Some time ago, the journal Criminal Technology published a paper titled "Virtual Currency Forensic Analysis Technology and Practical Application." The authors' institutional affiliations include the Lucheng District Branch of the Wenzhou Public Security Bureau, the Criminal Investigation Corps of the Zhejiang Provincial Public Security Department, Shanghai University of Political Science and Law, Hangzhou Pinghang Technology Co., Ltd., and the Wenzhou Public Security Judicial Appraisal Center. From the differing perspectives of public security electronic evidence, criminal investigation, technical services, and judicial appraisal, the paper provides a relatively systematic discussion of issues in virtual currency-related cases, including device forensics, the discovery of mnemonic phrases and private keys, the acquisition of exchange data, on-chain address tracing, and the control and custody of virtual assets involved in cases.
From the perspective of a criminal defense lawyer, the most valuable aspect of this paper is not that it tells us "which high-tech tools the police will use," but that it allows us to see a path by which evidence is generated: how a coin moves from an on-chain record to evidence of control, evidence of fund flows, evidence of subjective knowledge, and evidence of the handling of property involved in a case in the case file.
For the purposes of practical study and exchange, Mankun lawyers, drawing on the important information in this paper and the observations of the Mankun criminal team in cases involving virtual currency-related criminal matters, frozen bank cards, frozen exchange accounts, theft of virtual assets, OTC-related matters, and illegal payment-settlement schemes and money laundering, share the following discussion with readers.
How do the police locate the private keys of a crypto wallet?
In virtual currency cases, the first threshold is usually not conviction, but control.
In bank card cases, the real-name registration of the account, the account opening address, transfer records, login devices, and counter withdrawal records all help the investigating authorities determine the relationship between an account and a person. Crypto wallets are different: an address itself does not bear a name, and the blockchain does not show that "Zhang San holds this address." The police must continue searching devices, accounts, and operational traces to see whether an address is actually controlled by a particular person.
This is why the paper repeatedly mentions private keys, mnemonic phrases, wallet files, and hardware wallets. For non-custodial wallets, private keys and mnemonic phrases are not ordinary files; they are the entry point for controlling assets. Whoever holds the private key or mnemonic phrase may be able to initiate a transfer. When the police search mobile phones, hard drives, chat records, memos, image OCR, wallet apps, exchange apps, and hardware wallets for such information, they are in fact determining whether a suspect has the ability to dispose of the virtual currency involved in the case.
From the perspective of criminal defense, the appearance of a certain virtual currency address in the case file does not mean that it has been proven that the client controls that address.Lawyers need to examine where the address came from: is it a receiving address sent by someone else in chat records, or an address generated by a wallet on the device itself; are there mnemonic phrases, private keys, keystore files, or wallet.dat files; are there login records, transfer authorization records, or device binding records; and do watch-only wallets, cold wallets, multisignature wallets, or similar arrangements exist?
A watch-only wallet is a typical example. The fact that a person can see the balance of a certain address on a mobile phone does not mean that the person can transfer out the coins in it. If only a watch-only address has been imported, without private keys or signing authority, evidence of control cannot be established merely on the basis that "the balance can be seen on the mobile phone." The same applies to cold wallets, multisignature wallets, and hardware wallets: whether a transfer can be made depends on whether the keys, PIN, signing device, authorization process, and transaction records can corroborate one another.
In many virtual currency-related cases, the dispute hinges on the gap between "the address" and "the person."The presence of an exchange app on a mobile phone does not mean that the address involved in the case is controlled; nor does the appearance of a certain address in chat records mean that the coins in that address can be transferred out. The police must establish this connection, and the defense must also examine whether this connection is genuinely supported by the evidence.
Why do the police seize mobile phones, computers and hard drives first?
In many crypto-related cases, the first action family members see is the police seizing mobile phones, computers, hard drives, USB drives and even hardware wallets together. This action may look like a search for "coins," but more accurately it is a search for the entry points, processes and personal relationships connected to the coins.
The paper notes that media such as mobile phones and hard drives may contain centralized exchange apps, as well as wallet software such as MetaMask, imToken, TokenPocket and Bitpie. Some people also store mnemonic phrases, private keys, addresses, transaction screenshots and transfer notes in WeChat, QQ, memos, notepads, cloud drives, images and even ordinary documents.
