[{"data":1,"prerenderedAt":1918},["ShallowReactive",2],{"tag-wallet":3},[4,746,1316],{"_path":5,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":9,"description":10,"slug":11,"date":12,"lastUpdated":12,"author":13,"readingTime":14,"category":15,"tags":16,"ogImage":22,"featured":7,"body":23,"_type":740,"_id":741,"_source":742,"_file":743,"_stem":744,"_extension":745},"\u002Farticles\u002F38-multisig-contract-wallet-attribution","articles",false,"","One address, many actors: contract wallet attribution","Contract wallets and multisigs are not one-person accounts. Experts reconstruct owners, signers, modules, and relayers to attribute on-chain activity.","multisig-contract-wallet-attribution","2026-08-29","Nick Kampe",12,"Methodology",[17,18,19,20,21],"multisig","wallet","account-abstraction","smart-contracts","evidence","\u002Fog\u002Fmultisig-contract-wallet-attribution.png",{"type":24,"children":25,"toc":715},"root",[26,34,41,57,80,85,90,96,103,108,114,119,125,138,144,165,171,194,200,205,240,253,259,264,270,284,289,295,300,499,504,510,515,528,534,539,544,582,603,609,615,626,632,641,647,656,662,671,677,686],{"type":27,"tag":28,"props":29,"children":30},"element","p",{},[31],{"type":32,"value":33},"text","When a disputed wallet is a smart contract, the address is an execution account, not a person. Authority over it is defined by code: an owner list, a signature threshold, enabled modules, guards, and sometimes delegation or account-abstraction infrastructure. For fraud, corporate, and probate counsel the question is therefore not \"who owns this address\" but \"whose authorization moved these assets,\" and where that answer stops being a chain fact and becomes inference.",{"type":27,"tag":35,"props":36,"children":38},"h2",{"id":37},"contract-wallets-are-not-ordinary-accounts",[39],{"type":32,"value":40},"Contract Wallets Are Not Ordinary Accounts",{"type":27,"tag":28,"props":42,"children":43},{},[44,46,55],{"type":32,"value":45},"Ethereum distinguishes externally owned accounts (EOAs) from contract accounts. An EOA is controlled by its private key; a contract account has no private key and acts according to its code when called. EIP-7702 adds a third fact an analyst may need to account for: an EOA can carry a delegation indicator that causes calls to execute delegated code. The ",{"type":27,"tag":47,"props":48,"children":52},"a",{"href":49,"rel":50},"https:\u002F\u002Fethereum.org\u002Fdevelopers\u002Fdocs\u002Faccounts\u002F",[51],"nofollow",[53],{"type":32,"value":54},"ethereum.org account documentation",{"type":32,"value":56}," describes the EOA and contract-account distinction.",{"type":27,"tag":28,"props":58,"children":59},{},[60,62,69,71,78],{"type":32,"value":61},"A transaction that appears \"signed by the wallet\" is signed by whatever actors the wallet's code accepts. Contracts cannot sign the way key-based accounts do, which is why the ",{"type":27,"tag":47,"props":63,"children":66},{"href":64,"rel":65},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-1271",[51],[67],{"type":32,"value":68},"ERC-1271 standard",{"type":32,"value":70}," exists: a contract exposes ",{"type":27,"tag":72,"props":73,"children":75},"code",{"className":74},[],[76],{"type":32,"value":77},"isValidSignature(hash, signature)",{"type":32,"value":79}," and returns a fixed magic value when the signature is valid for it. Validation can be context dependent, keyed to time, state, or a signer's authorization level.",{"type":27,"tag":28,"props":81,"children":82},{},[83],{"type":32,"value":84},"An analyst who treats a contract-wallet address as an EOA misattributes everything downstream, because the assumption of one key, one signer, one person does not hold.",{"type":27,"tag":28,"props":86,"children":87},{},[88],{"type":32,"value":89},"Safe Smart Account, formerly Gnosis Safe, is a common multisig implementation. A Safe stores an owner list and a threshold, the minimum number of owner approvals needed to execute, on-chain. Changes to the owner set or threshold are Safe transactions, so the same address can have different control arrangements at different times.",{"type":27,"tag":35,"props":91,"children":93},{"id":92},"the-actors-behind-a-single-address",[94],{"type":32,"value":95},"The Actors Behind a Single Address",{"type":27,"tag":97,"props":98,"children":100},"h3",{"id":99},"owners-and-signers",[101],{"type":32,"value":102},"Owners and Signers",{"type":27,"tag":28,"props":104,"children":105},{},[106],{"type":32,"value":107},"Owners are the addresses permitted to approve transactions; each approval is a signature over the transaction hash. Owners can themselves be contracts, a configuration ERC-1271 anticipated, so owner lists can nest. In Safe's standard execution path, transaction input contains a packed signature value that can include an ECDSA signature, an ERC-1271 contract signature identifying its verifying contract, or a pre-validated hash. For that execution path, the analyst can often enumerate which approving addresses were presented: a chain fact.",{"type":27,"tag":97,"props":109,"children":111},{"id":110},"the-threshold",[112],{"type":32,"value":113},"The Threshold",{"type":27,"tag":28,"props":115,"children":116},{},[117],{"type":32,"value":118},"The threshold is a control setting, not a person; a change from 2-of-3 to 1-of-1 is a concentration-of-control event that leaves its own signed record. The threshold in force on the transfer date is usually the first thing to pin down.",{"type":27,"tag":97,"props":120,"children":122},{"id":121},"modules",[123],{"type":32,"value":124},"Modules",{"type":27,"tag":28,"props":126,"children":127},{},[128,130,136],{"type":32,"value":129},"Modules are contracts an owner set enables through an approved wallet transaction. Once enabled, a module can execute transactions through the wallet without collecting the owner-threshold signatures used in ordinary Safe execution. Evidentiary significance: a transfer executed through a module does not carry owner signatures in the standard ",{"type":27,"tag":72,"props":131,"children":133},{"className":132},[],[134],{"type":32,"value":135},"execTransaction",{"type":32,"value":137}," encoding, and whether owners approved depends on the module logic rather than the threshold.",{"type":27,"tag":97,"props":139,"children":141},{"id":140},"guards",[142],{"type":32,"value":143},"Guards",{"type":27,"tag":28,"props":145,"children":146},{},[147,149,155,157,163],{"type":32,"value":148},"Guards add pre- and post-execution checks; unlike modules they cannot originate transactions, only pass or block them. A guard change is recorded on-chain, including the ",{"type":27,"tag":72,"props":150,"children":152},{"className":151},[],[153],{"type":32,"value":154},"ChangedGuard",{"type":32,"value":156}," event emitted by Safe's ",{"type":27,"tag":72,"props":158,"children":160},{"className":159},[],[161],{"type":32,"value":162},"setGuard",{"type":32,"value":164}," function. That interface is a transaction guard on ordinary Safe execution. A module-executed transfer is a different path, so a claim that the guard should have stopped it requires showing the guard actually ran on that execution.",{"type":27,"tag":97,"props":166,"children":168},{"id":167},"relayers-bundlers-paymasters-and-delegated-code",[169],{"type":32,"value":170},"Relayers, Bundlers, Paymasters, and Delegated Code",{"type":27,"tag":28,"props":172,"children":173},{},[174,176,183,185,192],{"type":32,"value":175},"Submission is not approval. Safe contracts allow relayed execution, so the account submitting an execution can differ from the owners who signed it. Under account abstraction the separation is structural: ",{"type":27,"tag":47,"props":177,"children":180},{"href":178,"rel":179},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-4337",[51],[181],{"type":32,"value":182},"ERC-4337",{"type":32,"value":184}," defines UserOperations, a pseudo-transaction naming the sender account, factory data, gas limits and fees, optional paymaster data, and a signature the account itself validates. Bundlers collect valid UserOperations and submit them to a shared EntryPoint contract, so the on-chain transaction's sender is the bundler, not the smart-account address. Paymasters can sponsor fees. A related mechanism is ",{"type":27,"tag":47,"props":186,"children":189},{"href":187,"rel":188},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-7702",[51],[190],{"type":32,"value":191},"EIP-7702",{"type":32,"value":193},", under which an EOA signs an authorization tuple writing a persistent delegation indicator into its account code. The authorization list is processed before that transaction's execution, and the indicator remains in effect on later calls until it is updated, so attribution requires reading the delegation indicator in effect at the disputed date along with the delegate contract.",{"type":27,"tag":35,"props":195,"children":197},{"id":196},"reconstructing-configuration-at-the-disputed-time",[198],{"type":32,"value":199},"Reconstructing Configuration at the Disputed Time",{"type":27,"tag":28,"props":201,"children":202},{},[203],{"type":32,"value":204},"For an identified wallet implementation, configuration changes may be recoverable from its transactions, event logs, and historical state. The analyst must establish from the code and records which changes are observable, then reconstruct the configuration to the relevant date rather than reading today's state. The reconstruction runs in six layers:",{"type":27,"tag":206,"props":207,"children":208},"ol",{},[209,215,220,225,230,235],{"type":27,"tag":210,"props":211,"children":212},"li",{},[213],{"type":32,"value":214},"Classify the account: EOA or contract, including any EIP-7702 delegation indicator, and the implementation behind any proxy.",{"type":27,"tag":210,"props":216,"children":217},{},[218],{"type":32,"value":219},"Rebuild the configuration history to the disputed date.",{"type":27,"tag":210,"props":221,"children":222},{},[223],{"type":32,"value":224},"Classify each execution path: owner-signed, module-executed, or delegated call.",{"type":27,"tag":210,"props":226,"children":227},{},[228],{"type":32,"value":229},"Extract approving addresses from signature data where the execution path encodes it.",{"type":27,"tag":210,"props":231,"children":232},{},[233],{"type":32,"value":234},"Identify infrastructure actors: submitter, gas payer, refund receiver, bundler, paymaster.",{"type":27,"tag":210,"props":236,"children":237},{},[238],{"type":32,"value":239},"Map addresses to persons or entities using off-chain evidence.",{"type":27,"tag":28,"props":241,"children":242},{},[243,245,251],{"type":32,"value":244},"What is not on-chain deserves equal emphasis. Which human held each key is almost always an off-chain question, and confirmations collected before a transaction reached threshold may live only in the wallet provider's services. The ",{"type":27,"tag":47,"props":246,"children":248},{"href":247},"\u002Fresources\u002Funderstanding-wallet-ownership-evidence",[249],{"type":32,"value":250},"evidence methods used to tie keys to people",{"type":32,"value":252}," apply here with one twist: a