Investigation and seizure of digital currency in criminal cases.

In this article we want to analyze the international and national legal regulation of the digital currencies circulation at the present stage, to assess the state of crime with the illegal use of these assets, to identify the features of the investigating such crimes and to substantiate proposals aimed at improving legislation and law enforcement practice.

We will address that with the rapid growth of crime involving cryptocurrencies, the legislation of various states is at the stage of formation of legal regulation of the fight against its illicit trafficking: only some countries have established the status of digital currency as property, provided for the specifics of seizure, storage and sale of digital currency in criminal cases.

The need to recognize digital currencies as property has been substantiated. It will be shown that the seizure and confiscation of cryptocurrencies should be carried out only by court decision.

The lack of special knowledge in the field of digital technology among the investigator, prosecutor and the court requires the mandatory involvement of a specialist in the proceedings on cases of crimes committed with the use of digital currency.

Our daily investigation practices shows a steady increase in crimes committed with the use of digital technologies, including the use of various digital currencies – Bitcoin, Ethereum, Monero – which are becoming a means of payment in the criminal activities of terrorist organizations, drug dealers, as well as a subject of theft, extortion, tax evasion, money laundering, Ponzi schemes and other crimes.

Anonymity and the complete absence of an administrative center in the cryptocurrency circulation are an obstacle to the regulation and control of this area. Cryptocurrency is used for fast anonymous remote payments without being linked to any bank account. And this is what attracts representatives of the shadow economy to the cryptocurrency.

So, 1,1 million bitcoins were stolen for the period of 2013-2017, which corresponded to a monetary loss of the equivalent of $8,9 billion at the prices of 2018 (Grobys, 2021).

The lack of legal regulation of the digital currencies circulation is observed both at the international and national levels. Even the status of a cryptocurrency itself often remains uncertain: whether it can be recognized as money, property, whether transactions with it should be taxed, whether it can be confiscated, etc.

In the context of insufficient legal regulation, the legal positions of international and national judicial authorities on certain aspects of cryptocurrency transactions are important.

The first international act regulating virtual currencies was the 5th Anti-Money Laundering Directive 2018/843, adopted by the European Union (hereinafter referred to as the EU), which distributed international standards against money laundering over virtual assets’ markets.

The European Union (EU) regulation exists not only at the Pan-European level, but is also included in the national legislation of the participating countries. As of July 2020, 35 of the 54 reporting jurisdictions reported that they have now implemented the revised FATF standards, with 32 of them regulating the virtual currencies circulation and the activities of virtual asset service providers (“VASPs”, which include exchanges, custodians and hedge funds), and 3 prohibiting their operation.

As for the national laws, we would like to note the Liechtenstein law on blockchain, which is proposed for use as a basis for the development of an international standard for regulating blockchain and cryptocurrency (Teichmann & Falker, 2020).

Practice of seizing digital currencies and confiscating them in criminal cases

An important place among the measures taken to prevent and deter crimes related to cryptocurrency payments is occupied by the seizure of it in criminal proceedings and its further confiscation.

The legal regulation of the application of these measures in criminal proceedings, as well as the legal regulation of the digital currencies circulation in general, is at the stage of its formation, which creates obstacles to combating crimes related to the illegal circulation of cryptocurrencies.

Besides, the seizure and confiscation process is largely complicated by the “decentralization” nature of cryptocurrencies, i.e., the absence of a central authority that performs the functions of an administrator in relation to such assets. Currently, there are 3 main types of cryptocurrency exchange platforms: 1) trading platforms, i.e. the websites where you can buy and sell cryptocurrencies; at the same time, buyers and sellers only access the platform and do not interact with each other; the service charges a commission fee for each concluded transaction; 2) peer-to-peer platforms, which connect buyers and sellers directly; the exchange rate is set by agreement of the parties; 3) crypto brokers, operating as forex brokers and setting the value of cryptocurrencies.

Despite the incompleteness of legal regulation, cryptocurrencies seizure, confiscation and sale are widely used in practice, and the high effectiveness of these measures in the fight against corruption and money laundering is noted in doctrinal studies (Vandezande, 2017).

The Federal Bureau of Investigation investigates cybercrimes, including crimes committed using cryptocurrency, in the USA. Under U.S. federal law, the government has the power to seize and hold – and then ultimately sell, with the proceeds going to the state treasury – “any property, real or personal, involved in a transaction or attempted transaction” that violates certain federal laws. At the moment, virtual currency is recognized as property in the United States.

