Crypto-asset fraud: the routes to recovering funds

Crypto-asset fraud is handled as a single matter: freezing whatever funds can still be located, preparing the complaint, approaching the exchanges and, where relevant, the bank. These steps are not taken one after another: they are run together, and in the first days. The firm takes the matter in hand at any point, from the first hours to years after the events, and carries it through to recovery. A first conversation is enough to say what remains possible, and in what order to set it in motion.

A centralised exchange can block an account within minutes. It will not do so at the request of a private individual. What compels it to do so is a seizure ordered by the judicial authority, and how quickly that seizure happens depends almost entirely on the state of the file handed to the investigators. That is where cases are lost: while the complaint waits to be processed, the funds are split, converted, then moved off the platforms that still knew who held them. What was not frozen at that point is not recovered.

The rest follows, and it takes people by surprise. A judgment awarding damages is not a payment: it still has to be enforced against an offender who is often insolvent or out of reach. Where assets have been confiscated, a victim who has not been compensated elsewhere can be paid out of them by the French agency for the management and recovery of seized and confiscated assets (AGRASC), provided the claim is made within six months of the final decision, failing which it is time-barred. A case can therefore be won and yield little when nothing was frozen during the investigation: recovery does not come after the trial, it is prepared from the first days.

Three things are dealt with together, and in the first days: what can be proved, what can still be frozen, and the time limits already running. The firm handles them in parallel. What follows sets out, for each, what can still be obtained and what is lost for want of having been asked for in time.

The first hours: freezing what can still be located

This is the most frequent request and it calls for a qualified answer. A centralised exchange holds its users’ funds and can technically block them within minutes. Nothing obliges it to do so at the request of a private individual. Four routes exist, differing in both force and author: the victim’s report, a freeze by Tracfin, a criminal seizure and a civil protective seizure.

Reporting directly to the exchange

This is discretionary and creates no right. It nonetheless produces effects, for a reason that has less to do with customer service than with regulation: an exchange established in the European Union is subject to anti-money-laundering obligations and has no interest in letting funds reported as fraudulent pass through. A documented report, providing transaction identifiers, addresses and a chronology, puts the exchange before a compliance question rather than a customer complaint.

The report is therefore framed in the language of its own obligations, not in that of the loss suffered. It also has procedural value: it fixes a date and establishes that the exchange was informed.

A temporary freeze by Tracfin

An exchange that receives a serious report may, for its part, report a suspicion of money laundering to Tracfin, the French State’s financial intelligence unit. Tracfin can then freeze pending operations for ten working days, and ask the President of the Paris Judicial Court to extend the freeze or to place the funds in escrow; the public prosecutor may make the same request (article L. 561-24 of the French Monetary and Financial Code).

The victim cannot apply to Tracfin directly: it is the exchange that reports. And the exchange is not allowed to disclose the freeze, so silence following a report does not mean that nothing was done.

The criminal route: an order for information, then a seizure

The judicial authority has two tools. The first is for finding out: the public prosecutor or a judicial police officer may require any private body or institution likely to hold information relevant to the investigation to hand it over, article 60-1 of the French Code of Criminal Procedure, failure to answer promptly being punishable by a fine of 3,750 euros. It is by this route that the identity of the account holder and the traceability of movements are obtained.

The second is for freezing: seizure falls under article 706-154 of the same code, which has expressly covered crypto-assets since 30 December 2024: it bears on all crypto-assets held at the moment it takes effect, up to the amount stated in the decision, and the liberty and custody judge or the investigating judge rules on its maintenance or discharge within ten days.

These measures belong to the prosecuting authorities; the person who has suffered the loss does not control them. Their role is to make them possible and to prompt them, by handing investigators a file that can be acted on at once: exchange identified, transaction identifiers, addresses, timestamps, and an express request that orders be issued without delay. An order issued on the third day does not yield what an order issued on the thirtieth yields.

The civil route, often overlooked

Anyone whose claim appears well founded in principle may apply to the court for authorisation to take a protective measure over the debtor’s assets, without prior formal demand, where circumstances are shown that may threaten recovery, article L. 511-1 of the French Code of Civil Enforcement Procedures.

This route presupposes an identified debtor and a usable connecting factor, but it has two advantages over the criminal route: it is controlled by the person who has suffered the loss, and authorisation is obtained on an ex parte application. It combines with the criminal complaint rather than replacing it.

Preserving what counts as evidence, and what does not

Not everything that was experienced is proved. An account of events, however detailed, establishes that it was given, and nothing more. What matters is what survives independently of the person telling it.

• Transaction identifiers and destination addresses, which allow movements to be followed.
• Bank statements and evidence of the transfers or card payments used to fund the account.
• Exchanges preserved in their original medium, with the counterparty identifiers, rather than as recomposed screenshots.
• The pages of the interface used, its terms and conditions, its legal notices, the identity it displays and the domain name.
• Account-opening emails and platform notifications, which carry timestamps.

One point deserves attention. An interface displaying a valuation and gains does not prove that those gains existed; it proves that they were displayed. That is what grounds the characterisation of fraud and may, where the display was intended to prevent the fraud from being discovered, establish that it was concealed, which delays the start of the limitation period.

What has not been preserved disappears. Interfaces close, domain names expire, messaging accounts are wiped. Preservation happens in the first days or not at all.

Filing a complaint, and the steps that run alongside it

The most common classification is fraud, and it is not the only one. Breach of trust applies where the funds were handed to a third party who was to manage them; money laundering covers those who recycled the proceeds of the offence; and where the platform operated without the authorisation required in France, the offence of acting as a crypto-asset service provider without authorisation is added to them. Settling on the right classification and establishing it in the complaint itself steers the investigation and determines the orders that can be sought.