single key is only part of the authorization.",{"type":27,"tag":35,"props":254,"children":256},{"id":255},"account-abstraction-and-the-erc-4337-pipeline",[257],{"type":32,"value":258},"Account Abstraction and the ERC-4337 Pipeline",{"type":27,"tag":28,"props":260,"children":261},{},[262],{"type":32,"value":263},"ERC-4337 changes how wallets are created and run. The sender account can be deployed for the first time inside the UserOperation via factory data, so the wallet can be created and transacted in one flow. The EntryPoint contract validates gas, calls the account's validation function, then calls it to execute; what counts as a valid signature is defined by the account's own code. Safe's ERC-4337 integration uses a module that validates a UserOperation against Safe owner signatures, then executes a module transaction. The forensic consequence: the chain identifies the account and the executor infrastructure, while authority lives in the account's code.",{"type":27,"tag":35,"props":265,"children":267},{"id":266},"counterfactual-accounts-authorization-before-the-contract-exists",[268],{"type":32,"value":269},"Counterfactual Accounts: Authorization Before the Contract Exists",{"type":27,"tag":28,"props":271,"children":272},{},[273,275,282],{"type":32,"value":274},"Deterministic deployment means an account's address can be computed before any code exists at it, using a factory and a salt; funds can sit at an address with no bytecode. ",{"type":27,"tag":47,"props":276,"children":279},{"href":277,"rel":278},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-6492",[51],[280],{"type":32,"value":281},"ERC-6492",{"type":32,"value":283}," standardizes signature validation for predeploy contracts: the signature is wrapped with the factory address, deployment calldata, and the underlying ERC-1271 signature, ending in magic bytes that cannot collide with a key-based signature. The specification requires a verifier to detect the magic bytes first and, when they are present, call the factory with the deployment calldata (deploying if the wallet is not already deployed) before validating the inner ERC-1271 signature; then perform standard ERC-1271 checks if code exists; if that ERC-1271 call failed and the factory call was skipped because the wallet already had code, execute the factory calldata and retry; and attempt ecrecover only as a final step.",{"type":27,"tag":28,"props":285,"children":286},{},[287],{"type":32,"value":288},"The evidentiary upshot: a party can produce a signature for a counterfactual wallet before that wallet exists on-chain. The intended configuration may then be reconstructed from the factory address and deployment calldata in the ERC-6492 wrap, from any later on-chain deployment if one exists, and from off-chain records of the planned owner set; on-chain state alone may under-describe what happened.",{"type":27,"tag":35,"props":290,"children":292},{"id":291},"an-attribution-matrix-for-expert-reports-and-deposition",[293],{"type":32,"value":294},"An Attribution Matrix for Expert Reports and Deposition",{"type":27,"tag":28,"props":296,"children":297},{},[298],{"type":32,"value":299},"The table below is the organizing device I use in expert reports and at deposition; it forces a separate answer for each actor type and labels each as fact or inference.",{"type":27,"tag":301,"props":302,"children":303},"table",{},[304,333],{"type":27,"tag":305,"props":306,"children":307},"thead",{},[308],{"type":27,"tag":309,"props":310,"children":311},"tr",{},[312,318,323,328],{"type":27,"tag":313,"props":314,"children":315},"th",{},[316],{"type":32,"value":317},"Actor",{"type":27,"tag":313,"props":319,"children":320},{},[321],{"type":32,"value":322},"What the chain shows",{"type":27,"tag":313,"props":324,"children":325},{},[326],{"type":32,"value":327},"Off-chain evidence needed",{"type":27,"tag":313,"props":329,"children":330},{},[331],{"type":32,"value":332},"Typical dispute question",{"type":27,"tag":334,"props":335,"children":336},"tbody",{},[337,361,384,407,430,453,476],{"type":27,"tag":309,"props":338,"children":339},{},[340,346,351,356],{"type":27,"tag":341,"props":342,"children":343},"td",{},[344],{"type":32,"value":345},"Owner signer",{"type":27,"tag":341,"props":347,"children":348},{},[349],{"type":32,"value":350},"Approving address in executed signature data",{"type":27,"tag":341,"props":352,"children":353},{},[354],{"type":32,"value":355},"Which person controlled the key",{"type":27,"tag":341,"props":357,"children":358},{},[359],{"type":32,"value":360},"Did this person approve?",{"type":27,"tag":309,"props":362,"children":363},{},[364,369,374,379],{"type":27,"tag":341,"props":365,"children":366},{},[367],{"type":32,"value":368},"Threshold",{"type":27,"tag":341,"props":370,"children":371},{},[372],{"type":32,"value":373},"Current value and every change, each with signatures",{"type":27,"tag":341,"props":375,"children":376},{},[377],{"type":32,"value":378},"Who pushed the change and why",{"type":27,"tag":341,"props":380,"children":381},{},[382],{"type":32,"value":383},"Was control concentrated?",{"type":27,"tag":309,"props":385,"children":386},{},[387,392,397,402],{"type":27,"tag":341,"props":388,"children":389},{},[390],{"type":32,"value":391},"Module",{"type":27,"tag":341,"props":393,"children":394},{},[395],{"type":32,"value":396},"Module executions and enable\u002Fdisable records; signatures depend on the module",{"type":27,"tag":341,"props":398,"children":399},{},[400],{"type":32,"value":401},"Module code and operator",{"type":27,"tag":341,"props":403,"children":404},{},[405],{"type":32,"value":406},"Who could move funds without threshold signers?",{"type":27,"tag":309,"props":408,"children":409},{},[410,415,420,425],{"type":27,"tag":341,"props":411,"children":412},{},[413],{"type":32,"value":414},"Guard",{"type":27,"tag":341,"props":416,"children":417},{},[418],{"type":32,"value":419},"Guard address and change events; whether that guard ran on this execution path",{"type":27,"tag":341,"props":421,"children":422},{},[423],{"type":32,"value":424},"Guard code and operator",{"type":27,"tag":341,"props":426,"children":427},{},[428],{"type":32,"value":429},"Why did no check stop it?",{"type":27,"tag":309,"props":431,"children":432},{},[433,438,443,448],{"type":27,"tag":341,"props":434,"children":435},{},[436],{"type":32,"value":437},"Relayer or bundler",{"type":27,"tag":341,"props":439,"children":440},{},[441],{"type":32,"value":442},"Submitter and gas records on the execution",{"type":27,"tag":341,"props":444,"children":445},{},[446],{"type":32,"value":447},"Operator identity and logs",{"type":27,"tag":341,"props":449,"children":450},{},[451],{"type":32,"value":452},"Does submission equal authorization?",{"type":27,"tag":309,"props":454,"children":455},{},[456,461,466,471],{"type":27,"tag":341,"props":457,"children":458},{},[459],{"type":32,"value":460},"Paymaster",{"type":27,"tag":341,"props":462,"children":463},{},[464],{"type":32,"value":465},"UserOperation paymaster data and EntryPoint deposits",{"type":27,"tag":341,"props":467,"children":468},{},[469],{"type":32,"value":470},"Sponsorship terms and operator",{"type":27,"tag":341,"props":472,"children":473},{},[474],{"type":32,"value":475},"Who paid for the move?",{"type":27,"tag":309,"props":477,"children":478},{},[479,484,489,494],{"type":27,"tag":341,"props":480,"children":481},{},[482],{"type":32,"value":483},"Deployer or factory",{"type":27,"tag":341,"props":485,"children":486},{},[487],{"type":32,"value":488},"Deployment transaction and factory parameters",{"type":27,"tag":341,"props":490,"children":491},{},[492],{"type":32,"value":493},"Factory operator records",{"type":27,"tag":341,"props":495,"children":496},{},[497],{"type":32,"value":498},"What configuration was fixed at creation?",{"type":27,"tag":28,"props":500,"children":501},{},[502],{"type":32,"value":503},"This matrix operationalizes the six-layer reconstruction order. Each step yields either an on-chain fact or an inference needing its own evidence, and the expert report must state which.",{"type":27,"tag":35,"props":505,"children":507},{"id":506},"hypothetical-the-two-of-three-corporate-wallet",[508],{"type":32,"value":509},"Hypothetical: The Two-of-Three Corporate Wallet",{"type":27,"tag":28,"props":511,"children":512},{},[513],{"type":32,"value":514},"Illustrative scenario: a company runs a 2-of-3 Safe holding operating funds. The owners are keys held by two officers and one outside investor. Over ten months the threshold is raised to 3, then lowered to 2, and a spending-limit module is enabled. The disputed transfer, a large payment to a new address, executes with two signatures: one key-based and one ERC-1271 contract signature from a second Safe added as an owner eight months prior. Gas is paid by a relayer address that is not an owner.",{"type":27,"tag":28,"props":516,"children":517},{},[518,520,526],{"type":32,"value":519},"Replaying the Safe's history shows the second Safe entering the owner set, the threshold change that made two approvals sufficient, and the module enable with its authorizing transaction. Parsing the disputed transaction's signature data shows the two approving addresses and their types, including the nested Safe's verifying contract address. What the chain does not show is which humans held the officer keys or whether the module was operated by an employee with no owner status; those answers require device forensics, exchange records, custody policies, and depositions, following the ",{"type":27,"tag":47,"props":521,"children":523},{"href":522},"\u002Fresources\u002Fself-custody-vs-custodial-wallets",[524],{"type":32,"value":525},"self-custody discovery playbook",{"type":32,"value":527},".",{"type":27,"tag":35,"props":529,"children":531},{"id":530},"limitations-and-the-questions-to-ask",[532],{"type":32,"value":533},"Limitations and the Questions to Ask",{"type":27,"tag":28,"props":535,"children":536},{},[537],{"type":32,"value":538},"Proposals that never reached threshold exist only off-chain. Recovered signature addresses can identify an approving key or verifying contract, not a human. Implementations can be upgraded through proxies, so authority can change without the address changing; the upgrade is on-chain, but its effect requires code review. The same address can be deployed deterministically across chains with different states, so each chain is analyzed separately. ERC-1271 validation is context dependent by design: a signature valid on one date may be invalid on another, so validity at the relevant date, not today, is the question. A smart account has no native KYC record comparable to an exchange account, although a related service may hold records.",{"type":27,"tag":28,"props":540,"children":541},{},[542],{"type":32,"value":543},"The discovery questions that follow:",{"type":27,"tag":206,"props":545,"children":546},{},[547,552,557,562,567,572,577],{"type":27,"tag":210,"props":548,"children":549},{},[550],{"type":32,"value":551},"Was the address an EOA or a contract at the relevant date, including any EIP-7702 delegation indicator, and what implementation is behind