Cryptocurrency is increasingly appearing in criminal cases around the world. Many attorneys have handled instances where digital assets are either involved in an offense, serve as a source of income, or are implicated in an arrest. Consider a common scenario: during a search, a suspect’s smartphone is seized, on which the Trust Wallet application and several screenshots with seed phrases are found. The detective and the prosecutor insist: this is proof of possession of cryptocurrency. However, is this sufficient to establish guilt in a court of law? Unlike cash or property, cryptocurrency can only be traced through digital footprints. Crypto-assets typically have no physical medium and are only accessible through digital keys. Therefore, an effective defense strategy requires knowledge of technology, the specifics of the evidence base, and judicial practice. In this article, we will explore the types of evidence frequently utilized in cryptocurrency-related cases, how investigative judges from the Supreme Court of Criminal Appeals assess them, and the strategies the defense can employ to either affirm or contest claims of digital asset possession. The History of Legal Regulation: Where We Are Today The lack of comprehensive legal regulation presents several problems in the criminal process. First, it is difficult to determine an asset’s legal status—whether it is property, benefit, or evidence. Second, attorneys and judges are forced to rely on judicial practice and technical expertise rather than on a clear legislative framework. This makes proving or disproving crypto-assets’ ownership a more complex and often controversial task. Although Ukraine is actively developing the digital economy, the legislative framework governing virtual assets remains incomplete. This is especially crucial given the rising number of criminal cases involving cryptocurrency. Unofficial expert estimates suggest that more than 70 such cases were recorded in 2024 alone. Below are the key milestones in the formation of legal regulation for virtual assets. 2017: The National Bank of Ukraine (NBU), in a statement, acknowledges that cryptocurrency is not a legal tender and does not have the status of currency in Ukraine. 2018: (1) Several draft laws on virtual assets (No. 7183, No. 7183-1) were registered in the Verkhovna Rada, but none were adopted; (2) The National Securities and Stock Market Commission and the Ministry of Finance are forming working groups on the legal status of cryptocurrency. 2020: The Ministry of Digital Transformation is developing a draft Law “On Virtual Assets.” For the first time, the draft law formalizes the concept of “virtual asset,” particularly cryptocurrencies, as its type. September 8, 2021: The Verkhovna Rada adopts the Law of Ukraine “On Virtual Assets” (No. 3637). March 15, 2022: The President signs the Law “On Virtual Assets.” The law was to come into force after amendments to the Tax Code, which have not yet been adopted. 2023–2024: The Ministry of Digital Affairs announces the preparation of a new draft law harmonized with the European MiCA (Markets in Crypto-Assets) regulation. As of April 2025, the Law of Ukraine “On Virtual Assets” has not yet entered into force due to the lack of tax amendments. Cryptocurrency regulation remains decentralized, and is mainly carried out by applying general provisions of the Civil, Tax, and Criminal Codes. At the same time, law enforcement agencies in criminal cases involving crypto-assets prefer proof of practical possession rather than separate norms of special legislation. This means that lawyers working with such cases must rely on case law, the technological features of the assets, and the specifics of each individual source of evidence. The following section provides a review of specific evidence related to these cases. 1. Declaration: When an Entry in a Declaration on the NACP Portal Can Become Evidence According to the Law of Ukraine “On Prevention of Corruption”, declarants are obliged to indicate the cryptocurrencies they own. Entering such data in the declaration can serve as independent proof of ownership, but requires confirmation—for example, access to a wallet or indicating the public address of the cryptocurrency. A decision by the investigating judges of the HACC Appeals Chamber, dated May 9, 2023, in case No. 991/2399/23, states that the only acceptable way to confirm ownership of the declared cryptocurrency is to demonstrate access to the crypto wallets containing the cryptocurrency and to provide the public addresses where the cryptocurrency was initially stored. 2. The Smartphone Is The #1 Source of Evidence. Detecting traces of crypto-asset use on digital devices is one of the key forms of proof. Most evidence regarding cryptocurrency is recovered from the suspect’s personal gadgets like phones, tablets, laptops. They include: installed crypto applications (Trust Wallet, Binance, etc.); screenshots or photos of seed phrases; correspondence about transactions; saved keys; account login history. It is such evidence that becomes decisive, in particular, according to the ruling of the investigating judge of the Supreme Court of Justice of Ukraine dated October 4, 2022, in case No. 991/3721/22, the fact of possession of cryptocurrency was confirmed by the presence on the suspect’s phone of photos of seed phrases and correspondence regarding transactions that coincided with activity at public addresses. Similarly, the verdict of the Supreme Court of Justice of Ukraine dated November 27, 2024, in case No. 991/1512/23 established that the presence of cryptocurrency applications, the history of their use, and photos of seed phrases on a mobile phone indicate that the accused is the owner of the crypto wallets and, accordingly, the assets contained in them. 3. Hardware Wallet or Seed Phrase? A clear position has already been established in judicial practice: ownership of a virtual asset is acquired at the moment the asset is created. The conclusion and execution of a transaction regarding the virtual asset is