Direct answer
On-chain movement proves a transfer record, not automatically the human actor or purpose
Preserve wallet addresses, transaction hashes, token, network, block time, exchange or custodian records, KYC, IP and device access, deposit and withdrawal addresses and fiat bank rails. Identify self-custody, custodial accounts, multisignature arrangements, shared devices and recovery access. Do not move assets after a lawful restriction or delete wallet software and messages.
Chain-analysis labels and clusters are investigative opinions that require methodology and corroboration. A wallet may receive mixed sources, exchange omnibus funds, bridge transactions, airdrops or legitimate trades. The PMLA analysis still begins with the alleged scheduled offence and property derived or obtained from it. Valuation should state token quantity, date, market source and purpose; a price peak should not silently become the proceeds figure.
Legal analysis
Crypto attribution requires chain, control, source and valuation analysis
Digital evidence can be exact about transaction hashes and uncertain about people. The brief should preserve that distinction.
Wallet and key control
Ownership of a device, seed phrase, exchange account or address label may indicate access, but shared custody, company wallets and compromised credentials require investigation.
Practical focus: Map keys, devices, custodians, permissions and access dates.
Chain methodology
Clustering, change-address heuristics, bridge tracing and service labels can contain assumptions. Request the transaction set and method, not only a visual graph.
Practical focus: Reproduce disputed paths independently and document excluded transactions.
Fiat and scheduled source
Connect token acquisition or receipt to the alleged criminal activity through fiat deposits, victim transfers, exchange records or other evidence. On-chain movement alone does not identify predicate source.
Practical focus: Use a source-to-token schedule with transaction hashes and bank references.
Valuation and mixed assets
Token price varies and wallets can contain legitimate and disputed assets. Acquisition value, transfer value, seizure value and current value serve different questions.
Practical focus: State quantity and valuation method separately for every legal purpose.
Evidence plan
Digital-asset evidence needs exact identifiers and human attribution
Screenshots are useful illustrations but weak substitutes for full transaction data, exchange records and forensic provenance.
| Record | What it may establish | What it cannot establish by itself |
|---|---|---|
| Wallet addresses and transaction hashes | Exact on-chain movement, token, time and amount | Human owner, purpose or unlawful source |
| Exchange KYC and account records | Registered user, deposits, trades, withdrawals and access | Exclusive control or truth of KYC |
| Device and key evidence | Possible access and wallet software | Who initiated each transaction |
| Fiat bank trail | Funding and cash-out route | Scheduled-offence origin without the underlying case |
| Chain-analysis report | Investigative path and service attribution | Correctness of every heuristic or label |
| Valuation schedule | Token quantity and stated market value at a time | The legal proceeds amount or beneficial ownership |
Response roadmap
A wallet-by-wallet defence audit
- 01
Preserve identifiers and devices
Record addresses, hashes, accounts, networks, devices, backups and custody without transacting or altering evidence.
- 02
Export complete histories
Obtain exchange, wallet and blockchain data for the full relevant period, not selected screenshots.
- 03
Map human control
Identify users, keys, permissions, IPs, devices, corporate custody and potential compromise.
- 04
Trace fiat and alleged predicate source
Connect or distinguish victim, business, loan, investment and own-fund transactions.
- 05
Challenge method and value precisely
Audit chain heuristics, labels, bridges, mixed funds and valuation dates in the correct bail, seizure, attachment or trial forum.
Delhi forum context
Crypto does not create a separate PMLA court
The predicate cyber, fraud or other scheduled case follows its investigating agency and court; the PMLA complaint follows the notified Special Court. Exchange or server location may create additional territorial questions but does not replace statutory allocation.
For Delhi proceedings, preserve the ED action, cyber case, exchange records and court allocation. Technical expert work should explain method and limitations in language that can be tested in court.
Focused questions
Questions commonly arising at this stage
Can a public wallet address prove ownership?
It proves the address and its on-chain history, not necessarily the human controller. Exchange KYC, keys, devices, access and surrounding communications may support attribution.
Is chain-analysis software conclusive?
It can be valuable evidence, but methodology, data, service labels, clustering assumptions and corroboration should be examined. A graphic is not beyond challenge.
Can legitimate and disputed crypto be in the same wallet?
Yes. The transaction chronology, token quantities, sources, disposals and applicable legal approach require tracing. Avoid all-or-nothing assumptions.
Does crypto volatility change the proceeds amount?
Valuation depends on the legal question and relevant date. Record token quantity and explain the chosen market source and date; price movement should not be treated as a new transfer.
Primary materials
Official sources for verification
Use the current statutory text, rules, notifications, roster and orders. This page is an issue map, not a substitute for checking the live record.
Case preparation
Convert the papers into a dated, transaction-level brief
For an initial assessment, organise the latest summons or order, case particulars, a one-page chronology, the relevant bank or property trail, and the exact next deadline. Do not alter, rename or selectively delete electronic records.
Part of the PMLA & Enforcement Directorate research cluster. Substantive legal propositions must be checked against the current Act, rules, notifications and binding decisions applicable to the actual record.