The confiscation of cryptocurrency was made in 2013 for the first time: the US Federal Bureau of Investigation confiscated 144,000 bitcoins from the well-known DarkNet marketplace – the “Silk Road” company, which carried out bitcoin transactions in exchange for drugs, stolen property, fake documents and hacking services. “Silk Road” was the most popular and extensive criminal market on the Internet before it was discovered by the FBI.

The US government estimates that the site earned about 600,000 bitcoins during this period. About 175,000 of them were seized when the head of the marketplace was arrested and the site was shut down. The Federal Prosecutor for the Southern District of New York noted during the trial in the Silk Road case that the seized cryptocurrency should be treated in the same way as any other currency obtained as part of illegal transactions (Manhattan, 2014). The Justice Department seized the contents of an electronic wallet belonging to the company, as part of a civil case, in the amount of 69,000 bitcoins worth more than a billion dollars in November 2020.

Europol (2018), with the support of the Spanish Civil Guard, confiscated more than $4,5 million in bitcoins and other cryptocurrencies, as well as 800 thousand doses of LSD from drug traffickers from the DarkNet in 2018.

This seizure was made possible due to obtaining access to computer information contained on electronic media found during searches.

In Australia, there is also a practice that confirms the right of authorized bodies to confiscate virtual currency as property. The Australian High-Tech Crime Centre (AHTCC) is located at the Australian Federal Police (AFP) headquarters in Canberra. Under the auspices of the AFP, the AHTCC is a party to a formal joint operation agreement concluded between the AFP, the Australian Security and Intelligence Organization, and the Australian Signals Directorate’s Computer Network Vulnerability Group. Australia has developed a special law on combating money laundering and the financing of terrorism, which regulates illegal activities carried out with the help of cryptocurrency.

The authority issuing crypto licenses in Australia is AUSTRAC. A joint official release was issued in 2019 by the Australian Federal Police (AFP) and AUSTRAC in connection with the case against Bullin during the second phase of the Australian Federal Police (AFP) investigation into the activities of an organized crime syndicate. He played a key role in leading the operations of a criminal syndicate that used various dark web sites, bitcoin accounts, and legitimate businesses to find, pay for, and distribute illicit drugs.

The AFP officers executed search warrants in Melbourne’s suburbs, seizing Australian currency and cryptocurrency-related items. Bullin was subsequently arrested and charged with importing, trafficking and possessing a total of about 30 kilograms of drugs. The Criminal Assets Confiscation Task Force (CACT) successfully sought the confiscation of assets related to the investigation in a separate special operation.

Orders were obtained from the District Court of Victoria to seize property worth more than $2 million, including cryptocurrency. The orders were issued in accordance with the Anti-Money Laundering and Counter Terrorism Financing Act 2006 No. 169, 2006. (Federal Register of Legislation of Australian Government, 2018)

On May 30, 2018, the Supreme Court of the Republic of Korea ruled that cryptocurrencies can be confiscated if their use was detected in illegal activities. This decision overturned the decision of the district court, which indicated that it was impossible to withdraw bitcoins from a person accused of distributing child pornography due to the lack of a physical embodiment and an objective standard value.

However, the Supreme Court of the Republic of Korea did not agree with this opinion, noting that “Korean law provides that hidden assets subject to confiscation include cash, deposits, shares and other forms of tangible and intangible objects that have a standard value. Bitcoin is intangible and comes in the form of digitized files, but it is sold on an exchange and can be used to buy goods. Thus, getting bitcoins is profit-taking” (Kim, 2018).

Legal regulation of the seizure of digital currencies and their confiscation in criminal cases

The regulation of the cryptocurrencies seizure is necessary in order to ensure the execution of a sentence in terms of a civil claim, the collection of a fine, other property penalties or their possible confiscation. However, at present, only some states have developed rules for the seizure, storage, exchange and further circulation of cryptocurrencies in the state’s income.

For example, the Finnish government adopted instructions on the storage of confiscated cryptocurrencies in 2018: cryptocurrencies themselves are considered as an asset, not a currency; law enforcement agencies should not store them on exchanges, but keep them offline without access to the Internet (in cold storage); after a court ruling that the seized funds will not be returned to the owner, it becomes possible to exchange them for euros at public auctions, and not on cryptocurrency exchanges (Palmer, 2018).

