

Cryptocurrency Investment Scam in Turkey: Criminal Complaint and Asset Tracing — 2026 Guide
Lost Bitcoin, USDT or other crypto assets in an investment scam connected with Turkey? Learn how foreign victims can file a criminal complaint, preserve wallet evidence, trace bank and cryptocurrency transfers, identify suspicious accounts and pursue asset recovery in Turkey in 2026.
Cryptocurrency investment scams can move a victim’s money through bank accounts, crypto exchanges and private wallets within minutes. For foreign nationals and international investors dealing with persons or platforms connected with Turkey, this can make the first hours after discovering the fraud particularly important.
A typical victim may have responded to a social-media advertisement promising cryptocurrency profits, joined a WhatsApp or Telegram investment group, communicated with an alleged financial adviser and initially transferred a relatively small amount.
The platform then displays substantial profits.
When the investor attempts to withdraw the supposed balance, the platform demands additional payments for a “tax,” “commission,” “liquidity requirement,” “verification fee,” “wallet activation,” or “anti-money-laundering clearance.”
The investor eventually discovers that the investment dashboard was fictitious and that the cryptocurrency has been transferred to wallets controlled by unknown persons.
This type of conduct is actively investigated in Turkey. In an April 2026 fake-investment investigation, Turkish prosecutors reported that victims had allegedly been directed through sponsored social-media advertisements and phishing techniques to fraudulent investment websites promising high returns. Financial analysis identified 15 bank accounts and four crypto-asset accounts associated with 27 suspects.
Another 2026 investment-fraud investigation identified 269 alleged victims and approximately TRY 600 million in alleged criminal proceeds. Prosecutors reported that financial analysis based on Financial Crimes Investigation Board data revealed extensive movements through individual and corporate accounts, while bank and crypto accounts, companies, vehicles, real estate and other assets became subject to investigative measures.
For a foreign victim, the recovery strategy should therefore begin with one question:
Where did the real money or cryptocurrency actually go?
A cryptocurrency investment scam generally involves inducing the victim to transfer money or crypto assets through false representations concerning an investment opportunity.
Common examples include:
The platform may look professional and may even imitate a legitimate financial business.
The legal investigation must focus on the actual transaction chain rather than the appearance of the website.
A common pattern is:
Advertisement → Adviser → Small deposit → Fake profits → Larger investment → Withdrawal request → Additional fee → More payments → Account blocked
For example, a foreign investor deposits USD 2,000.
Within several days, the platform displays USD 3,700.
The alleged adviser encourages the investor to increase the investment to USD 20,000.
The displayed balance later becomes USD 45,000.
When the investor requests withdrawal, the platform says:
“You must pay USD 6,000 in tax before your funds can be released.”
After payment, another demand appears:
“Your account requires a USD 4,000 AML security deposit.”
This cycle can continue until the victim refuses to make further payments.
One of the first mistakes victims make is believing that the number displayed on the investment dashboard represents real cryptocurrency.
It may not.
A fake platform can display:
Bitcoin balance: 1.45 BTC
USDT balance: 85,000
Profit: USD 34,500
without holding any corresponding crypto assets for the investor.
The investigation should therefore distinguish between:
what the website displayed
and
what actually happened on the blockchain and through the banking system.
The April 2026 official investigation concerning the alleged “invescogrubu” operation is particularly relevant because prosecutors reported both bank-account and crypto-asset-account activity associated with the alleged investment fraud.
Another January 2026 fraud investigation reported approximately TRY 120 million in suspicious account movements and stated that part of the money had allegedly been converted into crypto assets.
These cases illustrate that converting alleged fraud proceeds into cryptocurrency does not necessarily end financial tracing.
Once the investor suspects fraud, additional payments should not be made merely because the platform promises that one final payment will release the funds.
Common demands include:
The request itself should be preserved as evidence.
If cryptocurrency was transferred, the transaction hash can become one of the most important pieces of evidence.
Depending on the blockchain, transaction information may help identify:
Do not preserve only a screenshot of the transfer.
Preserve the actual transaction information available through the wallet or exchange.
Create a chronological list.
For example:
Transaction 1: 5,000 USDT → Wallet A
Transaction 2: 10,000 USDT → Wallet B
Transaction 3: 25,000 USDT → Wallet C
Also record:
A single mistyped character can identify an entirely different wallet, so accuracy matters.
This may create both a banking trail and a cryptocurrency trail.
For example:
Foreign investor → Turkish bank account → Crypto exchange → Private wallet
The investigation may seek to reconstruct each stage.
Bank records may identify the initial recipient, while exchange and blockchain information may help establish what happened afterward.
This is a common fraud method.
The supposed adviser may say:
“Do not transfer money to us. Open your own exchange account, purchase USDT and transfer it to your investment wallet.”
This creates an appearance of safety.