Once this data enters the case file, it is usually used in several ways. The first is to find asset entry points, to see whether there are exchange accounts, wallet apps, addresses, mnemonic phrases, private keys or hardware-wallet companion software. The second is to reconstruct the transaction process, to see who provided the address, who arranged the USDT exchange, who directed cross-chain transfers, who required split transfers, and who was responsible for withdrawals or cashing out. The third is to determine subjective knowledge, especially in cases of aiding information network criminal activities, concealment and disguise of criminal proceeds, money laundering, joint commission of fraud, running casinos, illegal business operations and similar cases, where chat records and operational traces are often used to prove whether the person knew that the source of funds was abnormal, the transaction structure was abnormal, or the platform's business was unlawful.
It is very difficult to discuss criminal risk fully on the basis of a single on-chain transaction flow chart.On-chain transaction flows can show that coins moved from address A to address B, but they cannot automatically show who operated, why they operated, whether they knew of the upstream crime, or whether they profited from it. Once a case enters the stage of criminal-law assessment, the investigating authorities will also examine chat records on mobile phones, exchange records, device logins, bank statements and offline identity relationships together.
For the person involved and their family members, there is a very practical reminder here: after a case arises, do not delete chat records, uninstall wallets, clear exchange records, or ask others to "handle" mnemonic phrases and private keys. These actions may not solve the problem and may instead be understood as destruction of evidence, transfer of property involved in the case, or evasion of investigation.
What crypto-related leads can forensic tools uncover?
The most detailed part of this paper directly describes several tools and service providers that may be used in practice. They are not merely technical terms; they can also help lawyers understand how the leads in the case file were obtained.
For example, when searching a computer or hard drive for mnemonic phrases, the paper notes that FileLocator can be used for a full-disk search: first, regular expressions are used to screen out suspected mnemonic phrases consisting of 12 to 24 English words, and then the Python mnemonic library is used to perform a secondary verification under the BIP39 standard. This process is very practical, because mobile phone screenshots, WeChat files, memos and ordinary txt documents contain large numbers of English words; one cannot conclude that a wallet mnemonic phrase exists merely because 12 consecutive words appear, and it is also necessary to see whether they conform to the wallet generation rules.
On mobile phone forensics, the paper mentions Pinghang Technology's PF5200 multi-channel mobile phone forensic software, Honglian Huoyan forensic analysis software, and Qi-An-Xin Pangu Stone mobile phone forensic analysis software. They mainly process local data in Android and iOS mobile phones, such as WeChat, QQ, memos, image OCR, exchange accounts, wallet information, suspected mnemonic phrases and virtual currency addresses. The police do not merely use blockchain explorers to trace coins in isolation; they first look in the suspect's devices for "why this address is connected to him."
On PC-side searches, the paper mentions that Meiya Forensic Master can automatically search for addresses on multiple public blockchains such as Bitcoin, Ethereum and TRON through keywords and regular expressions. On the analysis of chat records and third-party evidence-collection data, the paper also mentions Pinghang Technology's X501 analysis platform and Meiya Pico's Xinghuo platform, which can import BCP packages, HTML reports, chat records, cloud drives, memos, image OCR and other content, automatically extract virtual currency addresses and suspected mnemonic phrases, and trace back which chat, which attachment, which app or which file path these contents came from.
There is a limitation here that is easily overlooked.The paper explicitly notes that there are currently no mature tools on the market for "password-free database forensics" of exchange data. To obtain account information, asset balances, order records and cloud transaction data within an exchange platform, it often still depends on whether this can be accomplished through account login, a suspect's confession of login keys, screenshot preservation, platform-assisted investigation, or other means. In other words, the presence of an exchange app on a phone only shows that there are traces of use; it cannot directly lead to the conclusion that all data within the platform has been completely, lawfully and verifiably extracted.
When lawyers see statements such as "suspected mnemonic phrases extracted from a phone," "virtual currency addresses extracted from chat records," or "addresses identified through image OCR," they cannot look only at the conclusion. They must look more closely at the extraction path: whether the address is a local address in a wallet app or a receiving address sent by someone else; whether the mnemonic phrase is a complete and valid BIP39 mnemonic phrase or ordinary English words that were misidentified; whether the image OCR made recognition errors; and whether, after automated extraction by a tool, the case-handling personnel conducted manual review, path tracing and screenshot preservation.
