Crypto and Criminal Law: A Growing Legal Playing Field

Crypto and criminal law increasingly intersect as cryptocurrencies have matured considerably in recent years. As a result, their relevance within criminal law has grown as well. Whereas bitcoin and other digital currencies were initially associated mainly with dark web payments, they now play a role in a wide range of criminal cases, including fraud, deception, money laundering, seizure and the confiscation of illegally obtained gains.

For entrepreneurs, investors and private individuals who work with crypto, it is therefore important to understand the legal risks involved. The combination of relative anonymity, fast transactions and a cross-border character makes cryptocurrency attractive to criminals. At the same time, blockchain technology and digital investigation methods offer new ways to reconstruct transactions. It is precisely this tension between anonymity and traceability that lies at the heart of many crypto-related criminal cases.

Money laundering with crypto

Money laundering is one of the clearest examples of how crypto and criminal law intersect. The Public Prosecution Service and the police are increasingly focusing on cryptocurrency as a means of moving or concealing criminal proceeds. The anonymity of crypto transactions is, however, relative, since transactions on a blockchain are generally permanent and publicly viewable. Once a wallet can be linked to a person, the entire transaction history can be examined in detail.

Anyone who receives, exchanges or forwards cryptocurrency without being able to sufficiently explain its origin may be confronted with a suspicion of money laundering. Even where the original source is legitimate, the absence of proper record-keeping can raise questions.

In money laundering cases, reference is sometimes made to a reversal of the burden of proof, but that description is legally too absolute. The starting point remains that the Public Prosecution Service must put forward facts and circumstances giving rise to a reasonable suspicion of money laundering, for example missing records, transactions through unregulated platforms, or the use of mixers and anonymisation services.

Only once such a suspicion exists can a suspect be expected to provide a concrete and reasonably verifiable account of a legitimate origin. If that explanation is lacking or insufficiently substantiated, this may be weighed as an indication in the body of evidence, without on its own filling the evidential gap that the Public Prosecution Service must close.

A suspect is therefore well advised to carefully document transactions. Important records include purchase and sale receipts, bank statements of deposits and withdrawals, transaction overviews from exchanges, wallet addresses and transaction hashes, information about mining, staking or other sources of income, and correspondence regarding loans, gifts or transfers. Complete records are not only relevant for tax purposes, but can also form an important part of the criminal defence.

The role of crypto exchanges and payment service providers

Crypto exchanges and other providers of crypto services also play an important role. Certain service providers are subject to obligations under anti-money laundering legislation, including customer due diligence and the reporting of unusual transactions. These obligations are, however, not unlimited in scope: they apply to designated institutions and activities, are subject to exceptions, and are risk-based, meaning that a simplified customer due diligence process may suffice where the assessed risk is low. The records this generates concern the identification and transaction data used, and do not automatically constitute complete proof of the economic origin of every asset.

Activity through a registered exchange is therefore usually well documented and relatively easy to link to an identity. This does not mean that every transaction is suspicious. Transactions through unregulated platforms, mixers or privacy coins may give rise to additional questions about origin and destination, and are also identified in European regulation as risk-increasing factors requiring additional identification and origin verification. However, this does not mean that the mere use of such a platform or technology in itself constitutes proof of knowledge or intent on the part of the user. The legal assessment ultimately depends on the totality of the circumstances.

Fraud and deception via crypto platforms

A significant proportion of crypto cases involve fraud and deception, in which cryptocurrency is used both as bait and as a means of payment. Well-known forms include fake investment platforms, phishing targeting wallets, fake advertisements promising unrealistically high returns, malicious apps or browser extensions, theft of seed phrases, and fraud that begins via social media or dating apps.

A widely discussed variant is so-called pig butchering fraud. In this scheme, trust is built up over an extended period, for example via a dating platform, after which the victim is persuaded to invest through a platform entirely controlled by the fraudsters. The returns shown are fictitious, and once the victim attempts to withdraw funds, this proves impossible, or further deposits are requested.