validated by possessing the private key associated with that virtual asset. The presence of a hardware wallet, such as a Ledger or Trezor, may indicate ownership of the cryptocurrency stored on it, but only if the individual has control over the wallet. Such control may, in particular, be confirmed by possessing the necessary passwords or a seed phrase for the wallet. In addition, when an individual’s seed phrase is discovered, finding a hardware wallet or any other medium where the cryptocurrency is stored is unnecessary. This seems quite logical, since the seed phrase is a set of words required to restore the wallet. It is generated on the user’s device when creating the wallet and remains unchanged throughout use. Using the seed phrase, one can access the crypto wallet and its assets from virtually any device (phone, tablet, etc.) without knowing the access password or private key. Even in the event of loss of the physical device (ledger or other), access to the wallet and its assets is preserved. The decision of the HACC Appeals Chamber investigating judges dated October 31, 2024, in case No. 991/10335/23 clearly states that “the owner of the virtual asset key (wallet access code and password) is the owner of such a virtual asset.” 4. Crypto Exchanges As Digital Passports. Following international anti-money laundering legislation requirements, crypto exchanges conduct user identification (KYC) and store users’ personal data such as passports, photo, mailing address, phone number, etc. This data may be required within the framework of criminal proceedings and indicate the person’s connection with the accounts where the assets are stored. According to the ruling of the investigating judge of the Supreme Court of Justice of Ukraine dated 04.10.2022 in case No. 991/3721/22, the investigation established that the suspect’s mobile phone contained the WhiteBIT and Binance exchanges, which require personal data for registration. This became an argument in favor of establishing the fact of possession of crypto assets. 5. Public Address Is Never Enough. Although the blockchain is public and anyone can see transactions on an address, this does not prove ownership. Without proof of private key ownership, a public address can only be part of the proof. The next step may be confirming KYC verification on a crypto exchange or investigating transactions with other identified wallets. At the same time, a public address may be sufficient to confirm the absence of assets or to investigate transactions in the blockchain (establishing the date of asset disposal, acquisition, etc.). The decision made by the investigating judges of the HACC Appeals Chamber dated 09.05.2023 in case No. 991/2399/23, states that simply providing the public address of a cryptocurrency wallet is insufficient evidence to identify the cryptocurrency owner. This ruling highlights the necessity of presenting additional evidence, such as a private key or seed phrase, to confirm ownership of crypto assets. 6. Blockchain Analytics: Powerful Tool For Both Sides. In 2023, over 250 NABU detectives and analysts underwent a nine-month training on investigating crimes involving virtual assets. There, they learned modern analytical search methods, principles of using OSINT tools for crypto investigations, and algorithms for analyzing and studying the movement of virtual assets. For defense counsel, this means that using technology and the help of digital experts is an integral component of the defense strategy. Several tools can assist with independent analytics and information gathering, including: Chainalysis: A leading platform for analyzing blockchain transactions, widely used by US law enforcement. Elliptic: Effective for detecting connections between addresses. Blockchair: Provides summary information about transactions. Arkham: Allows you to deanonymize users through connection analytics. Investigators in Ukraine already utilize these services, and attorneys can also turn to them for independent analysis. This independent analysis could provide grounds for refuting accusations or altering case qualifications. In our work, we used several tools for independent analysis of transactions, documenting facts that have evidentiary value in criminal proceedings. These findings also became the basis for conducting a forensic computer technical examination. And it was the forensic examination that allowed us to establish the technical circumstances related to cryptocurrency transactions, determine their origin, and establish that they belong to a specific person. However, before commissioning a study, we recommend consulting multiple digital forensics or IT analytics experts with specific knowledge in blockchain technologies. Since these studies are not yet mainstream, each expert’s vision of conducting them and research methods will differ. Quick tips for attorneys: Study the digital data on the client’s smartphone. It is a key source of information. Check whether the person actually has access to the private key and seed phrase, and whether they have transferred such data to third parties, because this is a matter of control, not formal ownership. If crypto exchanges appear, get the complete data from the accounts. Do not ignore analytical tools—they can work to your advantage. Look more broadly—a declaration or public address does not equal undisputed ownership. Instead of a Сonclusion, or Is It Possible To Remain Just an Attorney? Proving ownership of cryptocurrency is a technical and legal task. And although legal regulation is still being formed, we can already talk about stable approaches in judicial practice. For a defense attorney, this means constant monitoring of decisions, mastery of digital tools, and analytical thinking. Work with IT specialists, involve experts in blockchain analytics, influence the development of practice, and do not avoid complex technical issues, as they are the key to a successful defense. After all, the one who first discovers the trace wins in the digital war for justice.
28 August 2025, 16:14