag":83,"props":1216,"children":1217},{"href":713},[1218],{"type":32,"value":1219},"contact ConsensusIntel",{"type":32,"value":1221}," to discuss how the trace, the pleadings, and the preservation strategy should fit together.",{"title":8,"searchDepth":720,"depth":720,"links":1223},[1224,1225,1229,1230,1231,1232,1233,1234,1235],{"id":772,"depth":720,"text":775},{"id":836,"depth":720,"text":839,"children":1226},[1227,1228],{"id":856,"depth":726,"text":859},{"id":904,"depth":726,"text":907},{"id":925,"depth":720,"text":928},{"id":991,"depth":720,"text":994},{"id":1021,"depth":720,"text":1024},{"id":1049,"depth":720,"text":1052},{"id":1098,"depth":720,"text":1101},{"id":1114,"depth":720,"text":1117},{"id":635,"depth":720,"text":638,"children":1236},[1237,1238,1239,1240,1241],{"id":1137,"depth":726,"text":1140},{"id":1152,"depth":726,"text":1155},{"id":1167,"depth":726,"text":1170},{"id":1182,"depth":726,"text":1185},{"id":1197,"depth":726,"text":1200},"content:articles:28-crypto-prejudgment-asset-freeze.md","articles\u002F28-crypto-prejudgment-asset-freeze.md","articles\u002F28-crypto-prejudgment-asset-freeze",{"_path":1246,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":1247,"description":1248,"slug":1249,"date":1250,"lastUpdated":1250,"author":13,"readingTime":1251,"category":1252,"tags":1253,"ogImage":1256,"featured":7,"body":1257,"_type":744,"_id":2020,"_source":746,"_file":2021,"_stem":2022,"_extension":749},"\u002Farticles\u002F26-token-approvals-permit-signatures","Token approvals, permits, and transfer attribution","Explains how ERC-20 approvals and permit signatures separate token ownership, transfer submission, delegated authority, and proof of owner intent.","token-approvals-permit-signatures","2026-06-06",10,"Education",[20,1254,1255,21],"smart-contracts","wallet-ownership","\u002Fog\u002Ftoken-approvals-permit-signatures.png",{"type":24,"children":1258,"toc":2002},[1259,1264,1269,1275,1280,1319,1332,1338,1343,1436,1456,1467,1473,1502,1515,1563,1569,1574,1672,1685,1691,1718,1730,1744,1749,1761,1767,1772,1777,1783,1795,1800,1806,1811,1854,1866,1872,1877,1900,1913,1917,1923,1946,1952,1961,1967,1976,1982,1991],{"type":27,"tag":28,"props":1260,"children":1261},{},[1262],{"type":32,"value":1263},"An ERC-20 token leaving a wallet does not necessarily mean the wallet owner submitted the transfer transaction or approved that particular recipient. The owner may previously have granted another address authority to spend tokens through an allowance. A signed permit can create the same authority even though the owner never broadcasts an approval transaction.",{"type":27,"tag":28,"props":1265,"children":1266},{},[1267],{"type":32,"value":1268},"That distinction matters in fraud, commercial, and probate matters. The blockchain can establish that a token balance changed, but the investigator still must separate the transaction sender, token owner, authorized spender, recipient, and signature author before drawing conclusions about human intent.",{"type":27,"tag":40,"props":1270,"children":1272},{"id":1271},"why-is-a-token-transfer-different-from-a-native-asset-transfer",[1273],{"type":32,"value":1274},"Why is a token transfer different from a native-asset transfer?",{"type":27,"tag":28,"props":1276,"children":1277},{},[1278],{"type":32,"value":1279},"In an ordinary top-level transfer of a blockchain's native asset, such as ETH, the transaction sender signs a transaction containing its destination and value. Contract execution can produce additional native-asset movements, so even that record may require a trace. ERC-20 tokens add another layer because the token contract maintains the balances.",{"type":27,"tag":28,"props":1281,"children":1282},{},[1283,1285,1292,1294,1301,1303,1309,1311,1317],{"type":32,"value":1284},"The ",{"type":27,"tag":83,"props":1286,"children":1289},{"href":1287,"rel":1288},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-20",[87],[1290],{"type":32,"value":1291},"ERC-20 token standard",{"type":32,"value":1293}," defines two relevant transfer paths. A holder can call ",{"type":27,"tag":1295,"props":1296,"children":1298},"code",{"className":1297},[],[1299],{"type":32,"value":1300},"transfer(to, value)",{"type":32,"value":1302}," from the holder's own address. Alternatively, another address can call ",{"type":27,"tag":1295,"props":1304,"children":1306},{"className":1305},[],[1307],{"type":32,"value":1308},"transferFrom(from, to, value)",{"type":32,"value":1310}," after the token owner has authorized that spender. Both paths can produce the same ",{"type":27,"tag":1295,"props":1312,"children":1314},{"className":1313},[],[1315],{"type":32,"value":1316},"Transfer",{"type":32,"value":1318}," event showing tokens moving from the owner's balance to the recipient.",{"type":27,"tag":28,"props":1320,"children":1321},{},[1322,1324,1330],{"type":32,"value":1323},"A block explorer's token-transfer display therefore answers an accounting question: which token contract recorded a debit, a credit, and an amount? It does not, by itself, answer who signed the outer transaction or why the debit was authorized. For the foundational transaction fields, see ",{"type":27,"tag":83,"props":1325,"children":1327},{"href":1326},"\u002Fresources\u002Fhow-to-read-a-blockchain-transaction",[1328],{"type":32,"value":1329},"how to read a blockchain transaction",{"type":32,"value":1331},". The unique issue here is delegated token authority.",{"type":27,"tag":40,"props":1333,"children":1335},{"id":1334},"which-addresses-perform-the-relevant-roles",[1336],{"type":32,"value":1337},"Which addresses perform the relevant roles?",{"type":27,"tag":28,"props":1339,"children":1340},{},[1341],{"type":32,"value":1342},"A defensible analysis identifies each role separately rather than using \"sender\" for all of them:",{"type":27,"tag":57,"props":1344,"children":1345},{},[1346,1372,1389,1399,1416,1426],{"type":27,"tag":61,"props":1347,"children":1348},{},[1349,1354,1356,1362,1364,1370],{"type":27,"tag":65,"props":1350,"children":1351},{},[1352],{"type":32,"value":1353},"Token owner:",{"type":32,"value":1355}," The address whose token balance is debited. In a ",{"type":27,"tag":1295,"props":1357,"children":1359},{"className":1358},[],[1360],{"type":32,"value":1361},"transferFrom",{"type":32,"value":1363}," call, this is the ",{"type":27,"tag":1295,"props":1365,"children":1367},{"className":1366},[],[1368],{"type":32,"value":1369},"from",{"type":32,"value":1371}," argument.",{"type":27,"tag":61,"props":1373,"children":1374},{},[1375,1380,1382,1387],{"type":27,"tag":65,"props":1376,"children":1377},{},[1378],{"type":32,"value":1379},"Spender:",{"type":32,"value":1381}," The address whose allowance permits it to withdraw from the owner's balance. In a standard direct ",{"type":27,"tag":1295,"props":1383,"children":1385},{"className":1384},[],[1386],{"type":32,"value":1361},{"type":32,"value":1388}," call, this is the immediate caller seen by the token contract.",{"type":27,"tag":61,"props":1390,"children":1391},{},[1392,1397],{"type":27,"tag":65,"props":1393,"children":1394},{},[1395],{"type":32,"value":1396},"Transaction sender:",{"type":32,"value":1398}," The address recovered as the signer of the outer blockchain transaction. It may be the owner, the spender, or an address interacting with another contract.",{"type":27,"tag":61,"props":1400,"children":1401},{},[1402,1407,1409,1414],{"type":27,"tag":65,"props":1403,"children":1404},{},[1405],{"type":32,"value":1406},"Recipient:",{"type":32,"value":1408}," The address credited in the token contract's ",{"type":27,"tag":1295,"props":1410,"children":1412},{"className":1411},[],[1413],{"type":32,"value":1316},{"type":32,"value":1415}," event.",{"type":27,"tag":61,"props":1417,"children":1418},{},[1419,1424],{"type":27,"tag":65,"props":1420,"children":1421},{},[1422],{"type":32,"value":1423},"Token contract:",{"type":32,"value":1425}," The contract that enforces balances and allowances and emits the relevant events.",{"type":27,"tag":61,"props":1427,"children":1428},{},[1429,1434],{"type":27,"tag":65,"props":1430,"children":1431},{},[1432],{"type":32,"value":1433},"Signature author:",{"type":32,"value":1435}," For a permit, the address whose private key produced the authorization signature. A relayer can submit that signature on-chain later.",{"type":27,"tag":28,"props":1437,"children":1438},{},[1439,1441,1447,1449,1454],{"type":32,"value":1440},"These roles can collapse into fewer addresses. An owner may call ",{"type":27,"tag":1295,"props":1442,"children":1444},{"className":1443},[],[1445],{"type":32,"value":1446},"transfer",{"type":32,"value":1448}," directly. In a routed transaction, the owner may call an application contract, that contract may be the approved spender, and the token contract may debit the owner through ",{"type":27,"tag":1295,"props":1450,"children":1452},{"className":1451},[],[1453],{"type":32,"value":1361},{"type":32,"value":1455},". In a disputed delegated transfer, the owner's address may appear only as the debited account.",{"type":27,"tag":28,"props":1457,"children":1458},{},[1459,1461,1466],{"type":32,"value":1460},"The next question is attribution to a person. An address-level finding does not establish who controlled the address at the relevant time. That requires the separate analysis described in ",{"type":27,"tag":83,"props":1462,"children":1463},{"href":282},[1464],{"type":32,"value":1465},"understanding wallet ownership evidence",{"type":32,"value":287},{"type":27,"tag":40,"props":1468,"children":1470},{"id":1469},"how-does-an-erc-20-allowance-create-delegated-authority",[1471],{"type":32,"value":1472},"How does an ERC-20 allowance create delegated authority?",{"type":27,"tag":28,"props":1474,"children":1475},{},[1476,1478,1484,1486,1492,1494,1500],{"type":32,"value":1477},"Under ERC-20, ",{"type":27,"tag":1295,"props":1479,"children":1481},{"className":1480},[],[1482],{"type":32,"value":1483},"approve(spender, value)",{"type":32,"value":1485}," sets the amount that a spender may withdraw from the owner's account. Calling ",{"type":27,"tag":1295,"props":1487,"children":1489},{"className":1488},[],[1490],{"type":32,"value":1491},"approve",{"type":32,"value":1493}," again overwrites the existing allowance for that owner-spender pair. The standard's ",{"type":27,"tag":1295,"props":1495,"children":1497},{"className":1496},[],[1498],{"type":32,"value":1499},"allowance(owner, spender)",{"type":32,"value":1501}," function reports how much the spender is still allowed to withdraw.",{"type":27,"tag":28,"props":1503,"children":1504},{},[1505,1507,1513],{"type":32,"value":1506},"An approval for a specific amount bounds the spender's authority by that value, subject to prior uses and the token's implementation. An approval set to the maximum ",{"type":27,"tag":1295,"props":1508,"children":1510},{"className":1509},[],[1511],{"type":32,"value":1512},"uint256",{"type":32,"value":1514}," value is commonly treated as