Cryptocurrency as Physical Evidence: How to Seize It Lawfully

A hardware wallet, a sheet of paper with a seed phrase, or a screenshot of an exchange balance can be worth millions — but only for as long as they have been recorded and seized correctly. One procedural lapse, and the most convincing crypto asset is thrown out by the court as inadmissible evidence. As a forensic economic expert, I explain here what actually counts as physical evidence in crypto cases, how to fix and seize it under the Criminal Procedure Code of Ukraine (Кримінальний процесуальний кодекс, KPK), and where such cases most often fall apart.

Cryptocurrency as physical evidence: what Article 98 of the KPK says

The starting point is Article 98 of the KPK, “Physical evidence” (речові докази). Under it, physical evidence means material objects that were the instrument of a criminal offence, that retained its traces upon them, or that contain other information usable as evidence — as well as money, valuables and other property obtained by criminally unlawful means.

Dedicated regulation of virtual assets in Ukraine is still taking shape: the Law “On Virtual Assets” (Про віртуальні активи) has been adopted, but its full application is tied to amendments to the Tax Code. So, for now, cryptocurrency in criminal proceedings is “fitted” into the existing categories of Article 98 — with one crucial caveat. The virtual asset itself is not a “coin in your pocket” but an entry in a distributed ledger (the blockchain). It does not “sit” on any device. What is stored on a medium is only the key of access to it. That is why crypto cases require a clear distinction between three different objects.

Asset, medium and key — three different things

• The virtual asset — an entry at a particular address on the blockchain. It has value, and it is ultimately this that constitutes “property obtained by unlawful means”.
• The medium — a hardware wallet, a phone, a laptop, a flash drive, even a sheet of paper or a metal plate bearing a seed phrase.
• The key of access — the private key, the seed phrase (the mnemonic recovery phrase), the login and password for an exchange account together with access to two-factor authentication (2FA).

The practical conclusion I keep repeating to investigators and defence lawyers: without the key, a seized device is an empty box. You can lawfully seize a hardware wallet holding a million dollars and get nothing out of it if access to the seed phrase has not been secured. Conversely, a seed phrase alone, lawfully recorded, opens access to the asset even without the physical device.

Three lawful methods of fixing

The KPK has no dedicated “crypto chapter”, so crypto is fixed through the ordinary investigative (search) actions. The choice of method depends on the situation.

Inspection (Article 237 of the KPK)

Inspection (огляд) is used where access to the object is free or voluntary: the scene of the event, a device handed over voluntarily, an exchange account open on the screen, a page of a blockchain explorer. During an inspection you fix what is “here and now”: the state of the screen, the addresses on display, balances, transaction history. As a rule, an inspection of a person’s home or other property is carried out on a ruling of the investigating judge under the rules established for a search.

Search (Articles 234–236 of the KPK)

Where compulsory access to premises or a person is needed in order to find and seize media and keys, a search (обшук) is conducted on the basis of a ruling of the investigating judge (слідчий суддя). The motion should state the purpose expressly — the recovery not only of devices, but also of media carrying key information (notebooks, loose sheets, metal plates), and the granting of access to the contents of electronic devices. A search is accompanied by mandatory continuous video recording.

Temporary access to things and documents (Article 159 of the KPK)

This is the tool for cases where the asset or the data is controlled by a third party — above all a crypto exchange, an exchanger or a bank. On a ruling of the investigating judge granting temporary access, you can obtain statements, operation history, KYC data and IP logs, and, where there are grounds, the seizure of specified things and documents. For assets on a centralised exchange this is often more effective than hunting for keys in the physical world. In cases of economic and financial crime the pre-trial investigation is frequently led by the Bureau of Economic Security (Бюро економічної безпеки, BEB), while orienting information may come from the State Financial Monitoring Service (Держфінмоніторинг) and the State Tax Service (Державна податкова служба, DPS).

Method	When appropriate	Basis
Inspection (Art. 237)	Free or voluntary access; fixing the state of the screen	Often without a ruling; home — on a ruling
Search (Arts. 234–236)	Compulsory hunt for media and keys	Ruling of the investigating judge
Temporary access (Art. 159)	Data or assets held by an exchange, bank, exchanger	Ruling of the investigating judge

What to seize and how: a step-by-step practice

The commonest mistake is to seize the “hardware” and forget the keys. Here is what to concentrate on.

• The hardware wallet. Seize the device itself, but it is critical to find and separately fix the seed phrase right there — without it, access to the assets can be lost if the device locks or is reset. Look for it nearby: sheets, envelopes, metal plates, notes on a phone.
• The seed phrase and private keys. This is the principal evidence of access. Record it verbatim, character by character, photographing the original and entering it in the protocol. Word order matters — an error in a single word devalues the whole phrase.
• Access to the exchange account. Login and password are not enough — you also need the second factor (a phone, an authenticator app, recovery codes). That is why seizing a phone with a linked 2FA is often more valuable than the password itself.
• Blockchain-explorer screenshots. The state of the address, the balance, the hashes (IDs) of specific transactions, the times and amounts are captured with screenshots of a public blockchain explorer right on the spot. This “ties” the address to specific operations and preserves the picture as of the moment of the action — even if the assets are later moved.

