When cryptocurrency is allegedly moved without authority, the visible transaction is often the easiest part to find. The harder questions are usually off-chain: who accessed the exchange account, which device or session was used, whether a withdrawal was authorised, who controlled the destination wallet, and whether the records offered to prove those points are complete and reliable.
That distinction matters in cross-border disputes. In Exchange Union Co and others v Wo Qi and others [2026] SGHC 124, the Singapore High Court considered jurisdiction and forum issues in a dispute involving parties and entities connected with Singapore, China, the Cayman Islands and the British Virgin Islands. The judgment records allegations that access to, and disabling of, Binance and OKX accounts occurred on 6–7 December 2023 from an IP address located in Singapore, followed by alleged transfers from those accounts to DFG wallets between 8 and 10 December 2023. These are recorded allegations, not a substitute for examining the underlying technical evidence.
The practical lesson is precise: preserve two evidence streams in parallel. The first is the exchange or custodian record of account activity. The second is the device, communications and wallet evidence that may corroborate who controlled the relevant account or session. Public blockchain data can establish movement between addresses, but it does not by itself establish legal ownership or authority to transfer.
The central evidentiary problem: movement is not attribution
A public blockchain can provide a durable record of a transaction. Depending on the chain and the records available, investigators may be able to verify the transaction hash, sending and receiving addresses, amount, block position and a timestamp recorded by the relevant ledger or data source. A block or ledger timestamp is not necessarily the time of an off-chain withdrawal request, provider-processing event or human action. Its interpretation depends on the chain, the source used, the relevant timezone and the question being tested. These records can provide evidence of movement between addresses, but they do not, by themselves, establish that a particular legal person owned the originating assets or authorised the transaction.
That is the dividing line between on-chain visibility and off-chain attribution.
An address may be associated with an exchange, a corporate structure, a custodian or an individual only through additional evidence. Relevant material may include exchange KYC records, withdrawal records, authentication logs, API-key activity, device information, communications, signed instructions and corporate custody documents. Even then, the conclusion must be tested rather than assumed. A login from an IP address may be an important event in a timeline, but it does not automatically prove the physical presence or identity of a person. Its significance depends on the integrity of the provider record and corroboration from other evidence.
The same discipline applies to the phrase “without authority”. Whether a transaction was technically initiated from an account is one question. Whether the person who initiated it had authority, acted as an agent, or exercised lawful control is a legal and evidentiary question requiring more than a transaction hash.
What the Singapore judgment contributes to preservation planning
The judgment is important for identifying the factual targets and chronology recorded in the proceeding. It identifies Binance, OKX and Gate.io as relevant custodial repositories for digital assets and records allegations concerning access, account disabling and transfers to DFG wallets.
It does not establish that the exchanges still hold every potentially relevant log. Nor does it show that provider logs, internal administrative records, device images or wallet artefacts were examined for the purposes of the public judgment. The case record should therefore be used as a targeting document: it can help counsel and investigators define accounts, providers, dates, wallet identifiers and potentially relevant actors for preservation requests.
The dates in the judgment are historical events in the reported dispute. Their value now is evidentiary and analytical. They illustrate how a judicially recorded chronology can be converted into a targeted preservation scope in a comparable matter, without treating the allegations as technically proven.
The two evidence streams to preserve
1. Exchange and custodian records
Provider-side records are often the most direct route to account attribution and the reconstruction of a withdrawal sequence. A targeted request may seek, subject to applicable process and provider capability:
- KYC and account-profile materials;
- account creation and modification history;
- login, authentication and password-reset records;
- IP addresses, user-agent data, device identifiers and session information;
- API-key creation and use records;
- deposit and withdrawal histories linked to transaction hashes;
- destination-address, beneficiary and whitelist changes;
- two-factor authentication changes or recovery events;
- internal transfer records, including movements that did not immediately appear as public blockchain transactions;
- administrative actions, account-disablement records, freeze notes and compliance flags; and
- support tickets and communications concerning the account or disputed transfers.
The request should identify the relevant account identifiers, wallet addresses, transaction hashes and a defined date range. It should also ask the provider to state the timezone, source system, export method and retention basis for the records supplied. A screenshot or account statement may help orient an investigation, but it should not be treated as a complete substitute for raw or natively exported records.
The provider’s published legal or law-enforcement channel may be the operational starting point. OKX publishes a Law Enforcement Request Guide. For Binance, the applicable request route and production requirements should be confirmed directly with Binance and relevant counsel rather than assumed from general published material.
