Crypto Assets: Investigation, Tracing, Attribution and Disclosure
A 72 page legal and technical reference on how crypto assets are traced, attributed, preserved and disclosed in UK litigation, investigations and regulatory work.
Download the PDF72 pages · September 2026 edition · Free, no registration
Guide entry in the PDF library →About this guide
Crypto assets now appear in commercial fraud, insolvency, divorce, sanctions work and regulatory investigations, and they behave unlike any other class of evidence. Keys can be moved in seconds, ledgers are public but pseudonymous, and the analytical tools that produce a tracing report are rarely understood by the court without help. This reference sets out, for practitioners in England and Wales, how that evidence is gathered, interpreted and put before a tribunal in a form that holds up.
It is written by the forensic team at Computer Forensics Lab and follows ISO 17025 aligned laboratory practice and NPCC guidance, with worked examples, checklists and drafting points you can apply to a live matter.
- What the blockchain proves, and what it does not
- A public ledger records that value moved between addresses at a given time. It does not record who controlled those addresses. The guide separates the two questions carefully, because most crypto disputes are lost or won on attribution rather than on tracing.
- Tracing across exchanges, mixers and bridges
- Following funds through consolidations, peel chains, mixing services, cross-chain bridges and centralised exchange deposits, and how each hop changes the evidential weight of the trail.
- Attribution to a real person
- Exchange KYC records, device and cloud artefacts, seed phrase and wallet file recovery, browser and app residue, and open source material, combined into an attribution case that survives cross-examination.
- Preservation, seizure and interim relief
- Securing wallets and private keys without destroying them, working with custodians in and outside the jurisdiction, and the practical evidence needed for freezing orders, proprietary injunctions and Norwich Pharmacal or Bankers Trust relief.
- Disclosure and expert evidence
- How crypto material fits CPR Part 31 and PD 57AD disclosure, the standards a court expects of blockchain analytics output, and how to write and defend a CPR Part 35 expert report on crypto evidence.
§ Worked example
A sample crypto matter
A finance director is alleged to have moved company funds to a personal exchange account, converted them to Bitcoin and withdrawn to a private wallet before resigning. The firm holds bank statements showing three transfers to a UK exchange, a company laptop, and the leaver's mailbox.
The first move is preservation, not tracing: image the laptop before it is reissued, secure the mailbox under legal hold, and put the exchange on notice so the account is frozen rather than emptied. The laptop is then searched for wallet applications, seed phrase backups, browser history and exchange logins, which is where attribution usually comes from. The on-chain trace runs from the exchange withdrawal address forward, and the report sets out the transaction data so the trace can be reproduced and tested. Interim relief, a proprietary injunction with third-party disclosure against the exchange, is prepared in parallel because value moves faster than proceedings.
Chapters 3, 5 and 8 of the guide cover each of those steps in detail, including the evidential standard the attribution work has to meet under CPR Part 35.
Run these facts yourself
The case builder is prefilled with this matter, so you can see the stage to start from, the first practical step and the supporting reading, then change the facts to match your own.
Open the prefilled case builderTimeline, cost drivers and FAQs →Reported crypto cases →Crypto investigation FAQ →Read the full guide
The complete 72 page PDF is embedded below. It can also be downloaded and shared freely within your firm.
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.