Wallet files must also be examined separately. Early Bitcoin wallets may contain wallet.dat files; Ethereum, TRON and other wallets may contain keystore JSON files, whose file names often include a UTC timestamp and a wallet address beginning with 0x. In practice, if public security authorities find wallet.dat or keystore files on a hard drive and then combine them with passwords, login traces, wallet balances and transaction records, this may further prove the relationship between the device and a certain wallet address. Conversely, if only a file name or address fragment is retrieved, without decryption, import verification or transaction authorization records, it cannot easily be treated as complete evidence of control.
Hardware wallets likewise cannot be assessed merely by whether "the device was seized."The paper takes hardware wallets such as imKey as an example and notes that hardware wallets are usually used in conjunction with an internet-connected wallet via Bluetooth or USB, and that creation and connection involve a PIN code, the official app, random number verification and authorization on the hardware side. If public security authorities have seized only the internet-connected phone but have not found the hardware wallet, PIN code or offline signing device, they may be able to see only the addresses and balances in a watch-only wallet and may not be able to prove that transfer authority has been obtained. Conversely, if the hardware wallet, PIN, connection records and transfer authorization actions can corroborate one another, the evidence of control will be significantly strengthened.
These tool names are included in the article not to demonstrate technical complexity, but to remind readers that crypto-related leads in case files usually have specific sources.Tools can help case-handling authorities locate addresses, mnemonic phrases, wallet files and chat records, but tool output does not equal a conclusive finding.Whether something can serve as criminal evidence also depends on the entire process of extraction, preservation, verification and explanation.
Can on-chain tracing find out where the funds went?
When ordinary people look at on-chain tracing, they easily assume it is simply tracing a transfer: this address transferred to that address, and you just keep tracing downward. In actual case handling, the difficulties often arise from cross-chain activity, contracts, token swaps, authorized transfers, mixing and exchange internal accounts.
Virtual asset tracing usually has two objectives: one is the flow of funds, and the other is the actual holder of the address. The flow of funds can be preliminarily examined through blockchain explorers, but once funds enter cross-chain bridges, aggregators, swap contracts or mixing services, the path becomes complex.
For example, a certain USDT transfer may be sent from a TRON address and may subsequently enter a centralized exchange, or may cross over to BSC, Ethereum or another chain; it may enter an aggregator, a swap contract or a cross-chain bridge; or it may be split into multiple transfers in small amounts across multiple addresses. At this point, the case-handling authorities cannot look only at an ordinary transfer page; they must also analyze contract logs, event records, sources of transaction fees, historical interactions between addresses, and correlations in transaction timing and amounts.
The paper's discussion of "fee address tracing" refers to precisely this. On-chain addresses are anonymous, but addresses are not completely isolated. When a new address initiates a transaction for the first time, it often needs a transaction fee. Where the fee comes from—whether from a certain exchange, a certain known hot wallet, or a certain account that previously underwent KYC—may become a clue for identifying the actual user. In many cases, what links a person to an address may not be a large principal transaction, but rather small actions such as first activation, the source of transaction fees, test transfers, and historical interactions.
Cross-chain transactions also require examining logs. After funds enter a contract address, looking only at an ordinary browser page may give the impression that the trail has gone cold. However, from a technical analysis perspective, it is still possible to continue examining event logs, the target chain ID, the final receiving address, and platform aggregator records. The paper gives a specific example: by querying a transaction hash through a browser associated with a cross-chain aggregator such as transitswap, and then using the ChainID to determine that the funds were transferred from the BSC chain to the OK chain, and ultimately to which target address they landed.
The paper also describes a practical case: technical personnel used the OKLink blockchain explorer to trace the source of the first transaction fee for a certain wallet, discovered that the fee source address had fund interactions with the Binance exchange, and thereby connected the server rental payment address, the suspected technical developer, and the mnemonic document found on the device. This case is highly instructive. In coin-related cases, server rental payments, test transactions, first activation, and sources of transaction fees are often closer to "the person" than a single large transfer.
