After discovering a cryptocurrency scam or unauthorized transaction, one of the most useful things you can do is preserve evidence.

Start with the blockchain transaction details. Record the transaction hash, sending address, receiving address, cryptocurrency, amount, and date and time of the transaction.

Keep copies of relevant communications as well. Emails, chat messages, social-media conversations, website addresses, payment confirmations, and screenshots may help establish how the incident occurred.

If the incident involved an exchange or cryptocurrency platform, record the account details and any correspondence with its support team. Avoid deleting messages simply because they appear unimportant.

You should also document the incident in chronological order. Write down what happened, when you noticed the problem, and the actions taken afterward.

Do not provide your private key, seed phrase, or account password to someone claiming that they can recover your cryptocurrency. Legitimate investigators and service providers should not require your private wallet credentials simply to examine a transaction.

Finally, consider reporting suspected fraud to the appropriate platform and relevant authorities. The correct reporting channel will depend on where you are located and the circumstances of the incident.

Good documentation does not guarantee that stolen cryptocurrency will be recovered, but it can help create a clearer record of what happened and support further investigation.