The availability of any particular record remains provider-specific. The public material does not establish that Binance, OKX or Gate.io preserved the relevant logs in this matter, or that internal administrative and whitelist histories remain available. Those are questions for direct confirmation and, where necessary, formal process.
2. Devices, wallets and communications
Provider records rarely answer every attribution question. Device and user-side evidence may show how an account was accessed, whether a browser session or wallet application was active, and whether communications support or contradict an alleged instruction.
Depending on the circumstances and applicable authority, relevant sources may include forensic images of laptops and mobile devices, volatile memory, browser profiles, extension storage, local wallet files, exported keystores, backups, email, messaging applications, SMS or authenticator records, and screenshots or exported exchange data.
Volatile evidence deserves particular care. Active sessions, tokens, running processes and keys held in memory may disappear when a device is powered down or an application is closed. The SWGDE Tech Notes on Cryptocurrency emphasise the importance of volatility and appropriate acquisition decisions. Whether live capture is suitable is case-specific; it should be decided and documented by a qualified forensic practitioner, with attention to legal authority and the risk of altering evidence.
Browser-extension storage and wallet files can be useful without necessarily proving control. An encrypted vault may demonstrate that an artefact existed on a device, but access to the relevant key or seed phrase may still be required for decryption. The presence of a wallet file does not automatically prove that it controlled a particular on-chain address. Any stronger conclusion requires verifiable technical linkage and appropriate safeguards.
Communications can add a different form of corroboration. Emails, WeChat, Telegram, WhatsApp, Signal or Slack messages may contain instructions, consent, objections or contemporaneous explanations. Their value depends on preserving original metadata and relating the messages to provider records, device artefacts and the relevant timeline. A screenshot alone may omit information needed to assess authorship, completeness or timestamp reliability.
Independent testing: what should be checked?
Preservation creates the possibility of analysis; independent testing determines whether the resulting records support the proposed account of events.
Reconcile exchange records with the blockchain
For each alleged withdrawal, the transaction hash supplied by the exchange should be reconciled with the relevant blockchain record. The comparison should address the destination address, amount, transaction status, block position, confirmation history and the relevant time fields. A block timestamp should be treated as a ledger or protocol field, not automatically as the time of the withdrawal request, provider processing or human action. Provider-record timestamps and other off-chain event times should be assessed separately, with attention to timezone and source-system conventions.
The acquisition context should also be recorded: for example, whether the data came from a direct node, an exchange-supplied record, a blockchain explorer or another source. The analyst should preserve the data obtained in the form appropriate to that method, document the software or source context, and state the limitations of the source. Explorer output, direct node data and provider records may answer different questions and should not be treated as interchangeable.
The NIST Blockchain Technology Overview explains the relevant distinction: blockchain records can provide an auditable history of transactions, but the ledger does not by itself identify the legal person controlling a private key.
Internal exchange transfers require separate treatment. A movement within a platform may not immediately produce the same public-chain evidence as a withdrawal. The provider’s internal ledger and audit trail may therefore be essential, and its completeness must be established rather than inferred from an account statement.
Test the provenance and integrity of provider exports
Provider-produced CSV or JSON files should be accompanied, where possible, by information identifying the source system, export method, custodian representative, timezone and relevant retention policy. On receipt, the files should be preserved in their original form and hashed. A hash supports assessment of whether the file changed after hashing; it does not, by itself, establish that the file is authentic, complete, accurately exported or generated by the claimed provider.
Provider information and custodian evidence may assist with provenance. Scope, completeness, export methodology and the relationship between the file and the provider’s systems require separate testing. Any transformation, parsing or normalization should be documented so that the analysis can be reproduced. A signed cover letter or chain-of-custody record may support the evidential account, but neither is independently sufficient to resolve authenticity, completeness or evidential weight.
The key question is not simply whether a file looks authentic. It is whether the file can be connected to the provider’s systems, whether its scope is understood, and whether its timestamps can be aligned with the blockchain and device evidence. Those issues should be assessed together rather than treated as resolved by a hash, signature or handling record alone.
Correlate authentication events with endpoint evidence
A provider log may show a login, IP address, device identifier or API-key event. Endpoint evidence may show a corresponding browser session, application process, stored token or communication. Correlation can strengthen a timeline, but it must account for shared devices, remote access, virtual networks, timezones, incomplete logs and the possibility that an account was accessed by someone other than its nominal owner.
An IP address is therefore an event identifier, not an automatic identity finding. The stronger the attribution conclusion, the more important it is to test provider-log integrity and seek independent corroboration.