In international law enforcement and compliance practice, on-chain tracing also draws on professional blockchain analysis tools. Public product information shows that Chainalysis Reactor focuses on cross-chain tracing, mixers, bridges, DEXs and real-world entity identification; TRM Labs provides law enforcement agencies with products such as TRM Forensics, TRM Triage and Seed Analysis, used to trace the origin and destination of transactions, quickly search crypto identifiers, and identify wallets associated with mnemonics and their balances; Elliptic Investigator also emphasizes cross-chain investigations, visualization of fund flows, and locating regulated exchanges as entry points for obtaining KYC information. These names do not mean that every case in China will use the same set of overseas tools, but they reflect the same industry trend: on-chain analysis is moving from manual browser queries toward address clustering, entity tagging, cross-chain paths and evidence graphs.
From a defense perspective, on-chain tracing still has its limits.An on-chain path can prove the flow of assets, but it does not inherently prove subjective knowledge; it can prove that a certain address received coins, but it does not necessarily prove that the party knew the nature of the upstream funds; it can show that funds entered a certain exchange, but it does not necessarily prove that the person named on the exchange account is the actual operator.Whether a virtual currency-related case can be established also depends on whether on-chain traces and off-chain evidence can corroborate each other.
Is it really impossible to investigate cross-chain transactions, mixing services and overseas exchanges?
When public security authorities investigate virtual currency-related cases, the most difficult categories of circumstances typically include mixing services, cross-chain transactions, overseas platforms that do not require strict KYC, and exchanges that do not cooperate with judicial assistance.
The purpose of mixing services is to isolate the inflow and outflow of funds. Taking Tornado-type mixing services as an example, the paper explains that after a user transfers assets in, the user can withdraw them from a new address using the transaction voucher, and the fund path will be severed. For public security authorities, this significantly increases the difficulty of tracing.
However, "increased difficulty" does not equal "completely untraceable."The paper notes that if the suspect's devices still contain relevant wallet addresses, transaction records, timestamps, and amount records, it may still be possible to trace the destination of funds through device correlation, timing correlation, amount correlation, and other methods. In many cases, the truth is ultimately not revealed at a glance through a blockchain explorer, but rather reconstructed jointly from device data, chat instructions, exchange records, and on-chain traces.
For persons involved in a case, one should not assume that cross-chain transfers, coin mixing, or splitting addresses can sever the investigation. Particularly in cases such as illegal payment-settlement schemes for money laundering, online gambling fund transfers, conversion of fraud proceeds, and professional OTC cash-outs, the on-chain path is only one part; chat records, bank card transaction histories, order records, exchange assistance in investigations, and offline personal relationships will all enter into the assessment together.
For the defense, the use of coin mixing or cross-chain transfers also cannot be directly equated with criminal intent.Some cross-chain transfers are normal asset management, some conversions are normal chain-switching needs, and some wallet usage habits come from industry practice. The key still lies in the transaction background, source of funds, purpose of the operations, whether abnormal remuneration was received, whether risk controls were circumvented, and whether instructions were received from upstream criminal actors. A technical act itself is not a conclusion; only when placed back into the specific facts of a case does it carry criminal significance.
Will exchange assistance in investigations turn the real-name holder into the responsible person?
Non-custodial wallets may not require real-name verification, but centralized exchanges generally have KYC. In cases involving virtual assets, public security authorities often combine on-chain tracing with exchange assistance in investigations.
If funds ultimately enter centralized exchanges such as Binance, OKX, or Huobi, the case-handling authorities may obtain account registration information, KYC materials, login IP addresses, bound mobile phone numbers and email addresses, deposit and withdrawal records, order records, internal transfer records, risk control records, and more. The paper also notes that KYC verification at exchanges helps judicial authorities obtain holder information in cases involving money laundering, fraud, gambling, drugs, and other offenses.
However, real-name information at an exchange is not the endpoint of liability determination.Some exchanges are located overseas, and obtaining materials requires platform cooperation, potentially even involving international criminal judicial assistance; some platforms have weak KYC, and the real-name holder and the actual controller may not be the same person; some accounts may be lent, purchased, stolen, or operated by others on one's behalf. After obtaining exchange information, public security authorities must also assess the actual user in light of devices, login environments, fund flows, and chat records.
