Subpoena Responses from Cryptocurrency Exchanges:
What to Expect and How to Interpret Them
In traditional financial discovery and due diligence, most attorneys are accustomed to reviewing bank records. They know what to expect from monthly statements: starting balance, ending balance, and a clear chronological summary of everything that happened in between. Dates, amounts, descriptions – deposits, checks, wire transfers – such details tend to be self-explanatory.
Exchange production follows a different format.
Cryptocurrency exchanges rarely produce a single document that tells the entire story.
Instead, exchanges provide the raw materials from which the account history must be reconstructed.
Exchange production includes several types of records, each documenting a different aspect of the customer relationship. Certain exchanges may provide traditional-style account statements with starting and ending balances for a given period, but this remains the exception rather than the rule. More commonly, exchanges export transaction history in CSV (comma-separated values) spreadsheets with other customer data fragmented across multiple additional files.
Attorneys may receive:
Transaction ledgers
Spot and margin trading activity
Current portfolio balances
Staking balances
Deposit addresses
Onboarding records
Support communications
Account access logs
User-agent data
IP addresses
KYC files
API logs
The most valuable data is often spread across multiple folders and files. Not every file produced by an exchange necessarily has equal investigative value.
Account Opening Information
These records establish who opened the account, when, and using which identifiers. They may also reveal previously unknown email addresses, telephone numbers, or identity documents that become useful in subsequent discovery.
Linked Bank Accounts
Exchange records frequently identify linked bank accounts, brokerage accounts, debit card or credit card accounts, as well as details on payment methods and funding transactions associated with the customer. These records often create additional avenues for civil discovery beyond the exchange itself.
Current Balances
Current balances provide a snapshot of the account at the time of production. Balances may be presented solely in terms of the quantity of each digital asset, without an equivalent dollar value. Historical price indexes can be used to estimate the market values of cryptocurrencies and tokens for a specific date.
If the account currently contains a low balance, further review of the account history may yield evidence concerning prior holdings, transfers, and withdrawal destinations.
Transfer Activity and Withdrawal Destinations
Transfer records frequently become the starting point for blockchain tracing. Withdrawals to external wallet addresses may identify self-custodial wallets, transfers to another cryptocurrency exchange, or payments to third parties.
Interpreting those transactions often requires forensic blockchain analysis and attribution data to determine the nature of the destination address and whether additional assets or discovery targets may exist.
Deposit Addresses and Funding Sources
Exchanges generally assign unique deposit addresses to each customer, which are used by the customer to receive incoming transfers of cryptocurrency and tokens. A single customer account may have multiple deposit addresses, especially if the customer actively transacts across several blockchains.
The list of deposit addresses can be used to identify recurring funding wallets and counterparties. When forensically analyzed alongside transaction history, they can reveal patterns of funding activity, relationships with self-custodial wallets, or connections to additional exchanges and service providers.
Login Activity
Login records can corroborate account ownership, establish geographic patterns of use, and identify persistent devices or sessions associated with the account.
Support Communications
Chat logs and email correspondence with customer support may reveal certain admissions, account problems, recovery requests, claims of stolen funds, change of residence, device replacement, or lost authenticator credentials. In some matters, support communications may provide unique context and insights that are not found anywhere else in the production.
Where Document Review Ends and Forensic Analysis Begins
Some portions of exchange production can be reviewed in much the same way as traditional financial records. Understanding other materials – particularly blockchain transfers, wallet addresses, API logs, and trading histories – often depends on careful forensic interpretation.
Exchange production may answer only part of the investigative question, particularly if the current balance does not align with total anticipated holdings. Determining what happened to the funds and assets that passed through the account – and where the investigation should proceed next – frequently requires specialized forensic analysis.
Exchange production represents an important transition in a cryptocurrency asset investigation. The inquiry may have begun with nothing more than a suspicion of undisclosed digital assets, followed by a review of bank records and third-party discovery to identify the relevant exchange. Once exchange records reveal wallet addresses and blockchain transactions, the investigation can move into forensic blockchain analysis—tracing the movement of assets and identifying additional wallets, exchanges, and counterparties.
This article is the third in our series, How to Find Cryptocurrency Assets: A Discovery Guide for Attorneys. In prior articles, we considered how attorneys and investigators can begin the process of identifying cryptocurrency assets and exchange accounts through review of traditional bank records and targeted third-party discovery.
John Powers, CFE, CTCE, is President of Hudson Intelligence. He specializes in cryptocurrency forensic investigations, asset tracing, and expert consulting for attorneys handling judgment enforcement, matrimonial disputes, commercial litigation, fraud, and other matters involving digital assets.
Questions About a Cryptocurrency Matter?
Whether you are attempting to identify undisclosed cryptocurrency holdings, interpret exchange records, or determine the next step in a cryptocurrency asset investigation, we would be glad to discuss your matter and how we might assist.