Sticky Notes to Seed Phrases: How To Identify Crypto Artifacts in the Field

Whether executing a search warrant or responding to a crime scene, law enforcement officers today are more likely than ever to encounter digital evidence connected to cryptocurrency — from hardware wallets and seed phrases to lesser-known clues like transaction memos, printed QR codes, and air-gapped devices.

In a recent webinar, two of the world’s leading crypto investigators — Chris Janczewski (TRM’s Global Head of Investigations and former IRS-CI special agent) and Chris Wong (Global Investigator, Law Enforcement Relations at TRM and former FBI supervisory special agent) — led front-line law enforcement professionals through a deep-dive into all things crypto evidence. 

They explored the common crypto artifacts officers are likely to come across in the field, what they mean, and how to preserve them for effective follow-up and prosecution. And they also walked attendees through some of the high-profile cases they both led during their time in law enforcement — a rare, behind-the-scenes look into the frontline investigative process.

Read on for a recap of the session, or use your law enforcement email address to watch the recap below.

What are crypto artifacts — and why do they matter?

Crypto artifacts refer to the physical and digital traces that signal cryptocurrency usage or ownership. Unlike traditional assets, crypto assets can be stored, transferred, and accessed through a wide range of hardware and software — meaning key evidence may not always resemble what most investigators expect (especially those who are new to the digital asset space).

As Janczewski noted, “Crypto artifacts aren’t always flashy. Sometimes it’s a sticky note, sometimes it’s a label on a laptop. But that small detail could unlock an entire investigation.”

Recognizing these indicators — and understanding their potential investigative value — is essential for any officer responding to a scene where financial crime, fraud, or digital assets may be in play.

Common types of crypto artifacts found in the field

Janczewski and Wong outlined several common crypto artifacts law enforcement officers may encounter during field operations, including:

• Hardware wallets: Physical devices often resembling USB sticks or external hard drives, used to store the private keys needed to access crypto assets. Popular brands include Ledger, Trezor, and SafePal.
• Seed phrases: A sequence of 12 to 24 words that can be used to regenerate a crypto wallet. Officers often find these written down or saved in password managers.
• Mobile and desktop applications: Crypto wallets may be installed on a suspect’s phone, laptop, or even a burner device used for a single transaction.
• QR codes: These may appear on printed documents, whiteboards, or even t-shirts — often linking to a wallet address or payment request.
• Notes and receipts: Transaction memos, screenshots, exchange deposit confirmations, or shipping labels with wallet addresses can all serve as critical leads.
  

A key investigative tip: when in doubt, photograph first, interpret later. Preservation is key, and you never know if an artifact will play an important role at a later stage of your investigation or if you will ever have access to it again.

Field tactics for securing digital evidence

Janczewski and Wong also shared real-world examples of successful evidence collection based on their past casework — and where missed artifacts led to dead ends. To help investigators preserve and assess crypto evidence, they emphasized the following best practices:

• Photograph all digital screens and handwritten materials before seizing devices or documents
• Look for small, unexpected items like USBs hidden in inconspicuous containers (e.g. deodorant sticks, toys, or coin pouches)
• Label and log devices accurately, noting whether they were powered on, connected to a network, or encrypted
• When in doubt, treat cryptocurrency like cash
• Understand that seed phrases and other mechanisms for accessing crypto wallets may exist in multiple places, giving illicit actors access to the wallet, even though you have “seized” a copy of that access
  

These details may prove essential later in court or when building attribution through blockchain intelligence platforms like TRM.

How TRM supports law enforcement in the field

TRM’s blockchain intelligence platform is designed to help investigators follow the money through every stage of their investigation.

Investigators can use TRM Triage to search crypto artifacts in the field with their mobile device. With a photo of any crypto artifact — QR code, ATM receipt, or even a partial address — investigators can instantly view balances, transaction history, and threat categories.

With Seed Analysis, investigators can quickly and securely convert seed phrases and xPubs into actionable leads across dozens of blockchains and billions of addresses to discover linked wallets, transactions, and assets.

TRM Forensics helps law enforcement trace the flow of cryptocurrency across blockchains in a single graph, link wallets to real-world services with glass box attribution, and generate clear, court-ready visuals and reports to support subpoenas, freezes, and prosecutions.

TRM’s solutions are built specifically to support time-sensitive law enforcement needs — helping teams trace, seize, and disrupt illicit crypto activity in real time.

Tips for improving frontline crypto readiness

Janczewski and Wong closed out the session with practical guidance for law enforcement professionals who want to improve their crypto readiness:

• Train your team to recognize common crypto artifacts — and know how to escalate when needed
• Coordinate with digital evidence specialists when crypto is suspected or discovered
• Meticulously look everywhere and document everything
• Leverage TRM Academy for continuing education to upskill your team
  

As Wong summarized, “If we can help an officer identify a single wallet in the field, we can potentially stop an entire laundering operation from succeeding.”

{{horizontal-line}}

Want to go deeper? Download the Identifying Crypto Artifacts in the Field Flip Book to explore each type of crypto artifact in more detail, unpack their roles in investigations, and learn blockchain tracing and TRM Triage basics.