A simple complaint is addressed to the public prosecutor or filed with a judicial police service. It opens the investigation and, above all, makes orders to exchanges and measures over assets possible.

A complaint with an application to join as a civil party before an investigating judge is subject to an admissibility condition: it presupposes that the public prosecutor has stated that no prosecution will be brought, or that three months have elapsed since the complaint was filed with the prosecutor against a receipt or by registered letter with acknowledgment of receipt, article 85 of the French Code of Criminal Procedure. That period is counted, not estimated, and the receipt is what proves it. Where the complaint comes from a for-profit legal entity, it is admissible only if accompanied by the balance sheet and profit and loss account.

The usual sequence is therefore as follows: an immediate simple complaint, with the objective material and the identification of the exchanges, then an application to join as a civil party if the investigation does not progress, the three-month period having run in the meantime.

A complaint filed alone at a police station and a complaint prepared by a lawyer produce the same act but not the same consequences. The second identifies the providers to be served with orders, appends the tracing material and formulates precise requests. Once the victim has joined as a civil party, their lawyer consults the file, asks the investigating judge for the relevant investigative steps and, where appropriate, brings the civil protective seizure: the victim can take some of these steps alone, but their effect depends on the precision of what is asked for.

Two further steps fall under other regimes. Where payments were made without the victim’s consent, from a hacked account or card, the bank must refund them by the end of the next business day after they are reported at the latest, unless it suspects fraud by its own customer (article L. 133-18 of the French Monetary and Financial Code); that refund does not in principle apply to a transfer the victim ordered themselves, even when deceived, which is the most frequent case in investment fraud. And where a business suffers an intrusion into its information systems, its insurer pays the indemnity provided under a cyberattack policy only if the complaint was filed within seventy-two hours of discovering the attack (article L. 12-10-1 of the French Insurance Code).

Where the funds were paid to a fake platform, to a fake broker or after a relationship cultivated over months, the documents to gather and the levers available differ on several points. They are set out in Fake platform, fake broker, cultivated relationship: crypto-asset fraud.

Months, or years, after the events: what remains possible

Public prosecution for an ordinary offence is time-barred after six full years from the day the offence was committed, article 8 of the French Code of Criminal Procedure.

Article 9-1 derogates from this for concealed or hidden offences. Time then runs from the day the offence came to light and could be established in conditions allowing prosecution to be brought, without exceeding twelve full years from the day it was committed. An offence is hidden where its author deliberately carries out any characterised manoeuvre intended to prevent its discovery.

The Criminal Chamber of the Court of Cassation has confirmed that fraud can be concealed within the meaning of that provision, and recalled that where successive payments result from a single fraudulent operation, time runs only from the last payment (Crim., 25 March 2026, no 24-80.607, published in the Bulletin). Schemes resting on an interface that displays gains until the moment of withdrawal fall within that discussion. A case that is four, six or eight years old is therefore not necessarily lost, but the question of the starting point is settled before any other, because it determines whether any action remains.

Securing payment, not merely a judgment

Once judgment is obtained, one last step determines the outcome, and it is overlooked in many cases.

That claim must, failing which it is time-barred, be sent to the agency by registered letter within six months from the day the decision became final. Where several creditors apply and assets are insufficient, payment is made in order of arrival.

Two consequences follow. Letting six months pass means losing the possibility of being paid out of the confiscated assets. And arriving after other creditors against insufficient assets means receiving nothing. The date on which the decision becomes final is therefore monitored as a deadline.

What to gather before a first conversation

This material makes it possible to say, from the first conversation, what can still be done and in what order.

• The date of the events and the date on which they were discovered.
• The amount and its composition: successive payments, assets concerned, any part still held.
• The scheme: fake platform, fake adviser, a relationship built up before the first approach, compromised wallet, fake support.
• The platforms and services used, the addresses and transaction identifiers if available.
• The stage of the proceedings: complaint filed and its date, receipt, discontinuance, ongoing investigation, judicial investigation.
• Any decisions already served, with their date of service.

Frequently asked questions

Can funds be recovered if the perpetrator has not been identified?

Identifying the perpetrator and locating the assets are two distinct questions. Funds may be frozen in an account held with a provider subject to identification obligations before the person controlling them is identified. That is one more reason to supply the tracing material with the complaint.

Can the exchange block the funds at the victim’s request?

It can technically; nothing obliges it to. What determines its response is its own compliance obligations, not the request addressed to it, hence the value of a documented report framed in those terms. What compels it to freeze is a seizure ordered by the judicial authority, a freeze by Tracfin or a protective seizure authorised by a judge.

Is an offer to recover the funds for a commission genuine?

This is the classic second-stage scheme, which targets people who have already suffered a loss and asks them for fees paid in advance. No private operator can have a criminal seizure discharged or compel a foreign exchange to make restitution. Sums paid on that basis constitute a further loss, to be included in the complaint.

Does a discontinuance end the case?

No. Discontinuance bars neither a complaint with an application to join as a civil party, subject to the admissibility condition of article 85 of the French Code of Criminal Procedure, nor a civil action. It does however start, for property held by the court, a six-month period: if restitution has not been requested within that period, the property becomes the property of the State (article 41-4 of the French Code of Criminal Procedure). Restitution is therefore requested without waiting.

Does the amount lost change the strategy?

It mainly changes the relationship between the cost of the action and what can be expected from it, and how deep a tracing exercise it is reasonable to undertake. It changes neither the deadlines nor the legal bases, which are the same for everyone.

Can a victim living outside France take action?

Jurisdiction is assessed case by case, according to where the events took place, where the person who suffered the loss is located and where the providers concerned are established. It is dealt with before the complaint is filed, not afterwards.