What the Latest Crypto Crime Data Tells Us
New analysis from Chainalysis' 2026 Crypto Crime Report confirms a trend legal and accounting professionals are already seeing in practice: crypto-related disputes are becoming more complex, more professionalised, and harder to resolve without forensic verification.
The report highlights three developments that matter directly to recovery and evidentiary work.
-
01Funds are moving faster — and fragmenting earlier. Illicit and undisclosed crypto activity increasingly involves rapid transfers across wallets, chains, and intermediaries. This shortens the window for effective tracing and raises the evidentiary bar for proving custody and control.
-
02Centralised platforms remain pivotal. Despite the growth of self-custody, exchanges and service providers continue to play a critical role — often as points where funds are pooled, frozen, or disclosed through legal process. Recovery frequently turns not on technology alone, but on documentation, timing, and procedure.
-
03Professionalisation cuts both ways. As bad actors adopt more sophisticated methods, courts and counterparties are responding with higher expectations. Screenshots and assumptions are no longer sufficient. What is required is independently verifiable evidence that can withstand scrutiny.
EU — Proving Crypto Ownership
Requires Proof of Control
As courts around the world confront disputes involving cryptocurrency, a consistent evidentiary question is emerging: how do you prove ownership of an asset that exists only as a cryptographic record?
Recent decisions from the High Anti-Corruption Court (HACC) of Ukraine provide one of the clearest judicial answers to date — and the reasoning is instructive well beyond criminal proceedings or national borders.
Ownership Requires Proof of Control
In a decision dated 9 May 2023 (Case No. 991/2399/23), the HACC Appeals Chamber held that the only acceptable way to confirm ownership of declared cryptocurrency was to demonstrate access to the relevant crypto wallets and to identify the public addresses where the assets were initially held.
The Court rejected the idea that ownership could be established through declarations, balances, or screenshots alone. Instead, it focused on the practical reality of crypto custody: control of private keys equals control of the asset.
"Cryptocurrency ownership is proven through control of a wallet — not by screenshots, balances, or assertion."
Device-Level Evidence Becomes Central
A related decision by the Supreme Court of Justice of Ukraine (Case No. 991/3721/22) illustrates how that principle operates in practice. The Court confirmed possession of cryptocurrency based on evidence recovered from the suspect's personal smartphone — photographs of seed phrases, correspondence relating to crypto transactions, and digital artefacts that coincided with activity at known public blockchain addresses.
Crucially, the Court accepted this device-level evidence as decisive because it directly linked the individual to operational control of the wallet — bridging the gap between on-chain activity and a real-world person.
Implications for Practitioners
Across jurisdictions, courts are converging on a shared understanding. Visibility on the blockchain is not ownership. Ownership must be proven through control. Control is established through verifiable linkage — wallets, devices, and behaviour.
- 01Wallet access matters more than wallet balance. A static balance screenshot proves nothing about who controls the funds.
- 02Smartphones are often the strongest source of proof. In many cases, the most compelling evidence sits not on the blockchain, but on personal devices.
- 03Verification must connect people to addresses. Successful tracing requires attribution — proving who controlled the wallet at the relevant time.
Hot and Cold Wallets —
Why the Distinction Matters in Court
The difference between hot and cold wallets is not about temperature — it is about access, exposure, and proof. For legal and recovery matters, the distinction matters because evidence looks different.
| Feature | Hot Wallet | Cold Wallet |
|---|---|---|
| Connectivity | Connected to the internet | Kept offline |
| Typical Examples | Mobile apps, browser extensions, desktop wallets | Hardware wallets, offline storage |
| Transaction Activity | Frequent, ongoing | Infrequent, deliberate |
| Evidence Characteristics | More behavioural data and transaction history | Fewer transactions; stronger custody inference when funded |
| Attribution Challenges | Can involve obfuscation or rapid movement | Often hinges on proving funding source and access |
| Recovery Considerations | Easier to trace activity; harder to restrain | Harder to observe; stronger control arguments if linked |
| Cost | Usually free | Typically USD $50–$200 |
Crypto on an Exchange —
The Pooled Funds Problem
When crypto is held on an exchange, the user typically does not control the private keys. Instead, assets are held in pooled (commingled) wallets, with ownership tracked on the exchange's internal ledger. This fundamentally changes how tracing and recovery work.
On-chain analysis can often identify that funds reached a particular exchange. What it usually cannot show is which customer owned those funds once pooled. Attribution then depends on off-chain evidence — including bank statements, payment gateways, account records, emails, or disclosure obtained through legal process.
On-chain tracing can take you to the exchange. Evidence and procedure take you to the person.
Pooling does not make recovery impossible — but it shifts the problem from technology to procedure. Success often turns on timing, jurisdiction, and whether the exchange will respond to lawful requests.
Is It Worth Recovering?
The Question Asked Too Late.
Recovery feasibility depends less on how much crypto exists and more on four practical factors. Many matters fail not because recovery was impossible, but because teams pursued the wrong target or underestimated evidentiary friction.
Sometimes the most professional decision is to proceed. Sometimes it is to stop. Behind exchanges, wallet value is often indeterminate on-chain because balances are tracked on the exchange's internal ledger, not at the public address level. That is precisely why subpoenas and disclosure requests matter.
You May Be Working on a
Crypto Matter and Not Know It.
In many cases, crypto is not disclosed because it is not recognised. The matter is rarely labelled "crypto" at the outset. Instead, it appears as a mismatch between spending, behaviour, and provable assets.
Practitioners increasingly encounter digital-fund issues in the following forms:
- —Unexplained bank transfers, particularly to overseas institutions or unfamiliar counterparties
- —Gaps in financial disclosure, where balances decline without corresponding asset acquisition
- —Funds routed through payment gateways or exchanges, rather than held in traditional accounts
- —Inconsistencies between what a client believes they hold and what can be independently proven
Coming soon: Case Study on the $1 Billion Superfund Collapse in Australia.