effectively unlimited because it may support repeated withdrawals. Standard ERC-20 approval data identifies a spender and amount, not the later recipient or business purpose.",{"type":27,"tag":28,"props":1516,"children":1517},{},[1518,1520,1526,1528,1533,1535,1540,1542,1547,1549,1554,1556,1561],{"type":32,"value":1519},"The events also have limits. ERC-20 requires an ",{"type":27,"tag":1295,"props":1521,"children":1523},{"className":1522},[],[1524],{"type":32,"value":1525},"Approval",{"type":32,"value":1527}," event after a successful ",{"type":27,"tag":1295,"props":1529,"children":1531},{"className":1530},[],[1532],{"type":32,"value":1491},{"type":32,"value":1534}," call and a ",{"type":27,"tag":1295,"props":1536,"children":1538},{"className":1537},[],[1539],{"type":32,"value":1316},{"type":32,"value":1541}," event when tokens move. It does not require an ",{"type":27,"tag":1295,"props":1543,"children":1545},{"className":1544},[],[1546],{"type":32,"value":1525},{"type":32,"value":1548}," event every time ",{"type":27,"tag":1295,"props":1550,"children":1552},{"className":1551},[],[1553],{"type":32,"value":1361},{"type":32,"value":1555}," consumes allowance. An investigator should not assume the latest visible ",{"type":27,"tag":1295,"props":1557,"children":1559},{"className":1558},[],[1560],{"type":32,"value":1525},{"type":32,"value":1562}," event equals the remaining allowance immediately before a disputed transfer.",{"type":27,"tag":40,"props":1564,"children":1566},{"id":1565},"how-should-counsel-reconstruct-the-approval-timeline",[1567],{"type":32,"value":1568},"How should counsel reconstruct the approval timeline?",{"type":27,"tag":28,"props":1570,"children":1571},{},[1572],{"type":32,"value":1573},"The key sequence is authority first, use second. A useful reconstruction proceeds as follows:",{"type":27,"tag":310,"props":1575,"children":1576},{},[1577,1587,1611,1621,1645,1662],{"type":27,"tag":61,"props":1578,"children":1579},{},[1580,1585],{"type":27,"tag":65,"props":1581,"children":1582},{},[1583],{"type":32,"value":1584},"Fix the chain, token contract, and block range.",{"type":32,"value":1586}," Record the contract address, chain identifier, transaction hashes, block numbers, and UTC timestamps. A ticker symbol is not enough.",{"type":27,"tag":61,"props":1588,"children":1589},{},[1590,1595,1597,1602,1604,1609],{"type":27,"tag":65,"props":1591,"children":1592},{},[1593],{"type":32,"value":1594},"Classify the movement.",{"type":32,"value":1596}," Decode the input and trace to determine whether the token received ",{"type":27,"tag":1295,"props":1598,"children":1600},{"className":1599},[],[1601],{"type":32,"value":1446},{"type":32,"value":1603},", ",{"type":27,"tag":1295,"props":1605,"children":1607},{"className":1606},[],[1608],{"type":32,"value":1361},{"type":32,"value":1610},", or an intermediary-contract call. Do not rely solely on an explorer's summary label.",{"type":27,"tag":61,"props":1612,"children":1613},{},[1614,1619],{"type":27,"tag":65,"props":1615,"children":1616},{},[1617],{"type":32,"value":1618},"Identify the immediate caller.",{"type":32,"value":1620}," The outer transaction sender and the contract that called the token may differ. The trace shows which address acted as spender at the token contract.",{"type":27,"tag":61,"props":1622,"children":1623},{},[1624,1629,1631,1636,1638,1643],{"type":27,"tag":65,"props":1625,"children":1626},{},[1627],{"type":32,"value":1628},"Locate the grant of authority.",{"type":32,"value":1630}," Search backward for relevant ",{"type":27,"tag":1295,"props":1632,"children":1634},{"className":1633},[],[1635],{"type":32,"value":1525},{"type":32,"value":1637}," events and transactions involving the same owner, spender, and token. Determine whether authority arose from ",{"type":27,"tag":1295,"props":1639,"children":1641},{"className":1640},[],[1642],{"type":32,"value":1491},{"type":32,"value":1644},", a permit, or a token-specific mechanism.",{"type":27,"tag":61,"props":1646,"children":1647},{},[1648,1653,1655,1660],{"type":27,"tag":65,"props":1649,"children":1650},{},[1651],{"type":32,"value":1652},"Calculate intervening use.",{"type":32,"value":1654}," Review prior ",{"type":27,"tag":1295,"props":1656,"children":1658},{"className":1657},[],[1659],{"type":32,"value":1361},{"type":32,"value":1661}," calls, replacements, revocations, and failed calls. Where available, query contract state immediately before execution.",{"type":27,"tag":61,"props":1663,"children":1664},{},[1665,1670],{"type":27,"tag":65,"props":1666,"children":1667},{},[1668],{"type":32,"value":1669},"Preserve the data.",{"type":32,"value":1671}," Retain input, receipts, logs, traces, relevant contract code, ABI, and retrieval method. A screenshot is an orientation aid, not the complete record.",{"type":27,"tag":28,"props":1673,"children":1674},{},[1675,1677,1683],{"type":32,"value":1676},"Proxy contracts and upgrades can change the relevant code over time. The correct question is what logic governed the token at the disputed block, not what a current block-explorer page displays today. Our ",{"type":27,"tag":83,"props":1678,"children":1680},{"href":1679},"\u002Fservices#evidence-review",[1681],{"type":32,"value":1682},"evidence review work",{"type":32,"value":1684}," treats decoded explorer labels as leads to verify against contract data, not as substitutes for it.",{"type":27,"tag":40,"props":1686,"children":1688},{"id":1687},"what-changes-when-authority-comes-from-a-permit-signature",[1689],{"type":32,"value":1690},"What changes when authority comes from a permit signature?",{"type":27,"tag":28,"props":1692,"children":1693},{},[1694,1701,1703,1709,1711,1716],{"type":27,"tag":83,"props":1695,"children":1698},{"href":1696,"rel":1697},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-2612",[87],[1699],{"type":32,"value":1700},"ERC-2612",{"type":32,"value":1702}," adds a ",{"type":27,"tag":1295,"props":1704,"children":1706},{"className":1705},[],[1707],{"type":32,"value":1708},"permit",{"type":32,"value":1710}," function that can set an ERC-20 allowance from a signed message. The signed fields include the owner, spender, value, nonce, and deadline. The token contract verifies the signature, updates the allowance, increments the owner's nonce, and emits an ",{"type":27,"tag":1295,"props":1712,"children":1714},{"className":1713},[],[1715],{"type":32,"value":1525},{"type":32,"value":1717}," event if the standard's conditions are satisfied.",{"type":27,"tag":28,"props":1719,"children":1720},{},[1721,1723,1728],{"type":32,"value":1722},"The permit caller can be any address. The owner can sign off-chain, while a relayer, application, spender, or unrelated address pays gas and submits the permit. The permit transaction sender is therefore not necessarily the signature author. The permit grants allowance; it does not prove that the owner submitted or separately approved a later ",{"type":27,"tag":1295,"props":1724,"children":1726},{"className":1725},[],[1727],{"type":32,"value":1361},{"type":32,"value":1729}," transaction.",{"type":27,"tag":28,"props":1731,"children":1732},{},[1733,1735,1742],{"type":32,"value":1734},"ERC-2612 uses ",{"type":27,"tag":83,"props":1736,"children":1739},{"href":1737,"rel":1738},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-712",[87],[1740],{"type":32,"value":1741},"EIP-712 typed structured-data signing",{"type":32,"value":1743},". Its domain can include a name, version, chain identifier, and verifying-contract address, helping distinguish similar messages intended for different applications or contracts. EIP-712 supplies the format and domain separation, but leaves replay protection to the application.",{"type":27,"tag":28,"props":1745,"children":1746},{},[1747],{"type":32,"value":1748},"ERC-2612 uses an owner nonce that must match and then increments, plus a deadline after which the permit must revert. The deadline can be set so far out that the authorization is effectively nonexpiring. Examine the domain, nonce, and deadline together. A signature image or shortened wallet prompt does not establish the complete signed data.",{"type":27,"tag":28,"props":1750,"children":1751},{},[1752,1754,1759],{"type":32,"value":1753},"Not every token with a function called ",{"type":27,"tag":1295,"props":1755,"children":1757},{"className":1756},[],[1758],{"type":32,"value":1708},{"type":32,"value":1760}," implements ERC-2612 exactly. The standard itself notes preexisting variants with different fields and semantics. The analyst must use the deployed contract's code and ABI at the relevant block rather than forcing every signed approval into the ERC-2612 template.",{"type":27,"tag":40,"props":1762,"children":1764},{"id":1763},"what-does-the-transfer-prove-and-what-remains-unresolved",[1765],{"type":32,"value":1766},"What does the transfer prove, and what remains unresolved?",{"type":27,"tag":28,"props":1768,"children":1769},{},[1770],{"type":32,"value":1771},"A verified on-chain record can establish that contract execution changed token balances and emitted specified logs. Decoded input and traces can identify the outer transaction sender, immediate callers, owner argument, recipient, amount, and method. A valid permit can establish that a signature associated with the owner address covered the exact typed fields under the contract's rules.",{"type":27,"tag":28,"props":1773,"children":1774},{},[1775],{"type":32,"value":1776},"Those facts do not prove that a particular human knowingly authorized the disputed transfer. They do not establish who possessed the key, what the wallet displayed, whether the signer understood the authority, or whether another person had device access. They also do not resolve consent, agency, capacity, mistake, breach of duty, or fraud. Those conclusions depend on governing law and evidence beyond the ledger.",{"type":27,"tag":153,"props":1778,"children":1780},{"id":1779},"hypothetical-example",[1781],{"type":32,"value":1782},"Hypothetical example",{"type":27,"tag":28,"props":1784,"children":1785},{},[1786,1788,1794],{"type":32,"value":1787},"Assume Wallet O holds 80,000 units of Token T. On January 4, O signs an ERC-2612 permit authorizing Contract S to spend up to 80,000 units, with a deadline six months later. Relayer R submits the permit and pays the gas. On February 12, Address A calls S, and S executes ",{"type":27,"tag":1295,"props":1789,"children":1791},{"className":1790},[],[1792],{"type":32,"value":1793},"transferFrom(O, B, 30,000)",{"type":32,"value":287},{"type":27,"tag":28,"props":1796,"children":1797},{},[1798],{"type":32,"value":1799},"The February transfer shows Token T debited O and credited B during execution initiated by A. The trace may show S as the spender, while the January permit identifies R as its submitter. Neither transaction proves that the human associated with O selected B or understood that the signature let S choose a later recipient. The investigation should recover the typed