Identifying Cryptocurrency in the Field

checklist

Core idea

Crypto leaves physical traces, and a search that does not know what they look like walks past them. Six categories of artifact tell you crypto is involved, and each points at a different route to the keys.

Components

Seed phrase. Usually 12 to 24 words handwritten or printed on paper, sometimes stamped in metal. It is the wallet, so anyone holding a copy can drain the funds from anywhere. Treat a photographed or copied phrase as a live compromise.
Crypto ATM receipts. Paper, or a text message or email. They typically carry the transaction date, the amount of crypto purchased, and the deposit address, though the layout varies by operator. These are often the only record a victim has, and they name the kiosk operator you can serve.
Hardware wallets. Small USB-sized devices, commonly Ledger or Trezor, usually with a cable nearby. Look for the cable even if the device is hidden.
Software wallets. On a computer, installed applications such as Electrum or Exodus in the programs or applications folder. On a phone, apps such as Trust Wallet or Mycelium in the app drawer.
Web wallets. Browser history, bookmarks, and the saved-password store; Coinbase and Blockchain.info are common. The browser password manager is frequently the fastest route in.
Paper wallets. Printed keys and QR codes, often kept in a safe or filed with documents. Any page carrying a long string of letters and numbers or a bare QR code deserves a second look.

Two framings that cut across the list: cold storage is anything offline (hardware and paper wallets, and any device or document holding keys that is not connected), and hot storage is anything connected and in regular use (desktop, mobile, and web wallets). Hot wallets are where you expect frequent activity and the shortest access window.

When to use

During a physical search or device triage, and when reviewing what a victim or a reporting party actually has in their possession.

Avoid when

Finding an artifact is not attribution. A seed phrase in a drawer proves access, not ownership or control at the time of a given transaction, and an ATM receipt records what the victim was told, not what settled on chain. Verify every address and amount on an explorer before it enters a case file.

Example

A search recovers a Trezor with no cable, a handwritten 24-word list in a bedside book, and two Bitcoin Depot receipts. The receipts give the deposit addresses and the kiosk operator to subpoena, while the word list means the funds may already be moving, which sets the priority for the seizure step.

Seizing Crypto: Devices, VASP Accounts, and the Agency Wallet · Victim Artifact Intake: Getting the Starting Point Right · Impersonation Scams and the Crypto-Kiosk On-Ramp · Chain of Custody by Evidence Type · What to Collect: On-Chain & Off-Chain Evidence · Time-Decay of Crypto Evidence