At a Glance
Every cryptocurrency holding that was bought with dollars left one record in the banking system: the transfer to the service that converted the money. From there the work runs in a loop. The statement names the service; the service holds the records; the records hold the addresses; the addresses run the on-chain report; and the report often names the next service to ask.
Either side of a matter can run this loop. It reads what was produced and takes no position.
Step 1. Read the bank statements for the crossing
The statement never shows a crypto balance, but it shows the crossing, and the name on the line tells you who holds the records that matter.
Six kinds of line items worth flagging:
- Transfers to and from exchanges.Debits are funding; credits are sales or cash-outs. Credits that exceed total funding mean value entered the account from outside the bank trail.
- Wires.The beneficiary is often a bank account held "for the benefit of" the exchange's customers; read the memo and beneficiary fields.
- Card purchases.Card issuers often treat crypto buys as cash advances; a cash-advance fee beside an unfamiliar merchant is a flag. Card on-ramps deliver to a wallet address the buyer supplied, so their records hold the destination.
- Payment apps.Cash App, PayPal, Venmo and Robinhood sell crypto inside the app; the bank shows only the transfer in. Regular funding of an app is a reason to request the app's own statements.
- Recurring identical amounts.The same amount on the same day each week or month to Strike, Swan, River or an exchange is an automatic purchase plan.
- Small verification deposits.Two deposits of a few cents from a service prove an account exists and was linked.
A weaker signal: repeated cash withdrawals are consistent with bitcoin ATM purchases, and with much else. Flag only with corroboration.
The name on the statement is rarely the brand
The legal name is also usually the one to put on a subpoena.
Swipe sideways to see all columns →
| The statement may read | Service | Entity to name |
|---|---|---|
COINBASE.COM WEBCOINBASE INC | Coinbase | Coinbase, Inc. |
KRAKENPAYWARD | Kraken | Payward Interactive, Inc. d/b/a Kraken |
BINANCE.US | Binance.US | BAM Trading Services Inc. |
GEMINI TRUST CO TXFER | Gemini | Gemini Trust Company, LLC (ID, LA, NY, OH, TX); Gemini Moonbase, LLC elsewhere |
FORIS DAX INCCRYPTO.COM | Crypto.com | Foris DAX, Inc. (confirm in the user agreement) |
STRIKEZAP SOLUTIONS | Strike | Zap Solutions, Inc. |
SWAN BITCOINor its custodian's name | Swan Bitcoin | Electric Solidus, Inc. d/b/a Swan Bitcoin |
RIVER | River | River Financial Inc. |
CASH APP*CASH OUTCASH APP*CRYPTOSQC | Cash App | Block, Inc. |
ROBINHOOD FUNDS | Robinhood | Robinhood Crypto, LLC (separate from the brokerage) |
PAYPALVENMO | PayPal and Venmo crypto | PayPal Digital, Inc., with Paxos Trust Company, N.A. |
MOONPAY (four-digit code) CARD PURCHASE | MoonPay, a card on-ramp inside wallet apps | MoonPay USA LLC |
Descriptors vary by bank, card network and year; PAYWARD on a US statement comes from practitioner reports rather than a published source. Treat a match as a lead and confirm it before it goes on a subpoena. The VASP Directory resolves a descriptor to the service and the entity to name.
Read the statements as a ledger, not a list: net the amounts sent and received by service; place the activity against the dates the matter turns on; cover every account, card and payment app; and pull the tax records (Form 1099-DA from tax year 2025, 1099-MISC for staking and rewards, Form 8949, and the digital-asset question on Form 1040), each of which either corroborates the statements or raises a question.
Step 2. Ask for the addresses by name
A request for "all records" or "all account statements" of a crypto account returns what a bank statement would: dates, amounts, balances. An exchange statement for a withdrawal reads "Sent 0.5 BTC" and stops. The destination is a 26- to 62-character blockchain address that lives in a different export, a per-transaction detail screen, or a confirmation email. Name it.
Two routes, usually both:
- From the party. A request for production for the full transaction-history export from each account, every tax document the service issued, all statements, and the list of deposit addresses and withdrawal destination addresses with dates, amounts and transaction hashes. Interrogatories identifying every exchange, wallet, custodial account and self-custody device. A signed authorization for the service to release records directly. For estates, the service's deceased-customer process, before any process issues.
- From the exchange. A subpoena for the account's transaction history including transaction hashes and addresses, served on the right legal entity's registered agent, after a preservation letter. Treat the exchange's production as verification of the party's: an export is only as complete as the party chose to make it.
Three rules that decide whether you get addresses:
- Name the data element, not the document."The destination blockchain address and transaction hash of each withdrawal", not "withdrawal records".
- Name where it lives.The withdrawal or sent history export, the per-transaction detail view, the on-chain transaction hash, and the withdrawal confirmation email, so that "we produced the statements" is not a complete answer.
- Ask for both directions.Withdrawal destinations show where funds went; deposit addresses and deposit sources show where they came from and tie the account to the on-chain picture.