What the evidence can and cannot establish
With appropriate records, the investigation may be able to establish with substantial technical confidence that:
- a particular on-chain transaction occurred;
- specified assets moved between identified addresses;
- an exchange account generated a withdrawal request linked to a transaction hash;
- a recorded authentication event occurred at a particular provider-recorded time and from a particular network endpoint; and
- separate records are consistent with a particular sequence of account, device and blockchain events.
The time fields in those records should remain identified by source. A provider timestamp, a device timestamp and a blockchain block timestamp may reflect different systems and should not automatically be treated as the same real-world event time.
Those propositions remain distinct from conclusions about ownership, authority, intent or agency. On-chain data alone cannot establish who beneficially owned a private key. An exchange account record alone may not establish who was operating the device. A device artefact alone may not establish who had authority to transfer corporate or custodial assets.
The unresolved gaps in the reported matter illustrate why this distinction matters. The public record does not provide provider-produced raw logs, confirm whether internal administrative records were retained, identify device-level wallet evidence, or resolve the connection between the named Cayman and BVI entities and the relevant on-chain addresses. Those gaps should remain visible in any technical report or litigation strategy.
A disciplined preservation sequence for cross-border disputes
The most useful preservation plan is not the longest list of possible artefacts. It is a sequence that connects the alleged event to the evidence needed to test it.
First, define the identifiers: account names or IDs, registered email addresses and phone numbers, wallet addresses, transaction hashes, providers and the relevant date range. The chronology recorded in a judgment can be a useful starting point, but the scope should be widened where necessary to capture preceding authentication, address-whitelist or recovery events.
Second, send targeted preservation requests through the relevant provider channels and retain delivery evidence. The request should identify the records sought, ask that native or raw exports be preserved where available, and distinguish account activity from internal administrative action. Prompt action may reduce the risk that relevant records become unavailable, but retention periods, availability and production capability are provider-specific and should be confirmed directly.
Third, protect potentially volatile devices and sessions. A decision to capture live memory, preserve a running application or power down a device should be made by a qualified practitioner and recorded with the reasons, tools and handling steps. Device and session evidence may be particularly time-sensitive because it can change or disappear when a device or application state changes.
Fourth, independently capture the on-chain timeline. Record transaction hashes, block heights, confirmations, relevant ledger timestamps and the source data used for verification. Public-chain evidence may be comparatively accessible, but it still needs a reproducible acquisition record and a clear statement of the source’s limitations.
Finally, separate technical findings from legal conclusions. A forensic report can explain what the records show, how they were obtained and how they correlate. It should not silently convert those findings into conclusions about title, authority or liability.
Cross-border process may affect both preservation and production. Providers may require specific legal or law-enforcement channels, court orders or other recognised forms of process. Evidence or custodians connected with Singapore, China, the Cayman Islands or the British Virgin Islands may create additional procedural considerations. The technical preservation plan should therefore be coordinated with counsel’s jurisdictional strategy, without assuming that a record available in one forum will be available in another.
The decision point for counsel and investigators
The important question is not merely whether cryptocurrency moved. It is whether the available evidence can support a defensible account of the movement, the account access, the device or session involved, and the authority said to govern the transfer.
For a cross-border ownership dispute, the strongest early approach is usually a paired one: preserve custodian records before retention or access conditions change, while independently protecting devices, communications and wallet artefacts that may corroborate or challenge those records. Then test the links between the streams rather than presenting any one source as conclusive.
An independent technical assessment can be useful when the dispute turns on the integrity of exchange exports, the reconstruction of an authentication and withdrawal timeline, the relationship between wallet activity and custodial records, or the limits of what on-chain evidence can prove. IVIDENTIA’s perspective is simple: digital facts become decision-useful only when their provenance, limitations and relationship to the disputed question are made explicit.
If a dispute turns on whether an exchange account, device or wallet was used to initiate a transfer, contact IVIDENTIA to discuss an independent technical assessment that preserves the distinction between recorded digital facts and the legal conclusions those facts may support.
Sources
- Exchange Union Co and others v Wo Qi and others [2026] SGHC 124 (Judgment)
- Exchange Union Co and others v Wo Qi and others [2026] SGHC 124 (HTML viewer)
- Tech Notes on Cryptocurrency (SWGDE)
- Blockchain Technology Overview (NIST IR 8202)
- OKX Law Enforcement Request Guide
- Binance posts and published law-enforcement guidance
- How blockchain forensic and exchange records are used in investigations
- Processing heterogeneous cryptocurrency exchange data for law enforcement