it?",{"type":27,"tag":210,"props":553,"children":554},{},[555],{"type":32,"value":556},"Produce the full configuration history: every owner, threshold, module, and guard change, with transaction hashes.",{"type":27,"tag":210,"props":558,"children":559},{},[560],{"type":32,"value":561},"Produce raw transaction input data and event logs for each disputed transaction, not block explorer summaries.",{"type":27,"tag":210,"props":563,"children":564},{},[565],{"type":32,"value":566},"Which disputed transactions ran through modules, and what code was each module running?",{"type":27,"tag":210,"props":568,"children":569},{},[570],{"type":32,"value":571},"Who submitted each execution and who paid gas, including bundler and paymaster activity?",{"type":27,"tag":210,"props":573,"children":574},{},[575],{"type":32,"value":576},"Produce confirmation and signing records from any wallet provider interface used before execution.",{"type":27,"tag":210,"props":578,"children":579},{},[580],{"type":32,"value":581},"Document key custody for every owner address: devices, seed phrases, corporate policy, personnel changes.",{"type":27,"tag":28,"props":583,"children":584},{},[585,587,593,595,601],{"type":32,"value":586},"These are forensic facts and methods that apply in any U.S. forum. How a court weighs them depends on the jurisdiction's evidence rules, and the legal responsibility of each actor is a conclusion built on the factual record under corporate, agency, probate, or criminal law. Conduct executed through code is still conduct; the ",{"type":27,"tag":47,"props":588,"children":590},{"href":589},"\u002Fresources\u002Fsmart-contract-disputes",[591],{"type":32,"value":592},"smart contract disputes article",{"type":32,"value":594}," covers how courts treat it. Our ",{"type":27,"tag":47,"props":596,"children":598},{"href":597},"\u002Fmethodology",[599],{"type":32,"value":600},"methodology page",{"type":32,"value":602}," explains how expert reports separate chain facts from inference.",{"type":27,"tag":35,"props":604,"children":606},{"id":605},"frequently-asked-questions",[607],{"type":32,"value":608},"Frequently Asked Questions",{"type":27,"tag":97,"props":610,"children":612},{"id":611},"q-is-a-multisig-address-owned-by-any-single-person",[613],{"type":32,"value":614},"Q: Is a multisig address owned by any single person?",{"type":27,"tag":28,"props":616,"children":617},{},[618,624],{"type":27,"tag":619,"props":620,"children":621},"strong",{},[622],{"type":32,"value":623},"A:",{"type":32,"value":625}," No, not in the way an ordinary wallet is. The address is a contract with an owner list and threshold stored on-chain; control is defined by code, by the threshold number of owner approvals or the module's rules. \"Ownership\" is a legal characterization, resolved by who holds which key and what the parties agreed. No single owner key is sufficient unless the threshold is one.",{"type":27,"tag":97,"props":627,"children":629},{"id":628},"q-if-a-transaction-was-signed-by-enough-owners-who-is-responsible-for-it",[630],{"type":32,"value":631},"Q: If a transaction was signed by enough owners, who is responsible for it?",{"type":27,"tag":28,"props":633,"children":634},{},[635,639],{"type":27,"tag":619,"props":636,"children":637},{},[638],{"type":32,"value":623},{"type":32,"value":640}," The approvals are on-chain facts, but responsibility is a legal question depending on the signers' relationships. Signature evidence shows which addresses approved and the exact approval set; mapping those to persons, and deciding whether an approval binds the entity, the signer, or both, requires off-chain evidence and applicable law. The forensic contribution is pinning down who approved, when, and through which mechanism.",{"type":27,"tag":97,"props":642,"children":644},{"id":643},"q-can-activity-from-an-erc-4337-smart-account-be-traced-to-the-person-who-initiated-it",[645],{"type":32,"value":646},"Q: Can activity from an ERC-4337 smart account be traced to the person who initiated it?",{"type":27,"tag":28,"props":648,"children":649},{},[650,654],{"type":27,"tag":619,"props":651,"children":652},{},[653],{"type":32,"value":623},{"type":32,"value":655}," Only partially, and not from the chain alone. Under ERC-4337 the on-chain transaction is submitted by a bundler; the actor is the sender account, a contract whose code defines what signatures it accepts. The UserOperation contains signature data, but whether that data identifies approving keys depends on the account implementation. Connecting any approving address to a human, and separating the initiator from the infrastructure, requires the same off-chain evidence used for any self-custody wallet.",{"type":27,"tag":97,"props":657,"children":659},{"id":658},"q-what-does-it-mean-if-a-wallet-was-not-deployed-when-the-disputed-authorization-happened",[660],{"type":32,"value":661},"Q: What does it mean if a wallet was not deployed when the disputed authorization happened?",{"type":27,"tag":28,"props":663,"children":664},{},[665,669],{"type":27,"tag":619,"props":666,"children":667},{},[668],{"type":32,"value":623},{"type":32,"value":670}," The address existed as a computation, a deterministic deployment waiting to happen, with no bytecode on-chain at the time. ERC-6492 standardizes validating signatures for such predeploy accounts by wrapping the signature with factory and deployment data. For attribution, the intended owner set must be reconstructed from the factory address and deployment calldata in that wrap, from any later on-chain deployment if one exists, and from off-chain records, because the chain holds no configuration for a contract that did not yet exist.",{"type":27,"tag":97,"props":672,"children":674},{"id":673},"q-what-discovery-should-you-request-when-the-other-side-controls-a-contract-wallet",[675],{"type":32,"value":676},"Q: What discovery should you request when the other side controls a contract wallet?",{"type":27,"tag":28,"props":678,"children":679},{},[680,684],{"type":27,"tag":619,"props":681,"children":682},{},[683],{"type":32,"value":623},{"type":32,"value":685}," Go beyond the address. Request the implementation and proxy records, the full history of owner, threshold, module, and guard changes with transaction hashes, raw input data for each disputed transaction, module code, submission and gas records, wallet provider confirmation logs, and key custody documentation for every owner address. Without that layer, a contract-wallet attribution rests on the false premise that one address equals one person.",{"type":27,"tag":28,"props":687,"children":688},{},[689,691,697,699,705,707,713],{"type":32,"value":690},"Each matter turns on its own facts, and the line between what the chain proves and what must be proven around it varies with the wallet design and the parties' records. If you are facing that line, ",{"type":27,"tag":47,"props":692,"children":694},{"href":693},"\u002Fcontact",[695],{"type":32,"value":696},"contact us",{"type":32,"value":698}," to discuss the evidence picture, or see how ",{"type":27,"tag":47,"props":700,"children":702},{"href":701},"\u002Fservices#blockchain-tracing",[703],{"type":32,"value":704},"blockchain tracing engagements",{"type":32,"value":706}," and ",{"type":27,"tag":47,"props":708,"children":710},{"href":709},"\u002Fservices#litigation-consulting",[711],{"type":32,"value":712},"litigation consulting",{"type":32,"value":714}," are structured.",{"title":8,"searchDepth":716,"depth":716,"links":717},2,[718,719,727,728,729,730,731,732,733],{"id":37,"depth":716,"text":40},{"id":92,"depth":716,"text":95,"children":720},[721,723,724,725,726],{"id":99,"depth":722,"text":102},3,{"id":110,"depth":722,"text":113},{"id":121,"depth":722,"text":124},{"id":140,"depth":722,"text":143},{"id":167,"depth":722,"text":170},{"id":196,"depth":716,"text":199},{"id":255,"depth":716,"text":258},{"id":266,"depth":716,"text":269},{"id":291,"depth":716,"text":294},{"id":506,"depth":716,"text":509},{"id":530,"depth":716,"text":533},{"id":605,"depth":716,"text":608,"children":734},[735,736,737,738,739],{"id":611,"depth":722,"text":614},{"id":628,"depth":722,"text":631},{"id":643,"depth":722,"text":646},{"id":658,"depth":722,"text":661},{"id":673,"depth":722,"text":676},"markdown","content:articles:38-multisig-contract-wallet-attribution.md","content","articles\u002F38-multisig-contract-wallet-attribution.md","articles\u002F38-multisig-contract-wallet-attribution","md",{"_path":747,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":748,"description":749,"slug":750,"date":751,"lastUpdated":751,"author":13,"readingTime":752,"category":753,"tags":754,"ogImage":759,"featured":7,"body":760,"_type":740,"_id":1313,"_source":742,"_file":1314,"_stem":1315,"_extension":745},"\u002Farticles\u002F31-crypto-wallet-exchange-device-discovery","Discovery for wallets, exchanges, and devices: beyond the CSV","Draft discovery requests for native exchange data, device records, and authentication history, not bare CSVs, so your expert can tie transactions to users.","crypto-wallet-exchange-device-discovery","2026-07-11",13,"Legal Reference",[755,756,18,757,758],"discovery","exchange-records","device-forensics","kyc","\u002Fog\u002Fcrypto-wallet-exchange-device-discovery.png",{"type":24,"children":761,"toc":1282},[762,767,773,778,792,798,803,827,840,846,851,874,879,885,890,896,901,907,912,918,923,929,934,940,945,958,964,977,983,988,994,999,1005,1010,1038,1044,1049,1062,1068,1073,1096,1101,1107,1150,1156,1161,1166,1172,1184,1188,1194,1203,1209,1218,1224,1240,1246,1263],{"type":27,"tag":28,"props":763,"children":764},{},[765],{"type":32,"value":766},"A party may produce a CSV labeled \"transaction history\" that lacks a timezone, field definitions, reconcilable identifiers, or documented fiat-conversion rates. Such an export may be inadequate for reconstruction. This article is about drafting discovery so that does not happen: requests to parties, exchanges, and devices that deliver native data, schemas, identifiers, timestamps, and authentication history. The working assumption is federal practice; state rules vary, so check the forum's counterpart.",{"type":27,"tag":35,"props":768,"children":770},{"id":769},"why-a-transaction-csv-is-not-enough",[771],{"type":32,"value":772},"Why a Transaction CSV Is Not Enough",{"type":27,"tag":28,"props":774,"children":775},{},[776],{"type":32,"value":777},"A recurring discovery failure is accepting a summary export as the production. A CSV from an exchange's reporting tab may be a curated customer view rather than a record set built for reconstruction: it may omit internal transfers or failed orders, convert amounts to fiat at undocumented rates, truncate identifiers, or log times in a local timezone.",{"type":27,"tag":28,"props":779,"children":780},{},[781,783,790],{"type":32,"value":782},"Rule 34(b)(1)(C) permits the request to specify the form or forms in which ESI will be produced (",{"type":27,"tag":47,"props":784,"children":787},{"href":785,"rel":786},"https:\u002F\u002Fwww.uscourts.