But the destination “investment wallet” may actually be controlled by the fraudsters.
Preserve:
The fact that cryptocurrency was purchased through a genuine exchange does not prove that the investment itself was legitimate.
The relevant chain may be:
Victim’s bank → legitimate exchange → victim’s exchange account → fraudster’s wallet
The exchange and the fraudulent destination are separate issues.
Potentially, yes.
Blockchain transactions can create a persistent transaction trail.
Investigators may examine:
Wallet A → Wallet B → Wallet C → Exchange account
The key difficulty is often not seeing the blockchain transaction itself but determining:
Who controlled Wallet A, Wallet B or Wallet C?
That may require combining blockchain information with:
A blockchain wallet address is not automatically equivalent to a person’s identity.
Therefore:
Wallet address ≠ automatically identified suspect.
The investigation should seek evidence connecting the wallet to a person, exchange account, device or financial transaction.
This distinction is especially important in criminal proceedings.
Suppose stolen cryptocurrency moves:
Victim → Private Wallet A → Private Wallet B → Exchange X
The point at which the assets reach an identifiable crypto-asset service provider may become important because the service provider may hold customer and transaction records.
Turkey’s Financial Crimes Investigation Board updated its Crypto-Asset Service Providers Guide in September 2025. The guide addresses customer identification, enhanced measures, the Travel Rule, transfer restrictions, suspicious-transaction reporting and information/document obligations. These requirements remain relevant to the 2026 compliance environment.
Crypto-asset transfers increasingly operate within a regulatory environment requiring identifying information to accompany qualifying transfers.
For asset tracing, this can matter because the investigation is not necessarily limited to an anonymous blockchain address.
Where regulated service providers are involved, customer-identification and transaction records may provide additional investigative leads.
The exact records available depend on the provider, transaction and applicable legal framework.
Where legally relevant records are held by a domestic service provider, investigators may seek information through the applicable criminal-procedure mechanisms.
Potentially relevant information may include:
The precise scope depends on the investigation and applicable legal authority.
The case becomes more complex but does not automatically become impossible to investigate.
Foreign-held evidence may require international judicial cooperation or other applicable legal mechanisms.
The key is to identify the exchange or service provider accurately and preserve the blockchain trail leading to it.
This may create a different recovery problem.
A blockchain may show that assets remain at an address, but authorities still need to determine:
Tracing an asset and recovering it are therefore different stages.
This distinction is critical.
Determining where the cryptocurrency went.
Connecting the assets or wallet to particular persons.
Using available legal measures to prevent disposal where statutory conditions are met.
Returning property or obtaining compensation for the victim through the appropriate procedure.
Finding a wallet address does not automatically mean the victim can immediately recover the cryptocurrency.
Depending on the legal basis and facts, accounts and assets connected with suspected criminal proceeds can become subject to investigative measures.
The scale of such measures can be substantial. In the 2026 investment-fraud investigation involving alleged shell companies, prosecutors reported restrictions affecting bank and crypto accounts as well as companies, vehicles, real estate, corporate shares and other property.
This demonstrates why asset tracing should not be limited to the cryptocurrency itself.
A recovery investigation may also examine whether suspects have identifiable:
If the stolen cryptocurrency has already been dissipated, other identifiable assets may become relevant to the broader recovery strategy.
Financial analysis can play a significant role in major fraud investigations.
The 2026 shell-company investment investigation expressly stated that financial analysis based on Financial Crimes Investigation Board data was used to identify very substantial transaction volumes.
The Board also maintains sector-specific suspicious-transaction guidance for crypto-asset service providers.
For victims, this reinforces the importance of giving investigators accurate account, wallet and transaction information from the beginning.
A cryptocurrency investment-fraud complaint should not consist merely of:
“I sent cryptocurrency and was scammed.”
It should reconstruct the scheme.
Explain:
How contact began → Who made the investment representations → Which website/application was used → What returns were promised → How payments were made → Which wallets received the cryptocurrency → What happened when withdrawal was requested → What additional payments were demanded.
Attach the evidence chronologically.
Even if the victim does not know the person’s real identity, include available identifiers:
Do not invent identities.
State clearly which information is verified and which was merely represented by the suspected fraudster.
Record:
The website may later disappear.
This may establish how the victim was recruited.
Save evidence of:
Official 2026 investigations show that sponsored social-media advertisements and digital communication platforms are being examined as part of investment-fraud schemes.
Keep the complete conversation.
Important messages may include:
Do not delete the conversation after discovering the fraud.
Screenshots may document what the victim saw, but they should not replace the original evidence where it remains available.
Preserve:
This provides a stronger evidentiary record.
Preserve the application before deleting it where safe and practicable.
Record:
Do not factory-reset the phone simply because the application appears fraudulent if the device may contain important evidence.
Verify the claim independently.