It also happens that victims lose access to their wallet via a malicious app or browser extension, or that, after sharing a seed phrase, the entire balance is siphoned off within seconds. Blockchain transactions are in many cases not easily reversed, making speed of action essential.

In the event of suspected fraud, it is advisable to contact the exchange or service provider involved directly, to preserve transaction hashes, wallet addresses and correspondence, to report the matter to the police, and to have it assessed whether civil law measures such as a precautionary attachment are possible. A criminal complaint is primarily aimed at investigation and prosecution and does not automatically lead to compensation for the damage suffered, so that alongside the criminal route a civil law strategy is often needed as well.

Criminal liability risks for intermediaries

Not only victims, but also persons who have forwarded cryptocurrency, may become involved in a criminal investigation. This applies, for example, to intermediaries who made their bank account or wallet available, or who carried out transactions without being fully aware of the background involved. For the criminal law assessment, it matters whether someone knowingly cooperated in a scheme, or was instead involved in good faith.

The circumstances under which someone was approached, the compensation received, the actions performed and the warning signs available all play a role. Anyone identified as a suspect is well advised to seek legal assistance quickly and not to make a substantive statement before the possible consequences have been discussed.

Seizure and confiscation

Where cryptocurrency is suspected of originating from a criminal offence, wallets and accounts held with trading platforms can be seized under the Dutch Code of Criminal Procedure. In addition, the Public Prosecution Service can institute confiscation proceedings to recover illegally obtained gains.

The valuation of cryptocurrency is a particular point of attention in this respect, since prices can fluctuate significantly between the moment of seizure, the further handling of the case, and the ultimate settlement. In practice, seized crypto is regularly converted into euros, in order to simplify management and limit price risk. Case law shows, however, that such conversion does not automatically mean that the suspect is entitled to the value as it stood on the date of seizure.

Upon a later return, the actual realised sale proceeds are in principle taken as the starting point, rather than the price at an earlier point in time. A suspect who believes that the conversion took place too late or in a careless manner will need to specifically state and substantiate this, for example by demonstrating that a significant and foreseeable decline in value could have been prevented. The mere fact that the sale did not take place immediately and that the price subsequently fell is not sufficient for this purpose.

Careful record-keeping is also important in relation to the confiscation claim itself. The court must estimate the gain on the basis of lawful evidence, and may not, without giving reasons, treat legitimate assets, directly attributable costs and amounts already surrendered as illegally obtained gain. Purchase receipts, bank statements and a consistent trading history can help to clarify the legitimate portion of the assets.

This is particularly relevant where legitimate and criminal assets have become mixed within the same wallet or on the same exchange. Under case law, such mixing does not automatically lead to the confiscation of the entire balance, nor does it lead to the conclusion that only the precisely traceable criminal portion can be confiscated. Depending on the information provided, the court will need to arrive at a verifiable and, where possible, proportionate allocation between the legitimate and criminal portions of the assets.

Hardware wallets and seed phrases

Seizure of hardware wallets and other physical carriers of crypto keys raises specific questions. With a bank account, it is generally a claim against a bank that is at issue, whereas with crypto, access to the assets can depend directly on a private key, PIN code or seed phrase. This carries its own risks in relation to seizure and safekeeping: a hardware wallet may, for example, be secured with a PIN code after which access is permanently lost following multiple failed attempts, and loss or damage to the physical device can likewise lead to irreversible inaccessibility.

When such items are seized, it is therefore necessary to assess not only whether the legal basis and scope of the seizure are in order, but also the technical manner in which access to the cryptocurrency is preserved. For the defence, this may be grounds to request expert supervision when unlocking the wallet, to have it recorded who manages the PIN code or seed phrase, and to request a controlled protocol whereby a forensic copy or inventory is made before any further steps are taken.

Evidence and blockchain analysis

Evidence in crypto cases differs in important respects from evidence in traditional criminal cases. Blockchain analysis, the linking of wallet addresses to identities via exchanges, and digital forensic investigation often play a central role. Investigative authorities use specialised software to map transaction patterns, clustering wallets presumed to belong to the same person or organisation. These techniques can be valuable, but are not infallible: a wallet may have been used by multiple people, may previously have belonged to someone else, may be part of a service using shared addresses, or may still be linked to old data after a transfer of access.