message, identify who controlled O and A, inspect S's code and call parameters, and seek device and communications evidence.",{"type":27,"tag":40,"props":1801,"children":1803},{"id":1802},"what-evidence-should-counsel-request-beyond-the-chain",[1804],{"type":32,"value":1805},"What evidence should counsel request beyond the chain?",{"type":27,"tag":28,"props":1807,"children":1808},{},[1809],{"type":32,"value":1810},"Discovery should target the authorization event as closely as the transfer event. Useful requests and examination questions include:",{"type":27,"tag":57,"props":1812,"children":1813},{},[1814,1819,1824,1829,1834,1839,1844,1849],{"type":27,"tag":61,"props":1815,"children":1816},{},[1817],{"type":32,"value":1818},"The wallet application, browser extension, hardware wallet, or custodial interface used when the approval or permit was created.",{"type":27,"tag":61,"props":1820,"children":1821},{},[1822],{"type":32,"value":1823},"Wallet records, device logs, browser history, notifications, and prompts showing what the user was presented.",{"type":27,"tag":61,"props":1825,"children":1826},{},[1827],{"type":32,"value":1828},"The exact EIP-712 typed-data payload, signature, domain fields, nonce, deadline, and originating website or application.",{"type":27,"tag":61,"props":1830,"children":1831},{},[1832],{"type":32,"value":1833},"Communications concerning the spender, transaction purpose, expected amount, intended recipient, and any claimed revocation.",{"type":27,"tag":61,"props":1835,"children":1836},{},[1837],{"type":32,"value":1838},"Evidence of remote access, malicious extensions, credential compromise, or shared key material.",{"type":27,"tag":61,"props":1840,"children":1841},{},[1842],{"type":32,"value":1843},"Exchange, custodian, or account records connecting the relevant addresses to identified persons.",{"type":27,"tag":61,"props":1845,"children":1846},{},[1847],{"type":32,"value":1848},"Source code, deployment records, upgrade history, and administrative controls for the token and spender contracts.",{"type":27,"tag":61,"props":1850,"children":1851},{},[1852],{"type":32,"value":1853},"Testimony explaining why the approval amount was chosen and whether the signer understood that approval and transfer were separate acts.",{"type":27,"tag":28,"props":1855,"children":1856},{},[1857,1859,1864],{"type":32,"value":1858},"Preserve timestamps, time zones, file metadata, and acquisition methods. Wallet prompts and local artifacts may disappear even though the on-chain record remains. The ",{"type":27,"tag":83,"props":1860,"children":1861},{"href":627},[1862],{"type":32,"value":1863},"ConsensusIntel methodology",{"type":32,"value":1865}," explains how technical findings are separated from attribution opinions and legal conclusions.",{"type":27,"tag":40,"props":1867,"children":1869},{"id":1868},"how-should-an-expert-describe-the-result",[1870],{"type":32,"value":1871},"How should an expert describe the result?",{"type":27,"tag":28,"props":1873,"children":1874},{},[1875],{"type":32,"value":1876},"Avoid language such as \"the owner sent the tokens\" unless the evidence actually establishes that proposition. A more precise formulation is:",{"type":27,"tag":1878,"props":1879,"children":1880},"blockquote",{},[1881],{"type":27,"tag":28,"props":1882,"children":1883},{},[1884,1886,1891,1893,1898],{"type":32,"value":1885},"Transaction X was signed by Address A. Its execution caused Token Contract T to emit a ",{"type":27,"tag":1295,"props":1887,"children":1889},{"className":1888},[],[1890],{"type":32,"value":1316},{"type":32,"value":1892}," event debiting Owner Address O and crediting Recipient Address B. The execution trace shows Spender Contract S called ",{"type":27,"tag":1295,"props":1894,"children":1896},{"className":1895},[],[1897],{"type":32,"value":1361},{"type":32,"value":1899},". An earlier approval authorized S to spend up to V units from O. The on-chain evidence does not, without additional attribution evidence, establish who controlled A or O, what a human signer understood, or whether O intended this specific transfer.",{"type":27,"tag":28,"props":1901,"children":1902},{},[1903,1905,1911],{"type":32,"value":1904},"If a permit is involved, the report should separately state whether the signature validated for the owner address, the exact fields covered, who submitted the permit transaction, and which later call exercised the allowance. This phrasing preserves strong technical conclusions while avoiding one of the ",{"type":27,"tag":83,"props":1906,"children":1908},{"href":1907},"\u002Fresources\u002Fcommon-mistakes-crypto-investigations",[1909],{"type":32,"value":1910},"common mistakes in cryptocurrency investigations",{"type":32,"value":1912},": treating address activity as self-proving evidence of a person's identity or intent.",{"type":27,"tag":40,"props":1914,"children":1915},{"id":635},[1916],{"type":32,"value":638},{"type":27,"tag":153,"props":1918,"children":1920},{"id":1919},"q-does-a-transfer-event-prove-the-token-owner-sent-the-transaction",[1921],{"type":32,"value":1922},"Q: Does a Transfer event prove the token owner sent the transaction?",{"type":27,"tag":28,"props":1924,"children":1925},{},[1926,1930,1932,1937,1939,1944],{"type":27,"tag":65,"props":1927,"children":1928},{},[1929],{"type":32,"value":652},{"type":32,"value":1931}," No. A ",{"type":27,"tag":1295,"props":1933,"children":1935},{"className":1934},[],[1936],{"type":32,"value":1316},{"type":32,"value":1938}," event proves that the token contract recorded a movement from one address to another. If the movement resulted from ",{"type":27,"tag":1295,"props":1940,"children":1942},{"className":1941},[],[1943],{"type":32,"value":1361},{"type":32,"value":1945},", an approved spender may have initiated it. The transaction input and execution trace are needed to identify the actual call path.",{"type":27,"tag":153,"props":1947,"children":1949},{"id":1948},"q-does-signing-a-permit-authorize-one-specific-transfer",[1950],{"type":32,"value":1951},"Q: Does signing a permit authorize one specific transfer?",{"type":27,"tag":28,"props":1953,"children":1954},{},[1955,1959],{"type":27,"tag":65,"props":1956,"children":1957},{},[1958],{"type":32,"value":652},{"type":32,"value":1960}," Not necessarily. A standard ERC-2612 permit authorizes a named spender up to a stated value, subject to a nonce and deadline. It does not name the eventual transfer recipient. The spender may use the resulting allowance in one or more later transactions within the authorization's bounds.",{"type":27,"tag":153,"props":1962,"children":1964},{"id":1963},"q-can-a-relayer-submit-a-permit-without-owning-the-tokens",[1965],{"type":32,"value":1966},"Q: Can a relayer submit a permit without owning the tokens?",{"type":27,"tag":28,"props":1968,"children":1969},{},[1970,1974],{"type":27,"tag":65,"props":1971,"children":1972},{},[1973],{"type":32,"value":652},{"type":32,"value":1975}," Yes. ERC-2612 does not tie the permit caller to the owner. Any address can submit a valid signed permit, while the token contract verifies that the signature corresponds to the owner and that the nonce and deadline conditions are satisfied.",{"type":27,"tag":153,"props":1977,"children":1979},{"id":1978},"q-what-is-the-most-important-evidence-outside-the-blockchain",[1980],{"type":32,"value":1981},"Q: What is the most important evidence outside the blockchain?",{"type":27,"tag":28,"props":1983,"children":1984},{},[1985,1989],{"type":27,"tag":65,"props":1986,"children":1987},{},[1988],{"type":32,"value":652},{"type":32,"value":1990}," The most useful evidence often includes the exact signed payload, wallet or device artifacts showing the signing context, records identifying who controlled each address, and communications about the spender and transaction purpose. Those materials address identity, knowledge, and intent that the ledger does not record.",{"type":27,"tag":28,"props":1992,"children":1993},{},[1994,1996,2000],{"type":32,"value":1995},"If a disputed token transfer turns on delegated authority, ",{"type":27,"tag":83,"props":1997,"children":1998},{"href":713},[1999],{"type":32,"value":1219},{"type":32,"value":2001}," to discuss the approval timeline, permit evidence, and limits of the available attribution.",{"title":8,"searchDepth":720,"depth":720,"links":2003},[2004,2005,2006,2007,2008,2009,2012,2013,2014],{"id":1271,"depth":720,"text":1274},{"id":1334,"depth":720,"text":1337},{"id":1469,"depth":720,"text":1472},{"id":1565,"depth":720,"text":1568},{"id":1687,"depth":720,"text":1690},{"id":1763,"depth":720,"text":1766,"children":2010},[2011],{"id":1779,"depth":726,"text":1782},{"id":1802,"depth":720,"text":1805},{"id":1868,"depth":720,"text":1871},{"id":635,"depth":720,"text":638,"children":2015},[2016,2017,2018,2019],{"id":1919,"depth":726,"text":1922},{"id":1948,"depth":726,"text":1951},{"id":1963,"depth":726,"text":1966},{"id":1978,"depth":726,"text":1981},"content:articles:26-token-approvals-permit-signatures.md","articles\u002F26-token-approvals-permit-signatures.md","articles\u002F26-token-approvals-permit-signatures",{"_path":2024,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":2025,"description":2026,"slug":2027,"date":2028,"lastUpdated":2028,"author":13,"readingTime":2029,"category":757,"tags":2030,"ogImage":2033,"featured":7,"body":2034,"_type":744,"_id":2572,"_source":746,"_file":2573,"_stem":2574,"_extension":749},"\u002Farticles\u002F25-crypto-perpetual-futures-evidence","Evidence in crypto perpetual futures disputes","A practical evidence map for crypto perpetual disputes, separating blockchain records from venue data on orders, margin, funding, prices, and liquidations.","crypto-perpetual-futures-evidence","2026-05-30",11,[2031,2032,20,21],"crypto-derivatives","perpetual-futures","\u002Fog\u002Fcrypto-perpetual-futures-evidence.png",{"type":24,"children":2035,"toc":2547},[2036,2041,2046,2052,2083,2097,2102,2108,2119,2124,2129,2135,2141,2146,2174,2179,2227,2241,2247,2252,2266,2287,2293,2298,2303,2308,2314,2319,2325,2330,2336,2341,2347,2352,2358,2363,2369,2374,2379,2385,2390,2395,2401,2451,2456,2462,2467,2472,2476,2482,2491,2497,2506,2512,2521,2527,2536],{"type":27,"tag":28,"props":2037,"children":2038},{},[2039],{"type":32,"value":2040},"A crypto perpetual contract is a derivative that tracks a referenced asset without a conventional expiration date. The referenced bitcoin, ether, or other token may exist on a blockchain, but that does not determine where evidence of the derivative position lives. On a centralized venue, the order, leverage, margin balance, funding entries, mark price, and liquidation decision are usually recorded in the venue's systems. On an on-chain perpetual protocol, more of that evidence may appear in contract state and transaction logs, although oracle inputs, user interfaces, keepers, and communications can still create important off-chain evidence.",{"type":27,"tag":28,"props":2042,"children":2043},{},[2044],{"type":32,"value":2045},"That