Guide: How to Recover Stolen Cryptocurrency

Edmonds, Marshall, McMahon | Rhys Evans

United Kingdom

Crypto recovery: what to do when you’ve been scammed

Crypto-related fraud continues to rise at an alarming rate, leaving victims desperate to understand how to recover stolen crypto and protect what remains of their assets. With little protection in place for victims of these frauds, regrettably the responsibility for crypto recovery is on the victim when it comes to recovering their stolen assets.

Positively, there is a potential arsenal of remedies at a victim’s disposal that can be deployed to to trace, freeze and recover stolen cryptocurrency – and the sooner these actions begin, the greater the chance of success.

Important first steps in the crypto recovery process

The first 72 hours immediately following a fraud or scam can often prove to be vital. The speed at which cryptocurrencies can be moved, to deposit addresses anywhere around the world, at the click of a mouse, mean that victims must move quickly to thwart a fraudster’s efforts to dissipate assets.

Victims should gather information relating to the fraud and those that perpetrated it, including saving all communication with the fraudster(s), and screenshotting websites or platforms that were used as a mechanism of the fraud. If a victim has their own cryptocurrency wallet, they should secure this immediately or move any remaining funds to a different, secure wallet.

After this, professional assistance will likely be necessary. Victims should make a report to Action Fraud without delay. Thereafter, expert legal advice should be sought urgently.

Once solicitors have been instructed, it will be necessary to trace and locate the stolen assets. To conduct a blockchain tracing exercise, it could be beneficial at the outset to instruct an expert tracing firm. This will allow the victim to identify where their funds have been sent to and, potentially, where they are currently held. This will likely impact the onward course of action in the recovery efforts.

Where possible, communication with the fraudster(s) should be maintained to avoid raising suspicion and tipping them off that the victim has commenced efforts to recover their assets. However, it is paramount that no further assets are sent to these people.

1. Requesting a voluntary freeze from cryptocurrency exchanges

At this stage, it may be possible to request the exchange place a voluntary freeze on the deposit address. However, exchanges are often reluctant to keep a voluntary freeze in place for an extended period, and so the onward phase of the process must be dealt with at pace.

Once it has been ascertained where the assets have been sent to, it is ordinarily preferable to open communications with the cryptocurrency exchange that host the deposit address. When dealing with reputable, cooperative exchanges, it is often possible to garner very useful information from them, including whether the funds remain in the deposit address, and what the balance of the address is.

2. Using civil litigation tools to recover stolen cryptocurrency

Upon the identification of deposit addresses holding the misappropriated assets, it may be viable to commence proceedings to (i) identify the owner of the deposit address, (ii) obtain a Worldwide Freezing Order to freeze the assets indefinitely, and (iii) obtain default and/or summary judgment and appropriate orders for the return of the stolen assets.

To identify the owners of the deposit addresses, it is possible to obtain information orders (known as Norwich Pharmacal or Bankers Trust orders) from the Court. This compels a cryptocurrency exchange to provide information relating to the deposit address, including the owner or operator of the address, the transactional history and the IP addresses from which the account was accessed.

Should the stolen funds remain in the address; to avoid them being further dissipated, a victim is able to advance an application for a Worldwide Freezing Order. This will compel a cryptocurrency exchange to place an indefinite freeze on the relevant deposit addresses until the freezing order has been discharged which, in turn, prevents the funds from being transferred or dealt with.

If the identity of the account owner is known, it may be possible to open negotiations with them, demanding they voluntarily return the stolen assets. However, in practice, it is rare that a criminal of this nature will engage with lawyers or proceedings generally.

In these circumstances, it is thereafter possible to seek default or summary judgment, which is in essence a truncated final judgment in the proceedings on the basis that there is no realistic prospect of defending the proceedings. At that juncture, a victim will be able to obtain an order for ‘delivery up’ of the stolen assets, returning them back to the victim.

3. Working with the police and law enforcement on Crypto Recovery

As an alternative to issuing court proceedings, it may be viable to seek the assistance of the police. Law enforcement has powers under the Proceeds of Crime Act 2002 to obtain Crypto Wallet Freezing Orders which require exchanges to freeze deposit addresses which have been identified as receiving misappropriated assets. Thereafter, a victim can make an application off the back of this for the release of the stolen funds back to them.

Whilst the police and wider law enforcement’s ability and resources to investigate these frauds is increasing, it is simply impossible for them to investigate every instance that is referred to them, such is the scale of this problem. As such, it can be of assistance for a victim to conduct their own investigations, including tracing the stolen assets, identifying the owners of the deposit addresses that received the stolen funds and/or taking steps to freeze accounts, even if on a temporary basis. At this stage, a victim can then ‘package up’ their investigation and provide it to the police to assist them in their ability to commence their own investigation, with a view to obtaining a Crypto Wallet Freezing Order.

4. Private prosecutions: A powerful tool to help recover stolen cryptocurrency

Once the identity of the owners of the deposit addresses that received the stolen funds has been confirmed, it may be possible to commence a criminal private prosecution. To do so, there must be a sufficient UK connection, which can be as straightforward as the victim being resident in the UK.

A victim can seek a conviction against the suspected fraudster(s) and, once proceedings have been commenced, seek to restrain any assets that the fraudsters own. Whilst this will typically be the deposit addresses identified from the tracing exercise; it can also include other, tangible assets such as bank accounts and property.

Recovering cryptocurrency under the Proceeds of Crime Act 2002

Thereafter, the victim can pursue confiscation of these assets under the Proceed of Crime Act 2002 in order to recover the stolen cryptocurrency, otherwise compensate them for the fraud committed against them.

Acting quickly is the key to successful crypto recovery

To help recover stolen cryptocurrency, it is paramount that victims act immediately after the fraud has taken place. Lawyers and other experts should be instructed without delay, to commence their investigation and advise on the most appropriate strategy for the recovery of the stolen funds.

This article first appeared on Lexology | Source