Finding them isn't enough: issues surrounding the seizure and return of crypto assets

The technical structure of transactions does not automatically identify the person who controlled the crypto wallet, and courts have reached differing conclusions on whether a digital asset can be seized as physical evidence. So how can one prove ownership of such assets, enforce court orders, and return funds to victims?

Answers to these and other questions were sought during the roundtable discussion «Crypto & law Ukraine 2026: regulation, investigation and protection of virtual assets». The event was organized by the UNBA Committee on business and investor protection and the UNBA Committee on cybersecurity and virtual assets. Advocates, representatives of the National Police and the National Agency for the Identification, Tracing and Management of Assets Derived from Corruption and Other Crimes participated in the discussion.

Complexities of legal status

A member of the UNBA Committee on business and investor protection Alona Radeva drew attention to the varying approaches taken by courts regarding the seizure of crypto assets for the purpose of preserving evidence. According to her, in some cases, courts proceed on the basis that cryptocurrency can corroborate the circumstances of criminal proceedings and therefore meets the criteria for physical evidence.

At the same time, there are cases where funds in crypto wallets are not recognized as individualized tangible objects. On this basis, the court concludes that they cannot be subject to the same treatment as other physical evidence and are therefore not subject to seizure.

A separate issue arises regarding the enforcement of a seizure order. A. Radeva cited an example where a district court ordered a company to ensure the return or reissuance of virtual assets to the victim. In another case, the court agreed that simply freezing funds in a crypto wallet does not guarantee their preservation, since third parties may have access to them, and ordered the exchange to return the assets to the victim.

Deputy chairman of the UNBA Committee on cybersecurity and virtual assets Roman Ostrovsky noted that a seizure order entails a temporary prohibition on the disposal or use of property; however, it does not in and of itself establish a mechanism for the confiscation and return of a virtual asset. According to him, some investigating judges simultaneously order the seizure of assets and their return to the victim, although the possibility of such a decision is not explicitly provided for in the current Code of Criminal Procedure.

In one of the cases he cited, the court ordered the crypto exchange to transfer the seized cryptocurrency to the victim’s wallet for safekeeping. R. Ostrovsky emphasized that the transfer of assets into safekeeping does not grant the victim the right to use, exchange, or dispose of them until a final procedural decision is rendered.

Track a transaction

According to A. Radeva, the blockchain makes it possible to view transfers between wallets and the subsequent movement of assets through exchanges or other services. However, the transaction record itself does not prove that a specific wallet was controlled by a particular person or that that person carried out the transaction in question.

A representative of the National Police’s Department of International Police Cooperation Yevgen Panchenko drew attention to the undefined procedural status of blockchain analytics materials. In criminal proceedings, these are referred to as analytical reports; however, there is no uniform approach to the legal nature of such a document.

The police officer proposed distinguishing between analytical material which document the sequence of actions during a blockchain investigation and an expert’s conclusion, which explains the connections between transactions and the circumstances of the criminal proceeding. To prepare such a document, information from a public distributed ledger and specialized analytical software are used.

According to him, the prosecution and the courts often accept the results of blockchain analysis without further verification. To challenge them, the defense also needs an expert who will conduct their own investigation or identify errors in the report provided. Yevhen Panchenko cited reproducibility as one of the requirements for such an analysis: the actions described in the document must allow another specialist to replicate the investigation and obtain the same results or verify the conclusions drawn.

A representative of the Cyberpolice Department of the National Police Lilia Sushko also noted that a technical graph (a visual and mathematical model) of asset movement is not conclusive evidence. In police practice, the results of the analysis are additionally documented in inspection reports, and the link between an exchange wallet and a user can be confirmed by account data, IP addresses, and other information from the cryptocurrency exchange. Identifying the user of a cold wallet is more difficult.

L. Sushko supported the use of the SHA-256 hash, which allows for verifying the integrity of the report. A detailed description of the steps taken enables the investigation to be replicated during court proceedings.

Why timing matters

R. Ostrovsky also presented a basic algorithm for interacting with victims in cases involving the recovery of stolen digital assets. According to him, the initial stage involves establishing the facts of the case and the measures already taken, conducting a legal and technical assessment, reconstructing the flow of funds, and identifying the exchanges and exchange services involved.

Afterward, information about addresses linked to the crime is provided to the relevant services to flag the assets as high-risk and establish grounds for blocking them should they be deposited into an exchange or exchange service. Fund flows must be monitored continuously, as once they enter the custodial wallets of exchanges or exchange services, further tracing may require significant resources or become impossible.

Y. Panchenko clarified that contacting a single blockchain analytics provider does not ensure that assets are flagged across all systems. According to him, the largest providers do not share all such data with one another, so information about a suspicious address must be forwarded to several services that exchanges and other service providers may use.

R. Ostrovsky noted the difficulty advocates face in communicating with some crypto exchanges. He explained that certain platforms for submitting requests only allow registration using government email domains, which prevents advocates from sending documents on their own. In some cases, the request must be submitted through the client’s account, provided the client still has access to it.

L. Sushko explained that after a request to freeze stablecoins is submitted, the issuer conducts its own investigation of the circumstances, which can take up to 90 days. The issuer may refuse to freeze or reissue the assets if, based on the results of this investigation, it finds no evidence of a crime—even when the request is accompanied by a ruling from a Ukrainian court.

From tracing to management

ARMA traces crypto assets at the request of law enforcement agencies based on the Procedures for Interaction. This was stated by head of the Department for the Identification and Tracing of Financial and Other Assets at the National Agency Vitaliy Chubaevsky. ARMA has prepared recommendations for investigators on identifying virtual assets, verifying crypto wallets, and preparing procedural actions, and has forwarded them to the operational units of the National Police, the SSU and other law enforcement agencies.

If a request is improperly formatted or lacks sufficient information linking the asset to a criminal proceeding, ARMA staff contact the investigator and suggest supplementing the materials. According to V. Chubaevsky, formal deficiencies do not constitute grounds for an automatic refusal to trace assets.

In 2026, ARMA sent 656 requests to cryptocurrency exchanges. A representative of the Agency stated that responses are typically received within approximately 3 to 5 days, although in some cases the process takes longer.

An investigator submits a request; ARMA traces the assets and forwards the results to the investigator, who, together with the prosecutor, applies to the court to freeze the asset. The Agency’s next steps depend on the wording of the court’s decision: the court determines whether the asset should be transferred to the Agency’s management or liquidated.

V. Chubaevsky also reported that over 8.3 million USDT, transferred to the Agency for management pursuant to a court order, has already been credited to ARMA’s official crypto wallet on one of the crypto exchanges. The Agency has purchased three cold wallets and is preparing to accept other seized crypto assets.

Responding to a question about Bitcoin, the ARMA representative highlighted the risk of changes in the cryptocurrency’s value (market volatility): if an asset is sold after seizure and the court later orders it to be returned to the owner, and the price has risen in the meantime, the question will arise as to who should compensate for the difference.

© 2026 Unba.org.ua Всі права захищені
"Національна Асоціація Адвокатів України". Передрук та інше використання матеріалів, що розміщені на даному веб-сайті дозволяється за умови посилання на джерело. Інтернет-видання та засоби масової інформації можуть використовувати матеріали сайту, розміщувати відео з офіційного веб-сайту Національної Асоціації Адвокатів України на власних веб-сторінках, за умови гіперпосилання на офіційний веб-сайт Національної Асоціації Адвокатів України. Заборонено передрук та використання матеріалів, у яких міститься посилання на інші інтернет-видання та засоби масової інформації. Матеріали позначені міткою "Реклама", публікуються на правах реклами.