Crypto-asset fraud: the routes to recovering funds

Crypto-asset fraud is handled as a single matter: freezing whatever funds can still be located, preparing the complaint, approaching the exchanges and, where relevant, the bank. These steps are not taken one after another: they are run together, and in the first days. The firm takes the matter in hand at that point and carries it through to recovery. A first conversation is enough to say what remains possible, and in what order to set it in motion.

A centralised exchange can block an account within minutes. It will not do so at the request of a private individual. What compels it is a judicial order, and how quickly that order is issued depends almost entirely on the state of the file handed to the investigators. That is where cases are lost: while the complaint waits to be processed, the funds are split, converted, then moved off the platforms that still knew who held them. What was not frozen at that point is not recovered.

The rest follows, and it takes people by surprise. A judgment awarding damages produces payment only to the extent of what was seized during the investigation, and that payment must then be claimed within six months, failing which the claim is time-barred. A case can therefore be won and yield nothing, because recovery was treated as the sequel to the trial when it is in fact its precondition.

Three things are dealt with together, and in the first days: what can be proved, what can still be frozen, and the time limits already running. The firm handles them in parallel. What follows sets out, for each, what can still be obtained and what is lost for want of having been asked for in time.

The first hours: freezing what can still be located

This is the most frequent request and it calls for a qualified answer. A centralised exchange holds its users’ funds and can technically block them within minutes. Nothing obliges it to do so at the request of a private individual. Four routes exist, and only one compels.

Reporting directly to the exchange

This is discretionary and creates no right. It nonetheless produces effects, for a reason that has less to do with customer service than with regulation: an exchange established in the European Union is subject to anti-money-laundering obligations and has no interest in letting funds reported as fraudulent pass through. A documented report, providing transaction identifiers, addresses and a chronology, puts the exchange before a compliance question rather than a customer complaint.

The report is therefore framed in the language of its own obligations, not in that of the loss suffered. It also has procedural value: it fixes a date and establishes that the exchange was informed.

The suspicious activity report and the right of opposition

Where a reporting entity files a suspicious activity report with the financial intelligence unit, that unit may oppose the execution of an operation not yet carried out, article L. 561-24 of the French Monetary and Financial Code. Operations are then postponed for ten working days from notification.

That period is not an end in itself: while it runs, the President of the Paris Judicial Court may, on application by the unit after the opinion of the public prosecutor, extend the postponement or order the provisional sequestration of the funds, accounts or securities concerned. The public prosecutor may apply for the same purpose.

Two points should be made. The person who has suffered the loss is not the author of that report and cannot apply to the unit directly. And the exchange is prohibited from disclosing the existence of the opposition, so silence following a report does not mean that nothing was done.

The route that compels

Only the judicial authority compels. The public prosecutor or a judicial police officer may require any private body or institution likely to hold information relevant to the investigation to hand it over, article 60-1 of the French Code of Criminal Procedure, failure to answer promptly being punishable by a fine of 3,750 euros. It is by this route that the identity of the account holder and the traceability of movements are obtained.

Seizure itself then falls under article 706-154 of the same code, which has expressly covered crypto-assets since 30 December 2024: it bears on all crypto-assets held at the moment it takes effect, up to the amount stated in the decision, and the liberty and custody judge or the investigating judge rules on its maintenance or discharge within ten days.

These measures belong to the prosecuting authorities; the person who has suffered the loss does not control them. Their role is to make them possible and to prompt them, by handing investigators a file that can be acted on at once: exchange identified, transaction identifiers, addresses, timestamps, and an express request that orders be issued without delay. An order issued on the third day does not yield what an order issued on the thirtieth yields.

The civil route, often overlooked

Anyone whose claim appears well founded in principle may apply to the court for authorisation to take a protective measure over the debtor’s assets, without prior formal demand, where circumstances are shown that may threaten recovery, article L. 511-1 of the French Code of Civil Enforcement Procedures.

This route presupposes an identified debtor and a usable connecting factor, but it has two advantages over the criminal route: it is controlled by the person who has suffered the loss, and authorisation is obtained on an ex parte application. It combines with the criminal complaint rather than replacing it.

Preserving what counts as evidence, and what does not

Not everything that was experienced is proved. An account of events, however detailed, establishes that it was given, and nothing more. What matters is what survives independently of the person telling it.

• Transaction identifiers and destination addresses, which allow movements to be followed.
• Bank statements and evidence of the transfers or card payments used to fund the account.
• Exchanges preserved in their original medium, with the counterparty identifiers, rather than as recomposed screenshots.
• The pages of the interface used, its terms and conditions, its legal notices, the identity it displays and the domain name.
• Account-opening emails and platform notifications, which carry timestamps.

One point deserves attention. An interface displaying a valuation and gains does not prove that those gains existed; it proves that they were displayed. That is precisely what grounds the characterisation of fraud and, often, the concealed nature of the offence.

What has not been preserved disappears. Interfaces close, domain names expire, messaging accounts are wiped. Preservation happens in the first days or not at all.

