Seizure and Freezing of Crypto Assets in Spanish Criminal Proceedings (Art. 127 et seq. CP)

The seizure and freezing of crypto assets has become a central feature of criminal proceedings with an economic dimension — money laundering, investment fraud, cybercrime or trafficking — precisely because of the ease with which cryptocurrencies move and are transformed. The Spanish Criminal Code governs this deprivation of assets in Articles 127 to 127 octies CP, which are not a penalty in the strict sense but an accessory consequence aimed at ensuring that crime does not pay. As criminal defence lawyers specialised in crypto-asset confiscation, we explain each limb of the measure, how the asset is secured during the investigation and the available lines of defence.

What Confiscation of Crypto Assets Is

Confiscation is the permanent loss, to the State, of the effects, assets, means, instruments and proceeds derived from an offence. Applied to cryptocurrency, it means that the convicted person definitively loses the digital assets linked to the criminal activity. Its nature matters: it is not a custodial penalty or a fine, but an accessory consequence whose rationale is to prevent the offender from keeping the economic benefit of the crime.

Its most relevant feature in the crypto world lies in Article 127 CP itself: confiscation reaches the proceeds whatever transformations they may have undergone. It makes no difference whether the funds have gone from bitcoin to a stablecoin, from there to euros and then to real estate: the measure pursues the value throughout the entire chain of transformations. This commitment to following the money, combined with the global and decentralised nature of crypto assets, explains why confiscation is today one of the most significant tools in the criminal response to technology-enabled economic crime.

It is worth drawing, from the outset, a distinction that is often blurred. Freezing is a precautionary and reversible measure operating during the investigation so that the assets are not dissipated; confiscation is the substantive and definitive consequence which, save for the cases in Article 127 ter CP, is tied to a judgment. The former secures a possible outcome; the latter makes it permanent.

Direct Confiscation (Art. 127 CP)

Article 127 CP contains the ordinary limb: the confiscation of the effects, assets, means, instruments and proceeds derived from an intentional offence, including crypto assets. As a general rule, it requires a prior conviction and proof of the link between the assets and the criminal act. It covers both the proceeds (what was obtained through the offence) and the instruments used to commit it, for example the devices or wallets used to channel the funds.

In the crypto context this distinction has practical consequences. The proceeds are the digital assets generated by the criminal activity — what was collected in an investment fraud, the laundered funds, the payment received for an unlawful service. The instruments are the means used to commit the offence, which may range from computer equipment to particular wallets or accounts on exchange platforms. The court must give reasons for the link between each asset and the offence; confiscation cannot extend automatically to the whole of the convicted person's estate by the mere fact of the conviction.

Extended Confiscation (Art. 127 bis CP)

Article 127 bis CP allows the court to go beyond assets directly tied to the offence being tried. In cases involving a closed list of offences — including money laundering, terrorism, corruption, serious computer offences or drug trafficking — the court may confiscate the convicted person's assets and proceeds where, on the basis of well-founded objective indicia, it concludes that they derive from criminal activity and the person concerned does not prove their lawful origin. This limb is especially sensitive in opaque crypto holdings, where justifying the source of funds becomes decisive.

The provision lists indicia that the court may weigh, such as the disproportion between the convicted person's estate and their lawful income, or the concealment of ownership through interposed structures. This is not, however, a full reversal of the burden of proof: extended confiscation requires reasoning grounded in solid indicia and leaves the person concerned the opportunity to prove the legitimate origin of crypto assets that may stem from old purchases, from mining activity or from fully documented transactions.

Confiscation Without Conviction (Art. 127 ter CP)

Article 127 ter CP governs autonomous confiscation, which may be ordered even where no conviction is handed down. It applies only in listed situations — death or illness preventing the person from being tried, a state of absconding (rebeldía), or exemption from criminal liability — and requires the unlawful financial situation to be established in adversarial proceedings, with full defence guarantees. It is an exceptional mechanism, not an ordinary route for depriving someone of assets outside a trial.

The point of this limb is that the impossibility of trying the person should not translate into the impossibility of stripping the offence of its benefit. Even so, the legislator surrounds autonomous confiscation with safeguards: it must be conducted in proceedings with genuine adversarial debate, in which those affected — the person themselves where possible, their heirs or third-party holders — may make submissions and prove the lawful origin of the crypto assets. Without that proof of the unlawful financial situation, confiscation without a conviction cannot succeed.

