

A foreign national’s crypto wallet or crypto assets are seized during a Turkish criminal investigation. Learn how wallet ownership, source of funds, exchange records and blockchain transactions can be proven and how seizure may be challenged.
Cryptocurrency has become increasingly important in Turkish criminal investigations involving fraud, money laundering, unauthorized transfers, investment schemes and proceeds of crime. A foreign national may discover that a hardware wallet, mobile wallet, computer, cryptocurrency account or other digital asset has been seized even though the assets were acquired lawfully. One of the most difficult questions then becomes: how can ownership of a crypto wallet be proven when blockchain records generally identify wallet addresses rather than the legal name of the owner?
The answer normally requires combining blockchain evidence with conventional financial and digital evidence. Merely stating “this wallet belongs to me” may not be enough. The foreign suspect or third-party owner should create an evidence chain connecting their identity to the wallet, acquisition of the cryptocurrency, source of the funds and relevant transactions.
Cryptocurrency may become relevant where prosecutors suspect that digital assets represent criminal proceeds, were used to transfer allegedly unlawful funds, are connected with a fraud scheme or constitute evidence relating to an investigated offence.
However, the existence of cryptocurrency itself does not establish criminal conduct.
The relationship between the specific assets and the alleged offence must be examined.
Depending on the investigation and applicable judicial measures, authorities may encounter hardware wallets, computers, mobile phones, seed-related materials, exchange accounts or other digital records relating to cryptocurrency.
The legal position can differ depending on whether authorities physically possess a device or a measure affects identifiable digital assets.
Public blockchains usually show addresses and transactions rather than the civil identity of the person controlling the address.
Ownership therefore frequently has to be demonstrated through surrounding evidence.
If cryptocurrency was purchased through a regulated exchange, account records may connect the individual’s identity with the acquisition of the assets.
Relevant evidence can include account-opening records, transaction history, deposit and withdrawal records and records showing withdrawals to the disputed wallet address.
Suppose a foreign national transferred money from their personal bank account to a cryptocurrency exchange and later withdrew cryptocurrency to the seized wallet.
The combination of bank transfer, exchange purchase and blockchain withdrawal can create a strong chronological chain connecting the individual to the assets.
Ownership evidence should ideally show:
bank account → exchange account → cryptocurrency purchase → withdrawal transaction → wallet address → subsequent blockchain activity.
The more complete the chain, the easier it becomes to explain the legitimate acquisition of the cryptocurrency.
Transaction hashes, wallet addresses, timestamps, amounts and relevant blockchain records should be preserved.
These records can help connect exchange withdrawals or transfers with the wallet under investigation.
An invoice showing that the individual purchased the hardware wallet can provide supporting evidence.
However, ownership of the physical device alone does not necessarily establish ownership of every cryptocurrency address accessible through it.
A mobile phone or computer may contain wallet applications, transaction notifications, exchange emails or other information connecting the person with the disputed wallet.
Digital forensic examination may therefore become relevant.
Screenshots showing the wallet before the investigation may provide supporting evidence, particularly where they contain transaction history consistent with independently verifiable blockchain data.
Screenshots should generally be supported by stronger objective evidence where available.
Account registration emails, withdrawal confirmations, transaction alerts and security notifications can establish a historical relationship between the person and particular cryptocurrency transactions.
Preserve original electronic records rather than relying exclusively on printed copies.
In appropriate circumstances, technical methods may demonstrate control of a particular blockchain address. However, any such step should be coordinated carefully with criminal-defense counsel and technical experts, particularly where assets or devices are already subject to an investigative measure.
Do not move seized or disputed cryptocurrency merely to demonstrate control.
Moving cryptocurrency after becoming aware of an official restraint can create additional legal problems.
Ownership should be demonstrated through lawful evidence rather than attempts to move or conceal assets.
A seed phrase can establish practical control over a wallet but is also extremely sensitive security information.
Its evidentiary use should be carefully managed. Unnecessary disclosure can create security risks and potentially compromise all assets associated with the wallet.
Proving that a wallet belongs to the foreign national may not be enough.
Authorities may separately ask where the money used to acquire the cryptocurrency came from.
The defense should therefore address both ownership and lawful source of funds.
If cryptocurrency was purchased using employment income, preserve employment contracts, salary statements, bank deposits and tax-related records where relevant.
These records can help explain how the investment was financed.
A business owner may need corporate distributions, invoices, accounting records, bank transfers or other documentation demonstrating legitimate income.
The evidence should connect the lawful income with the funds eventually used to acquire the cryptocurrency.
Some investors have traded cryptocurrency for many years and no longer have a simple bank-to-wallet transaction.
In that situation, reconstruct the historical transaction chain using exchange records, blockchain transactions and available financial documents.
A foreign national may have acquired cryptocurrency through an exchange outside Turkey.
Obtain account records from the relevant foreign platform as quickly as possible because access may later become difficult.
Request historical records where possible. Bank transfers, emails, blockchain withdrawals and other records may still help reconstruct the connection.
A closed account does not necessarily make ownership impossible to prove.
Peer-to-peer acquisitions can be more difficult to document.
Contracts, communications, bank transfers and corresponding blockchain transactions may become important.
Where cryptocurrency was purchased using cash, the evidentiary chain may be weaker.
Any contemporaneous communications, receipts or transaction records should be preserved.
If the assets were received as a gift, identify the sender and preserve communications and blockchain records connecting the sender’s wallet to the recipient.
The lawful source of the donor’s assets may also become relevant depending on the investigation.