In cases involving frozen exchange accounts and judicial assistance in investigations, clients are most prone to saying only "the account is mine" or "the account is not mine." Neither statement is sufficient. Who registered the account, who completed KYC, who keeps the password and 2FA, who logs in, who places orders, who provides the deposit address, who decides on withdrawals, where the funds come from, where withdrawals go, whether anyone else operated the account on one's behalf, and whether there was account theft or lending—these details directly affect the distinction between the liability of the real-name holder and that of the actual controller.
From the perspective of industry infrastructure, exchange assistance in investigations is also becoming productized. In addition to exchanges' own law enforcement request portals, platforms such as Kodex have emerged overseas as law enforcement data request management platforms, used to enable law enforcement agencies to submit, track, and manage data requests to companies. For virtual asset cases, such platforms do not directly prove criminal facts, but they affect the efficiency of assistance in investigations. When public security authorities seek materials from exchanges, wallets, payment institutions, stablecoin issuers, cloud service providers, domain name registrars, and email service providers, an increasing number of steps will follow standardized request and record-keeping processes.
After coins are seized or frozen, what should a lawyer examine?
In traditional cases, it is relatively easy for people to understand the seizure of a computer or the freezing of a bank card. Virtual assets are different. Seizing a mobile phone, computer or hard drive does not mean that the coins in an address have already been seized.
The paper identifies an issue that requires special handling by case-handling personnel: control over virtual assets ultimately depends on the private key and mnemonic phrase. If other persons still hold the private key, or if the suspect backed up the mnemonic phrase in advance, the coins may still be transferred away even if the device has been seized.
In cases involving virtual assets, seizure and freezing generally follow several approaches.
One approach is to seize storage media or hardware wallets, such as mobile phones, computers, hard drives or the hardware wallets themselves. This addresses evidence preservation and the obtaining of leads, but it may not achieve full control over the assets.
Another approach is to transfer the virtual assets involved in the case to a wallet or dedicated account designated by the public security authority, achieving control through the management of new private keys. The paper considers that, in theory, this achieves genuine control over the assets more effectively than merely seizing devices, but only on the premise that procedures, authority and management mechanisms are properly regulated.
Another approach is to entrust a qualified third-party institution with custody. This can reduce the risk of personal custody by case-handling personnel, but it also raises issues concerning the third party's qualifications, fees, the boundaries of liability and supervision.
There is also the approach of issuing a letter to a centralized exchange to freeze an account. If the suspect's coins are still in an exchange account, freezing the account is often more direct than searching off-chain for the private key. However, whether the exchange is located overseas, the degree of the platform's cooperation and the path for judicial assistance will all affect the practical outcome.
Lawyers cannot ask only whether the coins have been seized; they must also ask how the coins were seized.Was there a record of the seizure process; did the transfer process involve screen recording, witnesses, two-person operation and address verification; are the source and destination of the coins involved in the case clear; to which address the coins were transferred, who holds the private key, and whether case-handling personnel are keeping them personally; how the quantity is confirmed, how the type of coin is confirmed and how the value is determined; whether the party concerned was informed and whether there are channels for appeal or complaint. All of these may affect the lawfulness and transparency of the handling of property involved in the case and subsequent disputes.
The paper gives a strong procedural warning in this part. Virtual assets involved in a case must not remain for a long time in a state where "a certain case-handling officer knows the private key and a certain temporary wallet holds the coins." A more standardized approach is to separate case handling from management, use dedicated accounts or multisignature wallets, implement "two-person, two-lock" controls, and ensure that the source, destination, quantity, type of coin and time of transfer can all be reviewed. Otherwise, once coins are secretly transferred, the type or quantity of coins does not match, or delays in handling cause significant value fluctuations, the problem will turn from a technical dispute into a dispute over the management of property involved in the case and the lawfulness of procedures.
After a case is filed, where should the focus of the defense be placed?
When some coin-related cases are discussed further, they return to an old question: are virtual assets property protected by criminal law?
This question is of course important, but if the case has already entered the public security investigation stage, the defense cannot stop at this question alone.
