Cryptoassets in criminal proceedings: the role of counsel for the suspect and the victim

What is the issue?    Unlawful appropriation of cryptoassets is not a separate type of crime; rather, it is a method of committing already recognised criminal offences. Most commonly, such cases involve fraud, unlawful interference with information systems, laundering of criminally obtained proceeds, or other offences, depending on the specific circumstances of the case.

The primary legal classification may be fraud committed through unlawful operations involving electronic computing technology, as provided for in Part 4 of Article 190 of the Criminal Code of Ukraine. The sanction under this provision is imprisonment for a term of three to eight years. If the fraud is committed on a particularly large scale or by an organised group, Part 5 of Article 190 of the Criminal Code of Ukraine may apply, providing for imprisonment from five to twelve years with confiscation of property.

Depending on the method used and the subsequent movement of funds, the following provisions may also be considered:

• Article 361 of the Criminal Code of Ukraine — unauthorised interference with information or electronic communications systems;
• Article 209 of the Criminal Code of Ukraine — laundering of property obtained through criminal means;
• Article 200 of the Criminal Code of Ukraine — where the case involves unlawful acts involving payment cards, electronic money, or other payment instruments;
• other provisions of the Criminal Code of Ukraine — depending on the particular scheme, the method of accessing the assets, and the actions of those involved.

A cryptoasset itself does not create a new corpus delicti. It merely makes it more difficult to identify the owner, trace the movement of funds, determine the amount of damage, and establish the method by which property was unlawfully obtained.

Legal status of cryptoassets

Ukraine’s Law “On Virtual Assets” has been adopted but, as of August 2026, has not entered into force. Its implementation is linked to the entry into force of certain amendments to the Tax Code of Ukraine.

At the same time, the absence of an effective special law does not mean that cryptoassets cannot have evidentiary or proprietary significance in criminal proceedings. Courts already consider issues concerning their seizure, recognition as physical evidence, special confiscation, and compensation for damage.

In such cases, it is important to distinguish between:

• the virtual asset itself;
• a crypto wallet or an account on an exchange;
• an information storage device on which private keys may be held;
• blockchain transaction data;
• property or funds for which cryptoassets were exchanged.

It is therefore incorrect to claim that every seizure of a crypto wallet is unlawful or, conversely, that the mere discovery of a crypto wallet address automatically proves that the assets belong to a particular person.

The role of counsel for the suspect

1. Challenging the seizure of assets and property

Counsel verifies whether there were lawful grounds for the seizure of cryptoassets, funds, bank accounts, devices, and other data storage media.

The investigation must substantiate the precise purpose of the seizure: preservation of evidence, securing special confiscation, confiscation of property, or compensation for the victim’s damage. Seizure cannot be imposed merely “just in case.”

Case law includes instances in which courts have refused to recognise cryptocurrency as physical evidence or have lifted a seizure because its connection to a criminal offence was insufficiently substantiated. However, the existence of differing case law does not mean that the seizure of cryptoassets is always unlawful.

2. Verifying ownership of cryptoassets

One of the key issues is who actually owns the assets.

To establish a connection between a person and a crypto wallet, the following may be analysed:

• access to private keys;
• correspondence and email;
• data from an exchange or crypto service;
• account login history;
• IP addresses and devices;
• witness testimony;
• transfers between bank accounts and crypto wallets;
• blockchain-analysis results.

The presence of a crypto wallet on a phone or computer does not necessarily prove that all assets in it belong to the user of that device. The defence may challenge both control over the wallet and the amount, origin, and connection of the assets to the alleged criminal offence.

3. Correct legal classification of conduct

A single chain of events may contain elements of several criminal offences: unlawfully obtaining access to an account, appropriating cryptoassets, transferring funds to other wallets, exchanging them for fiat money, and their subsequent use.

At the same time, the existence of several stages does not mean that each of them automatically constitutes a separate crime. Counsel assesses:

• whether each alleged offence has an independent corpus delicti;
• whether separate acts are covered by a single criminal offence;
• whether intent to launder funds has been proven;
• whether the amount of damage was correctly determined;
• whether the accusation is based solely on assumptions.

4. Reviewing digital evidence

Digital evidence may include data from exchanges, electronic correspondence, CCTV footage, login records, screenshots, information from mobile phones, and blockchain-analysis results.

Counsel assesses:

• how the device or information was seized;
• whether search requirements were observed;
• whether the data were copied and preserved correctly;
• whether the integrity of electronic files can be established;
• who conducted the blockchain analysis and which methods were used;
• whether those data support the specific prosecution theory advanced.

A transaction screenshot alone does not always establish the identity of the sender or recipient. It may be only one item of evidence considered together with other materials.

The role of counsel for the victim

1. Proving the fact and amount of damage

The victim must prove that the cryptoassets belonged to them, how they were lost, and the amount of damage caused.

The following may be used for this purpose:

• blockchain transaction history;
• data from a cryptocurrency exchange;
• confirmations of account funding;
• bank statements;
• electronic correspondence;
• recordings of conversations;
• screenshots and video recordings;
• an opinion from a blockchain-analysis specialist or expert.

Particular attention should be paid to valuation of the assets. Due to exchange-rate fluctuations, the claim should clearly state the date as of which the loss is calculated: the date of appropriation, the date of filing the claim, the date of the judgment, or another legally justified date.

2. Representing the victim’s interests

A victim has the right to participate in investigative and court proceedings, submit evidence and motions, challenge decisions of the investigator, prosecutor, or court, and file a civil claim.

In practice, without active participation by a representative, a victim may not receive proper notice of court hearings, may not have access to case materials, or may fail to submit important motions in time. The Supreme Court has emphasised the need to properly notify victims and their representatives about hearings and to respect their procedural rights.

3. Securing the seizure of assets

If stolen assets can still be traced, the victim’s counsel may raise with the pre-trial investigation authority and the prosecutor the issue of locating and seizing them.

This may concern not only cryptocurrency, but also:

• accounts on cryptocurrency exchanges;
• bank accounts;
• funds received from exchanging cryptoassets;
• property acquired using stolen funds;
• data storage media and other items connected with access to the assets.

The motion must demonstrate a specific connection between the asset and the criminal offence and substantiate the purpose of the seizure.

4. Civil claim in criminal proceedings

A victim may bring a civil claim for compensation for property damage and, where grounds exist, non-pecuniary damage within the criminal proceedings.

The claim must substantiate:

• the fact that the assets belonged to the victim;
• the manner in which they were unlawfully taken;
• the amount of cryptoassets;
• the exchange rate or valuation methodology;
• the amount of property damage;
• the causal link between the suspect’s actions and the damage caused.

Due to cryptocurrency volatility, valuation may become a separate subject of dispute.

Conclusion

Cryptoassets do not create a separate type of crime. They only add technical and evidentiary questions to traditional criminal proceedings: who owns the wallet, who controlled the private key, where the assets came from and where they went, and how the damage should be calculated.

For a suspect, the main areas of defence are reviewing the lawfulness of seizure, ownership of the assets, admissibility of digital evidence, and the correctness of the criminal-law classification. For a victim, they are promptly documenting transactions, proving the amount of loss, participating in the proceedings, and taking measures to preserve property.

Contact WINNER — we will help assess the situation, determine the legal position, and select the best defence strategy for your particular case.

Author: Nazar Al-Mzirawi, Attorney-at-Law, WINNER Law Firm.