Time-Decay of Crypto Evidence

caution

Core idea

Crypto investigations are uniquely time-sensitive: several evidence types degrade fast, so triage should ask what evidence is about to disappear, and that wins priority even over larger-value cases.

Components

Exchange freezes: once funds leave the exchange, the CEX cannot freeze; speed to notify is measured in hours.
IP logs: in the UK, ISPs retain connection records 12 months; a preservation order must be in place before the window closes.
Social media evidence: subjects delete tweets, take down websites, lock accounts; archive first, analyse second.
Tx mempool data: fee-bumping, RBF replacements, and private mempool submissions disappear from public indices within minutes.

When to use

During triage and prioritisation across multiple concurrent cases, rank by what is decaying, not just by dollar value.

Avoid when

Do not deprioritise a small-value case behind a larger one when the small case has evidence about to vanish (funds nearing a CEX exit, an ISP retention window closing, a subject deleting accounts).

Example

An active theft with a branch heading to a CEX deposit address is worked first because the freeze window is measured in hours, ahead of a larger but static case.

Case Tractability: When to Decline, Intake Triage Checklist, Chain of Custody by Evidence Type