If you lost crypto to a scam, the police and the FBI need clear, checkable facts before they can act: which transactions took your funds, where the money went next, and which exchanges it reached. An evidence report puts those facts in one document you can hand over. Wallet Sleuth checks every transfer on the blockchain itself before it goes into the report, so every transfer in it was confirmed on the blockchain.

It is called an evidence report, not a police report: only the police write police reports. Yours is the evidence that helps them open one.

Who it is for

• You lost funds to an investment scam, a romance scam, a fake platform, a wallet drainer, phishing, or an impersonator.
• Someone helping a victim, such as a family member or a professional. You can mark yourself as the preparer and the report says so.

Reports are for people in the United States for now, and follow the order of the FBI Internet Crime Complaint Center (IC3) form.

What you need

• A Scout investigation that shows where your funds went. If you don't have one yet, start with Your first investigation.
• The address of each wallet the funds were taken from (your wallets).
• The transaction id of each transfer that took your funds. A transaction id is the long code that identifies one transfer on the blockchain; your wallet app's history shows it. You can also pick these from the transfers already on your canvas.

Steps

1. Open your investigation in Scout and select Evidence report in the toolbar. If the AI Investigator wrote a report for this investigation, you can also start from Create evidence report on that report.
2. What happened. Enter the date you lost the money, choose the kind of scam, and describe in your own words how it started. You can also say how much you lost; the report prints it as your own figure, next to the verified total.
3. Your wallets and the transactions. Add the wallets your money was taken from, then add each transaction that took it, either by picking it from your canvas or by pasting its id.
4. About the other party. Add anything you know about the scammer: usernames, websites, phone numbers, emails, and the apps you talked on. Leave out what you don't know. Then fill in Your details: your full name, and if you want, how to contact you. Turn on "I'm preparing this report for someone else" if you are filling it in for a victim.
5. Select Create report. Wallet Sleuth now checks every transaction on the blockchain and follows your funds along the transfers on your canvas. This can take a few minutes; you can leave the page and come back.
6. When the report is ready, review the evidence cards, write your statement, and download it.

Your answers are kept on this device as a draft while you fill in the form, so you can close it and carry on later. The draft keeps the facts of the case only, never your name or contact details.

What "verified on-chain" means

Your canvas is a set of leads, not proof: anyone can draw a line between two wallets. So Wallet Sleuth fetches every transaction in the report again from the blockchain and keeps only what the blockchain confirms:

• A theft transaction counts only if it really moved funds out of one of the wallets you listed.
• Each later transfer counts only if it really moved funds between the two wallets your canvas shows, and happened after your funds arrived in the sending wallet.
• A wallet that received your funds is followed further only if it is on your canvas. Otherwise the transfer is listed and the report says the wallet was not traced further.
• Amounts in US dollars are the value at the time of each transfer. When no price is found, the report shows the token amount only and says why: no price was available when the report was made, or none was near the time of the transfer. It never counts an unknown value as zero.
• On Base and Ethereum, a transfer of a token Wallet Sleuth does not recognise is labelled as such, and counts as part of your loss only if the transaction was sent from your wallet. Anyone can make a fake transfer record that appears to come from your wallet.

Returns and network costs

• Returned to you: if funds came back into one of your wallets along the trail, the report lists that transfer as a return. It is shown next to the loss, never subtracted from it.
• Network and account costs: a theft transaction often pays small costs, such as the rent for a token account it opens or a tip to the network. These are listed with the transaction but are not counted as part of your loss.

Anything that could not be confirmed is still listed, with the reason, so you and the officer can see what was checked and why it was left out of the totals.

How to read the endpoints

An endpoint is a wallet where the trail on your canvas stops. Each one gets one of these labels:

• Exchange wallet: the address belongs to a named exchange, and the report says which sources identified it. This is the most useful result, because exchanges know who their customers are and can be asked by law enforcement to keep their records and consider holding the funds.
• Probable deposit address: the address is not on a list, but it behaves like a customer deposit address at a named exchange (it passes what it receives on to that exchange's main wallet). The report shows the transfers that support this.
• Not identified: no one has identified who controls this wallet. It may belong to the scammer or to a service nobody has labelled yet.
• Could not be checked: a data provider did not answer while the report was being made. Make a new version later to try again.

If the trail stops only because the report reached its limit on how far it follows funds, the endpoint says so: the funds may have moved on from there. You can trace further in Scout and make a new version.

Where an exchange has published how law enforcement should contact it, the report includes that contact so the officer knows where to send a request.

Curate your report

You decide how the report reads, but you cannot change the facts. Blockchain facts are locked so that the report stays trustworthy for anyone who checks it.

• Order: drag cards to put the most important evidence first.
• Exclude: move a card out of the main report. Excluded items are not deleted: they appear in an appendix, so nothing is hidden from the reader.
• Highlight: mark the cards that matter most.
• Add note: add your own explanation to a card. Notes are printed as your words, next to the facts.
• Your statement: describe what happened in your own words. It is printed under "Provided by the reporter".

Your changes save automatically. They never change the verified facts or the evidence fingerprint.

Choose a format

• Police: plain, in the order of the FBI IC3 complaint form, written about you in the third person. Use this one for the police and the FBI.
• Wallet Sleuth: branded, with a summary written to you and a glossary of terms. Use this one to understand your case or to share it with someone helping you.

Select Download PDF for the format you picked, or Download transactions (CSV) for a spreadsheet of every verified transfer. Officers and analysts often want the spreadsheet too.

Next steps after you download

1. File a complaint at the FBI IC3 website (ic3.gov). The report's sections follow the form's order, so you can copy each part across.
2. Report the crime to your local police and ask for a police report number. Write it in the "Agency case #" space on the report.
3. Ask the officer to send a preservation request to each exchange listed in the report, asking it to keep its records and to consider holding the funds.
4. Keep the PDF and the spreadsheet together, and give both to anyone working on your case.

The verification link

You can turn on a Verification link for a report. Anyone with the link, such as an officer, can open a public page that shows:

• the transfers in the report and when the report was generated;
• the evidence fingerprint, and whether Wallet Sleuth's stored record still matches it.

A match proves that the record Wallet Sleuth holds is unchanged since the report was generated, including any AI analysis kept with it. It does not check the copy in the reader's hands, so the reader should compare the transfers in their copy with the list on the page.

It never shows your name, contact details, statement, notes or the amount you said you lost. Your wallet addresses do appear there, because they are part of the theft transactions on the public blockchain. Turning the link off stops it working at once.

Common questions

Can I change an amount or an address that looks wrong? No. Facts come from the blockchain and are locked. If something is missing, add the transfer in Scout and make a new version. Earlier versions are kept unchanged, so a report you already filed never changes.

Why is something listed as "could not be verified"? The blockchain did not confirm it the way the report needs. The report counts two kinds separately: transactions you listed that were not a transfer out of your wallets, and onward transfers drawn on your canvas that do not move funds between the wallets shown. The reason is printed with each one.

Does Wallet Sleuth say who the scammer is? No. The report shows where funds went and what is known about each wallet. It never names a person as responsible.

Is this legal advice? No. Wallet Sleuth is not a law-enforcement agency, and the report is not legal advice.

Related

• Your first investigation
• Working the canvas
• Sharing investigations