How to Report Exchange Fraud and Preserve Evidence

When fraudulent assets are still moving, the quality and speed of the first report can determine whether an exchange can identify, restrict, or preserve the relevant account. Knowing how to report exchange fraud is therefore not a customer-service exercise. It is an evidence-preservation and disruption operation that must connect victim facts, blockchain activity, exchange records, and a clear legal or investigative basis for action.

For law enforcement, compliance teams, payment providers, and forensic investigators, the objective is twofold: stop further dissipation where possible and create a record that can withstand scrutiny in a criminal, civil, regulatory, or recovery proceeding. A vague complaint may establish that a victim lost funds. A well-supported report gives an exchange and its legal team a practical basis to locate exposure, retain records, and coordinate with authorized counterparts.

How to Report Exchange Fraud: Treat It as a Time-Critical Case

Exchange fraud takes several forms. A victim may have sent cryptocurrency to an address controlled by a scam operation, deposited assets into a fraudulent investment platform, lost account credentials through phishing, or been induced to transfer funds to a mule account at a centralized exchange. The reporting path depends on the facts, but delay is the common adversary.

Before contacting an exchange, establish the essential event timeline. Record when the victim first interacted with the suspect, when assets were transferred, the time and date of each transaction, every account or wallet involved, and any communications that explain the fraud. Use a consistent time standard, preferably UTC alongside local time, to reduce ambiguity when blockchain activity and exchange logs are compared.

The initial report should be directed through the exchange’s official fraud, compliance, legal, or law-enforcement channels. Do not rely on search-engine advertisements, unsolicited direct messages, or purported recovery agents. Fraud actors routinely impersonate exchange support teams and exploit victims a second time by requesting wallet access, seed phrases, remote-device access, or advance fees.

For an institutional referral, identify the requesting agency or organization, the authorized point of contact, the case or incident number, the applicable jurisdiction, and the legal authority or process already available. Be precise about what action is sought. A request to “help recover funds” is far less actionable than a request to preserve records for specified accounts, review exposure to identified addresses, and consider a temporary restriction under the exchange’s fraud and legal obligations.

Build an Exchange-Ready Evidence Package

A report should allow the receiving team to verify the alleged fraud without reconstructing the incident from scattered screenshots. The evidence package does not need to prove every element of a criminal offense before an initial preservation request, but it should make the nexus between the victim, transaction, and suspected illicit destination unmistakable.

Include, at minimum, the following materials:

• Transaction hashes, blockchain names, asset types, transferred amounts, timestamps, and sending and receiving addresses.
• A victim statement describing the inducement, impersonation, account takeover, or other fraudulent conduct in chronological order.
• Screenshots and exports of communications, websites, social-media profiles, emails, phone numbers, payment instructions, and relevant account pages.
• Exchange account identifiers, deposit addresses, user IDs, bank-transfer references, or payment-provider records where known.
• A clear loss calculation that separates confirmed on-chain transfers from estimated losses, fees, or unverified claims.
• A point of contact able to respond quickly to validation questions and provide formal legal process if required.

Preserve original files whenever possible. Screenshots are useful, but native exports, email headers, chat logs, device records, and bank statements often carry stronger evidentiary value. Document who collected each item, when it was obtained, and where it has been stored. This basic chain-of-custody discipline matters if the investigation later supports seizure, forfeiture, restitution, litigation, or regulatory action.

Blockchain evidence requires similar care. A transaction hash proves that a transaction was recorded on a particular network, but it does not by itself identify the person behind an address or establish fraudulent intent. Investigators must correlate on-chain observations with off-chain evidence, exchange records, victim testimony, infrastructure intelligence, and other case facts. That distinction is central to a defensible case.

Trace Beyond the First Receiving Address

Fraud proceeds rarely remain at the initial destination. They may move through intermediary wallets, cross-chain bridges, swaps, mixing services, or multiple exchange deposit addresses. A report that stops at the first address can miss the point at which the assets enter a regulated service capable of taking action.

Conduct or obtain blockchain tracing that identifies the path of funds, relevant transaction clusters, likely service exposure, and the current status of traced value. Clearly label analytical confidence. For example, distinguish direct transaction evidence from attribution based on service patterns, public reporting, behavioral indicators, or other intelligence. Overstating certainty can weaken the referral. A transparent explanation of what is known, what is assessed, and what remains unverified is more useful to an exchange and more credible in court.

Where commingling has occurred, document the tracing methodology and the basis for any value calculation. It may not be possible to claim that every unit at a destination belongs to a particular victim. That does not eliminate the value of the report. It changes the analysis from a simple one-to-one transfer to a more careful assessment of flow, timing, exposure, and available legal remedies.

Request the Right Action From the Exchange

Exchanges operate under their own terms, compliance obligations, privacy requirements, and legal constraints. They may not disclose account-holder information or take a requested action based solely on a private complaint. A successful report recognizes those limits while preserving the urgent need to prevent further movement.

The immediate request may include preservation of account and transaction records, internal review of identified addresses or deposits, escalation to the exchange’s fraud or legal team, and consideration of account restrictions consistent with its policies and applicable law. For authorized agencies, the next step may involve a formal preservation letter, subpoena, production order, restraining order, seizure warrant, mutual legal assistance request, or other jurisdictionally appropriate process.

Do not ask an exchange to send funds to a new wallet supplied by a victim or third party unless the exchange has independently confirmed a lawful and secure process. Recovery is not automatic after a freeze. Rights to funds can be contested, multiple victims may be involved, and the exchange may need direction from law enforcement or a court before releasing assets.

Escalate Across the Appropriate Reporting Channels

An exchange report should be one part of a coordinated response, not the entire case strategy. Victims and institutions should report the matter to the appropriate law-enforcement authority and, where relevant, banking partners, payment processors, insurers, regulators, and internal incident-response teams. Cross-border cases require early attention to jurisdiction because records, account holders, victims, and infrastructure may sit in several countries.

For US cases, preserve information needed for referrals to federal, state, and local authorities, including the scale of the loss, victim demographics, suspected money-laundering indicators, and any connection to organized fraud, sanctions evasion, ransomware, or terrorism financing. If there is an immediate threat to life, critical infrastructure, or national security, use emergency reporting procedures rather than waiting for routine exchange correspondence.

Avoid publicizing wallet addresses, investigative theories, or anticipated enforcement actions prematurely. Public disclosure can alert suspects, trigger additional laundering, compromise parallel investigations, or create defamation and privacy risks. Share intelligence on a need-to-know basis and retain an audit trail of all submissions, acknowledgments, and follow-up communications.

Common Reporting Failures That Delay Action

The most damaging failure is waiting for complete certainty before alerting an exchange. A preliminary, fact-based preservation referral can be appropriate while deeper tracing continues. Another common error is submitting a narrative without machine-verifiable identifiers such as transaction hashes, exact addresses, account IDs, or timestamps.

Teams also lose time by treating a blockchain explorer result as final attribution. Address labels can be incomplete, stale, or wrong. Confirm service exposure through multiple sources, explain the attribution standard used, and update the report as new evidence emerges. Finally, do not confuse urgency with informality. A concise report with organized exhibits is more likely to reach the right operational team than a stream of fragmented messages.

Aegis Financial Forensics supports this operational model by combining blockchain tracing, visual investigation, de-mixing analysis, case management, and evidentiary workflows designed to help investigators turn fragmented transaction data into disruption-ready intelligence.

The practical goal is simple: give the exchange enough verified information to act responsibly, give investigators a record they can defend, and preserve every viable path toward restraint, seizure, or victim recovery before illicit funds disappear into the next transaction.