architecture distinction should be made before counsel promises that a transaction hash or wallet trace can reconstruct the disputed trade. The useful question is not whether perpetual futures are \"on-chain\" in the abstract. It is which system created, priced, modified, and closed the specific position.",{"type":27,"tag":40,"props":2047,"children":2049},{"id":2048},"why-did-perpetual-contract-evidence-become-more-important-in-2026",[2050],{"type":32,"value":2051},"Why did perpetual-contract evidence become more important in 2026?",{"type":27,"tag":28,"props":2053,"children":2054},{},[2055,2057,2064,2066,2073,2075,2081],{"type":32,"value":2056},"On May 29, 2026, the Commodity Futures Trading Commission approved KalshiEX's BTCPERP contract for listing as a futures contract and released a ",{"type":27,"tag":83,"props":2058,"children":2061},{"href":2059,"rel":2060},"https:\u002F\u002Fwww.cftc.gov\u002Fmedia\u002F14066\u002FPerpetualContractsPolicyStatement052926\u002Fdownload",[87],[2062],{"type":32,"value":2063},"policy statement concerning the listing of perpetual contracts",{"type":32,"value":2065},". The accompanying ",{"type":27,"tag":83,"props":2067,"children":2070},{"href":2068,"rel":2069},"https:\u002F\u002Fwww.cftc.gov\u002FPressRoom\u002FPressReleases\u002F9240-26",[87],[2071],{"type":32,"value":2072},"CFTC announcement",{"type":32,"value":2074}," described BTCPERP as a perpetual contract that references the spot price of bitcoin. The ",{"type":27,"tag":83,"props":2076,"children":2078},{"href":2059,"rel":2077},[87],[2079],{"type":32,"value":2080},"policy statement",{"type":32,"value":2082}," issued the same day describes perpetual contracts as having no fixed expiration date. The policy statement is agency guidance, not a generally applicable final rule, and the approval concerned a particular contract submitted by a designated contract market.",{"type":27,"tag":28,"props":2084,"children":2085},{},[2086,2088,2095],{"type":32,"value":2087},"The same-day package also included a staff action. On May 29, 2026, CFTC staff stated that certain crypto-asset perpetual contracts described in a staff letter could be categorized as foreign futures under Commission Regulation 30.1 and issued related no-action relief concerning transfers of customer crypto assets by futures commission merchants to foreign brokers as margin. That ",{"type":27,"tag":83,"props":2089,"children":2092},{"href":2090,"rel":2091},"https:\u002F\u002Fwww.cftc.gov\u002FPressRoom\u002FPressReleases\u002F9241-26",[87],[2093],{"type":32,"value":2094},"staff action",{"type":32,"value":2096},", Staff Letter No. 26-17, responded to Coinbase Financial Markets, Inc. and expressly cites the May 29, 2026 order approving the KalshiEX BTCPERP contract. It is staff-level relief, not a Commission rule.",{"type":27,"tag":28,"props":2098,"children":2099},{},[2100],{"type":32,"value":2101},"These actions matter operationally because a regulated contract can reference an on-chain asset without creating an on-chain record of each customer's position. Product regulation, custody architecture, and evidence location are separate questions.",{"type":27,"tag":40,"props":2103,"children":2105},{"id":2104},"what-is-the-difference-between-spot-ownership-and-a-perpetual-position",[2106],{"type":32,"value":2107},"What is the difference between spot ownership and a perpetual position?",{"type":27,"tag":28,"props":2109,"children":2110},{},[2111,2113,2117],{"type":32,"value":2112},"A spot transaction changes ownership or control of an asset. If a customer withdraws bitcoin from a venue to a self-custody address, the blockchain can record the transfer, including the transaction identifier, addresses, amount, fee, and block time. Counsel can use the process described in ",{"type":27,"tag":83,"props":2114,"children":2115},{"href":1326},[2116],{"type":32,"value":1329},{"type":32,"value":2118}," to verify what the public ledger actually shows.",{"type":27,"tag":28,"props":2120,"children":2121},{},[2122],{"type":32,"value":2123},"A perpetual position is a contractual exposure to price movement. It can be cash-settled and can remain open through recurring funding or similar economic adjustments. A trader may post stablecoins or another asset as collateral without receiving or delivering the quantity of bitcoin represented by the position. Consequently, a five-bitcoin long position does not necessarily produce an on-chain transfer of five bitcoin.",{"type":27,"tag":28,"props":2125,"children":2126},{},[2127],{"type":32,"value":2128},"The distinction is especially important when the venue uses omnibus custody. A deposit may move on-chain into an address controlled by the venue, after which customer balances and trades are recorded on an internal ledger. Later withdrawals may be paid from a different venue-controlled wallet. The blockchain can establish movement into and out of the custody perimeter, but it ordinarily cannot allocate the venue's pooled assets among individual derivatives accounts without venue records.",{"type":27,"tag":40,"props":2130,"children":2132},{"id":2131},"where-does-the-evidence-live",[2133],{"type":32,"value":2134},"Where does the evidence live?",{"type":27,"tag":153,"props":2136,"children":2138},{"id":2137},"centralized-derivatives-venues",[2139],{"type":32,"value":2140},"Centralized derivatives venues",{"type":27,"tag":28,"props":2142,"children":2143},{},[2144],{"type":32,"value":2145},"For a centralized venue, the public blockchain may show:",{"type":27,"tag":57,"props":2147,"children":2148},{},[2149,2154,2159,2164,2169],{"type":27,"tag":61,"props":2150,"children":2151},{},[2152],{"type":32,"value":2153},"deposits to addresses assigned or attributed to the venue;",{"type":27,"tag":61,"props":2155,"children":2156},{},[2157],{"type":32,"value":2158},"withdrawals from venue-controlled wallets;",{"type":27,"tag":61,"props":2160,"children":2161},{},[2162],{"type":32,"value":2163},"movements among hot, warm, and cold wallets;",{"type":27,"tag":61,"props":2165,"children":2166},{},[2167],{"type":32,"value":2168},"transfers to custodians or settlement counterparties, if identifiable; and",{"type":27,"tag":61,"props":2170,"children":2171},{},[2172],{"type":32,"value":2173},"network timestamps and transaction status.",{"type":27,"tag":28,"props":2175,"children":2176},{},[2177],{"type":32,"value":2178},"The venue's internal systems may hold the evidence that resolves the actual trading dispute:",{"type":27,"tag":57,"props":2180,"children":2181},{},[2182,2187,2192,2197,2202,2207,2212,2217,2222],{"type":27,"tag":61,"props":2183,"children":2184},{},[2185],{"type":32,"value":2186},"account, portfolio, and subaccount identifiers;",{"type":27,"tag":61,"props":2188,"children":2189},{},[2190],{"type":32,"value":2191},"order submissions, amendments, cancellations, rejections, and time-in-force instructions;",{"type":27,"tag":61,"props":2193,"children":2194},{},[2195],{"type":32,"value":2196},"matching-engine acknowledgments and fill records;",{"type":27,"tag":61,"props":2198,"children":2199},{},[2200],{"type":32,"value":2201},"position snapshots, average entry price, size, direction, and realized profit or loss;",{"type":27,"tag":61,"props":2203,"children":2204},{},[2205],{"type":32,"value":2206},"collateral balances, transfers, haircuts, leverage settings, and margin requirements;",{"type":27,"tag":61,"props":2208,"children":2209},{},[2210],{"type":32,"value":2211},"index prices, mark prices, funding rates, funding debits or credits, and fee entries;",{"type":27,"tag":61,"props":2213,"children":2214},{},[2215],{"type":32,"value":2216},"liquidation warnings, margin calculations, liquidation orders, partial-close activity, and insurance-fund or auto-deleveraging records;",{"type":27,"tag":61,"props":2218,"children":2219},{},[2220],{"type":32,"value":2221},"API keys, authentication events, request identifiers, IP logs, device records, and user-interface activity where retained; and",{"type":27,"tag":61,"props":2223,"children":2224},{},[2225],{"type":32,"value":2226},"customer support messages, incident records, and status-page communications.",{"type":27,"tag":28,"props":2228,"children":2229},{},[2230,2232,2239],{"type":32,"value":2231},"Official venue materials illustrate why counsel should request native records instead of substituting a public price chart. Kraken's derivatives materials publish contract-specific terms and a historical endpoint for ",{"type":27,"tag":83,"props":2233,"children":2236},{"href":2234,"rel":2235},"https:\u002F\u002Fdocs.kraken.com\u002Fapi-reference\u002Fmarket-history\u002Fget-public-mark-price-events",[87],[2237],{"type":32,"value":2238},"public mark-price events",{"type":32,"value":2240},". Those public materials can help interpret produced records, but they are not a substitute for the customer's private order, fill, collateral, and position history.",{"type":27,"tag":153,"props":2242,"children":2244},{"id":2243},"on-chain-perpetual-protocols",[2245],{"type":32,"value":2246},"On-chain perpetual protocols",{"type":27,"tag":28,"props":2248,"children":2249},{},[2250],{"type":32,"value":2251},"On-chain protocols require a different map. A transaction may create an order request, add collateral, change position size, cancel an instruction, or trigger execution through a smart contract. Contract events and state can therefore provide direct evidence of some position activity. The wallet signature and transaction path may also establish which address authorized the request, subject to the separate question of who controlled that address.",{"type":27,"tag":28,"props":2253,"children":2254},{},[2255,2257,2264],{"type":32,"value":2256},"Even then, \"on-chain\" does not mean that every relevant fact is self-explanatory or confined to one transaction. GMX's official documentation, for example, describes oracle-based pricing, on-chain order types, and keeper execution, with separate rules for mark price, triggering, acceptable price, funding, and fees. Its ",{"type":27,"tag":83,"props":2258,"children":2261},{"href":2259,"rel":2260},"https:\u002F\u002Fdocs.gmx.io\u002Fdocs\u002Ftrading\u002Forder-types\u002F",[87],[2262],{"type":32,"value":2263},"positions and order-types documentation",{"type":32,"value":2265}," shows why counsel may need contract events, oracle observations, keeper transactions, protocol configuration, and the version of the interface used at the disputed time.",{"type":27,"tag":28,"props":2267,"children":2268},{},[2269,2271,2277,2279,2285],{"type":32,"value":2270},"For background on how decentralized protocols differ from centralized intermediaries, see ",{"type":27,"tag":83,"props":2272,"children":2274},{"href":2273},"\u002Fresources\u002Fwhat-lawyers-need-to-know-about-defi",[2275],{"type":32,"value":2276},"what lawyers need to know about DeFi",{"type":32,"value":2278},". A ",{"type":27,"tag":83,"props":2280,"children":2282},{"href":2281},"\u002Fservices#smart-contract",[2283],{"type":32,"value":2284},"smart-contract