Seizure does not mean return: how to get an exchange to return stolen crypto assets

In cases involving cryptocurrency theft, the assets move faster than the criminal proceedings, so it is best to first freeze and seize them, and only then identify the perpetrator. However, even a seizure will not recover the funds unless the court order specifies exactly what the exchange or issuer must do.

This logic was explained by chairman of the UNBA Committee on cybersecurity and virtual assets Andriy Galych and his deputy Roman Ostrovsky in their report «Crypto asset recovery: from blockchain investigation to actual asset recovery». They spoke on October 16 at the Second International scientific and practical forum «Blockchain Forensics Forum 2026», organized by the Kyiv Scientific Research Institute of Forensic Expertise of the Ministry of Justice of Ukraine and the Igor Sikorsky Kyiv Polytechnic Institute.

According to the speakers, the window of opportunity for recovering cryptocurrency is often measured in hours, while the funds are still held on a centralized service. Identifying the perpetrator, on the other hand, takes months or even years, and the resources required for this are often disproportionate to the amount of the loss. Therefore, recovering stolen assets and bringing the perpetrator to justice should be considered as separate tasks.

And while a specialist tracks the funds’ route, an advocate must send an urgent request to the exchange where the asset was received. However, the speakers cautioned that the platform can lift such a freeze at any time, so it must be secured through a court-ordered seizure.

A. Galich and R. Ostrovsky identified the key problem as the fact that seizure, confiscation, or transfer, custodial custody, and restitution are four distinct actions with different legal bases. A seizure under Article 170 of the Code of Criminal Procedure merely prohibits the disposal of the asset; a transfer changes control over it; and custodial custody determines the custodian and the conditions of custody. An asset may be returned to free disposal only after the seizure is lifted pursuant to Article 174 of the Code of Criminal Procedure or by a judgment in accordance with Part 9 of Article 100 of the Code of Criminal Procedure. Therefore, each of these actions must be specified separately in the ruling.

The general wording «to seize virtual assets» often does not provide the exchange with grounds for the transfer. The speakers distinguished three models for the operative part:

• seizure only, where the asset remains frozen in the suspect’s account;
• seizure with an obligation on the platform to transfer the asset to a specified wallet;
• transfer of the asset to the victim for safekeeping without the right to dispose of it.

In the speakers’ opinion, given the requirements of Part 5 of Article 173 of the CPC, the ruling should specify the network, address or User ID, the token and amount, the custodian, the restrictions and the procedure for execution.

According to the rapporteurs’ estimates, the Unified State Register of Court Decisions for 2020–2026 contains over 2,000 rulings on the seizure of cryptoassets. In 2026, courts began specifying in their rulings the custodian or issuer including their address and registration number as well as the method of restriction. Courts are also already applying the transfer of assets to the victim for safekeeping. At the same time, this does not yet constitute a return, the advocates emphasized: the seizure and prohibition on disposal remain in effect until a final decision is reached in the proceedings.

The speakers noted that blocking at the stablecoin issuer’s level is more effective than exchange-based measures. The USDT issuer can block the address itself at the smart contract level, and tokens cannot be withdrawn from it, even if the fraudster possesses the private key. A law enforcement agency sends a request to the issuer, and the advocate prepares the exact details and justification.

The speakers concluded that the process will culminate in the actual transfer of the asset to the owner’s wallet, confirmed by the transaction hash and a transfer certificate.

Previously, the UNBA discussed why simply locating a crypto asset is not enough to secure its return. To learn how courts handle the seizure of crypto assets, read the article «Cryptocurrency in the crosshairs of the courts: from seizure to division of assets».