Investigating Crypto Fraud: What a Victim Should Do

Cryptocurrency fraud rarely looks like a robbery. In most cases the victim transfers the money themselves, voluntarily, having believed a promise of extraordinary returns or the words of a “loved one.” That is exactly why these cases feel hopeless — yet a real chance of a result does exist, and it depends critically on how quickly and completely you act in the first days. Below I explain how the offence is classified, where to turn, what to preserve and how, and why forensic economic examination becomes the backbone of proving the amount of loss.

How the law classifies crypto fraud

Ukraine has no separate “cryptocurrency” offence. The dedicated legislation on virtual assets is still being finalised, so the legal status of crypto assets as an object of law is not fully settled. This does not prevent prosecution: fraudulently taking someone else’s money through a crypto scheme is classified under the general provision — Article 190 of the Criminal Code of Ukraine (KK), “Fraud” (taking another person’s property, or acquiring a right to property, by deception or abuse of trust).

The severity of liability rises with the aggravating features set out in parts 2–4 of the article:

• committed repeatedly, by a group of persons acting on prior conspiracy, or causing significant harm to the victim;
• fraud on a large scale, and also committed through unlawful operations using electronic computing equipment — a feature often applicable precisely to online schemes;
• fraud on an especially large scale, or committed by an organised group — the most serious part of the article.

The size of the harm caused (significant, large, especially large) is defined in law as a multiple of the statutory tax-free minimum income; together with the organised-group feature, it can move a case into the category of grave crimes. An important nuance here: courts usually value cryptocurrency not “in coins” but in its hryvnia equivalent as at the date of the relevant operation — and calculating that equivalent already calls for economic analysis. If the conduct also involves subsequent “laundering” of the stolen funds, an additional charge is possible under the provision on legalisation of property obtained through crime (Article 209 of the KK).

Let me underline a boundary I will return to: the legal qualification — which part of the article applies, whether there was intent — is for the investigator and the court. The economic expert answers a different question: what is the amount of loss, and how is it substantiated.

The typical schemes I see most often

Behind the outward variety stand a few recurring scenarios. Recognising “yours” is useful, because it points to the evidence you should be looking for.

Fake exchanges and “investment platforms”

The victim is drawn onto a professionally built website or app where a “deposit” appears to grow quickly. On small amounts, funds are withdrawn without any trouble — to lull vigilance — but once the balance is large, withdrawal is blocked on the pretext of a “tax,” a “release fee” or “verification,” with demands for further payments. This is the most common model, the one people describe with the words “the platform won’t release my funds.”

Romance scams

An acquaintance on a dating app or a social network grows into a “relationship,” after which the “partner” shares a “can’t-lose” investment opportunity. The money goes to the same fake platform. The danger of this scheme lies in its duration: the victim trusts and keeps topping up for months, while the evidence — the correspondence — is scattered across messengers that are easily lost.

Fake traders and “account management”

A pseudo-expert offers to “manage” your funds or invites you into a “closed club” with guaranteed income. Sometimes forged screenshots of other members’ profits are shown. The money is either transferred directly to the “trader” or moved onto a wallet under their control.

What all these schemes share is a promise of unrealistic income, time pressure (“the offer is only today”) and a request to transfer specifically in cryptocurrency or to the card of a “drop” — a front individual.

Where to turn

A report of a criminal offence can be filed through several channels; choose according to the circumstances:

Body	When it fits
Cyberpolice Department of the National Police	Online schemes, fake sites/apps, crypto and card transfers
Investigative units of the National Police (local)	Filing a written report under Art. 190 of the KK, including in person at any station
Bureau of Economic Security (BEB)	Where the scheme has a tax component or signs of offences within the BEB’s jurisdiction

In practice it is sensible to file a written report with an investigative body (in person, or by post with an inventory of enclosures) and, in parallel, to notify the Cyberpolice, who have the tools to work with the digital trail. If Ukrainian bank accounts are involved in the transfers, it is worth flagging possible signs of laundering too: information on threshold and suspicious financial transactions is collected by the State Financial Monitoring Service (Derzhfinmonitoring).