evidence review",{"type":32,"value":2286}," should identify both the on-chain execution path and any off-chain component that supplied prices, routed requests, or displayed terms to the user.",{"type":27,"tag":40,"props":2288,"children":2290},{"id":2289},"why-does-a-transaction-hash-fail-to-prove-the-position-history",[2291],{"type":32,"value":2292},"Why does a transaction hash fail to prove the position history?",{"type":27,"tag":28,"props":2294,"children":2295},{},[2296],{"type":32,"value":2297},"A transaction hash proves the contents and status of a particular blockchain transaction. It does not, by itself, prove why the transfer occurred, which derivatives subaccount received internal credit, what orders were entered afterward, or how the venue calculated margin.",{"type":27,"tag":28,"props":2299,"children":2300},{},[2301],{"type":32,"value":2302},"A deposit address has the same limitation. It can connect a transfer to a venue's custody environment, but it may not identify the final account or portfolio if the venue uses address reuse, memo fields, sweep transactions, or pooled wallets. Account attribution requires the venue's mapping records or other corroboration.",{"type":27,"tag":28,"props":2304,"children":2305},{},[2306],{"type":32,"value":2307},"Proof-of-reserves materials answer a different question. Even a technically sound snapshot of venue-controlled assets does not establish an individual customer's historical order sequence, mark price, funding ledger, or liquidation calculation. It should not be used as a proxy for account-level trading records.",{"type":27,"tag":40,"props":2309,"children":2311},{"id":2310},"what-records-are-needed-to-reconstruct-a-disputed-liquidation",[2312],{"type":32,"value":2313},"What records are needed to reconstruct a disputed liquidation?",{"type":27,"tag":28,"props":2315,"children":2316},{},[2317],{"type":32,"value":2318},"Counsel should request records by function, not merely ask for a \"complete account history.\" The production should include field definitions, schema documentation, and the contract specifications effective during the relevant period.",{"type":27,"tag":153,"props":2320,"children":2322},{"id":2321},"order-and-execution-records",[2323],{"type":32,"value":2324},"Order and execution records",{"type":27,"tag":28,"props":2326,"children":2327},{},[2328],{"type":32,"value":2329},"Request every order event with the venue's unique order identifier, client-supplied identifier, account and subaccount, instrument, side, order type, quantity, price, trigger condition, time in force, reduce-only flag, creation time, receipt time, matching time, status, rejection reason, amendments, cancellations, and fills. For API trading, request the authenticated request logs and response codes tied to those identifiers.",{"type":27,"tag":153,"props":2331,"children":2333},{"id":2332},"position-collateral-and-liquidation-records",[2334],{"type":32,"value":2335},"Position, collateral, and liquidation records",{"type":27,"tag":28,"props":2337,"children":2338},{},[2339],{"type":32,"value":2340},"Request position snapshots before and after each disputed event, together with collateral balances, collateral valuation, maintenance-margin requirements, risk tier, leverage, unrealized profit or loss, available margin, and liquidation threshold. The liquidation record should identify the trigger time, mark price, index price, position quantity selected for closure, execution price, liquidation fee, remaining collateral, and whether the venue used partial liquidation, an insurance fund, or auto-deleveraging.",{"type":27,"tag":153,"props":2342,"children":2344},{"id":2343},"pricing-and-funding-records",[2345],{"type":32,"value":2346},"Pricing and funding records",{"type":27,"tag":28,"props":2348,"children":2349},{},[2350],{"type":32,"value":2351},"Request the mark-price series actually consumed by the risk engine, not only a public candlestick chart. Obtain the index constituents, weights, excluded sources, stale-price rules, update frequency, smoothing or basis adjustments, and fallback method. Funding evidence should include the rate, calculation interval, position size used, debit or credit, ledger posting time, and any cap or floor in effect.",{"type":27,"tag":153,"props":2353,"children":2355},{"id":2354},"versioned-rules-and-systems-evidence",[2356],{"type":32,"value":2357},"Versioned rules and systems evidence",{"type":27,"tag":28,"props":2359,"children":2360},{},[2361],{"type":32,"value":2362},"Contract specifications change. Preserve every version of the trading rules, fee schedule, margin table, liquidation methodology, API documentation, and user agreement that was effective during the disputed period. Also seek deployment records or configuration histories showing when a change became active, rather than relying only on the date printed on a document.",{"type":27,"tag":40,"props":2364,"children":2366},{"id":2365},"how-should-timestamps-be-tested",[2367],{"type":32,"value":2368},"How should timestamps be tested?",{"type":27,"tag":28,"props":2370,"children":2371},{},[2372],{"type":32,"value":2373},"A liquidation timeline may combine blockchain time, API gateway time, matching-engine time, risk-engine time, database time, oracle time, and a customer's local device time. These timestamps can differ in precision and purpose. A block timestamp is not proof of when a centralized matching engine first received an order, and a user-interface screenshot may reflect browser time or delayed market data.",{"type":27,"tag":28,"props":2375,"children":2376},{},[2377],{"type":32,"value":2378},"Discovery should ask what each timestamp means, whether it is recorded in UTC, its precision, the system that generated it, the clock-synchronization method, and any known drift or incident. Preserve original values before converting them for a demonstrative. An expert timeline should distinguish submission, receipt, validation, matching, persistence, risk evaluation, and blockchain confirmation rather than collapsing them into one event.",{"type":27,"tag":40,"props":2380,"children":2382},{"id":2381},"worked-hypothetical-what-can-the-blockchain-establish",[2383],{"type":32,"value":2384},"Worked hypothetical: what can the blockchain establish?",{"type":27,"tag":28,"props":2386,"children":2387},{},[2388],{"type":32,"value":2389},"Hypothetical example: A customer sends 100,000 USDC to a centralized derivatives venue and later disputes the liquidation of a bitcoin perpetual long. The blockchain transaction establishes that 100,000 USDC reached the destination address at a particular network time. It does not establish when the venue credited the derivatives portfolio, whether the customer moved collateral to a subaccount, the order instructions, the filled quantity, or the leverage and margin settings.",{"type":27,"tag":28,"props":2391,"children":2392},{},[2393],{"type":32,"value":2394},"The customer points to a public spot chart showing a low of $58,200. The venue says its risk engine liquidated at a $57,800 mark price. The decisive evidence is not the original USDC deposit. It is the applicable mark-price formula, the underlying index observations, the risk-engine inputs, the position and collateral snapshot, the maintenance-margin rule, the liquidation event log, and the execution records. If the position had instead been opened through an on-chain protocol, counsel would begin with the relevant wallet transactions and contract events, then test the oracle, keeper, configuration, and front-end evidence required to interpret them.",{"type":27,"tag":40,"props":2396,"children":2398},{"id":2397},"what-should-counsel-preserve-and-request-first",[2399],{"type":32,"value":2400},"What should counsel preserve and request first?",{"type":27,"tag":310,"props":2402,"children":2403},{},[2404,2409,2414,2419,2424,2435,2440],{"type":27,"tag":61,"props":2405,"children":2406},{},[2407],{"type":32,"value":2408},"Identify the exact legal entity, venue, product symbol, account, portfolio, subaccount, wallet, and relevant date range.",{"type":27,"tag":61,"props":2410,"children":2411},{},[2412],{"type":32,"value":2413},"Send preservation demands covering order, fill, position, collateral, pricing, funding, liquidation, API, authentication, support, and incident records, including superseded specifications.",{"type":27,"tag":61,"props":2415,"children":2416},{},[2417],{"type":32,"value":2418},"Request native CSV, JSON, database extracts, or API output with data dictionaries, not only PDFs or screenshots.",{"type":27,"tag":61,"props":2420,"children":2421},{},[2422],{"type":32,"value":2423},"Preserve the customer's devices, API-client logs, trading-bot configuration, emails, screenshots, and exported account statements.",{"type":27,"tag":61,"props":2425,"children":2426},{},[2427,2429,2433],{"type":32,"value":2428},"Map deposits and withdrawals separately through ",{"type":27,"tag":83,"props":2430,"children":2431},{"href":611},[2432],{"type":32,"value":1011},{"type":32,"value":2434},", without treating those transfers as the position ledger.",{"type":27,"tag":61,"props":2436,"children":2437},{},[2438],{"type":32,"value":2439},"Reconcile identifiers across sources, including transaction hashes, transfer IDs, order IDs, fill IDs, ledger-entry IDs, and liquidation IDs.",{"type":27,"tag":61,"props":2441,"children":2442},{},[2443,2445,2450],{"type":32,"value":2444},"Ask the expert to document assumptions, missing fields, timezone conversions, calculation logic, and reproducible queries under a stated ",{"type":27,"tag":83,"props":2446,"children":2447},{"href":627},[2448],{"type":32,"value":2449},"forensic methodology",{"type":32,"value":287},{"type":27,"tag":28,"props":2452,"children":2453},{},[2454],{"type":32,"value":2455},"Useful deposition and discovery questions include: Which system was authoritative for margin? Was the displayed mark price the value used by the liquidation engine? Can each ledger entry be tied to an immutable event identifier? Were records rebuilt after an outage? Which rule version applied? Did manual intervention occur? What data was dropped, aggregated, or rounded during export? Those questions often reveal whether the produced account statement is a complete event history or only a reporting view.",{"type":27,"tag":40,"props":2457,"children":2459},{"id":2458},"what-are-the-limits-of-the-reconstruction",[2460],{"type":32,"value":2461},"What are the limits of the reconstruction?",{"type":27,"tag":28,"props":2463,"children":2464},{},[2465],{"type":32,"value":2466},"Record availability varies by venue, jurisdiction, product, and retention policy. A public blockchain cannot compel production of internal data, while a venue production may omit schema, historical configurations, or the raw observations needed to reproduce a calculation. Foreign entities and decentralized contributor structures can