Seizure and Confiscation of Crypto Assets in Criminal Proceedings

A crypto asset is easy to seize “on paper” — and almost impossible to actually hold if the case file gives no access to the private keys. This article explains to investigators, detectives of the Bureau of Economic Security (BEB), and defence lawyers how to seize cryptocurrency under the rules of the Criminal Procedure Code of Ukraine (KPK), how to secure its special confiscation, and how to avoid the classic error in which an asset is formally seized while it is quietly moved to other addresses.

Why crypto assets are a special subject of seizure

In criminal proceedings, cryptocurrency is treated as property that has value and may serve as evidence, as the object or instrument of an offence, and as a source of unlawful benefit. The difficulty is that the classic seizure mechanism was built for physical things and registered property — real estate, vehicles, funds in bank accounts — where a register or a custodian exists that can be ordered to block a transaction.

A crypto asset works differently. Control over it is defined not by an entry in a register but by possession of the private key (or seed phrase). Whoever holds the key can move the asset to any address in the world within seconds, and no court ruling can technically prevent this if the suspect still has access to the key. The legal status of virtual assets in Ukraine is still taking shape: the dedicated Law “On Virtual Assets” has been adopted, but its full application is tied to tax amendments still being worked through by parliament. In practice, therefore, the investigator relies on the general rules on the seizure of property and on special confiscation.

Seizure of property: grounds and procedure (Chapter 17 of the KPK, Art. 170–175)

Seizure of property is the temporary — until lifted in the manner prescribed by law — deprivation of the right to alienate, dispose of and/or use property, ordered by an investigating judge and, at the trial stage, by the court (Article 170 of the KPK). Grounds include, among others, preserving physical evidence, securing a future special confiscation or confiscation of property, and securing a civil claim for damages.

The procedure is short and strict on deadlines:

• The motion is filed by the investigator (with the prosecutor’s approval) or by the prosecutor before the investigating judge (Article 171 of the KPK).
• The investigating judge considers and decides the matter and, where grounds exist, issues a ruling (Articles 172, 173 of the KPK).
• The seizure ruling is executed immediately by the investigator or prosecutor (Article 175 of the KPK).
• The owner or holder of the property has the right to file a motion to lift the seizure (Article 174 of the KPK).

What must be recorded in the motion

• Asset identifiers: public wallet addresses, the name of the blockchain/network, the token type, and — for exchange-held funds — the name of the platform and the account identifier.
• A reasoned link between the asset and the proceedings: why it is evidence, was obtained by criminal means, or is the object or instrument of the offence.
• The scope of restrictions: not only a ban on alienation but also instructions for technical actions (seizing the media that hold the keys, requesting an exchange to block the account).
• An approximate value of the asset as at the date of the motion — with a note on volatility (see below).

The technical crux: whoever controls the keys controls the asset

The key decision in every case is where and how access to the asset is stored. This determines whether the seizure will be real rather than merely declarative.

Storage type	Who controls the key	What gives investigators real control
Custodial (exchange, bureau)	The custodian platform	Blocking the account and seizing the funds on it via a request to the exchange
Non-custodial “hot” (app, browser extension)	The user	Seizing the device + seed phrase/private key
Hardware wallet (“cold”)	The user	Seizing the device + PIN + seed phrase
Paper / metal backup	The user	Physically seizing the medium holding the key or seed

Non-custodial wallets: without keys the seizure is incomplete

If the asset is held in the suspect’s own wallet, the ruling alone is not enough — access to the private key or seed phrase is required. During a search it is therefore critical to seize and carefully describe: hardware wallets, phones and computers with wallet apps, and paper and metal media — sheets, cards, engravings bearing a set of 12 or 24 words. In my expert practice the seed phrase is often found written down “offline”: in a notebook, on the back of a document, in a safe. Such a medium is effectively the asset itself, and losing it means losing the ability to seize the asset in reality.

Custodial assets: blocking the account on an exchange

If the funds sit in an account with a centralised exchange or bureau, control over the keys belongs to the platform. Here the effective step is a request to block the account and seize the funds on it — mechanically this is closest to seizing funds in a bank account.

Cooperating with exchanges and the Financial Monitoring Service

Working with platforms is a separate line of effort that should be planned in advance. In economic-crime proceedings the investigation is often led by the Bureau of Economic Security (BEB), while the State Financial Monitoring Service (Derzhfinmonitoring) helps trace the movement of the asset.