Turkey’s Capital Markets Board has taken enforcement measures in 2026 against websites identified as providing unauthorized crypto-asset or leveraged trading services to persons resident in Turkey.
A logo, license number displayed on a website or Turkish company registration should therefore not be accepted without independent verification.
A fraudulent operation may use a genuine company or a shell company to create credibility.
The 2026 investigation concerning alleged investment and finance shell companies illustrates this risk.
Always distinguish:
company existence
from
authorization to provide the claimed financial or crypto service.
This is another documented risk.
In June 2026, the Capital Markets Board warned that individuals were misusing the names and titles of Board officials to request money. The Board stated that it and its personnel do not solicit money through telephone, SMS, email, social media or similar communication channels and advised victims that criminal complaints and legal remedies may be available.
A demand supposedly coming from a regulator should therefore be independently verified.
Potentially, depending on the facts and the statutory elements established by the evidence.
Digital investment schemes can involve information systems, banking mechanisms, deceptive websites and coordinated account structures.
The exact criminal classification must be determined from the individual facts rather than simply from the fact that cryptocurrency was involved.
Potentially.
Where alleged criminal proceeds are deliberately moved through accounts, companies, exchanges or wallets, investigators may also examine whether separate offences concerning criminal proceeds are implicated.
But cryptocurrency movement does not automatically establish money laundering.
The statutory elements and the knowledge and conduct of each person must be established separately.
Fraudsters may use bank and crypto accounts belonging to third parties.
Turkish prosecutorial authorities continue to warn in 2026 about people providing bank, digital and crypto accounts to others in exchange for payment or promises of income. Official warnings specifically mention cryptocurrency and high-return investment schemes among the methods used to obtain account access.
For the victim, the first account holder may therefore be only one part of a larger chain.
Document the chain.
For example:
Victim Wallet → Wallet A → Wallet B → Wallet C → Exchange
Each transaction may provide another investigative lead.
Do not assume that multiple wallet transfers automatically make tracing impossible.
These circumstances may make tracing significantly more technically difficult.
The legal strategy should distinguish between:
the blockchain evidence that is objectively available
and
speculation about who controls a particular address.
Specialist technical analysis may sometimes be necessary.
Potentially, but an IP address should not automatically be equated with a person.
Investigators may combine:
A technical connection is one piece of evidence, not necessarily conclusive identification.
Potentially, depending on where the assets are, the applicable legal process and whether the relevant assets can still be identified and secured.
Recovery becomes more difficult where cryptocurrency has already been:
No lawyer or investigator should guarantee recovery merely because the blockchain trail is visible.
This is common in investment fraud.
The fraudster may permit a USD 200 or USD 500 withdrawal to establish credibility.
The victim then invests USD 50,000.
The earlier successful withdrawal does not necessarily establish that the platform was genuine.
Preserve it as part of the overall transaction chronology.
That does not automatically mean there was no fraud.
The central allegation may be that the victim intentionally transferred the assets because they were deceived about:
A voluntarily executed transfer can still be relevant to a fraud investigation where the transfer was induced by intentional deception.
That depends heavily on the transaction structure.
If the victim personally transferred money to their own legitimate exchange account and then voluntarily transferred cryptocurrency to the fraudster’s wallet, the legal issues differ from an unauthorized bank-account takeover.
Potential claims involving a bank, payment institution or crypto service provider therefore require separate analysis.
Foreign nationality does not prevent a victim from reporting suspected criminal conduct falling within Turkish jurisdiction.
The complaint should be supported by an organized evidence package.
Language difficulties should not cause transaction amounts, wallet addresses, telephone numbers or other technical details to be recorded incorrectly.
Being abroad does not necessarily prevent legal action concerning fraud connected with Turkey.
The case should first be mapped geographically:
Cross-border cases may require international cooperation.
A victim who loses cryptocurrency often becomes the target of a second scam.
Someone may contact the victim and say:
“We found your Bitcoin.”
“We can hack the fraudster’s wallet.”
“Pay us 10% and we will release the funds.”
“We work with the Turkish prosecutor.”
Do not send additional cryptocurrency merely because someone claims to have traced the assets.
Legitimate legal asset recovery does not depend on paying an unknown person’s wallet to “unlock” stolen cryptocurrency.
For every transfer, identify:
Source: Where did the funds originate?
Conversion: Was fiat currency converted into cryptocurrency?
Exchange: Which service provider was used?
Token: Bitcoin, USDT, Ethereum or another asset?
Network: Which blockchain network?
Destination: Which wallet received the asset?
Transaction hash: What is the exact blockchain record?
Next movement: Where did the cryptocurrency go afterward?
Exchange endpoint: Did it reach another regulated service provider?
Identity evidence: What evidence connects the destination to a suspect?
This produces a much more useful investigation file than simply stating the total loss.