Ensuring the integrity of the evidence

Digital evidence is easy to alter, so the court is especially exacting about whether it was modified after seizure. Integrity is proven by several mutually reinforcing means.

• Hashing. Computing a control hash sum (for example, using the SHA-256 algorithm) of a disk image or a file fixes its “digital fingerprint”. If the hash later matches, the data has not changed. The hash value is entered in the protocol.
• Video recording. A continuous video record of the actions — from the discovery of the device to its packaging — removes most questions about substitution or manipulation. For a search, such recording is mandatory.
• Involvement of a specialist. Crypto assets are a field where the risk of irreversibly losing the evidence is high. Bringing in a digital-forensics specialist helps to extract the data correctly, without “waking” the wallet or triggering a remote wipe.
• Attesting witnesses and proper packaging. A search and an inspection of a person’s home or other property, as well as a personal search, are carried out with the mandatory participation of at least two attesting witnesses (понятих) — regardless of whether video recording is used; in other investigative actions the attesting witnesses may be replaced by continuous video recording. Describing, photographing and sealing the seized items in the protocol and its annexes close the chain of custody.

The asset can “escape” even after seizure

This is a specific and the most dangerous risk of crypto cases in particular. Imagine a typical situation: the investigation has seized a hardware wallet but has never found the seed phrase. If an accomplice kept the same phrase, or it exists in a backup, the assets can be moved to another address within minutes — straight from another device, while the seized “hardware” sits in a safe. Physically seizing the medium does not block the asset itself on the blockchain.

That is why in my expert work I stress: the goal is not to “take the box” but to gain control over the keys. Once access has been obtained lawfully, the next step is to secure the asset against alienation: temporary seizure of property followed by its arrest (арешт) on a ruling of the investigating judge, and, in practice, transferring the crypto asset to a wallet controlled by the pre-trial investigation body, within the limits and on the grounds permitted by the court. Without this step, even flawlessly documented evidence risks losing its “filling”.

Two examinations for the study

Crypto evidence almost always calls for specialist knowledge, and here it is appropriate to order a set of examinations under the KPK rules on engaging an expert.

• Computer-technical (telecommunications) examination studies the media and data: it confirms the attribution of addresses and wallets, recovers and describes the contents of devices, establishes the technical circumstances of operations, and verifies integrity against hash sums.
• Forensic economic examination answers questions of value and accounting: what the asset was worth in hryvnia equivalent on a given date, what movement of funds took place according to the data provided, and whether the operations reconcile with the accounts and the declared income.

The limit of competence is unchanged: the expert establishes the factual and value circumstances, but does not qualify the act and does not establish guilt — that is exclusively the prerogative of the investigation and the court. Methodologically, the examination rests on the Law of Ukraine “On Forensic Expert Activity” (Про судову експертизу) and the specialised Instruction of the Ministry of Justice (Мін’юст) on the appointment and conduct of forensic examinations (No. 53/5).

Typical mistakes that lead to inadmissibility

Article 87 of the KPK — the inadmissibility of evidence obtained through a substantial violation of human rights and freedoms — is the principal risk to the whole construction. The commonest reasons a crypto item of evidence “flies out”:

• seizure without a proper procedural basis (a search or access without the relevant ruling, or going beyond its limits);
• a break in the chain of custody — no hash, video or description, so it cannot be proven that the data was unchanged after seizure;
• fixing the asset without obtaining the keys — the evidence “exists”, but its value component is out of reach or has already been moved;
• independent manipulations with the wallet without a specialist, resulting in a change or loss of data;
• inaccurate recording of the seed phrase (an error in a word or in the order) — and access is lost irretrievably.

Any of these mistakes gives the defence a lawful basis to raise the question of inadmissibility, and along with the evidence the qualification by size often “crumbles” too.

A short checklist

• Separate the asset, the medium and the key — and hunt first of all for the keys (seed phrase, private key, 2FA).
• Choose the method of fixing to fit the situation: inspection, search, or temporary access to exchange data.
• Fix integrity: hash sums, continuous video, a specialist, attesting witnesses, and sealing.
• Screenshot the blockchain explorer with transaction hashes right on the spot.
• Immediately after obtaining the keys — secure the asset against transfer (seizure, arrest, transfer to a controlled wallet with the court’s sanction).
• Order computer-technical and economic examinations for study and valuation.

A crypto asset as evidence lives not in the “hardware” but in a flawless chain: lawful basis — correct recording — obtaining the keys — securing the asset — examination. If you or your client are preparing an investigative action involving cryptocurrency, or assessing materials already gathered, I would be glad to help with framing the questions for the expert and conducting a forensic economic examination — carefully and within the limits of the law.