The public security authorities will not discuss in the abstract only "what virtual currency is." Through devices, accounts, addresses, logs, chat records and exchange assistance in investigations, they will answer more specific factual questions: whether the person concerned controls a certain address or account; whether the coins involved are connected to upstream fraud, online gambling, illegal payment-settlement schemes, money laundering or illegal business operation chains; whether the person concerned knew the funds were abnormal when receiving, transferring out, exchanging or assisting with withdrawal; and whether, in the entire chain, he is an ordinary trading user, a professional OTC trader, a platform employee, a technical service provider, or an organizer, manager or funding channel in a joint crime.
The defense in coin-related cases cannot consist merely of the statement "I don't understand coins," nor merely of the statement "virtual currency is not protected."More solid work is to take apart the chain of evidence already established by the investigating authorities: where the evidence of control comes from, and whether the mnemonic, private key, keystore or wallet.dat has been effectively extracted and verified; whether the on-chain tracing report merely shows that funds passed through a certain address, or has already been corroborated against devices, login IPs, KYC and chat instructions; whether the real-name person at the exchange and the actual operator are the same; and whether the so-called "knowledge" comes from confessions, or from abnormal prices, frequent transactions, third-party payments, circumvention of risk controls, instructions from superiors, user complaints and the profit structure.
If the person concerned is merely an ordinary trading user, the focus is usually on the trading background, price, frequency, purpose of the transaction and explanation of the source of funds. If he is an OTC trader or USDT merchant, the focus shifts to the source of orders, whether the payer and the coin buyer are the same person, whether collection and payment are made on behalf of others, whether fraud-related funds are involved, whether there is long-term professionalized trading, and whether there are abnormal high prices or abnormal remuneration. If he is a platform employee, how the platform itself is characterized is one layer of the issue, and whether the individual constitutes a joint crime is another layer; the authority and sources of income of technical, operations, customer service, finance, business, agency, risk control and management personnel cannot be discussed as if they were all the same.
The same is true from the victim's perspective. Where virtual currency has been stolen, defrauded or lost through investment, it is not enough to hold up a screenshot from the chain and say "the coins were transferred away." What is more useful is to organize the transaction hash, addresses, platform accounts, chat records, payment records, clues to the counterparty's identity, reporting materials and the platform assistance-in-investigation path into a chain of facts that the case-handling authorities can understand. What is difficult in coin-related cases is not understanding a few crypto-industry terms, but placing the coin flow, fund flow, identity flow and information flow back into the same case structure.
What materials should family members and enterprises now verify?
The lessons this paper offers to family members, enterprises and persons involved in cases are very concrete: virtual-currency-related cases are no longer a question of whether "the public security authorities understand coins," but rather a situation in which electronic data forensics, on-chain analysis, exchange assistance in investigations, determination of wallet control and disposal of property involved in the case all enter the case at the same time.Rather than asking in general terms "will there be a criminal sentence," it is better first to clarify the evidence-collection and seizure actions that have already occurred in the case.
First, verify the extraction process for electronic data. Whether mobile phones, hard drives, computers and hardware wallets were lawfully seized, sealed and recorded in written records; if the original storage media were not seized, whether on-site extraction or online network extraction was used; and from which device, which app, which chat record, which image OCR or which file path the virtual currency addresses, mnemonics, private keys and wallet files mentioned in the forensic report were extracted. In particular, for "suspected mnemonics" and "suspected addresses" automatically identified by tools, it is necessary to see whether there was subsequent verification; automatic mining results cannot be directly treated as established facts of the case.
Second, verify whether the evidence of control is complete. The paper specifically reminds us of the problems of watch-only wallets, cold wallets, multi-signature wallets and hardware wallets, all of which may change the determination of control. Finding only a watch-only wallet may mean only that the balance can be viewed, not that transfers can be authorized; finding only an internet-connected phone does not necessarily mean the cold wallet has been found; finding only a hardware wallet does not necessarily mean the PIN code and the companion app are known; finding only a keystore file does not necessarily mean it has been decrypted; finding only a wallet.dat file does not necessarily prove actual control and historical transfers. Control is not a screenshot of an address, but a set of devices, keys, authorizations, logins and transaction records that can corroborate one another.