In the Republic of Belarus, a Decree on the development of the digital economy was issued in 2017, legalizing cryptocurrency exchanges, cryptocurrency exchange operators, mining, smart contracts, blockchain, tokens, etc. (Decree No. 8, 2017), and the first cryptocurrency exchange in Belarus was opened on the Internet in 2019, and Article 132 of the Criminal Procedure Code of the Republic of Belarus (Criminal Procedure Code of the Republic of Belarus No. 295-Z, 1999) provides for the possibility of seizing cryptocurrencies as a type of property in criminal proceedings since January 2021.

However, in general, the grounds, procedure and conditions for the cryptocurrencies seizure in criminal cases and their further confiscation in many states remain unresolved.

The Criminal Procedure Code of the Russian Federation does not contain special rules governing the seizure and confiscation of digital currencies at the request of the competent authorities of a foreign state for mutual legal assistance in criminal matters. This gap should also be eliminated.

It should be noted that the Criminal Code of the Russian Federation does not provide for the elements of crimes the subject of which is digital currency.

The development of legal regulation of the fight against crimes related to the illegal circulation of digital currency should be comprehensive and cover not only criminal procedure and criminal legislation, but also regulatory acts regulating operational search and banking activities, establishing guarantees for the protection of the rights of bona fide buyers and cryptocurrency sellers, etc.

Organizational and technical aspects of the digital currencies seizure and confiscation in criminal cases

The organizational and technical aspects of the digital currencies seizure, their subsequent storage and sale remain unresolved in most nations.

The greatest difficulties arise when it is necessary to gain access to digital currencies for seizure and subsequent confiscation, if law enforcement agencies have to deal with cryptocurrencies that have built-in anonymity and privacy features, which make it very difficult to track funds to a specific user or successfully seize funds available in a cryptocurrency wallet (Koerhuis, Kechadi, & Le-Khac, 2020). But the most well-researched and transparent cryptocurrencies, including Bitcoin, also require the development of special methods to seize them.

However, current global trends in the fight against cybercrime refute the idea that digital currencies and the blockchain network are invulnerable to unauthorized access through code modification, use of malware, and invulnerability to theft or other property crimes against users or third parties (Mkrtchian, 2020; Turner, McCombie, & Uhlmann, 2019).

There are already special software tools created for tracking and controlling transactions that link public encryption keys to certain individuals identified on the network in the United States and Europe (Dolgieva, 2018), although until recently it was believed that the technical possibility of hacking a crypto wallet when a suspect or accused refuses to cooperate with the investigation is not feasible.

However, not all states have the necessary software yet, so the methods of the digital currencies seizure and confiscation, the implementation of which is possible if the suspect, the accused or a third party voluntarily discloses the password required for authorization and use of the crypto wallet, are more widely used in practice in foreign countries.

So, in February 2021, German prosecutors confiscated more than 50 million euros ($60 million) worth of bitcoin from a fraudster, but they can’t unlock the money because he won’t give them the password (O’Donnell, 2021).

In the “Basic Manual on the Detection and Investigation of the Laundering of Crime Proceeds Using Virtual Currencies”, published by the UN Office on Drugs and Crime in June 2014, it is stated that crypto wallets contain information about private keys that provide individual control over digital assets, taking possession of these keys is tantamount to confiscating these crypto assets.

In general, there are 2 methods to seize cryptocurrencies and confiscate them.

The first is to leave the cryptomonets in the wallet of the suspect, accused or convicted, but with the mandatory replacement of the access code (password) required for authorization and use of such a wallet.

The second method involves the transfer of digital currencies from the crypto wallet of the suspect, accused or convicted person to a crypto wallet specially opened for this purpose under the control of a law enforcement officer to store the seized property in the form of digital rights.

The cryptocurrency wallets for storing confiscated digital assets are just being created in some states, while in others they have already been created. As an example, we can cite the Police Instructions of the State of Indiana of the United States on the standard procedure for the confiscation of cryptocurrencies and virtual currencies.

The cryptocurrency is stored in a wallet, i.e. a program that contains one or more private keys. There are “cold” and “hot” wallets. In the first case, the data is stored offline on a hard disk, electronic media, in the second – on the network and is in some way connected to the Internet. You can access the wallet using a key that can be private (a complex form of encryption that allows the user to access their cryptocurrency) or public (a cryptographic code that allows the user to receive cryptocurrency to their account).

The seizure and confiscation of digital currencies (“transparent” bitcoins) can also be carried out without the consent of the suspect, accused or convicted in cases where users store encryption keys on personal computers or accessible USB devices.