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fdocument\u002Ffederal-rules-of-civil-procedure.pdf",[51],[788],{"type":32,"value":789},"Federal Rules of Civil Procedure, amended through December 1, 2025",{"type":32,"value":791},"). If no form is specified, Rule 34(b)(2)(E) requires production in a form in which the information is ordinarily maintained or in a reasonably usable form. A party need not produce the same ESI in more than one form. If the request omits a form, or the responding party objects to the requested form, Rule 34(b)(2)(D) requires the responding party to state the form or forms it intends to use. Specify the form up front so the issue is addressed in the response, not after the expert receives an unusable production.",{"type":27,"tag":35,"props":793,"children":795},{"id":794},"start-with-the-disputed-propositions-then-map-each-to-a-record-source",[796],{"type":32,"value":797},"Start with the Disputed Propositions, Then Map Each to a Record Source",{"type":27,"tag":28,"props":799,"children":800},{},[801],{"type":32,"value":802},"Draft backward from what the case must prove, then name the record source for each proposition:",{"type":27,"tag":804,"props":805,"children":806},"ul",{},[807,812,817,822],{"type":27,"tag":210,"props":808,"children":809},{},[810],{"type":32,"value":811},"\"X held the account\" maps to registration records, KYC verification steps with dates, linked payment methods, and assigned deposit addresses.",{"type":27,"tag":210,"props":813,"children":814},{},[815],{"type":32,"value":816},"\"X controlled the withdrawal destination\" maps to withdrawal records with destination addresses, address book and whitelist entries with add dates, and withdrawal approvals.",{"type":27,"tag":210,"props":818,"children":819},{},[820],{"type":32,"value":821},"\"The transfers were authorized by X\" maps to authentication history: logins, sessions, device identifiers, two-factor changes, API key usage.",{"type":27,"tag":210,"props":823,"children":824},{},[825],{"type":32,"value":826},"\"The amounts and values on the relevant dates\" maps to order and trade records with native timestamps; \"X knew about or directed the activity\" maps to support tickets, chat logs, and the party's own communications.",{"type":27,"tag":28,"props":828,"children":829},{},[830,832,838],{"type":32,"value":831},"That source list should come from an expert who knows which fields an export must contain and which records exist only internally; that expertise defines the categories a ",{"type":27,"tag":47,"props":833,"children":835},{"href":834},"\u002Fservices#evidence-review",[836],{"type":32,"value":837},"discovery and evidence review engagement",{"type":32,"value":839}," can verify before the RFP goes out, cheaper than a motion to compel after an unusable production.",{"type":27,"tag":35,"props":841,"children":843},{"id":842},"what-to-request-native-data-schemas-and-field-definitions",[844],{"type":32,"value":845},"What to Request: Native Data, Schemas, and Field Definitions",{"type":27,"tag":28,"props":847,"children":848},{},[849],{"type":32,"value":850},"Name actual record categories rather than asking for \"all documents relating to cryptocurrency.\" For each category, specify:",{"type":27,"tag":804,"props":852,"children":853},{},[854,859,864,869],{"type":27,"tag":210,"props":855,"children":856},{},[857],{"type":32,"value":858},"Structured export format (CSV or JSON with full precision) with a schema or data dictionary defining every field, not PDFs or screenshots.",{"type":27,"tag":210,"props":860,"children":861},{},[862],{"type":32,"value":863},"Field definitions for identifiers: account identifier, wallet address, transaction hash, order identifier, internal transfer identifier.",{"type":27,"tag":210,"props":865,"children":866},{},[867],{"type":32,"value":868},"All timestamps in UTC with the source timezone documented, plus block height where relevant.",{"type":27,"tag":210,"props":870,"children":871},{},[872],{"type":32,"value":873},"Amounts in the asset's base units or with the exchange's recorded rate, and chain and network identifiers so exports from different sources can be joined.",{"type":27,"tag":28,"props":875,"children":876},{},[877],{"type":32,"value":878},"This is not a demand for the exchange's internal database; it is a demand for exports plus the documentation that makes them legible. Where a party operates its own Ethereum node, name the block, transaction, and receipt objects and fields needed rather than accepting any flat export.",{"type":27,"tag":97,"props":880,"children":882},{"id":881},"form-specifications-that-survive-objections",[883],{"type":32,"value":884},"Form specifications that survive objections",{"type":27,"tag":28,"props":886,"children":887},{},[888],{"type":32,"value":889},"Three habits keep these requests defensible. Tie each form specification to usability: the specified form is needed to reconcile the production against blockchain data and other productions, and Rule 34(b)(1)(C) lets the request name that form. Ask for one form per category, since a party need not produce the same ESI in more than one form. Anticipate an objection that a source is not reasonably accessible because of undue burden or cost under Rule 26(b)(2)(B): scope requests to the disputed period and be ready to show good cause if the source is an encrypted legacy backup.",{"type":27,"tag":35,"props":891,"children":893},{"id":892},"beyond-transactions-account-authentication-and-device-records",[894],{"type":32,"value":895},"Beyond Transactions: Account, Authentication, and Device Records",{"type":27,"tag":28,"props":897,"children":898},{},[899],{"type":32,"value":900},"Transaction exports capture value movement, not the account-level facts that tie movement to a person.",{"type":27,"tag":97,"props":902,"children":904},{"id":903},"account-lifecycle-records",[905],{"type":32,"value":906},"Account lifecycle records",{"type":27,"tag":28,"props":908,"children":909},{},[910],{"type":32,"value":911},"Request registration data, KYC steps with dates and outcomes, linked payment methods, every deposit address assigned, and address book and whitelist entries with add dates, often correlating with the disputed transfers. Also request hold, freeze, and flag records with the reasons recorded; a compliance flag is itself a relevant fact about the account.",{"type":27,"tag":97,"props":913,"children":915},{"id":914},"authentication-and-access-history",[916],{"type":32,"value":917},"Authentication and access history",{"type":27,"tag":28,"props":919,"children":920},{},[921],{"type":32,"value":922},"Login events with IP addresses and device fingerprints, session records, password and two-factor changes, recovery code issuance, and new-device notifications. This separates \"the account was used\" from \"the party used the account,\" and the fingerprints later reconcile against the device production.",{"type":27,"tag":97,"props":924,"children":926},{"id":925},"api-keys-and-automated-activity",[927],{"type":32,"value":928},"API keys and automated activity",{"type":27,"tag":28,"props":930,"children":931},{},[932],{"type":32,"value":933},"Request API key creation, scopes, last-use timestamps, and, if retained, the hosts from which keys were used. These records can help test a claim that a bot initiated transfers the party denies authorizing.",{"type":27,"tag":97,"props":935,"children":937},{"id":936},"support-and-communications-records",[938],{"type":32,"value":939},"Support and communications records",{"type":27,"tag":28,"props":941,"children":942},{},[943],{"type":32,"value":944},"Support tickets, chat logs, and emails, including KYC appeals and fraud reports, often contain the party's own admissions about the account and activity.",{"type":27,"tag":28,"props":946,"children":947},{},[948,950,956],{"type":32,"value":949},"The mechanics of enforcing these categories against nonparties are covered in ",{"type":27,"tag":47,"props":951,"children":953},{"href":952},"\u002Fresources\u002Fsubpoenaing-cryptocurrency-exchange-records",[954],{"type":32,"value":955},"how to subpoena cryptocurrency exchange records",{"type":32,"value":957},"; the point here is that party discovery and nonparty subpoenas should be one system. Serve the party first for identifiers and device records, then feed those identifiers into the exchange subpoena so the exchange searches by email, phone, and wallet address. If the party cooperates, consider a signed authorization to the exchange as an additional avenue for requesting account records.",{"type":27,"tag":35,"props":959,"children":961},{"id":960},"device-and-app-records-the-self-custody-evidence-layer",[962],{"type":32,"value":963},"Device and App Records: The Self-Custody Evidence Layer",{"type":27,"tag":28,"props":965,"children":966},{},[967,969,975],{"type":32,"value":968},"For self-custody wallets there is no institution holding records; the evidence lives on devices and in the party's files. Device production is a Rule 34 request too: phones, computers, and hardware wallets are tangible things within the scope of ",{"type":27,"tag":47,"props":970,"children":972},{"href":785,"rel":971},[51],[973],{"type":32,"value":974},"Rule 34(a)(1)",{"type":32,"value":976},", and the ESI on them is within the same rule.",{"type":27,"tag":97,"props":978,"children":980},{"id":979},"wallet-software-and-browser-extensions",[981],{"type":32,"value":982},"Wallet software and browser extensions",{"type":27,"tag":28,"props":984,"children":985},{},[986],{"type":32,"value":987},"Request installed wallet applications, app data directories, local databases, configuration files, and logs, plus browser extension storage. App data may persist after uninstall, though a qualified examiner must determine whether any artifact is recoverable. Seed material in notes apps, password managers, photos, and cloud documents belongs in the same category, requested explicitly.",{"type":27,"tag":97,"props":989,"children":991},{"id":990},"hardware-wallets",[992],{"type":32,"value":993},"Hardware wallets",{"type":27,"tag":28,"props":995,"children":996},{},[997],{"type":32,"value":998},"The device itself can be produced for examination, and its companion application may leave address and transaction artifacts on the host computer. The most productive target is often that computer: request connection artifacts, app install history, and records of which addresses the party managed through the device.",{"type":27,"tag":97,"props":1000,"children":1002},{"id":1001},"backups-seed-material-and-signed-messages",[1003],{"type":32,"value":1004},"Backups, seed material, and signed messages",{"type":27,"tag":28,"props":1006,"children":1007},{},[1008],{"type":32,"value":1009},"Request cloud backups of wallet data, password manager exports, encrypted containers, and any written or photographed seed phrase material. Where control of an address is disputed, request a signed message from it: a valid signature demonstrates that the signer controlled the relevant private key at the time of signing without disclosing the key. A refusal may become a factual issue, but it is not proof by itself.",{"type":27,"tag":28,"props":1011,"children":1012},{},[1013,1015,1022,1024,1029,1031,1036],{"type":32,"value":1014},"Collection integrity is the expert's