Example request language
For each account you hold or have held with [Service], produce for the period [start] through [end] and any other period in which the account was open: (1) every blockchain address from which cryptocurrency was deposited into the account, with the date, asset, amount and transaction hash of each deposit; (2) every blockchain address to which cryptocurrency was withdrawn or transferred from the account, with the date, asset, amount and transaction hash of each withdrawal; (3) every deposit address the service issued to the account; (4) the complete transaction history, including purchases, sales, conversions, transfers and staking or rewards; and (5) all monthly or periodic account statements. A production limited to statements, or to a transaction history that omits the blockchain addresses, is not complete.
Example wording only. Adapt it to your jurisdiction and matter before serving. The exchange-by-exchange mechanics (entity names, registered agents, preservation letters, Rule 45 and UIDDA domestication) are in the Exchange Records Guide.
Step 3. What comes back
Most productions are statement-shaped: dates and amounts, no addresses. Plan for that as the normal case, not a failure, and read the package for what it does contain.
An exchange's subpoena response usually arrives as a package:
- A cover letter and a custodian-of-records certification (FRE 902(11) or 803(6), or the state equivalent). Both often restate the identifiers from your own subpoena. An address that appears only there is an echo of your request, not the exchange's data.
- A KYC or account sheet: name, date of birth, address, email, and the linked bank accounts and cards by last four digits. The last four digits tie the exchange account back to the bank statements you started from.
- The transaction history, as a CSV or XLSX export or as a spreadsheet printed to PDF.
- A deposit and withdrawal address sheet, when it was asked for by name.
- Sometimes IP and device logs.
A party's production looks different: self-service exports, screenshots, confirmation emails printed to PDF, and sometimes a letter listing "all wallet addresses".
What the standard exports carry, by service. These formats come from practitioner knowledge and public export documentation; confirm against the production in hand.
Swipe sideways to see all columns →
| Service | Standard export | Where the addresses and hashes are |
|---|---|---|
| Coinbase | Transaction history CSV with a Notes column | Destination inside Notes ("Sent 0.25 BTC to bc1q..."); no hashes. Hashes are in the transaction detail view and confirmation emails. |
| Kraken | Ledgers CSV | None. The txid column is an internal ledger id, not a blockchain hash. The withdrawal history export carries address and TxID. |
| Gemini | Transaction history XLSX or CSV | Withdrawal Destination, Deposit Destination and Tx Hash columns. The best case. |
| Binance.US | Transaction history CSV or XLSX | Hash in Transaction_Id; the wallet deposit and withdrawal export carries Address and TXID. Many withdrawals on chains outside Bitcoin and Ethereum. |
| Crypto.com | App transaction history CSV | Transaction Hash, no address. Frequent USDT on Tron, which public-record analysis tools often do not cover. |
| Cash App | Account statement CSV | Bitcoin withdrawals listed; addresses in receipts and the transaction detail. |
| Robinhood | Monthly statements PDF | Statements only. The in-app crypto transfers history carries address and transaction ID; ask for it by name. Two entities: Robinhood Crypto, LLC and the brokerage. |
| PayPal and Venmo | Activity CSV, crypto statements | No addresses in the activity download. On-chain, deposits and hot wallets attribute to the custodian, Paxos Trust Company, N.A. |
| Strike | Transaction history CSV | A Destination column that is often a Lightning invoice, which leaves no on-chain record. |
Scans
Party productions, Bates-stamped re-scans and faxes arrive as images, often at poor quality. A blockchain address is a long string in which every character matters, and scanners and readers confuse 0 and O, 1 and l and I, 5 and S, 8 and B. Printed spreadsheets wrap and truncate addresses ("bc1qxy2k...7f9a" is not an address). A hash that lived in an email hyperlink disappears when the email is printed.
Step 4. Read the addresses: roles, and which ones to run
Not every address in a production is the party's wallet. The role of an address decides what an on-chain report on it would show, so classify before you run anything.
Swipe sideways to see all columns →
| Role | What it is | Who controls it | Run an on-chain report? |
|---|---|---|---|
| Withdrawal destination | Where funds went when they left the account | The party (self-custody) or another service | Yes, first. The report shows the wallet or service that received the funds. |
| External deposit source | An outside address that sent crypto into the account | The sender | Yes, second. Shows where the money came from. |
| Exchange-assigned deposit address | An address the exchange issued to the account to receive crypto | The exchange; funds sweep into its hot wallet | Not as the party's wallet. A report describes the exchange's cluster. Useful only to list who sent funds in. |
| Transaction ID (hash) | One on-chain transfer | Nobody; it is an identifier | Not directly. Resolve it to the addresses behind it. Exchanges batch many customers' withdrawals in one transaction, so the amount is needed to pick the right output. |
| Internal transfer, conversion, Lightning | Movement inside the service, or over Lightning | The service | Nothing to run. Record it so the ledger is complete and nobody reads the gap as missing data. |
| Echo of the request | An address restated from your own subpoena in the cover letter or certification | n/a | No. It is not evidence of what the exchange holds. |
Checksums first. Every genuine Bitcoin and Ethereum address carries a checksum that fails if any character is wrong. An address that fails its checksum is a misread, a truncation or a typo, and must be corrected from the source before it is used for anything.