complicate service and discovery.",{"type":27,"tag":28,"props":2468,"children":2469},{},[2470],{"type":32,"value":2471},"Technical reconstruction also does not decide contract interpretation, regulatory status, causation, or damages. Those are legal and expert-scope questions. The defensible approach is to identify what each source proves, state what remains inferential, and avoid forcing centralized and on-chain architectures into the same evidentiary model.",{"type":27,"tag":40,"props":2473,"children":2474},{"id":635},[2475],{"type":32,"value":638},{"type":27,"tag":153,"props":2477,"children":2479},{"id":2478},"q-can-blockchain-tracing-reconstruct-a-centralized-perpetual-futures-position",[2480],{"type":32,"value":2481},"Q: Can blockchain tracing reconstruct a centralized perpetual-futures position?",{"type":27,"tag":28,"props":2483,"children":2484},{},[2485,2489],{"type":27,"tag":65,"props":2486,"children":2487},{},[2488],{"type":32,"value":652},{"type":32,"value":2490}," Usually not by itself. Tracing can document deposits, withdrawals, and identifiable custody movements, but the position, orders, fills, margin, funding, and liquidation calculations generally require venue-maintained records.",{"type":27,"tag":153,"props":2492,"children":2494},{"id":2493},"q-are-all-crypto-perpetual-contracts-off-chain",[2495],{"type":32,"value":2496},"Q: Are all crypto perpetual contracts off-chain?",{"type":27,"tag":28,"props":2498,"children":2499},{},[2500,2504],{"type":27,"tag":65,"props":2501,"children":2502},{},[2503],{"type":32,"value":652},{"type":32,"value":2505}," No. Centralized venues commonly maintain customer positions on internal systems, while on-chain protocols may record orders, position changes, collateral, and execution events in smart contracts. The evidence plan must follow the specific protocol or venue architecture.",{"type":27,"tag":153,"props":2507,"children":2509},{"id":2508},"q-what-is-the-most-important-record-in-a-liquidation-dispute",[2510],{"type":32,"value":2511},"Q: What is the most important record in a liquidation dispute?",{"type":27,"tag":28,"props":2513,"children":2514},{},[2515,2519],{"type":27,"tag":65,"props":2516,"children":2517},{},[2518],{"type":32,"value":652},{"type":32,"value":2520}," There is no single universal record. Counsel usually needs the position and collateral snapshot, the mark and index data consumed by the risk engine, the applicable margin and liquidation rules, and the resulting liquidation and execution events.",{"type":27,"tag":153,"props":2522,"children":2524},{"id":2523},"q-does-a-public-spot-price-chart-disprove-a-venues-liquidation-price",[2525],{"type":32,"value":2526},"Q: Does a public spot-price chart disprove a venue's liquidation price?",{"type":27,"tag":28,"props":2528,"children":2529},{},[2530,2534],{"type":27,"tag":65,"props":2531,"children":2532},{},[2533],{"type":32,"value":652},{"type":32,"value":2535}," Not necessarily. A venue may use a defined mark price derived from an index, basis adjustment, oracle spread, or other methodology rather than the last spot trade. The relevant comparison is between the venue's effective contract rules and the price inputs actually used at the liquidation time.",{"type":27,"tag":28,"props":2537,"children":2538},{},[2539,2541,2545],{"type":32,"value":2540},"A focused review can determine which evidence is public, which must be obtained from the venue or protocol participants, and which conclusions remain unsupported. ",{"type":27,"tag":83,"props":2542,"children":2543},{"href":713},[2544],{"type":32,"value":716},{"type":32,"value":2546}," to discuss the evidence architecture and expert scope for a specific dispute.",{"title":8,"searchDepth":720,"depth":720,"links":2548},[2549,2550,2551,2555,2556,2562,2563,2564,2565,2566],{"id":2048,"depth":720,"text":2051},{"id":2104,"depth":720,"text":2107},{"id":2131,"depth":720,"text":2134,"children":2552},[2553,2554],{"id":2137,"depth":726,"text":2140},{"id":2243,"depth":726,"text":2246},{"id":2289,"depth":720,"text":2292},{"id":2310,"depth":720,"text":2313,"children":2557},[2558,2559,2560,2561],{"id":2321,"depth":726,"text":2324},{"id":2332,"depth":726,"text":2335},{"id":2343,"depth":726,"text":2346},{"id":2354,"depth":726,"text":2357},{"id":2365,"depth":720,"text":2368},{"id":2381,"depth":720,"text":2384},{"id":2397,"depth":720,"text":2400},{"id":2458,"depth":720,"text":2461},{"id":635,"depth":720,"text":638,"children":2567},[2568,2569,2570,2571],{"id":2478,"depth":726,"text":2481},{"id":2493,"depth":726,"text":2496},{"id":2508,"depth":726,"text":2511},{"id":2523,"depth":726,"text":2526},"content:articles:25-crypto-perpetual-futures-evidence.md","articles\u002F25-crypto-perpetual-futures-evidence.md","articles\u002F25-crypto-perpetual-futures-evidence",{"_path":2576,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":2577,"description":2578,"slug":2579,"date":2580,"lastUpdated":2580,"author":13,"readingTime":2029,"category":757,"tags":2581,"ogImage":2583,"featured":7,"body":2584,"_type":744,"_id":3195,"_source":746,"_file":3196,"_stem":3197,"_extension":749},"\u002Farticles\u002F24-rule-1006-blockchain-summary-evidence","Rule 1006 summaries in blockchain cases","A practical framework for admitting blockchain transaction summaries under Rule 1006 while preserving source access, reproducibility, and cross-examination.","rule-1006-blockchain-summary-evidence","2026-05-23",[20,21,18,2582],"expert-witness","\u002Fog\u002Frule-1006-blockchain-summary-evidence.png",{"type":24,"children":2585,"toc":3170},[2586,2591,2604,2610,2615,2620,2632,2638,2651,2657,2662,2674,2680,2685,2690,2696,2701,2706,2712,2726,2731,2836,2841,2847,2858,2864,2887,2893,2898,2904,2909,2914,2920,2925,2936,2942,2951,2956,2961,2967,2972,3015,3020,3026,3031,3074,3079,3085,3090,3095,3099,3105,3114,3120,3129,3135,3144,3150,3159],{"type":27,"tag":28,"props":2587,"children":2588},{},[2589],{"type":32,"value":2590},"A complete blockchain trace can contain thousands or millions of transaction records, token-transfer events, and intermediate calculations. Federal Rule of Evidence 1006 can permit a party to prove the content of that voluminous material through an admitted summary, chart, or calculation. It does not excuse the proponent from establishing that the underlying records are admissible, defining what was summarized, or giving the other parties a fair opportunity to examine the source material.",{"type":27,"tag":28,"props":2592,"children":2593},{},[2594,2596,2602],{"type":32,"value":2595},"This article addresses federal evidence practice. State rules, local practice, and scheduling orders may differ. Broader authentication questions are covered in ",{"type":27,"tag":83,"props":2597,"children":2599},{"href":2598},"\u002Fresources\u002Fblockchain-evidence-admissibility",[2600],{"type":32,"value":2601},"Blockchain Evidence in Litigation",{"type":32,"value":2603},". The narrower question here is how to convert a large transaction dataset into usable proof without severing it from its foundation.",{"type":27,"tag":40,"props":2605,"children":2607},{"id":2606},"why-are-blockchain-cases-a-natural-fit-for-rule-1006",[2608],{"type":32,"value":2609},"Why Are Blockchain Cases a Natural Fit for Rule 1006?",{"type":27,"tag":28,"props":2611,"children":2612},{},[2613],{"type":32,"value":2614},"A tracing opinion rarely depends on only one transaction. The relevant proof may include every transfer involving identified addresses during a defined period, token events from specified contracts, exchange exports, price data, and a table connecting each derived value to its source record.",{"type":27,"tag":28,"props":2616,"children":2617},{},[2618],{"type":32,"value":2619},"Printing or examining that material row by row would obscure the point of the evidence. A summary can answer a litigation question such as how much value entered a group of addresses, what portion moved to identified exchanges, or how frequently funds passed through specified services. Rule 1006 addresses this presentation problem, but only when the summary proves the content of a genuinely voluminous set of admissible materials that cannot conveniently be examined in court.",{"type":27,"tag":28,"props":2621,"children":2622},{},[2623,2625,2630],{"type":32,"value":2624},"This differs from ",{"type":27,"tag":83,"props":2626,"children":2627},{"href":1326},[2628],{"type":32,"value":2629},"reading a single blockchain transaction",{"type":32,"value":2631},". The expert must explain what individual records mean, why the selected universe is complete, and how source records became totals.",{"type":27,"tag":40,"props":2633,"children":2635},{"id":2634},"what-does-current-rule-1006-require",[2636],{"type":32,"value":2637},"What Does Current Rule 1006 Require?",{"type":27,"tag":28,"props":2639,"children":2640},{},[2641,2642,2649],{"type":32,"value":1284},{"type":27,"tag":83,"props":2643,"children":2646},{"href":2644,"rel":2645},"https:\u002F\u002Fwww.uscourts.gov\u002Fsites\u002Fdefault\u002Ffiles\u002F2025-02\u002Ffederal-rules-of-evidence-dec-1-2024.pdf",[87],[2647],{"type":32,"value":2648},"current text of Federal Rule of Evidence 1006",{"type":32,"value":2650}," has three operational components.",{"type":27,"tag":153,"props":2652,"children":2654},{"id":2653},"the-underlying-materials-must-be-voluminous-and-admissible",[2655],{"type":32,"value":2656},"The underlying materials must be voluminous and admissible",{"type":27,"tag":28,"props":2658,"children":2659},{},[2660],{"type":32,"value":2661},"Rule 1006(a) applies to voluminous admissible writings, recordings, or photographs that cannot conveniently be examined in court. A party seeking to use the rule for blockchain data would ordinarily identify the electronic records being summarized, explain the form in which they were collected, and establish the applicable foundation for each source category.",{"type":27,"tag":28,"props":2663,"children":2664},{},[2665,2667,2673],{"type":32,"value":2666},"Admissibility cannot be established only at the summary level. Rule 1006 does not cleanse unauthenticated screenshots, unexplained commercial labels, inadmissible exchange records, or unsupported price data. The proponent should map each source category to its authentication, hearsay, and expert-testimony foundation. See ",{"type":27,"tag":83,"props":2668,"children":2670},{"href":2669},"\u002Fresources\u002Fblockchain-evidence-federal-missouri-rules",[2671],{"type":32,"value":2672},"the federal and Missouri rules governing blockchain evidence",{"type":32,"value":287},{"type":27,"tag":153,"props":2675,"children":2677},{"id":2676},"the-summary-may-be-evidence-even-if-the-source-records-are-not-admitted",[2678],{"type":32,"value":2679},"The summary may be evidence even if the source records are not admitted",{"type":27,"tag":28,"props":2681,"children":2682},{},[2683],{"type":32,"value":2684},"The amendment effective December 1, 2024 clarified that the court may admit a qualifying summary