prerequisite. The four-phase forensic process in ",{"type":27,"tag":47,"props":1016,"children":1019},{"href":1017,"rel":1018},"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F86\u002Ffinal",[51],[1020],{"type":32,"value":1021},"NIST SP 800-86",{"type":32,"value":1023}," (published by NIST in August 2006) runs collection, examination, analysis, and reporting, with data integrity preserved through collection and examination. Devices should be imaged under a defensible protocol with hashing and documented chain of custody, and the request should permit that methodology rather than demanding raw devices with no safeguards. See ",{"type":27,"tag":47,"props":1025,"children":1026},{"href":247},[1027],{"type":32,"value":1028},"understanding wallet ownership evidence",{"type":32,"value":1030}," for the evidence types that establish control, and ",{"type":27,"tag":47,"props":1032,"children":1033},{"href":522},[1034],{"type":32,"value":1035},"self-custody vs. custodial wallets",{"type":32,"value":1037}," for how custody changes what records exist.",{"type":27,"tag":35,"props":1039,"children":1041},{"id":1040},"interrogatories-and-rule-30b6-depositions-explain-the-system",[1042],{"type":32,"value":1043},"Interrogatories and Rule 30(b)(6) Depositions: Explain the System",{"type":27,"tag":28,"props":1045,"children":1046},{},[1047],{"type":32,"value":1048},"Interrogatories describe; native ESI proves. Use interrogatories (Rule 33) to ask the party to identify every exchange account, wallet address, device, application, and key-storage location, and to state whether any data was deleted or migrated during the relevant period. The answers become the roadmap for the RFP. They do not substitute for production: responsive records still must come out in usable form under Rule 34, and describing records is not producing them.",{"type":27,"tag":28,"props":1050,"children":1051},{},[1052,1054,1060],{"type":32,"value":1053},"Rule 30(b)(6) depositions fill the explanatory gap for organizational parties. The notice must describe the matters for examination with reasonable particularity, and the named organization must designate one or more people to testify about information known or reasonably available to it. Useful topics for an exchange include schema, export methodology, retention periods, KYC process, key custody, and API logging. For an individual party, use an ordinary Rule 30(b)(1) deposition to cover which devices and applications were used, how keys were stored, and what happened to the account during the dispute window. Depose after production so the deponent can be walked through the actual exports. For nonparties, the same explanation can be compelled with a deposition subpoena under ",{"type":27,"tag":47,"props":1055,"children":1057},{"href":785,"rel":1056},[51],[1058],{"type":32,"value":1059},"Rule 45",{"type":32,"value":1061},", which also permits designating the form of production.",{"type":27,"tag":35,"props":1063,"children":1065},{"id":1064},"model-request-categories-and-proportionality-limits",[1066],{"type":32,"value":1067},"Model Request Categories and Proportionality Limits",{"type":27,"tag":28,"props":1069,"children":1070},{},[1071],{"type":32,"value":1072},"A defensible RFP structure for a digital asset matter:",{"type":27,"tag":206,"props":1074,"children":1075},{},[1076,1081,1086,1091],{"type":27,"tag":210,"props":1077,"children":1078},{},[1079],{"type":32,"value":1080},"Native exports with schemas and field definitions for account, trade, order, deposit, withdrawal, and transfer records, in the specified form.",{"type":27,"tag":210,"props":1082,"children":1083},{},[1084],{"type":32,"value":1085},"Account, authentication, API key, and support records as specified in the sections above.",{"type":27,"tag":210,"props":1087,"children":1088},{},[1089],{"type":32,"value":1090},"Device records: wallet applications, app data, extension storage, backups, seed and key material in any form, and device production for imaging where self-custody control is disputed.",{"type":27,"tag":210,"props":1092,"children":1093},{},[1094],{"type":32,"value":1095},"Explanatory records: written procedures, export documentation, and any tool used to generate the production.",{"type":27,"tag":28,"props":1097,"children":1098},{},[1099],{"type":32,"value":1100},"Handle proportionality in the drafting. Rule 26(b)(1) limits discovery to nonprivileged matter that is relevant to any party's claim or defense and proportional to the needs of the case. Scope time periods to the dispute, limit imaging to the custodians that matter, and stagger requests so account records come first and device production follows only if the dispute turns on self-custody control. The proposed discovery plan under Rule 26(f) must state the parties' views and proposals on ESI issues, including the form or forms in which ESI should be produced, and the scheduling order may include ESI preservation terms under Rule 16(b). Issue a litigation hold early: Rule 37(e) applies when ESI that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery, so the preservation letter should name these categories rather than \"all records.\"",{"type":27,"tag":97,"props":1102,"children":1104},{"id":1103},"practitioner-checklist",[1105],{"type":32,"value":1106},"Practitioner checklist",{"type":27,"tag":206,"props":1108,"children":1109},{},[1110,1115,1120,1125,1130,1135,1140,1145],{"type":27,"tag":210,"props":1111,"children":1112},{},[1113],{"type":32,"value":1114},"Build the proposition-to-source map with the expert before any RFP.",{"type":27,"tag":210,"props":1116,"children":1117},{},[1118],{"type":32,"value":1119},"Serve a preservation notice covering the categories above.",{"type":27,"tag":210,"props":1121,"children":1122},{},[1123],{"type":32,"value":1124},"Serve RFPs with explicit form specifications, schema demands, and date ranges.",{"type":27,"tag":210,"props":1126,"children":1127},{},[1128],{"type":32,"value":1129},"Serve interrogatories requiring identification of accounts, addresses, devices, applications, and deletions.",{"type":27,"tag":210,"props":1131,"children":1132},{},[1133],{"type":32,"value":1134},"Designate Rule 30(b)(6) topics against an organizational party and any custodial exchange.",{"type":27,"tag":210,"props":1136,"children":1137},{},[1138],{"type":32,"value":1139},"Coordinate nonparty subpoenas using produced identifiers, with party authorizations.",{"type":27,"tag":210,"props":1141,"children":1142},{},[1143],{"type":32,"value":1144},"Have the expert reconcile exchange exports against the blockchain and both against device evidence.",{"type":27,"tag":210,"props":1146,"children":1147},{},[1148],{"type":32,"value":1149},"If productions arrive without schemas or in unusable form, move to compel on the form specification.",{"type":27,"tag":35,"props":1151,"children":1153},{"id":1152},"reconciling-productions-a-worked-hypothetical",[1154],{"type":32,"value":1155},"Reconciling Productions: A Worked Hypothetical",{"type":27,"tag":28,"props":1157,"children":1158},{},[1159],{"type":32,"value":1160},"Hypothetical example: In a business divorce, the company's exchange account shows a withdrawal of 40 ETH to a wallet address, and the other side claims the address belongs to an unrelated third party repaying a loan. The native export shows the withdrawal with a transaction hash, a UTC timestamp, and an address book entry the account holder added for that destination 11 days earlier. The exchange's Rule 30(b)(6) deponent confirms address book entries are added only through authenticated sessions. Blockchain data confirms the hash and the recipient's later activity. Device production from the company laptop shows a browser extension vault and a photo of a seed phrase, and the expert verifies the derived addresses match the recipient. Each layer checks against the others: exchange records tie the company to the withdrawal, the address book ties the destination to the holder's action, and the device evidence ties it to the party personally.",{"type":27,"tag":28,"props":1162,"children":1163},{},[1164],{"type":32,"value":1165},"Now the same case with a badly drafted production: a PDF statement with local times, dollar-converted amounts, and no hashes. The expert cannot match the withdrawal to the blockchain, the address connects to no one, and the gap becomes a factual fight. That outcome was decided when the RFP was drafted.",{"type":27,"tag":97,"props":1167,"children":1169},{"id":1168},"limitations-what-discovery-cannot-fix",[1170],{"type":32,"value":1171},"Limitations: what discovery cannot fix",{"type":27,"tag":28,"props":1173,"children":1174},{},[1175,1177,1182],{"type":32,"value":1176},"Requests cannot manufacture records that never existed. Foreign and non-KYC platforms may sit beyond domestic process, decentralized protocols leave no record-holder to subpoena, retention windows may already have closed for login logs, and an encrypted device can block examination until the court addresses it. Shared keys and multisig arrangements complicate attribution even with perfect records. Where these limits bind, the case narrows to what the blockchain shows and what disclosure obligations require, which is one more reason to run ",{"type":27,"tag":47,"props":1178,"children":1179},{"href":701},[1180],{"type":32,"value":1181},"blockchain tracing",{"type":32,"value":1183}," in parallel with discovery rather than waiting for productions.",{"type":27,"tag":35,"props":1185,"children":1186},{"id":605},[1187],{"type":32,"value":608},{"type":27,"tag":97,"props":1189,"children":1191},{"id":1190},"q-can-i-compel-production-of-a-phone-computer-or-hardware-wallet-for-forensic-examination-in-civil-discovery",[1192],{"type":32,"value":1193},"Q: Can I compel production of a phone, computer, or hardware wallet for forensic examination in civil discovery?",{"type":27,"tag":28,"props":1195,"children":1196},{},[1197,1201],{"type":27,"tag":619,"props":1198,"children":1199},{},[1200],{"type":32,"value":623},{"type":32,"value":1202}," Devices are tangible things within the scope of Rule 34(a)(1), and the ESI on them is discoverable like any other electronically stored information, subject to relevance and proportionality under Rule 26(b)(1). Courts manage privacy and burden through protective orders, search protocols, special masters, or limits on custodians and timeframes. Because devices get replaced or wiped, request device production early and pair it with a preservation notice.",{"type":27,"tag":97,"props":1204,"children":1206},{"id":1205},"q-what-if-the-exchange-produces-a-csv-with-no-field-definitions-or-timezone-information",[1207],{"type":32,"value":1208},"Q: What if the exchange produces a CSV with no field definitions or timezone information?",{"type":27,"tag":28,"props":1210,"children":1211},{},[1212,1216],{"type":27,"tag":619,"props":1213,"children":1214},{},[1215],{"type":32,"value":623},{"type":32,"value":1217}," If you specified a structured form, it may be the wrong form. Rule 34(b)(1)(C) lets the request name the form, for example a structured CSV or JSON rather than a PDF statement. If you requested schemas, documented