Confiscation of Assets Transferred to Third Parties (Art. 127 quater CP)

Cryptocurrency is easily transferred to relatives, companies or front men, which is why Article 127 quater CP allows the confiscation of assets transferred to third parties, or their equivalent value. The test is subjective and protective: it applies only where the third party acquired the assets knowing their unlawful origin or where a diligent person, in their circumstances, would have had reason to suspect it. The bona fide third party who could not reasonably suspect the criminal source falls outside confiscation and may appear in the proceedings to defend the lawfulness of the acquisition.

In the crypto world this scenario is common: platform accounts in the name of relatives, transfers between wallets controlled by different people, or acquisitions of crypto assets by investors unconnected to the scheme. The third party's position calls for a careful analysis of what they knew or could have known at the time of acquisition, and the law affords them a procedural avenue of their own to assert their good faith. It is not enough, therefore, for an asset to appear in a third party's name for it to be automatically safe or, conversely, for it to be confiscable without more.

Securing and Freezing (Art. 127 octies CP)

Confiscation would be of little use if the assets vanished during the investigation. That is why Article 127 octies CP provides for securing the assets: from the very first steps, the court may seize or freeze the assets, instruments and proceeds and place them in deposit. The provision even authorises their early realisation or provisional use and forms the basis for the confiscation of equivalent value where the physical asset cannot be recovered.

In practice, securing crypto assets calls for careful technical execution:

• Transfer to a judicial wallet controlled by the authority, using the private keys or seed phrases found on devices, physical media or custody services.
• Blocking of funds at the exchange or platform holding the assets, by judicial order.
• Preservation of the digital chain of custody, documenting the discovery, the seizure and each transfer, to forestall a later challenge.

Traceability, Laundering and Valuation

The confiscation of crypto assets almost always rests on a traceability expert report on the blockchain that seeks to link the addresses (wallets) with the person under investigation and with the criminal origin of the funds. Two issues recur:

• Attribution of the wallets. A blockchain address does not, on its own, equate to a person's identity; shared wallets, custodial services and mixing techniques make direct attribution difficult.
• Valuation of the asset. The extreme volatility of cryptocurrency requires a reasoned choice of the relevant value and reference moment, which affects both the confiscation of equivalent value and the amount of any laundering.

Confiscation also tends to appear intertwined with the offence of money laundering: cryptocurrency is at once the object of the laundering and the proceeds subject to confiscation, which requires precisely delineating which assets correspond to the conduct being tried and which are sought to be confiscated through the extended route. A rigorous defence cannot confine itself to disputing the criminal classification; it must keep a close eye on the financial dimension of the proceedings, because that is where the real reach of the deprivation of assets is decided.

Lines of Defence

The defence against the seizure and freezing of crypto assets is built on verifiable lines, without anticipating outcomes:

• Proof of the lawful origin of the funds, decisive against the extended confiscation of Article 127 bis CP, through documentation of acquisition, mining, trading operations or declared returns.
• Breaking the link between the assets and the offence, where no established connection exists between the seized cryptocurrency and the act being tried.
• Challenging the traceability report and the attribution of the wallets to the person under investigation.
• Protecting the bona fide third party (Art. 127 quater CP), proving ignorance and the reasonable impossibility of suspecting the unlawful origin.
• Proportionality of the securing and of any early realisation, together with the defence of the digital chain of custody and the lawfulness of the evidence.

Each matter calls for its own technical and legal analysis, coordinating the criminal strategy with financial and forensic expert evidence, and with the utmost discretion.

Criminal Defence in Crypto-Asset Confiscation

The criminal-law firm Alonso Sala, based in Madrid (calle Velázquez 27) and acting throughout Spain, takes on the defence against confiscation and freezing measures over cryptocurrency in proceedings for money laundering, investment fraud and cybercrime. We analyse whether the requirements of Articles 127 to 127 octies CP are met, the traceability of the assets and the position of affected third parties, and we design a rigorous evidential strategy. You can read more about this service on our page on seizure and freezing of crypto assets.