whether or not the underlying materials have themselves been introduced. The underlying records must be admissible, but they do not all have to become trial exhibits. Some or all of them may still be admitted when otherwise appropriate.",{"type":27,"tag":28,"props":2686,"children":2687},{},[2688],{"type":32,"value":2689},"Counsel can therefore offer transaction totals without asking the factfinder to navigate millions of rows. The summary is substantive evidence, not merely a visual displayed during testimony. It must be accurate and capable of standing as proof of the summarized content.",{"type":27,"tag":153,"props":2691,"children":2693},{"id":2692},"other-parties-must-receive-meaningful-access",[2694],{"type":32,"value":2695},"Other parties must receive meaningful access",{"type":27,"tag":28,"props":2697,"children":2698},{},[2699],{"type":32,"value":2700},"Rule 1006(b) requires the proponent to make the underlying originals or duplicates available for examination or copying, or both, at a reasonable time and place. The court may also order production in court. The rule does not prescribe a particular file format or a universal notice period.",{"type":27,"tag":28,"props":2702,"children":2703},{},[2704],{"type":32,"value":2705},"For complex data, bare technical availability may not be meaningful. A defensible production should usually include the preserved export, a field dictionary, query boundaries, and enough documentation to connect summary rows to underlying records. A PDF chart or proprietary dashboard alone may not permit meaningful testing.",{"type":27,"tag":40,"props":2707,"children":2709},{"id":2708},"is-the-chart-rule-1006-evidence-or-a-rule-107-aid",[2710],{"type":32,"value":2711},"Is the Chart Rule 1006 Evidence or a Rule 107 Aid?",{"type":27,"tag":28,"props":2713,"children":2714},{},[2715,2717,2724],{"type":32,"value":2716},"The distinction changed in form on December 1, 2024. New Rule 107 now governs illustrative aids. The ",{"type":27,"tag":83,"props":2718,"children":2721},{"href":2719,"rel":2720},"https:\u002F\u002Fwww.supremecourt.gov\u002Forders\u002Fcourtorders\u002Ffrev24_9o6b.pdf",[87],[2722],{"type":32,"value":2723},"Supreme Court's April 2, 2024 amendments",{"type":32,"value":2725}," state that an illustrative aid helps the trier of fact understand evidence or argument, is not itself evidence, and ordinarily does not go to the jury during deliberations. Rule 107(d) directs admitted summaries of voluminous evidence back to Rule 1006.",{"type":27,"tag":28,"props":2727,"children":2728},{},[2729],{"type":32,"value":2730},"The practical question is what function the chart performs:",{"type":27,"tag":2732,"props":2733,"children":2734},"table",{},[2735,2759],{"type":27,"tag":2736,"props":2737,"children":2738},"thead",{},[2739],{"type":27,"tag":2740,"props":2741,"children":2742},"tr",{},[2743,2749,2754],{"type":27,"tag":2744,"props":2745,"children":2746},"th",{},[2747],{"type":32,"value":2748},"Question",{"type":27,"tag":2744,"props":2750,"children":2751},{},[2752],{"type":32,"value":2753},"Rule 1006 summary",{"type":27,"tag":2744,"props":2755,"children":2756},{},[2757],{"type":32,"value":2758},"Rule 107 illustrative aid",{"type":27,"tag":2760,"props":2761,"children":2762},"tbody",{},[2763,2782,2800,2818],{"type":27,"tag":2740,"props":2764,"children":2765},{},[2766,2772,2777],{"type":27,"tag":2767,"props":2768,"children":2769},"td",{},[2770],{"type":32,"value":2771},"What does it do?",{"type":27,"tag":2767,"props":2773,"children":2774},{},[2775],{"type":32,"value":2776},"Proves the content of voluminous admissible materials",{"type":27,"tag":2767,"props":2778,"children":2779},{},[2780],{"type":32,"value":2781},"Helps explain evidence or argument",{"type":27,"tag":2740,"props":2783,"children":2784},{},[2785,2790,2795],{"type":27,"tag":2767,"props":2786,"children":2787},{},[2788],{"type":32,"value":2789},"Is it evidence?",{"type":27,"tag":2767,"props":2791,"children":2792},{},[2793],{"type":32,"value":2794},"Yes, if admitted",{"type":27,"tag":2767,"props":2796,"children":2797},{},[2798],{"type":32,"value":2799},"No",{"type":27,"tag":2740,"props":2801,"children":2802},{},[2803,2808,2813],{"type":27,"tag":2767,"props":2804,"children":2805},{},[2806],{"type":32,"value":2807},"Must the underlying material be admissible?",{"type":27,"tag":2767,"props":2809,"children":2810},{},[2811],{"type":32,"value":2812},"Yes",{"type":27,"tag":2767,"props":2814,"children":2815},{},[2816],{"type":32,"value":2817},"The aid must fairly assist understanding, but it is not a substitute for proof",{"type":27,"tag":2740,"props":2819,"children":2820},{},[2821,2826,2831],{"type":27,"tag":2767,"props":2822,"children":2823},{},[2824],{"type":32,"value":2825},"Can it go to deliberations?",{"type":27,"tag":2767,"props":2827,"children":2828},{},[2829],{"type":32,"value":2830},"As admitted evidence, subject to the court's management",{"type":27,"tag":2767,"props":2832,"children":2833},{},[2834],{"type":32,"value":2835},"Not ordinarily, absent consent or a good-cause order",{"type":27,"tag":28,"props":2837,"children":2838},{},[2839],{"type":32,"value":2840},"Calling a chart “demonstrative” does not determine its status. If transaction totals are offered as proof, address Rule 1006. If a chart merely colors arrows on admitted transactions to assist testimony, Rule 107 may fit. One exhibit should not drift between those roles without a clear ruling.",{"type":27,"tag":40,"props":2842,"children":2844},{"id":2843},"what-work-product-supports-a-defensible-summary",[2845],{"type":32,"value":2846},"What Work Product Supports a Defensible Summary?",{"type":27,"tag":28,"props":2848,"children":2849},{},[2850,2852,2856],{"type":32,"value":2851},"A reliable summary begins with a reproducible specification, not a finished graphic. The analyst performing ",{"type":27,"tag":83,"props":2853,"children":2854},{"href":611},[2855],{"type":32,"value":1011},{"type":32,"value":2857}," should preserve enough detail for another qualified person to rerun the process and identify any judgment calls.",{"type":27,"tag":153,"props":2859,"children":2861},{"id":2860},"define-the-source-universe",[2862],{"type":32,"value":2863},"Define the source universe",{"type":27,"tag":28,"props":2865,"children":2866},{},[2867,2869,2876,2878,2885],{"type":32,"value":2868},"Record the blockchain and network, date range, block boundaries where applicable, addresses, transaction types, token contracts, and off-chain records included. Keep source identifiers attached to every row. Depending on the network, those may include transaction hashes, block identifiers, output indexes, event-log indexes, and contract addresses. Official ",{"type":27,"tag":83,"props":2870,"children":2873},{"href":2871,"rel":2872},"https:\u002F\u002Fethereum.org\u002Fdevelopers\u002Fdocs\u002Fapis\u002Fjson-rpc\u002F",[87],[2874],{"type":32,"value":2875},"Ethereum JSON-RPC documentation",{"type":32,"value":2877}," and ",{"type":27,"tag":83,"props":2879,"children":2882},{"href":2880,"rel":2881},"https:\u002F\u002Fbitcoincore.org\u002Fen\u002Fdoc\u002F30.0.0\u002Frpc\u002Frawtransactions\u002Fgetrawtransaction\u002F",[87],[2883],{"type":32,"value":2884},"Bitcoin Core transaction documentation",{"type":32,"value":2886}," show why a generic “transaction ID” column may be insufficient.",{"type":27,"tag":153,"props":2888,"children":2890},{"id":2889},"state-inclusion-and-exclusion-rules-before-totaling",[2891],{"type":32,"value":2892},"State inclusion and exclusion rules before totaling",{"type":27,"tag":28,"props":2894,"children":2895},{},[2896],{"type":32,"value":2897},"Specify whether the dataset includes failed transactions, internal calls, token events, fees, change outputs, self-transfers, bridge events, duplicates, and transactions below a threshold. Tie each exclusion to the question being answered. Rules created after seeing the totals invite a selection-bias challenge.",{"type":27,"tag":153,"props":2899,"children":2901},{"id":2900},"separate-observed-facts-from-derived-fields",[2902],{"type":32,"value":2903},"Separate observed facts from derived fields",{"type":27,"tag":28,"props":2905,"children":2906},{},[2907],{"type":32,"value":2908},"Transaction hash, block, sender field, recipient field, asset, and native-unit amount are source-level fields. Wallet clustering, entity attribution, transaction purpose, and ownership are analytical conclusions. The summary should not present an inferred entity label as though it were written on the blockchain.",{"type":27,"tag":28,"props":2910,"children":2911},{},[2912],{"type":32,"value":2913},"Derived monetary values need their own protocol. Identify the price source, currency, timestamp convention, time zone, and treatment of illiquid assets or missing observations. A transfer amount and its historical dollar valuation are different propositions with different foundations.",{"type":27,"tag":153,"props":2915,"children":2917},{"id":2916},"preserve-an-audit-path",[2918],{"type":32,"value":2919},"Preserve an audit path",{"type":27,"tag":28,"props":2921,"children":2922},{},[2923],{"type":32,"value":2924},"Maintain original exports, normalized data, transformation logic, an exception log, and final output as separate layers. Use stable row identifiers and reconcile counts and totals at each stage. Preserve the version or export date of commercial labels because attribution may change even when the on-chain transaction does not.",{"type":27,"tag":28,"props":2926,"children":2927},{},[2928,2930,2935],{"type":32,"value":2929},"A witness should be able to explain this process in plain language. The witness need not necessarily be an expert merely because a summary was prepared. Specialized clustering, attribution, valuation, or interpretation may, however, implicate Rule 702 and expert disclosure obligations. The engagement should be structured with that distinction in mind, consistent with the firm's documented ",{"type":27,"tag":83,"props":2931,"children":2932},{"href":627},[2933],{"type":32,"value":2934},"methodology",{"type":32,"value":287},{"type":27,"tag":40,"props":2937,"children":2939},{"id":2938},"worked-hypothetical-summarizing-token-transfers",[2940],{"type":32,"value":2941},"Worked Hypothetical: Summarizing Token Transfers",{"type":27,"tag":28,"props":2943,"children":2944},{},[2945,2949],{"type":27,"tag":65,"props":2946,"children":2947},{},[2948],{"type":32,"value":306},{"type":32,"value":2950}," A plaintiff alleges that assets were diverted from a project treasury over eighteen months. The preserved dataset contains 1.8 million transaction and token-event rows from twelve contracts and forty addresses. The proposed Rule 1006 exhibit reports monthly inflows, outflows, fees, and transfers to separately identified exchange deposit addresses.",{"type":27,"tag":28,"props":2952,"children":2953},{},[2954],{"type":32,"value":2955},"The analyst defines the block range, contract list, address list, event types, and