timezones, and full identifiers as their own categories, assess any response or objection to those categories against the rules and the case-specific order. Have the expert document which fields are missing and why they cannot be joined to the blockchain or to other productions; that turns a format dispute into a concrete showing.",{"type":27,"tag":97,"props":1219,"children":1221},{"id":1220},"q-are-interrogatory-answers-enough-to-establish-who-controlled-a-wallet",[1222],{"type":32,"value":1223},"Q: Are interrogatory answers enough to establish who controlled a wallet?",{"type":27,"tag":28,"props":1225,"children":1226},{},[1227,1231,1233,1239],{"type":27,"tag":619,"props":1228,"children":1229},{},[1230],{"type":32,"value":623},{"type":32,"value":1232}," No. Answers are useful evidence and can be used to impeach if contradicted, but they describe facts; they do not substitute for responsive records that must be produced in native, usable form under Rule 34. That form lets the expert verify addresses, hashes, and timestamps against the blockchain. Treat interrogatories as the map and the production as the territory. For how control is proven once records exist, see ",{"type":27,"tag":47,"props":1234,"children":1236},{"href":1235},"\u002Fresources\u002Fblockchain-analyst-vs-expert-witness",[1237],{"type":32,"value":1238},"the difference between a blockchain analyst and an expert witness",{"type":32,"value":527},{"type":27,"tag":97,"props":1241,"children":1243},{"id":1242},"q-when-should-i-bring-a-forensic-expert-into-the-discovery-process",[1244],{"type":32,"value":1245},"Q: When should I bring a forensic expert into the discovery process?",{"type":27,"tag":28,"props":1247,"children":1248},{},[1249,1253,1255,1261],{"type":27,"tag":619,"props":1250,"children":1251},{},[1252],{"type":32,"value":623},{"type":32,"value":1254}," At the drafting stage, not after the first production. The expert determines which fields an exchange export must contain, which records exist only internally, and what form the data needs to reconcile against the chain and device evidence. Early engagement converts vague requests into specific ones, shortens the meet-and-confer, and strengthens a motion to compel if the production still comes back unusable. For custody disputes over self-custody assets, an early ",{"type":27,"tag":47,"props":1256,"children":1258},{"href":1257},"\u002Fservices#expert-witness",[1259],{"type":32,"value":1260},"expert witness consultation",{"type":32,"value":1262}," also shapes the Rule 30(b)(6) topics before depositions are noticed.",{"type":27,"tag":28,"props":1264,"children":1265},{},[1266,1268,1273,1275,1280],{"type":32,"value":1267},"Rules differ by court and by state: Missouri's general provision governing discovery, for example, is in Rule 56.01, and federal districts impose their own ESI protocols. The right request set depends on the disputes and the exchanges and devices involved. If you are drafting discovery in a matter that touches wallets, exchanges, or devices, I am available to discuss the request categories and the ",{"type":27,"tag":47,"props":1269,"children":1270},{"href":597},[1271],{"type":32,"value":1272},"ConsensusIntel methodology",{"type":32,"value":1274}," for this kind of reconstruction. ",{"type":27,"tag":47,"props":1276,"children":1277},{"href":693},[1278],{"type":32,"value":1279},"Contact me",{"type":32,"value":1281}," with the facts of your matter.",{"title":8,"searchDepth":716,"depth":716,"links":1283},[1284,1285,1286,1289,1295,1300,1301,1304,1307],{"id":769,"depth":716,"text":772},{"id":794,"depth":716,"text":797},{"id":842,"depth":716,"text":845,"children":1287},[1288],{"id":881,"depth":722,"text":884},{"id":892,"depth":716,"text":895,"children":1290},[1291,1292,1293,1294],{"id":903,"depth":722,"text":906},{"id":914,"depth":722,"text":917},{"id":925,"depth":722,"text":928},{"id":936,"depth":722,"text":939},{"id":960,"depth":716,"text":963,"children":1296},[1297,1298,1299],{"id":979,"depth":722,"text":982},{"id":990,"depth":722,"text":993},{"id":1001,"depth":722,"text":1004},{"id":1040,"depth":716,"text":1043},{"id":1064,"depth":716,"text":1067,"children":1302},[1303],{"id":1103,"depth":722,"text":1106},{"id":1152,"depth":716,"text":1155,"children":1305},[1306],{"id":1168,"depth":722,"text":1171},{"id":605,"depth":716,"text":608,"children":1308},[1309,1310,1311,1312],{"id":1190,"depth":722,"text":1193},{"id":1205,"depth":722,"text":1208},{"id":1220,"depth":722,"text":1223},{"id":1242,"depth":722,"text":1245},"content:articles:31-crypto-wallet-exchange-device-discovery.md","articles\u002F31-crypto-wallet-exchange-device-discovery.md","articles\u002F31-crypto-wallet-exchange-device-discovery",{"_path":1317,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":1318,"description":1319,"slug":1320,"date":1321,"lastUpdated":1321,"author":13,"readingTime":14,"category":15,"tags":1322,"ogImage":1327,"featured":7,"body":1328,"_type":740,"_id":1915,"_source":742,"_file":1916,"_stem":1917,"_extension":745},"\u002Farticles\u002F30-preserving-crypto-native-esi","Preserving crypto-native ESI before it disappears","Preserve crypto-native evidence before it disappears: wallets, devices, exchange records, and browser data, with a defensible hold and Rule 37(e) context.","preserving-crypto-native-esi","2026-07-04",[1323,1324,1325,1326,18],"e-discovery","litigation-hold","spoliation","evidence-preservation","\u002Fog\u002Fpreserving-crypto-native-esi.png",{"type":24,"children":1329,"toc":1889},[1330,1335,1355,1361,1366,1400,1406,1419,1433,1438,1444,1456,1461,1484,1503,1509,1537,1542,1575,1581,1587,1592,1598,1603,1609,1614,1620,1625,1631,1645,1651,1665,1679,1684,1690,1696,1745,1751,1779,1785,1798,1802,1808,1817,1823,1832,1838,1847,1853,1862,1868,1877],{"type":27,"tag":28,"props":1331,"children":1332},{},[1333],{"type":32,"value":1334},"A wallet's transaction history can outlive the apps that produced it, but the evidence that gives it meaning rarely does: the wallet app, the browser extension, the exchange dashboard, the signed message, the device clock. This is crypto-native ESI: it exists only in software, with no paper equivalent. The public ledger may persist for decades; the context needed to interpret control, intent, and application state can disappear within days of a party learning they are under scrutiny.",{"type":27,"tag":28,"props":1336,"children":1337},{},[1338,1340,1346,1348,1353],{"type":32,"value":1339},"That ephemerality is the operational question: when the preservation duty attaches, what must be saved, in what order, and how, without mishandling private keys? ",{"type":27,"tag":47,"props":1341,"children":1343},{"href":1342},"\u002Fresources\u002Fcommon-mistakes-crypto-investigations",[1344],{"type":32,"value":1345},"Common Mistakes in Cryptocurrency Investigations",{"type":32,"value":1347}," catalogs errors that compromise a case, and ",{"type":27,"tag":47,"props":1349,"children":1350},{"href":522},[1351],{"type":32,"value":1352},"Self-Custody vs. Custodial Wallets",{"type":32,"value":1354}," maps the evidence profile of each custody model; this article supplies the affirmative workflow both skip. The frame is U.S. federal civil practice; state courts, regulatory proceedings, and criminal matters apply different standards.",{"type":27,"tag":35,"props":1356,"children":1358},{"id":1357},"what-counts-as-crypto-native-esi",[1359],{"type":32,"value":1360},"What Counts as Crypto-Native ESI",{"type":27,"tag":28,"props":1362,"children":1363},{},[1364],{"type":32,"value":1365},"Inventory all five evidence systems before any collection happens. Analysis can wait; the artifacts cannot.",{"type":27,"tag":804,"props":1367,"children":1368},{},[1369,1374,1385,1390,1395],{"type":27,"tag":210,"props":1370,"children":1371},{},[1372],{"type":32,"value":1373},"Public ledger infrastructure: chains, block explorers, archival nodes, indexers. Durable, pseudonymous, reproducible by anyone.",{"type":27,"tag":210,"props":1375,"children":1376},{},[1377,1379,1384],{"type":32,"value":1378},"Custodial platforms: exchanges, custodians, on-ramps and off-ramps. Internal ledgers (many exchanges pool customer funds and track balances off-chain), KYC files, IP logs, and support tickets are institutional records reached through legal process. See ",{"type":27,"tag":47,"props":1380,"children":1381},{"href":952},[1382],{"type":32,"value":1383},"Subpoenaing Cryptocurrency Exchange Records",{"type":32,"value":527},{"type":27,"tag":210,"props":1386,"children":1387},{},[1388],{"type":32,"value":1389},"Client devices: phones, laptops, tablets, hardware wallets. Wallet app data, browser extensions, notes, password managers, and transaction files live here; the custody model decides how much exists on device versus platform.",{"type":27,"tag":210,"props":1391,"children":1392},{},[1393],{"type":32,"value":1394},"Application-layer records: dApp dashboards, portfolio trackers, tax exports, API responses.",{"type":27,"tag":210,"props":1396,"children":1397},{},[1398],{"type":32,"value":1399},"Communications: email, messaging, exchange support threads, where control, knowledge, and intent are expressed in plain language.",{"type":27,"tag":35,"props":1401,"children":1403},{"id":1402},"what-the-chain-keeps-and-what-it-cannot",[1404],{"type":32,"value":1405},"What the Chain Keeps, and What It Cannot",{"type":27,"tag":28,"props":1407,"children":1408},{},[1409,1411,1417],{"type":32,"value":1410},"Public chain records are effectively permanent and reproducible from archival sources years later. That durability matters under Rule 37(e) of the ",{"type":27,"tag":47,"props":1412,"children":1414},{"href":785,"rel":1413},[51],[1415],{"type":32,"value":1416},"Federal Rules of Civil Procedure, as amended through December 1, 2025",{"type":32,"value":1418},", which governs ESI that \"cannot be restored or replaced through additional discovery.