What should be preserved from an exchange account?¶

A cryptocurrency exchange account can contain volatile evidence linking identity, devices, funding and blockchain activity.

Avoid the dangerous assumption¶

The dangerous assumption is that screenshots of the balance and recent transactions preserve everything important.

Record the exchange name, account ID, user ID, registered email address, phone number, displayed customer name and verification status.

Preserve deposit and withdrawal history, trade history, internal transfers, linked bank accounts or cards, wallet addresses, transaction hashes, assets, networks, fees and status information.

Capture complete transaction details rather than only summary lists.

Where visible, preserve registered devices, active sessions, login history, IP addresses, authentication methods, security alerts and recent account changes.

Record address-book entries, whitelisted withdrawal addresses and any memo or destination tag.

Preserve support messages, fraud notifications, password resets, recovery activity and records of any account restrictions or compliance review.

Do not change passwords, remove devices, revoke sessions or move assets without considering the evidential, legal and safeguarding consequences.

Opening pages or refreshing the account may create new provider logs.

Record every action taken and the time it occurred.

Screenshots are useful, but provider exports and formal records may contain more complete evidence.

Where the account contains live assets or sensitive recovery information, seek specialist support before interacting further.

Do not assume the registered customer controlled the account at the relevant time.

Preservation should support later examination of account ownership, access, transaction movement and actual user control.

Operational takeaway¶

Preserve exchange identity, access, funding, trade, deposit and withdrawal evidence with a complete action log before making security changes or relying on screenshots alone.