duplicate-removal key before calculating totals. Failed transactions are retained in an exception table but excluded from transferred-value totals because no asserted token transfer was completed. Dollar values use a named daily price source and a stated UTC convention. Every summary cell links through a schedule to source rows identified by transaction hash and event-log index.",{"type":27,"tag":28,"props":2957,"children":2958},{},[2959],{"type":32,"value":2960},"The plaintiff produces the raw exports, normalized table, data dictionary, calculation logic, exception table, and attribution support. At trial, the witness explains how the 1.8 million rows became the exhibit and distinguishes observed transfers from opinions about address control. Rule 1006 may solve the volume problem, but it does not establish that the defendant owned an address or that a transfer was wrongful. Those propositions require separate evidence.",{"type":27,"tag":40,"props":2962,"children":2964},{"id":2963},"how-can-opposing-counsel-test-the-summary",[2965],{"type":32,"value":2966},"How Can Opposing Counsel Test the Summary?",{"type":27,"tag":28,"props":2968,"children":2969},{},[2970],{"type":32,"value":2971},"The most productive challenge usually targets the boundary and transformation, not arithmetic alone. Discovery and examination should ask:",{"type":27,"tag":310,"props":2973,"children":2974},{},[2975,2980,2985,2990,2995,3000,3005,3010],{"type":27,"tag":61,"props":2976,"children":2977},{},[2978],{"type":32,"value":2979},"What exact records form the universe, and who selected the addresses, contracts, and dates?",{"type":27,"tag":61,"props":2981,"children":2982},{},[2983],{"type":32,"value":2984},"Can the record count be reproduced directly from the preserved source files?",{"type":27,"tag":61,"props":2986,"children":2987},{},[2988],{"type":32,"value":2989},"Were failed, duplicated, bridged, or self-directed transactions handled consistently?",{"type":27,"tag":61,"props":2991,"children":2992},{},[2993],{"type":32,"value":2994},"Which columns are direct observations, and which are labels, classifications, or opinions?",{"type":27,"tag":61,"props":2996,"children":2997},{},[2998],{"type":32,"value":2999},"Did the analyst change inclusion rules after reviewing preliminary results?",{"type":27,"tag":61,"props":3001,"children":3002},{},[3003],{"type":32,"value":3004},"Can each total be traced to identified source rows without access to the analyst's proprietary interface?",{"type":27,"tag":61,"props":3006,"children":3007},{},[3008],{"type":32,"value":3009},"What admissibility foundation supports exchange records, vendor labels, and price data?",{"type":27,"tag":61,"props":3011,"children":3012},{},[3013],{"type":32,"value":3014},"Do omitted records materially change the stated totals or narrative?",{"type":27,"tag":28,"props":3016,"children":3017},{},[3018],{"type":32,"value":3019},"Counsel should also request prior summary versions, query logs, transformation scripts or formulas, exception reports, and reconciliation results, subject to applicable discovery and expert-disclosure rules. A difference between totals may reflect a defensible scope choice, but the choice must be visible.",{"type":27,"tag":40,"props":3021,"children":3023},{"id":3022},"what-should-be-resolved-before-trial",[3024],{"type":32,"value":3025},"What Should Be Resolved Before Trial?",{"type":27,"tag":28,"props":3027,"children":3028},{},[3029],{"type":32,"value":3030},"Use a pretrial process that separates admissibility from presentation:",{"type":27,"tag":57,"props":3032,"children":3033},{},[3034,3039,3044,3049,3054,3059,3064,3069],{"type":27,"tag":61,"props":3035,"children":3036},{},[3037],{"type":32,"value":3038},"Identify the fact each proposed summary is offered to prove.",{"type":27,"tag":61,"props":3040,"children":3041},{},[3042],{"type":32,"value":3043},"Define the complete source universe and the foundation for every source category.",{"type":27,"tag":61,"props":3045,"children":3046},{},[3047],{"type":32,"value":3048},"Produce originals or duplicates early enough for meaningful examination and copying.",{"type":27,"tag":61,"props":3050,"children":3051},{},[3052],{"type":32,"value":3053},"Disclose normalization, deduplication, valuation, attribution, and exception rules.",{"type":27,"tag":61,"props":3055,"children":3056},{},[3057],{"type":32,"value":3058},"Reconcile source counts to normalized counts and normalized totals to the exhibit.",{"type":27,"tag":61,"props":3060,"children":3061},{},[3062],{"type":32,"value":3063},"Decide whether each visual is Rule 1006 evidence, a Rule 107 aid, or a separate expert opinion exhibit.",{"type":27,"tag":61,"props":3065,"children":3066},{},[3067],{"type":32,"value":3068},"Prepare the sponsoring witness to explain both the data pipeline and its limits.",{"type":27,"tag":61,"props":3070,"children":3071},{},[3072],{"type":32,"value":3073},"Address objections, exhibit status, jury access, and any limiting instruction in limine rather than during testimony.",{"type":27,"tag":28,"props":3075,"children":3076},{},[3077],{"type":32,"value":3078},"The Advisory Committee materials explain that the 2024 amendment was intended to stop confusion between substantive summaries and illustrative aids. That clarification does not make admission automatic. The Committee also recognized that an inaccurate or argumentative summary remains subject to Rule 403 concerns.",{"type":27,"tag":40,"props":3080,"children":3082},{"id":3081},"what-are-the-limits-of-a-rule-1006-summary",[3083],{"type":32,"value":3084},"What Are the Limits of a Rule 1006 Summary?",{"type":27,"tag":28,"props":3086,"children":3087},{},[3088],{"type":32,"value":3089},"Rule 1006 addresses how voluminous content may be proved. It does not authenticate every input, resolve hearsay objections, validate an expert method, establish wallet ownership, or convert association into causation. It also does not answer whether a state court follows the same framework.",{"type":27,"tag":28,"props":3091,"children":3092},{},[3093],{"type":32,"value":3094},"A narrow summary is often stronger than an ambitious one. A table proving amounts and dates can remain separate from opinions about control, intent, tracing heuristics, or damages. That separation makes the exhibit easier to reproduce and prevents disputed interpretation from being embedded invisibly inside arithmetic.",{"type":27,"tag":40,"props":3096,"children":3097},{"id":635},[3098],{"type":32,"value":638},{"type":27,"tag":153,"props":3100,"children":3102},{"id":3101},"q-must-every-blockchain-record-summarized-under-rule-1006-be-admitted-into-evidence",[3103],{"type":32,"value":3104},"Q: Must every blockchain record summarized under Rule 1006 be admitted into evidence?",{"type":27,"tag":28,"props":3106,"children":3107},{},[3108,3112],{"type":27,"tag":65,"props":3109,"children":3110},{},[3111],{"type":32,"value":652},{"type":32,"value":3113}," No. Under the rule effective December 1, 2024, the underlying voluminous materials must be admissible, but the summary may be admitted whether or not those materials have themselves been introduced. The proponent must still make the originals or duplicates available for examination or copying at a reasonable time and place.",{"type":27,"tag":153,"props":3115,"children":3117},{"id":3116},"q-is-a-transaction-flow-diagram-automatically-a-rule-1006-summary",[3118],{"type":32,"value":3119},"Q: Is a transaction-flow diagram automatically a Rule 1006 summary?",{"type":27,"tag":28,"props":3121,"children":3122},{},[3123,3127],{"type":27,"tag":65,"props":3124,"children":3125},{},[3126],{"type":32,"value":652},{"type":32,"value":3128}," No. Its function controls. A diagram offered to prove totals or the content of voluminous admissible records may require a Rule 1006 foundation. A diagram used only to help the trier of fact understand evidence or argument is an illustrative aid governed by Rule 107 and is not itself evidence.",{"type":27,"tag":153,"props":3130,"children":3132},{"id":3131},"q-does-the-person-who-prepared-the-summary-have-to-testify",[3133],{"type":32,"value":3134},"Q: Does the person who prepared the summary have to testify?",{"type":27,"tag":28,"props":3136,"children":3137},{},[3138,3142],{"type":27,"tag":65,"props":3139,"children":3140},{},[3141],{"type":32,"value":652},{"type":32,"value":3143}," Rule 1006 does not state a universal witness requirement, but the proponent needs a sufficient foundation for the source materials and the summary's accuracy. A witness who performed or supervised the transformation is often best positioned to explain scope, calculations, and exceptions. Specialized opinions may also require a properly disclosed expert.",{"type":27,"tag":153,"props":3145,"children":3147},{"id":3146},"q-what-should-be-produced-with-a-blockchain-summary",[3148],{"type":32,"value":3149},"Q: What should be produced with a blockchain summary?",{"type":27,"tag":28,"props":3151,"children":3152},{},[3153,3157],{"type":27,"tag":65,"props":3154,"children":3155},{},[3156],{"type":32,"value":652},{"type":32,"value":3158}," At minimum, counsel should consider producing the preserved source data, data dictionary, query boundaries, inclusion and exclusion rules, normalization and deduplication methods, calculation logic, exception log, and a crosswalk from summary values to source records. The precise legal obligation depends on Rule 1006, discovery rules, expert-disclosure requirements, court orders, and local practice.",{"type":27,"tag":28,"props":3160,"children":3161},{},[3162,3164,3168],{"type":32,"value":3163},"For a specific transaction dataset or proposed exhibit, ",{"type":27,"tag":83,"props":3165,"children":3166},{"href":713},[3167],{"type":32,"value":1219},{"type":32,"value":3169}," to discuss evidence review and a reproducible summary protocol.",{"title":8,"searchDepth":720,"depth":720,"links":3171},[3172,3173,3178,3179,3185,3186,3187,3188,3189],{"id":2606,"depth":720,"text":2609},{"id":2634,"depth":720,"text":2637,"children":3174},[3175,3176,3177],{"id":2653,"depth":726,"text":2656},{"id":2676,"depth":726,"text":2679},{"id":2692,"depth":726,"text":2695},{"id":2708,"depth":720,"text":2711},{"id":2843,"depth":720,"text":2846,"children":3180},[3181,3182,3183,3184],{"id":2860,"depth":726,"text":2863},{"id":2889,"depth":726,"text":2892},{"id":2900,"depth":726,"text":2903},{"id":2916,"depth":726,"text":2919},{"id":2938,"depth":720,"text":2941},{"id":2963,"depth":720,"text":2966},{"id":3022,"depth":720,"text":3025},{"id":3081,"depth":720,"text":3084},{"id":635,"depth":720,"text":638,"children":3190},[3191,3192,3193,3194],{"id":3101,"depth":726,"text":3104},{"id":3116,"depth":726,"text":3119},{"id":3131,"depth":726,"text":3134},{"id":3146,"depth":726,"text":3149},"content:articles:24-rule-1006-blockchain-summary-evidence.md","articles\u002F24-rule-1006-blockchain-summary-evidence.md","articles\u002F24-rule-1006-blockchain-summary-evidence",1790145013676]