The mere fact that a wallet appears in a transaction chain that ultimately leads to a criminal offence does not, therefore, automatically mean that its holder was aware of the criminal origin. Dutch case law does show that blockchain analysis, when supported by additional data such as exchange information, IP addresses, bank statements or the suspect’s own statements, can produce a convincing body of evidence.

For the defence, it is therefore important to critically examine the underlying analysis step by step: how the link between address and wallet was established, how the link between wallet and account was established, and how the link between account and the specific suspect was established, and whether sufficient account was taken of alternative explanations. The manner in which data carriers were seized and examined can also be a subject of defence arguments, and unlawfully obtained evidence may, in certain circumstances, lead to the exclusion of evidence.

The tax dimension

Crypto and taxation are closely connected. Anyone who fails to declare, or incorrectly or incompletely declares, income or assets from cryptocurrency may face additional tax assessments and a tax penalty, and in more serious cases also criminal prosecution for tax fraud. The Tax and Customs Administration and the Public Prosecution Service increasingly make use of data provided by crypto exchanges, including through international data exchange, to compare actual assets with the information declared in tax returns.

For entrepreneurs and private individuals, it is therefore advisable not only to seek tax advice on the treatment of gains and losses, but also to take into account the possible criminal consequences of incorrect tax returns. A timely voluntary correction can, in certain cases, limit risks, although the possibilities for doing so have been legally restricted in recent years, and an assessment after the fact offers no guarantee that criminal consequences will be avoided.

International cooperation and jurisdiction

Crypto cases almost always have an international dimension. Servers, exchanges, wallets and suspects may be located in different countries, while victims live elsewhere. This raises questions of jurisdiction, competence, and the lawfulness of evidence obtained abroad. Dutch investigative authorities make use of international legal assistance, European investigation orders, and cooperation through bodies such as Europol and Eurojust, although the practical effectiveness of this cooperation partly depends on the countries involved and the speed with which data is secured.

This international dimension also offers points of engagement for the defence, for example by examining which country has jurisdiction, which authority collected the evidence and under what procedure, and whether the transfer of data was lawful and meets the requirements the Dutch courts impose on foreign evidence. The cross-border nature of these cases often makes the assessment more complex, but does not remove the need for a concrete review of the evidence.

What to do in the event of suspicion or investigation

Anyone who becomes involved in a criminal investigation in which crypto plays a role is well advised to seek legal advice from a criminal law specialist quickly. This applies both to suspects and to victims of crypto fraud. For a suspect, early legal assistance can help in mapping the origin of assets, assessing a seizure, preparing a statement, defending against confiscation, assessing digital evidence, and determining the right strategy in dealing with the police and the Public Prosecution Service.

In the event of a search or seizure, it is generally advisable not to make a substantive statement before consulting a lawyer, since an incomplete or ill-considered statement can be difficult to correct later. It is also important to gather relevant documentation as quickly as possible, such as transaction overviews from exchanges, bank statements, purchase and sale receipts, wallet addresses, tax returns, and correspondence regarding transactions, loans, gifts or other assets.

For victims, speed is equally important. The sooner a report is filed and data is secured, the greater the chance that transactions can still be traced and that an exchange or investigative authority can take timely action.

In conclusion

Crypto and criminal law increasingly intersect. The technology is developing rapidly, and regulation, investigative methods and case law continue to evolve. What is regarded as a grey area today may be the subject of new regulation or settled case law tomorrow.

Investors, entrepreneurs, platforms and intermediaries are therefore well advised to put their legal position in order in advance. Careful record-keeping, clear internal procedures and timely legal and tax advice can significantly limit risks. Anyone working with cryptocurrency should look not only at returns and technical security, but also at the criminal, tax and civil law consequences of transactions. Especially with crypto, preventive advice is often more effective than remedying problems after the fact.

Frequently Asked Questions