Kit de evidencia para estafas cripto

Checklist de evidencia

Evidence type	What to save
Website and app	Full URL, login URL, app store link, domain spelling, screenshots of homepage and payment page.
Contacts	Telegram/WhatsApp handles, email addresses, phone numbers, social profiles and display-name changes.
Rastro de pago	Direcciones de wallet, hashes de transacción, recibos de retiro del exchange, horarios de pago y montos solicitados.
Promises and pressure	Guaranteed returns, unlock tax, liquidity fee, recovery promise, deadline pressure and threat wording.
Account state	Dashboard balance screenshots, withdrawal block messages, KYC requests and support ticket numbers.
Your actions	When you joined, what you clicked, what wallet you connected, which approvals you signed and what you revoked.

Plantilla de resumen del incidente

Field	What to write
Incident type	Fake exchange, recovery scam, wallet drainer, clone domain, fake support, romance/investment scam or unknown.
Main service/domain/contact	Exact website, app name, handle, email, phone number and the route that led you there.
Money movement	Coin, chain, amount, transaction hash, destination address, exchange used and date/time.
Trigger event	Failed withdrawal, tax demand, account freeze, recovery offer, malicious approval, seed phrase request or support-channel switch.
Current risk	Remaining funds at risk, wallet still connected, approvals still abrir, documents shared or ongoing pressure messages.
Reports already filed	IC3, FTC, Chainabuse, exchange support, wallet provider, local police or regulator references.

Evidencia por tipo de estafa

Scenario	Most useful evidence	Likely next route
Fake exchange / withdrawal tax	Dashboard URL, withdrawal error, tax/unlock message, support chat, deposit tx hash, destination wallet, account screenshots.	Verificador de alertas, exchange report, IC3/FTC or local regulator.
Recovery scam	Resumen de la pérdida original, promesa de recuperación, solicitud de tarifa, agencia/empresa alegada, dirección de wallet, prueba de contacto y solicitud de pago.	FTC/CFTC guidance, IC3, warning checker and evidence kit.
Wallet drainer	URL sospechosa, hash de transacción/aprobación firmada, contrato del token, dirección del spender, capturas del popup de wallet y resultado de revisión de aprobaciones.	Transaction lookup, Revoke.cash profile, wallet provider report.
Dominio clonado / fake support	Dominio exacto, página de marca copiada, widget de chat, cuenta Telegram/WhatsApp/email, acción solicitada y capturas.	Binance Verify when relevant, service profile, Chainabuse and warning checker.
Romance or investment pitch	Perfil del primer contacto, promesa de inversión, guiones, secuencia de pagos, lenguaje de presión y todas las direcciones de wallet.	IC3/FTC, local cybercrime report, warning checker.
Fake token / airdrop	Dirección del contrato, página del token, URL de reclamo, prompt de wallet, publicación/anuncio social y enlaces de exploradores.	Transaction lookup, wallet-drainer wiki, Chainabuse.

Plantilla de línea de tiempo

1. First contact: where the conversation began and which profile or ad led to the service.
2. Registration: domain, app, account ID and the first screenshot of the dashboard.
3. Deposit: coin, chain, amount, wallet address, exchange receipt and transaction hash.
4. Problem: failed withdrawal, frozen account, tax demand, recovery offer or support-channel switch.
5. Current state: last message, last domain seen, remaining funds at risk and what has already been reported.

Antes de enviar un reporte

1. Put the incident summary at the top so a reviewer can understand the case in one minute.
2. Attach raw links and screenshots, but keep private keys, seed phrases, passwords and full ID documents out of public reports.
3. Use exact timestamps with timezone when possible. If not, write the local time and country.
4. Keep wallet addresses and transaction hashes in plain text so exchanges and investigators can copy them.
5. Separate facts from assumptions: "I sent 0.5 ETH to this address" is stronger than "they stole everything."
6. Save a local copy before submitting because some portals do not show the full report after it is sent.

Dónde reportar

Goal	Dónde reportar	Attach
Cybercrime report	FBI IC3 or the relevant national cybercrime portal	Transaction hashes, wallet addresses, website URLs, communication records.
Consumer/regulator warning	FTC, CFTC, FCA, SEC/Investor.gov or local financial regulator	Texto de la oferta, afirmaciones de la empresa, coincidencias en listas de alerta y solicitudes de pago.
Exchange report	The exchange used to send funds	Recibo de retiro, hash de transacción, dirección de destino y relato de la estafa.
Wallet or abuse platform	Wallet provider support, Chainabuse or chain-specific abuse channels	Wallet addresses, chain, transaction hash and screenshots.
Public review or CryptoRescue tip	Only after saving evidence and avoiding doxxing/private data	Dominio sanitizado, patrón, fechas y enlaces de fuentes.

Qué no hacer

• No pagues tarifa de recuperación, cargo de validador, recarga de gas, impuesto de desbloqueo o depósito para investigador.
• Do not share seed phrases, private keys, one-time codes, ID documents or remote-access sessions with a recovery contact.
• Do not delete chats after reporting. Export or screenshot them first.
• Do not publish private personal data when posting a public warning.
• Do not assume a domain is safe because the name is absent from one warning list.

Registro de actualizaciones

1. 3 jun 2026Publicado con seguimiento de fuentes y contexto de seguridad para lectores.
2. CorreccionesSi una fuente cambia o una afirmación necesita aclaración, esta página puede actualizarse desde la redacción.