A foreign investor loses USD 100,000.
The evidence shows:
USD 20,000 → Turkish Bank Account A
USD 30,000 → Victim’s legitimate crypto exchange → USDT → Wallet B
USD 50,000 → Foreign bank → Crypto exchange → Wallet C
Blockchain analysis later shows:
Wallet B → Wallet D → Exchange X
and:
Wallet C → Wallet D
The convergence on Wallet D may become an important investigative fact.
If Wallet D subsequently transfers funds to an identifiable exchange account, investigators may have an additional avenue for identifying the person involved.
Cryptocurrency does not automatically make investment fraud anonymous or financially untraceable.
Current Turkish investigations demonstrate that prosecutors are examining bank accounts, crypto-asset accounts, digital communications, financial analysis and broader property holdings together.
In April 2026, prosecutors investigating a sponsored-advertisement investment scheme reported financial analysis involving 15 bank accounts and four crypto-asset accounts linked to 27 suspects.
In another 2026 investment-fraud investigation, prosecutors reported 269 victims, approximately TRY 600 million in alleged criminal proceeds and extensive financial movements identified through analysis. Investigative measures extended beyond bank and crypto accounts to companies, vehicles, real estate and corporate interests.
Turkey’s current crypto compliance environment also includes customer identification, enhanced due diligence, the Travel Rule, suspicious-transaction reporting and information/document obligations for crypto-asset service providers under the updated Financial Crimes Investigation Board guidance.
The practical strategy for a foreign victim in 2026 should therefore be:
Preserve the digital evidence → identify every transaction → map bank and blockchain movements → identify exchanges and wallets → file a detailed criminal complaint → seek timely investigation of identifiable assets → evaluate recovery options based on where the assets actually went.
Potentially. Blockchain transactions can provide a transaction trail, while exchange, banking, device and account records may assist in connecting addresses to individuals. Recent Turkish investigations have expressly involved analysis of crypto-asset accounts.
Potentially, but recovery is not guaranteed. Identifying a wallet is different from identifying its controller and securing the assets.
Wallet addresses, transaction hashes, exchange records, bank statements, complete communications and evidence showing how the investment was presented are particularly important.
Yes. A personally authorized transfer does not by itself exclude fraud where the allegation is that intentional deception caused the victim to transfer the assets.
Preserve and map every identifiable transaction. Multiple transfers may make tracing more complicated but do not automatically erase the blockchain trail.
Evidence held abroad may require applicable international cooperation procedures. The specific mechanism depends on the foreign jurisdiction and service provider.
Do not make an additional payment merely because the platform demands a supposed tax, compliance charge or release fee. Verify any claimed obligation independently.
Depending on the facts and legal basis, investigative measures can affect bank and crypto accounts. A 2026 Turkish investment-fraud investigation publicly reported restrictions involving both categories of accounts and other assets.
Possibly, but the process becomes more complex. The investigation may need to reconstruct the bank-to-crypto conversion, blockchain transfers, exchange endpoints and other identifiable assets.
As quickly as reasonably possible. Bank funds and cryptocurrency can move rapidly, while websites, accounts and communications may disappear. Early evidence preservation and transaction mapping can materially improve the quality of the criminal complaint and asset-tracing process.
Cryptocurrency investment fraud requires more than proving that a fake website existed.
The practical recovery investigation must determine:
Where did the money enter the crypto ecosystem? Which cryptocurrency was purchased? Which wallet received it? Where did the cryptocurrency move next? Did it reach an identifiable exchange? Who controlled the relevant accounts? Are other bank accounts, companies, vehicles, real estate or assets connected with the suspects?
Fırat Fesih Kaya Law Office provides legal assistance to foreign nationals, international investors, executives and foreign business owners who become victims of cryptocurrency and fake investment fraud connected with Turkey.
Lawyer Fırat Fesih Kaya assists foreign victims with criminal complaints, prosecutor investigations, Bitcoin and USDT transaction evidence, wallet-address analysis, bank-transfer tracing, crypto-exchange evidence, fake investment platforms, money-mule accounts, digital evidence, cross-border transfers and legal strategies concerning identifiable criminal proceeds.
Early legal action can be particularly important because blockchain transactions may remain visible while the practical ability to secure assets can change rapidly as cryptocurrency moves between wallets, exchanges and jurisdictions.
Phone: +90 312 434 22 22
Mobile: +90 532 769 22 22
Email: info@firatfesihkaya.av.tr
Address: Mevlana Boulevard No:221, Yıldırım Tower No:148, 06520 Balgat, Çankaya, Ankara, Turkey
This publication is provided for general informational purposes and does not constitute legal advice. Cryptocurrency tracing and recovery depend on the blockchain used, transaction structure, service providers involved, location of suspects and assets, applicable procedural measures and evidence available in the individual case.