NDA in a Crypto Investigation: Why Sign Before Details

Why an NDA before you tell the story

After theft or a freeze you hand over sensitive material: addresses that still hold assets, a transfer map, KYC screenshots, messages with the scheme. Without a frame, that is only trust in a stranger’s chat. NDA (non-disclosure agreement) is the everyday label for a written duty not to pass what you shared to third parties without your say. A legitimate counterparty usually offers it before the full picture, not after “send the seed first, we will paper it later.”

Fear of a second hit is justified: IC3 describes recovery scams and fictitious “law firms” that extract retainers or access from people already harmed. An NDA by itself does not stop a thief—but refusal to discuss confidentiality, pressure that “the trail is going cold, type the key,” and a request to skip any legal entity add up to a filter. If outflow is still open, protect and record facts first, paper second: a lawyer after crypto theft does not replace the first hour.

What an NDA does—and what it does not

An agreement can define which facts are confidential, how long that duty lasts, and what happens to files after the work. Wording, remedies, governing law, and venue are for your local lawyer, not a blog paragraph. We do not supply a copy-paste form and do not treat internet templates as legal advice.

An NDA does not turn an anonymous account into a vetted firm. You can sign one and still face a leak or a second scam if you handed over access. An authority needs TxIDs and a timeline, not a scan of an NDA: see filing a police report.

Checklist before you sign and share facts

1. Is there a legal entity and a services contract, not only a “privacy policy” on a website.
2. What you will share before an NDA: the type of situation (theft / exchange hold / lost access) without remaining-balance addresses.
3. What you never share: the seed phrase, private keys, 2FA codes, or AnyDesk “for an audit.”
4. Does the other side give time for your lawyer to read the document—or rush “sign it in chat in a minute.”
5. Does the promised scope (ticket, tracing, filing) match what will appear in the services contract.
6. Is there a channel that does not require pasting the full phrase into an open messenger.

If someone mixes an NDA with a services agreement, or says “confidentiality is obvious anyway,” that is not a ban on working with people who skip paperwork—but it is a cue to inspect the rest: payment details, refusal of keys, no recovery guarantee. Preparing a package without promising an outcome is legal support.

An NDA is not a reason to send a seed phrase

A short self-custody rule with no exceptions: the recovery phrase is not sent “under NDA,” “to a lawyer,” or “in an encrypted archive just in case.” Whoever holds the seed holds the asset. A non-disclosure paper does not reverse a confirmed transfer and does not cure phishing. If access is already compromised, that is not an NDA topic: stop the outflow and preserve the trail.

• Do not sign a Telegram PDF unread “so we can freeze in time.”
• Do not confuse an NDA with an analyst licence or a court order.
• Do not treat a signature as consent to move the remainder into the vendor’s “safe wallet.”
• Do not publish someone else’s NDA as a universal template—jurisdictions differ.

A workable order: close access, collect TxIDs, decide whether an authority is needed, and only then give case detail to a party that papers confidentiality and services separately. Anonymized reviews are in case studies. An NDA does not sell an investigation outcome.