• Ukrainian and controllable platforms respond to an investigating judge’s seizure ruling and to requests made within the proceedings; withdrawals can be blocked promptly on them.
• Foreign exchanges usually will not execute a Ukrainian ruling directly — a request for mutual legal assistance is required, and in urgent cases it is sensible to send the platform a “freeze” request through its compliance/security team in parallel, to buy time.
• Transaction-chain analysis helps trace the asset to a specific exchange and establish the moment it came under the control of a custodian who can then be ordered to act.

Practical advice: act fast and quietly. A public blockchain lets anyone see activity at an address, so revealing intentions prematurely triggers an immediate withdrawal of funds.

Valuation at the time of seizure

The volatility of crypto assets creates a separate problem for documentation and for later confiscation. The value of the same amount can change noticeably within hours, and for most crypto assets there is no official rate such as the National Bank of Ukraine (NBU) exchange rate.

Points to keep in mind:

• Fix the value as at a specific date and time of seizure, not “in general”.
• Rely on several independent sources of quotations (leading platforms), not on a single random bureau.
• Preserve the primary valuation data (screenshots, quotation exports with timestamps) — they will be needed during the examination and in court.
• Understand that the value at the moment of seizure, at the moment of examination and at the moment of the verdict may differ; this should be stated directly in the materials.

This is precisely where a forensic economic examination belongs. Its ordering and conduct are governed by the Law of Ukraine “On Forensic Expert Examination” and by the Instruction on the ordering and conduct of forensic examinations and expert studies (Order of the Ministry of Justice No. 53/5). As a court-appointed expert I document the value as at a defined date with a link to its sources, rather than offering “a single figure” without a methodology.

Storing seized assets: the role of ARMA and a systemic gap

Finding and seizing an asset is half the job; it must also be preserved until its fate is decided in the verdict. The management of assets seized in criminal proceedings falls within the competence of ARMA — the National Agency of Ukraine for Finding, Tracing and Management of Assets Derived from Corruption and Other Crimes.

The problem is that a ready, standardised mechanism for storing crypto assets specifically is currently lacking. In practice this raises questions: whether to move the seized asset to a separate controlled (“cold”) address, who stores that address’s keys and how, and how to ensure immutability and accounting. Until these procedures are finally settled, every decision on the method of storage must be carefully documented, so that no argument later arises about the loss or unavailability of the asset.

Special confiscation (Art. 96-1, 96-2 of the Criminal Code)

The ultimate purpose of seizure is often to secure special confiscation: the compulsory, gratuitous seizure of property into state ownership by court decision in the cases provided for by the Criminal Code (KK). Article 96-2 of the KK covers, among other things, property obtained as a result of an offence (and income derived from it), property that was the object of an offence, or that was used as a means or instrument of committing it. Crypto assets fully fall within these features once the relevant link to the crime is proven. At the same time, the practice of confiscating virtual assets specifically is still forming, so the quality of proving the asset’s origin and the accuracy of its description are critically important.

The typical investigative mistake: “seizing a wallet” without access to the keys

The most common and costliest mistake looks like this: the motion cites a wallet address, the investigating judge issues a ruling — and that is the end of it. The asset is “seized”, but the private key remains with the suspect. Technically nothing prevents him from moving the funds to a new address, and the seizure becomes an empty formality.

How to act differently:

1. Plan access to the keys together with the seizure. The seizure ruling should be accompanied by measures to obtain the key media (search, seizure of devices and paper backups).
2. Separate the two scenarios. A custodial asset — block it through the custodian (the exchange); a non-custodial one — obtain the key/seed, or there is no real control.
3. Do not reveal intentions prematurely, and act fast: on a public blockchain any delay is a window for withdrawal.
4. Fix the value as at the date of seizure from several sources and preserve the primary data.
5. Think through the storage of the seized asset immediately and document the chosen method.
6. Involve an expert for valuation and for studying the movement of funds wherever there is volatility or complex transaction chains.

The seizure and confiscation of crypto assets sit at the junction of law and technology, where an error at a single step devalues the entire effort. If your proceedings raise the question of valuing virtual assets, studying their origin, or tracing the movement of funds, seek a consultation and a forensic economic examination — we will analyse your situation on the merits and within the bounds of the law.