Skip to Content
Casework MethodFive Steps to Obtain Control Over Crypto

Five Steps to Obtain Control Over Crypto

framework

Core idea

Seizure is not one act, it is five, and they have to be completed in order. Skipping any of them produces a case that looks ready for enforcement and is not. The handbook’s framing is useful precisely because it separates the legal step from the technical ones and refuses to let either stand in for the other.

Components

  1. Identify and locate the asset. What type, how much, and whether it is reachable at all. A privacy coin, a balance at an unresponsive offshore service, and a hot wallet on a seized phone are three different problems wearing the same label.
  2. Link the asset to a person. The handbook calls this the hardest part of the investigation, and says that in most cases the link is established from evidence and facts found during searches rather than from the chain alone. On-chain tracing narrows the candidates; the physical and records work closes it.
  3. Ensure access. Either the holder provides it, or you recover the keys, seed phrase or passwords yourself. Without access there is nothing to enforce against. Where the target consents in writing, Article 32(b) of the Budapest Convention lets police act on that consent immediately without further procedural requirements, and some jurisdictions can compel production of a key.
  4. Obtain the legal instrument. Seizure happens only on a proper order from the competent authority. Note the ordering: this comes after you know what and whose, because the order has to describe the asset, the quantity, the holder and the destination.
  5. Enforce. Two routes, and only these two. Secure it, by transferring the value to a wallet the authority controls; or convert it, by selling. Everything before this point is preparation.

When to use

At the transition from tracing to enforcement, and as the checklist that tells you which of the five is actually blocking the case. Most stalled asset-recovery cases are stuck at step two or step three while the file records them as waiting on step four.

Avoid when

Do not treat the five as sequential in time only. Steps one and two are investigative and iterative, and the destination wallet for step five is prepared long before step four is granted. See Preparing and Executing a Crypto Seizure Transfer.

Example

A trace fixes an address holding a balance, which is step one complete. The file then sits for months awaiting a court order, when what it actually lacks is step two, a link between that address and a named person that would survive a hearing, and step three, any route to the key. The order was never the obstacle.

A Self-Custodied Wallet Cannot Be Frozen, Only Moved · Preparing and Executing a Crypto Seizure Transfer · Seizing Crypto: Devices, VASP Accounts, and the Agency Wallet · Post-Seizure Custody and Disposal of Seized Crypto · Crypto Address Attribution Process · The 5-Stage Investigation Process · Escalation Decision Matrix and Triggers · Case Tractability: When to Decline · Compelling VASP Disclosure: The Legal-Process Ladder · Crypto Artifacts on a Seized Device

Last updated on
Five Investigation Output TypesInvestigation Risk Categories & Mitigations