In the United States, obtaining passwords from crypto wallets from suspects, accused persons, or third parties on a voluntary basis is additionally stimulated in several ways. The U.S. Secretary of the Treasury, in consultation with the U.S. Attorney General, establishes a fund to pay a reward of no more than $450,000 to any person who provides information that leads to the conviction of an individual who has used digital currency for terrorist activities (Financial Technology Protection Act Art. 4, 2019).

Thus, there is information in the public domain that the US Department of Justice was assisted in gaining access to the electronic wallet of the “Silk Road” online service in the amount of more than 1 billion US dollars in exchange for the removal of all charges in the criminal case by a person whose identity was not disclosed.

The question of the fate of the confiscated cryptocurrency often remains unresolved.

As a rule, the confiscated cryptocurrency is sold at auctions, and the received fiat money is converted into state revenue.

For example, the cryptocurrency was confiscated from the “Lesen und Lauschen” online platform, which sold counterfeit copies of various content – audiobooks, films, software – without the knowledge and consent of the copyright holders during the trial in Bavaria in 2017. In total, the German police confiscated 1,312 bitcoins, 1,399 Bitcoin Cash (bitcoin fork) and 200 Ethers, which was equivalent to 12 million euros ($13,9 million). The seized cryptocurrency was sold through 1,600 separate transactions within two months (Voß, 2018).

The sale of confiscated cryptocurrency at auction has also spread in the United States of America, as evidenced by the announcement of the auction on the website of the US Marshals Service (a division of the Ministry of Justice). On January 22, 2018, 3,813 bitcoins were offered for sale, divided into 11 blocks (since the cryptocurrency was seized in eleven separate proceedings), with a total value of $53,38 million at the time of publication.

In 2017, the Bulgarian authorities seized cryptocurrency from an organized criminal group accused of corruption. The subsequent sale of 213,519 confiscated bitcoins brought about $3,3 billion to the state treasury and helped pay off 20% of Bulgaria’s public debt (Campbell, 2017).

Auctions for the sale of confiscated cryptocurrencies are very popular among investors due to the fact that the initial value of digital assets is much lower than if they were purchased at the existing exchange rate at the time of sale.

Thus, there is already a successful experience in solving crimes related to the illegal circulation of cryptocurrency, which can be used in legislative and law enforcement activities.

It is clear that further improvement of international and national legal regulation of the status of digital currencies and the rules of their legal circulation, as well as the establishment of conditions and procedures for their seizure in criminal (and not only) legal proceedings, their storage, confiscation and sale is necessary.

Harmonisation and unification of national legislation is particularly necessary since this category of offences often has a cross-border nature and only similar legal regulation will allow to effectively combine the efforts of different states in combating them.

Legislative classification of cryptocurrencies as property would provide an opportunity for various investigative actions in criminal cases of crimes related to their illicit trafficking, application of procedural coercive measures, including seizure of this type of assets and their conversion into the income of the state. The legality and validity of such actions and decisions should be guaranteed by a court decision, as seizure of digital currencies restricts the inviolability of property. Criminal proceedings in relation to cryptocurrencies at the present stage are not possible without the involvement of a specialist.

The procedure for seizure of property should not only provide for the powers of the criminal justice authorities, but also enshrine the rights of the accused due to the privilege against self- incrimination. This is particularly important in the current context where the seizure of digital currencies in the absence of cooperation by the defendant is extremely difficult and the temptation for criminal justice authorities to seek such cooperation by various methods is high.

The development of legal regulation of combating offences related to illicit digital currency circulation should be comprehensive and cover not only criminal procedural and criminal legislation, but also acts regulating operational and investigative activities, banking activities, establishing guarantees of protection of rights of bona fide buyers and sellers of cryptocurrency, etc.

A promising way to sell the confiscated cryptocurrency should be recognized as its sale at auctions, the procedure for conducting which also requires the development of special rules, including notifying the public about the auction.

The best way to overcome the negative factors in the spread of criminal manifestations in the economy is to continue progressive work on the development of the legal framework (both international and national) regarding the creation of a wide range of conditions to prevent the turnover of assets obtained by criminal means, including their digital expression, with the simultaneous comprehensive implementation of generally recognized financial security standards in national legislative systems.


These articles are for informational purposes only, their content may be based on employees’ independent research, and do not represent the position or opinion of Artefaktum. Furthermore, Artefaktum disclaims all warranties in the articles’ content, does not recommend/endorse any third-party products referenced therein, and any reliance and use of the articles is at the reader’s sole discretion and risk.