\" Since on-chain data can almost always be restored or replaced, spoliation disputes center on what the ledger never recorded: wallet app state, extension storage, cached balances, API responses, session data, and the local time and timezone settings that place activity in time.",{"type":27,"tag":28,"props":1420,"children":1421},{},[1422,1424,1431],{"type":32,"value":1423},"The collection-order principle is the order of volatility in ",{"type":27,"tag":47,"props":1425,"children":1428},{"href":1426,"rel":1427},"https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc3227.txt",[51],[1429],{"type":32,"value":1430},"RFC 3227",{"type":32,"value":1432},", the IETF guideline on evidence collection: proceed from the most volatile to the least, minimize changes, record the device clock's drift, and keep notes detailed enough to testify from years later. For crypto that runs from live screens and signed outputs, to application databases, to device images, to chain data. Chain analysis can wait a month; a phone that auto-updates, a browser that syncs, or a managed device with remote wipe cannot.",{"type":27,"tag":28,"props":1434,"children":1435},{},[1436],{"type":32,"value":1437},"Hypothetical example: A dispute turns on whether a party ever received or controlled an airdropped token that later moved to an exchange. The chain proves the tokens arrived and moved within a week; the dispositive questions are when the party knew and who controlled the wallet. On the day the dispute becomes foreseeable, counsel issues a hold covering the phone, browser profiles, and exchange account; the phone goes to airplane mode; the app database and extension state are hashed; the device clock is recorded; preservation letters go to the exchange. Months later the chain is rebuilt from public indexes and the exchange produces its records; the phone yields the install date and activity logs. A screenshot at filing captures none of that.",{"type":27,"tag":35,"props":1439,"children":1441},{"id":1440},"collecting-secrets-without-compromising-them",[1442],{"type":32,"value":1443},"Collecting Secrets Without Compromising Them",{"type":27,"tag":28,"props":1445,"children":1446},{},[1447,1449,1454],{"type":32,"value":1448},"A seed phrase is the master credential for a self-custody wallet: a fixed list of words, commonly 12 or 24 under the BIP-39 mnemonic standard, encoding the private keys so a holder can restore the wallet and spend it. The cardinal rule: never collect it by importing it; importing mutates application state and spreads the credential. How control is proven without key material is covered in ",{"type":27,"tag":47,"props":1450,"children":1451},{"href":247},[1452],{"type":32,"value":1453},"Understanding Wallet Ownership Evidence",{"type":32,"value":1455},". If a phrase or key file is found, preserve the medium in place: photograph where it was found, note who had access, secure it physically, and never transcribe it into case files or email.",{"type":27,"tag":28,"props":1457,"children":1458},{},[1459],{"type":32,"value":1460},"What you can collect safely:",{"type":27,"tag":804,"props":1462,"children":1463},{},[1464,1469,1474,1479],{"type":27,"tag":210,"props":1465,"children":1466},{},[1467],{"type":32,"value":1468},"Signed messages: a cryptographic signature from an address proves control without revealing the key or moving funds. The most useful non-destructive step.",{"type":27,"tag":210,"props":1470,"children":1471},{},[1472],{"type":32,"value":1473},"Secret metadata: file names, modification dates, and which app or vault holds the material, without contents, and when a vault was created or last accessed if determinable without opening it.",{"type":27,"tag":210,"props":1475,"children":1476},{},[1477],{"type":32,"value":1478},"Hardware-wallet presence: model, serial, firmware version, connection history. Keys generally cannot be extracted by standard forensic means, and resetting the device destroys the association between it and the addresses it controlled.",{"type":27,"tag":210,"props":1480,"children":1481},{},[1482],{"type":32,"value":1483},"Wallet application configuration and logs, excluding key databases.",{"type":27,"tag":28,"props":1485,"children":1486},{},[1487,1489,1494,1496,1501],{"type":32,"value":1488},"Key material is the one category where production itself is a harm: any handler gains the ability to move the client's entire estate, so extraction should be court-sanctioned, performed by an examiner under a defined protocol, and produced under seal or to a neutral. Designate who may touch it: a forensic examiner in a controlled, documented environment, and no one else. ",{"type":27,"tag":47,"props":1490,"children":1491},{"href":834},[1492],{"type":32,"value":1493},"ConsensusIntel's evidence review services",{"type":32,"value":1495}," are structured so collection never requires counsel to hold the keys, and our ",{"type":27,"tag":47,"props":1497,"children":1498},{"href":597},[1499],{"type":32,"value":1500},"methodology",{"type":32,"value":1502}," documents acquisitions end to end.",{"type":27,"tag":35,"props":1504,"children":1506},{"id":1505},"documentation-that-survives-cross-examination",[1507],{"type":32,"value":1508},"Documentation That Survives Cross-Examination",{"type":27,"tag":28,"props":1510,"children":1511},{},[1512,1514,1519,1521,1526,1528,1535],{"type":32,"value":1513},"A defensible collection is reproducible and explainable. ",{"type":27,"tag":47,"props":1515,"children":1517},{"href":1426,"rel":1516},[51],[1518],{"type":32,"value":1430},{"type":32,"value":1520}," requires transparent, reproducible methods and documented chain of custody, with notes detailed enough to testify from years later. ",{"type":27,"tag":47,"props":1522,"children":1524},{"href":1017,"rel":1523},[51],[1525],{"type":32,"value":1021},{"type":32,"value":1527},", the federal incident-response forensics guide (August 2006), applies the same discipline across hosts, applications, and network sources, from volatile to non-volatile data. ",{"type":27,"tag":47,"props":1529,"children":1532},{"href":1530,"rel":1531},"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F101\u002Fr1\u002Ffinal",[51],[1533],{"type":32,"value":1534},"NIST SP 800-101 Rev. 1",{"type":32,"value":1536}," (May 2014) defines preservation for mobile devices as maintaining custody without altering data, treats it as the first step in recovery, and warns that tool support varies with the operating system version and device family.",{"type":27,"tag":28,"props":1538,"children":1539},{},[1540],{"type":32,"value":1541},"Every acquisition should record:",{"type":27,"tag":804,"props":1543,"children":1544},{},[1545,1550,1555,1560,1565,1570],{"type":27,"tag":210,"props":1546,"children":1547},{},[1548],{"type":32,"value":1549},"Who collected, what, when, where, and by what method.",{"type":27,"tag":210,"props":1551,"children":1552},{},[1553],{"type":32,"value":1554},"Device and software identifiers: operating system build, wallet app version, extension versions, firmware.",{"type":27,"tag":210,"props":1556,"children":1557},{},[1558],{"type":32,"value":1559},"Chain identifiers: mainnet versus testnet is a routine source of confusion; record the chain ID, block height range, and the source used.",{"type":27,"tag":210,"props":1561,"children":1562},{},[1563],{"type":32,"value":1564},"Time source: device clock, timezone, network time, and observed drift at acquisition. Block timestamps are consensus-claimed times, not precise clocks; correlating them with device logs requires both offsets.",{"type":27,"tag":210,"props":1566,"children":1567},{},[1568],{"type":32,"value":1569},"Hash digests, for example SHA-256, of every image and export, computed at collection and again at handoff.",{"type":27,"tag":210,"props":1571,"children":1572},{},[1573],{"type":32,"value":1574},"Custody history: who held each device or exhibit, when, and how transfers occurred.",{"type":27,"tag":35,"props":1576,"children":1578},{"id":1577},"five-threats-between-the-hold-and-the-expert",[1579],{"type":32,"value":1580},"Five Threats Between the Hold and the Expert",{"type":27,"tag":97,"props":1582,"children":1584},{"id":1583},"remote-wipe-and-managed-devices",[1585],{"type":32,"value":1586},"Remote wipe and managed devices",{"type":27,"tag":28,"props":1588,"children":1589},{},[1590],{"type":32,"value":1591},"Managed phones can be remotely wiped on command, and NIST SP 800-101 describes device applications written to trigger exactly that. Isolate devices from networks immediately, suspend remote-wipe commands with IT first, and record network state at seizure.",{"type":27,"tag":97,"props":1593,"children":1595},{"id":1594},"automatic-updates",[1596],{"type":32,"value":1597},"Automatic updates",{"type":27,"tag":28,"props":1599,"children":1600},{},[1601],{"type":32,"value":1602},"Wallet apps and browser extensions update silently, rewriting local databases and changing versions. Where the user cooperates, disable auto-update before collection and snapshot the pre-update state; otherwise, ask about update history in discovery.",{"type":27,"tag":97,"props":1604,"children":1606},{"id":1605},"cloud-sync",[1607],{"type":32,"value":1608},"Cloud sync",{"type":27,"tag":28,"props":1610,"children":1611},{},[1612],{"type":32,"value":1613},"Cloud services synchronize photos, notes, and vaults across devices; deletions propagate automatically, but backups are also a preservation source when a device is gone or reset. Map what syncs before anyone changes a setting, and cover the backup account in the hold.",{"type":27,"tag":97,"props":1615,"children":1617},{"id":1616},"browser-extension-data",[1618],{"type":32,"value":1619},"Browser-extension data",{"type":27,"tag":28,"props":1621,"children":1622},{},[1623],{"type":32,"value":1624},"Wallet browser extensions keep authoritative state in local storage and profiles: connected sites, activity logs, account addresses, settings. That state is often the only surviving record of how a wallet was used. Preserve it in place or by forensic copy and record the extension version; popup screenshots are documentation, not collection.",{"type":27,"tag":97,"props":1626,"children":1628},{"id":1627},"exchange-retention-and-account-closure",[1629],{"type":32,"value":1630},"Exchange retention and account closure",{"type":27,"tag":28,"props":1632,"children":1633},{},[1634,1636,1643],{"type":32,"value":1635},"Institutional records have their own clocks. Under ",{"type":27,"tag":47,"props":1637,"children":1640},{"href":1638,"rel":1639},"https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F31\u002F1010.430",[51],[1641],{"type":32,"value":1642},"31 C.F.R. § 1010.430(d)",{"type":32,"value":1644},", records FinCEN's rules require covered financial institutions to retain must be kept five years, including amounts, execution dates, and payment instructions for transmittals of funds (31 C.F.R. § 1010.410(e)). Many platforms are not covered entities or are foreign, retaining for shorter contractual windows. Send a hold letter and serve process promptly; in federal practice, Rule 26(d)(2) lets a party deliver Rule 34 requests more than 21 days after service, treated as served at the first Rule 26(f) conference. Capture account state read-only with a witness, hash it, and treat it as supplementation, never a replacement: unilateral logins can trigger security holds.",{"type":27,"tag":35,"props":1646,"children":1648},{"id":1647},"rule-26-and-rule-37e-the-legal-frame-around-preservation",[1649],{"type":32,"value":1650},"Rule 26 and Rule 37(e): The Legal Frame Around Preservation",{"type":27,"tag":28,"props":1652,"children":1653},{},[1654,1656,1663],{"type":32,"value":1655},"The duty to preserve arises when litigation is reasonably anticipated, before a complaint is filed. Rule 26(b)(1) shapes the scope: discovery is limited to nonprivileged matter relevant to a claim or defense and proportional to the needs of the case, weighing the issues at stake, the amount in controversy, the parties' relative access to information, their resources, and burden versus benefit (",{"type":27,"tag":47,"props":1657,"children":1660},{"href":1658,"rel":1659},"https:\u002F\u002Fwww.law.cornell.edu\u002Frules\u002Ffrcp\u002Frule_26",[51],[1661],{"type":32,"value":1662},"Rule 26",{"type":32,"value":1664},"). Proportionality is both the tool for resisting over-collection and the justification for a scoped plan in a small matter; document why each step was taken.",{"type":27,"tag":28,"props":1666,"children":1667},{},[1668,1670,1677],{"type":32,"value":1669},"Rule 37(e) governs when preserved ESI is lost anyway. If ESI that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps, and it cannot be restored or replaced through additional discovery, the court may order measures no greater than necessary to cure resulting prejudice; adverse-inference instructions, dismissal, or default judgment are available only on a finding of intent to deprive (",{"type":27,"tag":47,"props":1671,"children":1674},{"href":1672,"rel":1673},"https:\u002F\u002Fwww.law.cornell.edu\u002Frules\u002Ffrcp\u002Frule_37",[51],[1675],{"type":32,"value":1676},"Rule 37(e)",{"type":32,"value":1678},"). It is not a hold-issuance checklist; the advisory committee note to the 2015 amendment states that it \"recognizes that 'reasonable steps' to preserve suffice; it does not call for perfection.