§ CFL Electronic Evidence Series · Guide 7

Crypto Assets: Investigation, Tracing, Attribution and Disclosure

A 72 page legal and technical reference on how crypto assets are traced, attributed, preserved and disclosed in UK litigation, investigations and regulatory work.

Ref · E-D · 2026 · §CRYClass · ConfidentialJuris · England & WalesStatus · Active
Cover of the Crypto Assets: Investigation, Tracing, Attribution and Disclosure guide Download the PDF

72 pages · September 2026 edition · Free, no registration

Guide entry in the PDF library →

About this guide

Crypto assets now appear in commercial fraud, insolvency, divorce, sanctions work and regulatory investigations, and they behave unlike any other class of evidence. Keys can be moved in seconds, ledgers are public but pseudonymous, and the analytical tools that produce a tracing report are rarely understood by the court without help. This reference sets out, for practitioners in England and Wales, how that evidence is gathered, interpreted and put before a tribunal in a form that holds up.

It is written by the forensic team at Computer Forensics Lab and follows ISO 17025 aligned laboratory practice and NPCC guidance, with worked examples, checklists and drafting points you can apply to a live matter.

What the blockchain proves, and what it does not
A public ledger records that value moved between addresses at a given time. It does not record who controlled those addresses. The guide separates the two questions carefully, because most crypto disputes are lost or won on attribution rather than on tracing.
Tracing across exchanges, mixers and bridges
Following funds through consolidations, peel chains, mixing services, cross-chain bridges and centralised exchange deposits, and how each hop changes the evidential weight of the trail.
Attribution to a real person
Exchange KYC records, device and cloud artefacts, seed phrase and wallet file recovery, browser and app residue, and open source material, combined into an attribution case that survives cross-examination.
Preservation, seizure and interim relief
Securing wallets and private keys without destroying them, working with custodians in and outside the jurisdiction, and the practical evidence needed for freezing orders, proprietary injunctions and Norwich Pharmacal or Bankers Trust relief.
Disclosure and expert evidence
How crypto material fits CPR Part 31 and PD 57AD disclosure, the standards a court expects of blockchain analytics output, and how to write and defend a CPR Part 35 expert report on crypto evidence.

Read the full guide

The complete 72 page PDF is embedded below. It can also be downloaded and shared freely within your firm.

Your browser cannot display PDFs inline. Download the guide instead.
Instruct the practice

Bring us in early. Defensibility is built, not retrofitted.

Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.

WhatsApp