A key procedural rule. Under Article 214 of the Criminal Procedure Code of Ukraine (KPK), the investigator (inquirer, prosecutor) is obliged, without delay but no later than 24 hours after a report is filed, to enter the details into the Unified Register of Pre-trial Investigations (ERDR) and open an investigation — with no “pre-investigation check” at their own discretion. A refusal or delay in registration is challenged before the investigating judge. Always ask for an extract from the ERDR: it confirms that proceedings have been opened.

The victim’s first steps: what to preserve immediately

Crypto cases are won or lost at the evidence-preservation stage. Do this before filing your report, and hand the investigation an already-organised package:

1. The full correspondence — every messenger, social network, email, and “manager” comment. Save not only screenshots but chat exports; record nicknames, phone numbers and links to profiles.
2. Details of the money movement — the recipient’s crypto wallet addresses, the hashes (TxID) of every transaction, the names of the coins and networks, dates and amounts. A transaction hash is an indestructible trail in the blockchain, and it is precisely what makes it possible to trace the movement of funds.
3. Bank evidence — statements for the account/card, transfer receipts, the details of the cards or accounts the money was sent to, and data on exchangers or payment services.
4. Traces of the platform — the site/app address, screenshots of the “cabinet” and “balance,” letters about “withdrawal fees,” and any “agreements” or “terms of use.”
5. A timeline — a short account of the sequence of events with dates: when, how much, to whom and under what pretext the funds were transferred.

A few warnings from practice. Do not delete the app or “clean up” the correspondence, however embarrassing it feels — this is your evidence. Do not pay any “release fees”: that is simply a continuation of the same scheme. And beware of “fund-recovery services” that approach victims themselves — as a rule this is a second fraud committed against people who have already lost money.

The role of forensic economic examination

Once proceedings are open, the question of proof arises — above all, the exact amount of loss caused. This is the field of forensic economic examination, appointed by an investigator’s resolution or a court ruling, or commissioned as an expert study at a party’s request, under the Law of Ukraine “On Forensic Expertise” and the Instruction on the appointment and conduct of forensic examinations approved by Order of the Ministry of Justice of Ukraine No. 53/5.

My opinion as an expert does not establish who is guilty and does not give a legal qualification — it documents the size of the harm: how much money, and in what hryvnia equivalent, left the victim’s accounts, under which operations, tied to bank statements, receipts and transaction data. The questions typically put to the expert sound like this: what amount of funds, and in what hryvnia equivalent, was transferred from the victim’s accounts (cards) to specified details over the period examined, and whether this is confirmed by primary documents.

This carries direct procedural weight. It is the amount of loss that determines which part of Art. 190 the conduct falls under — and therefore the severity of liability. A vague, “eyeballed” loss is easy to contest; a documented calculation becomes a pillar of the prosecution and the basis for a civil claim for compensation. Within the economic expert specialisms (examination of accounting and tax-accounting documents, of enterprises’ economic activity, and of financial-and-credit operations), it is precisely the money flows that are analysed — from the victim’s card or account to the point where the trail breaks off.

The main mistake is delay

The costliest mistake in crypto cases is time. Unlike cash, stolen crypto assets move in minutes: they are split up, run through mixers and chains of wallets, moved onto exchanges and cashed out into fiat. The more time passes, the more “diluted” the trail and the smaller the chance of freezing the funds.

Speed is critical for another reason too: early on, the trail is still “fresh” — exchanges and services, on a properly drawn-up procedural request, may still hold the user’s identifying data and the balances on the accounts; after the money has been cashed out there is often nothing left to look for. So the sequence is simple: preserve the evidence — file the report and secure registration in the ERDR — insist on urgent investigative action. Every day of delay works for the fraudster.

If you find yourself in such a situation, do not face it alone: correctly preserved evidence and a professionally calculated amount of loss often decide the outcome of a case. I will be glad to help with conducting a forensic economic examination and framing the right questions — carefully, and within the bounds of the law.