Third, verify the scope of proof of the on-chain tracing report. On-chain analysis can show where the coins came from and where they went, and which contracts, cross-chain bridges, aggregators, exchanges or mixing services they passed through, but it usually cannot by itself prove the person's subjective knowledge. Lawyers should examine whether the report distinguishes direct transfers, authorized transfers, contract interactions, cross-chain transfers and intra-platform accounts; whether it explains the relationship among the source of fees, the first activated address, exchange hot wallets and KYC accounts; and whether it connects on-chain addresses with mobile devices, chat instructions, bank card statements, server rentals, domain names or backend permissions.
Fourth, verify the seizure and freezing pathways for the virtual assets involved in the case. The paper identifies three common pathways: physical seizure of storage media or hardware wallets; custody by public security authorities at or above the county level in dedicated accounts or multi-signature wallets; and entrusting a qualified third-party institution to assist with custody. Another more common practical pathway is to send letters to centralized exchanges such as Binance, Huobi, and OKX to freeze accounts. The points of contention differ across pathways: physical seizure turns on whether the private keys were actually controlled; transfer to a dedicated wallet turns on address verification, dual-person operation, and the source and destination of funds; exchange freezing turns on the documents, duration, renewal of freezing, and platform cooperation; and third-party custody turns on the agreement, inventory checks, and the boundaries of responsibility.
Fifth, pay attention to procedural risks in the disposal of property involved in the case. Virtual asset prices are highly volatile, and delays in disposal may give rise to valuation disputes; unclear source and destination may give rise to disputes over quantity and responsibility; custody by case-handling personnel themselves may give rise to disputes over abuse of power and procedural defects; and if the parties do not know how the assets were transferred, who holds them, or how the quantity was confirmed, this may also affect their right to be informed and their right to appeal or complain. The professionalism of crypto-related cases is precisely reflected in these details.
How do technical leads become criminal evidence?
Virtual asset cases are easy to misjudge because they are cloaked in a strong technical veneer. Addresses, hashes, private keys, mnemonic phrases, contract logs, exchange KYC, freezing documents, and seizure records all look highly professional. But criminal cases ultimately still have to answer a few plain questions: who controlled the assets, who issued the instructions, who knew the funds were abnormal, who profited from them, and how the property involved in the case entered, circulated through, and was brought under control.
Both case handling and defense must avoid two misconceptions: first, treating the anonymity of virtual assets as overly mysterious; second, treating the conclusions of on-chain analysis as overly absolute. Seeing an address does not equal proving control; seeing a transfer does not equal proving knowledge; seeing coin mixing or cross-chain activity does not equal automatically constituting money laundering; seeing real-name registration at an exchange does not equal the registered person being the actual operator; and seeing virtual assets frozen does not equal the absence of disputes in the disposal of the property involved in the case.
The work of crypto-related criminal defense is to break technical leads back down into evidentiary questions: what the coin flow, fund flow, device flow, identity flow, and information flow each prove, to what extent they prove it, where something is merely a lead, and where it can already corroborate other evidence.In many cases, the room to maneuver is opened up precisely in these details.
If you or a family member have already encountered criminal issues involving virtual assets, USDT, OTC, exchange account freezing, theft of virtual assets, illegal payment-settlement schemes and money laundering, aiding information network criminal activities, concealment and disguise, illegal business operations, fraud, or similar matters, do not just look for a definitive answer online. More importantly, promptly organize the case stage, the case-handling authority, the accounts involved, transaction hashes, wallet addresses, chat records, exchange records, seizure and freezing materials, and the individual's role. Under different factual structures, the assessment of a case may be completely different.
Mankun Law Firm has long focused on criminal risks in Web3 and digital assets and can assist parties, family members, and enterprises in breaking down complex facts and identifying the legal issues that truly need to be addressed. If you have questions related to crypto-related criminal cases, account freezing, theft of virtual assets, or judicial assistance requests from exchanges, you may also contact Mankun Law Firm for further communication.
/ END.
*This article is an original article ofMankun Law Firmand represents only the personal views of the author. It does not constitute legal consultation or legal advice on any specific matter. For reprinting and legal consultation, please add our customer service:mankunlawyer。