Inheritance documents, estate records, wallet-transfer history and records relating to the deceased owner may be required.
The blockchain transfer should be connected with the underlying succession documents.
If the seized wallet belongs to a company rather than the individual manager, corporate accounting and authorization records can become critical.
The company should demonstrate that the assets belong to the legal entity and explain who was authorized to control the wallet.
A device found in the suspect’s possession may contain cryptocurrency belonging partly or entirely to another person.
The third party should independently document ownership rather than relying solely on the suspect’s explanation.
Multi-signature arrangements and jointly managed investment wallets can complicate ownership.
The defense should identify each authorized participant, applicable agreement and transaction history.
If investigators identify transactions involving mixing services, privacy-enhancing tools or complex transfer patterns, the transaction history may require specialist blockchain analysis.
Complexity alone should not automatically be equated with criminal origin.
A person may receive cryptocurrency through ordinary commercial transactions, investment activity or transfers without knowing that an earlier wallet is under investigation.
The defense should reconstruct the commercial reason for the transfer and the recipient’s knowledge at the relevant time.
Where investigators rely on blockchain-analysis software, the defense should determine what the analysis actually establishes.
A risk label, cluster or transaction connection may require interpretation and should not automatically be treated as conclusive proof of ownership or criminal knowledge.
The foreign national or lawyer should determine the precise legal measure affecting the assets and identify the wallet, device or account covered by it.
The date, authority and scope of the measure should be documented carefully.
A wallet can contain cryptocurrency accumulated through many unrelated transactions over several years.
The defense should examine whether the alleged criminal transaction concerns the entire wallet balance or only identifiable assets.
For significant amounts, it can be useful to prepare a structured evidentiary report containing the owner’s identity, wallet addresses, exchange accounts, acquisition history, bank transfers, transaction hashes, source-of-funds documentation and explanation of disputed transactions.
Complex cases may require an independent technical expert capable of reconstructing transaction flows.
The expert should distinguish objective blockchain data from assumptions concerning the identity or intent of wallet users.
Depending on the nature of the measure and procedural stage, the affected person may have legal remedies to challenge seizure or seek return of property.
The application should explain why continued retention is unnecessary or why the relevant assets are not connected with the alleged offence.
Potentially, depending on the circumstances and legal status of the assets. If continued seizure is no longer justified, return or lifting of the relevant measure may be requested through the appropriate criminal procedure.
The outcome depends heavily on the alleged offence and evidentiary connection.
The defense should identify this clearly.
Where legitimate assets can be distinguished from allegedly criminal proceeds, transaction-level analysis may become particularly important.
Bank, exchange and corporate records located abroad may take time to obtain.
Do not wait until an indictment or trial hearing to begin collecting them.
Foreign bank statements, exchange records and contracts should be organized carefully for use in Turkish criminal proceedings.
Consistency between translations and original records is essential.
Deleting applications, exchange communications or transaction records after learning of an investigation can create serious evidentiary problems.
Preserve the original data.
Each person’s evidence should reflect genuine historical facts.
Attempts to coordinate stories after an investigation begins can damage credibility and potentially create additional legal risk.
When a foreign national’s cryptocurrency wallet or assets are seized during a Turkish criminal investigation, the defense should immediately obtain the seizure documentation, identify every affected wallet and asset, preserve blockchain records, collect exchange and bank statements, reconstruct the acquisition history, document the lawful source of funds, preserve relevant devices and electronic communications, identify third-party ownership where applicable, obtain technical blockchain analysis if necessary and evaluate available procedures for challenging continued seizure.
Yes. Ownership may be established through a combination of exchange records, bank transfers, blockchain transactions, device evidence and other documentation connecting the person with the wallet.
Not necessarily. It can support the claim, but stronger evidence may be needed to connect the individual with the cryptocurrency addresses and assets.
They can be important evidence, particularly when transactions can be connected with identified exchange accounts or other records.
Seed phrases are highly sensitive. Any potential disclosure should be evaluated carefully with legal and technical assistance rather than provided unnecessarily.
A person should not move assets subject to an investigative or judicial restriction merely to demonstrate ownership.
Historical exchange records, bank statements, emails and blockchain data can be used to reconstruct the acquisition history.
The third party should prepare independent evidence demonstrating ownership and the source of the assets.
Not by itself. The circumstances of the transaction, commercial purpose, knowledge and broader evidence must be examined.
Depending on the legal basis for the measure and the circumstances, an application challenging continued seizure or requesting return may be possible.
The strongest approach is usually a continuous evidentiary chain connecting the person’s identity and lawful funds to an exchange purchase, blockchain withdrawal and the specific wallet address, supported by independent financial and digital records.
Cryptocurrency investigations can involve wallet seizures, exchange accounts, blockchain tracing, source-of-funds allegations, fraud investigations, asset restraints and disputes concerning third-party ownership. Fırat Fesih Kaya Law Office assists foreign nationals and international clients whose cryptocurrency or digital assets become subject to Turkish criminal investigations. Lawyer Fırat Fesih Kaya provides legal assistance in challenging seizure measures, preparing wallet-ownership and source-of-funds evidence, coordinating blockchain and financial records, protecting third-party property rights and seeking return of assets where legally available.
Phone: +90 312 434 22 22
Mobile: +90 532 769 22 22
Email: info@firatfesihkaya.av.tr
Address: Mevlana Boulevard No:221, Yıldırım Tower, Office No:148, 06520 Balgat, Çankaya, Ankara, Turkey