\"",{"type":27,"tag":28,"props":1680,"children":1681},{},[1682],{"type":32,"value":1683},"In practice, Rule 37(e) disputes in crypto matters center on off-chain artifacts: the chain is restorable. A hold naming the specific apps, devices, extensions, accounts, and time settings, plus a log showing it was enforced, converts a technical loss into a defensible position or an indefensible one.",{"type":27,"tag":35,"props":1685,"children":1687},{"id":1686},"the-litigation-hold-and-expert-handoff-checklist",[1688],{"type":32,"value":1689},"The Litigation-Hold and Expert Handoff Checklist",{"type":27,"tag":97,"props":1691,"children":1693},{"id":1692},"preservation-checklist",[1694],{"type":32,"value":1695},"Preservation checklist",{"type":27,"tag":206,"props":1697,"children":1698},{},[1699,1704,1709,1714,1719,1730,1735,1740],{"type":27,"tag":210,"props":1700,"children":1701},{},[1702],{"type":32,"value":1703},"Issue the written hold the day the matter opens, naming custodians, devices, apps, wallets, exchanges, and communications; prohibit updates, resets, uninstalls, sync changes, and new transactions.",{"type":27,"tag":210,"props":1705,"children":1706},{},[1707],{"type":32,"value":1708},"Inventory all five evidence systems.",{"type":27,"tag":210,"props":1710,"children":1711},{},[1712],{"type":32,"value":1713},"Stabilize volatile items: suspend remote wipe, disable auto-update, map cloud sync, record the device clock.",{"type":27,"tag":210,"props":1715,"children":1716},{},[1717],{"type":32,"value":1718},"Serve process early: hold letters, subpoenas, and early Rule 34 requests where the Federal Rules apply.",{"type":27,"tag":210,"props":1720,"children":1721},{},[1722,1724,1728],{"type":32,"value":1723},"Capture the reproducible chain data once, recording chain identifiers, block heights, and the source. Capture, not analysis; tracing comes later (",{"type":27,"tag":47,"props":1725,"children":1726},{"href":701},[1727],{"type":32,"value":1181},{"type":32,"value":1729},").",{"type":27,"tag":210,"props":1731,"children":1732},{},[1733],{"type":32,"value":1734},"Collect ephemeral artifacts in order of volatility; request a signed message where control is at issue.",{"type":27,"tag":210,"props":1736,"children":1737},{},[1738],{"type":32,"value":1739},"Document every acquisition with hashes and custody history.",{"type":27,"tag":210,"props":1741,"children":1742},{},[1743],{"type":32,"value":1744},"Hand the expert a manifest: what was collected, from whom, when, under what authority, and what questions remain.",{"type":27,"tag":97,"props":1746,"children":1748},{"id":1747},"questions-to-ask-at-first-contact",[1749],{"type":32,"value":1750},"Questions to ask at first contact",{"type":27,"tag":804,"props":1752,"children":1753},{},[1754,1759,1764,1769,1774],{"type":27,"tag":210,"props":1755,"children":1756},{},[1757],{"type":32,"value":1758},"Which exchanges, wallets, addresses, apps, and extensions, on which devices?",{"type":27,"tag":210,"props":1760,"children":1761},{},[1762],{"type":32,"value":1763},"Where are recovery phrases stored: notes, password manager, paper, safe deposit box, or memory?",{"type":27,"tag":210,"props":1765,"children":1766},{},[1767],{"type":32,"value":1768},"Which devices are employer-managed or subject to remote wipe, auto-update, or cloud backup, and which cloud accounts sync wallet data?",{"type":27,"tag":210,"props":1770,"children":1771},{},[1772],{"type":32,"value":1773},"Has any device been updated, reset, replaced, or wiped since the trigger date, and what was the device clock set to?",{"type":27,"tag":210,"props":1775,"children":1776},{},[1777],{"type":32,"value":1778},"Who else had access: spouses, employees, business partners, or custodians?",{"type":27,"tag":35,"props":1780,"children":1782},{"id":1781},"what-preservation-cannot-fix",[1783],{"type":32,"value":1784},"What Preservation Cannot Fix",{"type":27,"tag":28,"props":1786,"children":1787},{},[1788,1790,1796],{"type":32,"value":1789},"Preservation cannot resurrect overwritten data, recover a hardware wallet's secure element, decrypt a locked phone without the passcode, or compel a foreign platform beyond the reach of process. It cannot manufacture context that was never recorded, and it does not make material admissible; authentication and expert reliability are covered in ",{"type":27,"tag":47,"props":1791,"children":1793},{"href":1792},"\u002Fresources\u002Fblockchain-evidence-admissibility",[1794],{"type":32,"value":1795},"Blockchain Evidence in Litigation",{"type":32,"value":1797},". Criminal procedure, warrants, seizure authority, and compelled unlocking are outside this article's scope. Lose as little of the fragile layer as possible, and know exactly what was lost.",{"type":27,"tag":35,"props":1799,"children":1800},{"id":605},[1801],{"type":32,"value":608},{"type":27,"tag":97,"props":1803,"children":1805},{"id":1804},"q-when-does-the-duty-to-preserve-crypto-evidence-begin",[1806],{"type":32,"value":1807},"Q: When does the duty to preserve crypto evidence begin?",{"type":27,"tag":28,"props":1809,"children":1810},{},[1811,1815],{"type":27,"tag":619,"props":1812,"children":1813},{},[1814],{"type":32,"value":623},{"type":32,"value":1816}," When litigation is reasonably anticipated, which can be months before a complaint is filed. The hold must cover the ephemeral artifacts, not just the chain: apps, extensions, devices, accounts, browser profiles, and time settings.",{"type":27,"tag":97,"props":1818,"children":1820},{"id":1819},"q-is-a-screenshot-of-a-wallet-balance-or-a-recorded-seed-phrase-enough-preservation",[1821],{"type":32,"value":1822},"Q: Is a screenshot of a wallet balance, or a recorded seed phrase, enough preservation?",{"type":27,"tag":28,"props":1824,"children":1825},{},[1826,1830],{"type":27,"tag":619,"props":1827,"children":1828},{},[1829],{"type":32,"value":623},{"type":32,"value":1831}," No. A screenshot lacks the metadata, version context, and provenance needed to place it in time. A seed phrase should not be collected by counsel at all; preserve the medium in place and verify control through a signed message. Screenshots and phrases are documentation aids, not a collection protocol.",{"type":27,"tag":97,"props":1833,"children":1835},{"id":1834},"q-we-found-a-seed-phrase-during-review-can-we-import-it-to-check-the-wallet",[1836],{"type":32,"value":1837},"Q: We found a seed phrase during review. Can we import it to check the wallet?",{"type":27,"tag":28,"props":1839,"children":1840},{},[1841,1845],{"type":27,"tag":619,"props":1842,"children":1843},{},[1844],{"type":32,"value":623},{"type":32,"value":1846}," Do not import it into a live wallet. Importing mutates application state, spreads the credential, and changes the evidentiary picture. If verification is essential, have a forensic examiner work in a controlled, offline, documented environment, or verify control with a signed message.",{"type":27,"tag":97,"props":1848,"children":1850},{"id":1849},"q-the-other-side-wiped-a-phone-or-closed-an-exchange-account-what-now",[1851],{"type":32,"value":1852},"Q: The other side wiped a phone or closed an exchange account. What now?",{"type":27,"tag":28,"props":1854,"children":1855},{},[1856,1860],{"type":27,"tag":619,"props":1857,"children":1858},{},[1859],{"type":32,"value":623},{"type":32,"value":1861}," The chain data is still restorable, so the loss analysis turns on what the missing off-chain data could have shown. Document the loss with dates and known contents, check cloud backups, and preserve what does not require the lost device. If the loss followed a failure to take reasonable steps after the duty arose, that supports a spoliation argument; intent to deprive is required for the severe sanctions.",{"type":27,"tag":97,"props":1863,"children":1865},{"id":1864},"q-in-a-small-case-does-preservation-cost-more-than-it-is-worth",[1866],{"type":32,"value":1867},"Q: In a small case, does preservation cost more than it is worth?",{"type":27,"tag":28,"props":1869,"children":1870},{},[1871,1875],{"type":27,"tag":619,"props":1872,"children":1873},{},[1874],{"type":32,"value":623},{"type":32,"value":1876}," The highest-value steps are cheap: a written hold, a hold letter to platforms, disabling auto-update and remote wipe, recording the device clock, and capturing a signed message. Rule 26(b)(1) proportionality lets the parties scope the work to the stakes, and documenting those decisions is part of a defensible record.",{"type":27,"tag":28,"props":1878,"children":1879},{},[1880,1882,1887],{"type":32,"value":1881},"Cases vary in facts, jurisdiction, and stakes, and preservation decisions are best made before artifacts vanish. If a matter is headed toward crypto evidence, a short conversation about the specific devices and timeline clarifies what must happen in the first days and what can wait. Nick Kampe is available through the ",{"type":27,"tag":47,"props":1883,"children":1884},{"href":693},[1885],{"type":32,"value":1886},"contact page",{"type":32,"value":1888}," to discuss a preservation plan for a specific matter.",{"title":8,"searchDepth":716,"depth":716,"links":1890},[1891,1892,1893,1894,1895,1902,1903,1907,1908],{"id":1357,"depth":716,"text":1360},{"id":1402,"depth":716,"text":1405},{"id":1440,"depth":716,"text":1443},{"id":1505,"depth":716,"text":1508},{"id":1577,"depth":716,"text":1580,"children":1896},[1897,1898,1899,1900,1901],{"id":1583,"depth":722,"text":1586},{"id":1594,"depth":722,"text":1597},{"id":1605,"depth":722,"text":1608},{"id":1616,"depth":722,"text":1619},{"id":1627,"depth":722,"text":1630},{"id":1647,"depth":716,"text":1650},{"id":1686,"depth":716,"text":1689,"children":1904},[1905,1906],{"id":1692,"depth":722,"text":1695},{"id":1747,"depth":722,"text":1750},{"id":1781,"depth":716,"text":1784},{"id":605,"depth":716,"text":608,"children":1909},[1910,1911,1912,1913,1914],{"id":1804,"depth":722,"text":1807},{"id":1819,"depth":722,"text":1822},{"id":1834,"depth":722,"text":1837},{"id":1849,"depth":722,"text":1852},{"id":1864,"depth":722,"text":1867},"content:articles:30-preserving-crypto-native-esi.md","articles\u002F30-preserving-crypto-native-esi.md","articles\u002F30-preserving-crypto-native-esi",1790145013676]