Chains. Public-record analysis covers Bitcoin and the EVM family (Ethereum, Polygon, Arbitrum, Optimism, Base, Avalanche, BNB Chain and others). Addresses on Solana, XRP, Litecoin, Dogecoin, Bitcoin Cash, Tron, Cardano, Monero and Stellar must be recorded with their chain and handled by other means; never drop them. A Bitcoin Cash legacy address looks exactly like a Bitcoin address: the asset column decides which it is.
Coverage. For each account, count the withdrawals that show a date and an amount but no destination address or transaction ID. That count is the re-request: it names the rows, and it names where the data lives.
Step 5. From address to on-chain report, and the next request
One verified withdrawal destination is enough to start. From a single address, public blockchain records give a first pass: the related addresses that move together as a cluster, the exchanges, services and counterparties the cluster dealt with, and the inflows and outflows over time with balances. It does not establish ownership or intent, and it is not a forensic investigation; it tells counsel where to look and gives an expert a head start.
The loop closes in one of two ways:
The destination is attributed to another service.
You have found the next custodian. Go back to Step 2 with that service's name and the dates and amounts from the report.
The destination is not attributed to any known service.
It is a self-custody candidate. The report's related addresses and counterparties become the subject of interrogatories, a deposition, or an expert's work.
Reconcile the two sources when the exchange's records arrive. Addresses in the on-chain cluster that the exchange does not recognise belong to a different account or custodian. Addresses the exchange produced that are not in the cluster are new starting points. The combination is what makes the accounting complete.
Count each transfer once. The same withdrawal appears in the CSV, the printed statement, the confirmation email and the certification; de-duplicate by chain and address, and check whether a report already exists for an address before running another.
Keep provenance for every address: the document, the page or row, and the line it came from. Attach the reports and an address ledger to the matter. The ledger line format that reads well as an exhibit: "A-1. bc1q... (Bitcoin): withdrawal destination of a 2024-03-02 Coinbase withdrawal of 0.25 BTC; Coinbase production, p. 7."
Pitfalls checklist for a crypto production
Tick these off before the addresses go anywhere near a report, a motion or an expert.
- Statement-only production: dates and amounts, no addresses. Re-request the addresses by name (Step 2), naming the export, the detail view and the emails.
- Echo of the request: an address that appears only in the cover letter or certification came from your own subpoena.
- Exchange-assigned deposit address treated as the party's wallet. It belongs to the exchange.
- Address transcribed from a scan or a printed spreadsheet: checksum passes, and the string matches the source character for character.
- Wrapped or truncated address in a printed spreadsheet ("bc1qxy2k...7f9a"): get the native export.
- Hash that lived in an email hyperlink and vanished when the email was printed: ask for the native .eml or the export.
- Addresses on chains outside Bitcoin and the EVM family recorded with their chain, not dropped. Bitcoin Cash legacy addresses look like Bitcoin; the asset column decides.
- The same transfer counted once across CSV, PDF, email and certification.
- Token contract addresses (USDC, USDT) in an asset or description column are not counterparties.
- Dates reconciled: exports are usually UTC, statements local; tie them to the dates the matter turns on.
- Spreadsheet traps: Kraken asset codes (XXBT, XETH, XDG), Excel date serials, long numeric strings rounded by Excel, leading apostrophes.
- Personal data in the KYC sheet: use the holder name, account identifiers and last-four digits in work product; do not copy dates of birth or Social Security numbers into notes.
- Robinhood brokerage versus Robinhood Crypto records; Binance.US is not Binance; PayPal and Venmo on-chain activity sits with Paxos.
- The entity name and registered agent verified with the Secretary of State and the service's legal page before anything is served.
Where BlockScout Law fits
EXCLUSIVE · Built for Clio firms
The Crypto Activity Screen launches first for firms on Clio; Records Intake follows.
Each step above has a tool in BlockScout Law. Together they turn the loop into one workflow inside the Clio matter.
🔎VASP Directory.
Look up any payee or statement descriptor and see the service it belongs to and the entity to name. Free account. Open the VASP Directory.
📄Crypto Activity Screen.
Pick the Clio matter, tick the statements, and read only those files. The screen lists the services found, grouped by confidence, with the statement lines, the totals sent and received, the entity to name, its legal-process page, and request language ready to paste. The report attaches to the matter. How it works.
📥Records Intake Coming
From the Matter, "Extract addresses from documents": tick the production files, or drop them in directly. Every address and transaction ID is listed by role with its provenance, checksum-verified before it is offered, scanned reads flagged and held for confirmation against the source, unsupported chains labelled, echoes of the request marked, and a coverage notice with re-request language for the rows that came back without addresses. One click creates the on-chain reports for the addresses you choose, links them to the matter, and attaches the reports and an address ledger to Clio.
🔗Address reports.
One address in; the related addresses, the counterparties and the inflows and outflows out, in minutes, from public blockchain records.
The files you tick are read in memory and never stored. The findings are deleted after 30 days; the report you attach to Clio is the record.
Have one address already?
One verified withdrawal destination is enough. The address report lists the related addresses, the services and counterparties, and the inflows and outflows, from public blockchain records, in about five minutes.
Start Free