Filing a complaint, and the steps that run alongside it

The most common classification is fraud, and it is not the only one. Breach of trust applies where the funds were handed to a third party who was to manage them; money laundering covers those who recycled the proceeds of the offence; and where the platform was not registered, providing digital asset services without registration is added to them. Settling on the right classification and establishing it in the complaint itself steers the investigation and determines the orders that can be sought.

A simple complaint is addressed to the public prosecutor or filed with a judicial police service. It opens the investigation and, above all, makes orders to exchanges and measures over assets possible.

A complaint with an application to join as a civil party before an investigating judge is subject to an admissibility condition: it presupposes that the public prosecutor has stated that no prosecution will be brought, or that three months have elapsed since the complaint was filed with the prosecutor against a receipt or by registered letter with acknowledgment of receipt, article 85 of the French Code of Criminal Procedure. That period is counted, not estimated, and the receipt is what proves it. Where the complaint comes from a for-profit legal entity, it is admissible only if accompanied by the balance sheet and profit and loss account.

The usual sequence is therefore as follows: an immediate simple complaint, with the objective material and the identification of the exchanges, then an application to join as a civil party if the investigation does not progress, the three-month period having run in the meantime.

A complaint filed alone at a police station and a complaint prepared by a lawyer produce the same act but not the same consequences. The second identifies the providers to be served with orders, appends the tracing material and formulates requests for investigative steps; instructed counsel obtains access to the file, may request steps from the investigating judge and apply to the court for a protective measure, which an unrepresented person cannot do.

Two further steps run in parallel under different regimes. Where funds passed through a payment account, a banking lever exists, independent of the criminal route and faster than it: the payment service provider must refund an unauthorised transaction within very short deadlines. Where the harm involves a ransom, the timetable is set by insurance, the indemnity being due only if the complaint was filed within seventy-two hours of becoming aware of the incident.

You are coming months, or years, later

Public prosecution for an ordinary offence is time-barred after six full years from the day the offence was committed, article 8 of the French Code of Criminal Procedure.

Article 9-1 derogates from this for concealed or hidden offences. Time then runs from the day the offence came to light and could be established in conditions allowing prosecution to be brought, without exceeding twelve full years from the day it was committed. An offence is hidden where its author deliberately carries out any characterised manoeuvre intended to prevent its discovery.

Schemes resting on an interface that displays gains until the moment of withdrawal fall within that discussion. A case that is four, six or eight years old is therefore not necessarily lost, but the question of the starting point is settled before any other, because it determines whether any action remains.

Securing payment, not merely a judgment

Once judgment is obtained, one last step determines the outcome, and it is overlooked in many cases.

That claim must, failing which it is time-barred, be sent to the agency by registered letter within six months from the day the decision became final. Where several creditors apply and assets are insufficient, payment is made in order of arrival.

Two consequences follow. Letting six months pass means losing the benefit of a confiscation one helped to obtain. And arriving after other creditors against insufficient assets means receiving nothing. The date on which the decision becomes final is therefore monitored as a deadline.

What to gather before a first conversation

This material makes it possible to say, from the first conversation, what can still be done and in what order.

• The date of the events and the date on which you discovered them.
• The amount and its composition: successive payments, assets concerned, any part still held.
• The scheme: fake platform, fake adviser, a relationship built up before the first approach, compromised wallet, fake support.
• The platforms and services used, the addresses and transaction identifiers if you have them.
• The stage of the proceedings: complaint filed and its date, receipt, discontinuance, ongoing investigation, judicial investigation.
• Any decisions already served, with their date of service.

Frequently asked questions

Can I recover my funds if the perpetrator has not been identified?

Identifying the perpetrator and locating the assets are two distinct questions. Funds may be frozen in an account held with a provider subject to identification obligations before the person controlling them is identified. That is one more reason to supply the tracing material with the complaint.

Can the exchange block the funds at my request?

It can technically; nothing obliges it to. What determines its response is its own compliance obligations, not the request addressed to it, hence the value of a documented report framed in those terms. Only the judicial authority compels, by order and then by seizure.

Someone offers to recover my funds for a commission. Is that genuine?

This is the classic second-stage scheme, which targets people who have already suffered a loss and asks them for fees paid in advance. No private operator can have a criminal seizure discharged or compel a foreign exchange to make restitution. Sums paid on that basis constitute a further loss, to be included in the complaint.

My case was discontinued. Is that the end of it?

No. Discontinuance bars neither a complaint with an application to join as a civil party, subject to the admissibility condition of article 85 of the French Code of Criminal Procedure, nor a civil action. It does however start, for property held by the court, the six-month period of article 41-4 at the end of which unclaimed items become the property of the State.

Does the amount lost change the strategy?

It mainly changes the relationship between the cost of the action and what can be expected from it, and how deep a tracing exercise it is reasonable to undertake. It changes neither the deadlines nor the legal bases, which are the same for everyone.

Can I act if I live outside France?

Jurisdiction is assessed case by case, according to where the events took place, where the person who suffered the loss is located and where the providers concerned are established. It is dealt with before the complaint is filed, not afterwards.