Criminal Defence for Crypto Asset Seizure and Freezing

Crypto asset seizure is a new legal scenario combining classical criminal procedure institutions (real precautionary measures, seizure, restitution) with the technical particularities of blockchain networks: private key custody, value volatility, transaction irreversibility. Both prosecution and defense must navigate this terrain with specialized technical advice for the seizure to be legally solid and economically effective.

Seizure Modalities

Direct seizure (Art. 127 CP) operates on crypto assets that are object or proceeds of the offense: for example, Bitcoin received in a scam or used in a bribery payment. Extended seizure (Art. 127 bis CP) affects assets acquired previously if there is disproportion with the convict's lawful income and a serious offense has occurred (drugs, terrorism, corruption, money laundering). Third-party seizure (Art. 127 quater CP) falls on crypto assets transferred to a third party who knew or should have known their illicit origin: typically, nominee family members or third-party wallets used for concealment.

Custody and Valuation

Custody is the most delicate point. Three options exist: (1) Immediate conversion to fiat and consignment in judicial deposit account: protects against volatility but materializes losses if the asset appreciates; (2) Custody in institutional wallets under court or ONIF control, preserving the crypto asset; (3) Delegated custody in an accredited exchange under judicial order. The choice must be documented with technical and financial criteria, not improvised.

Precautionary Attachment and Timing

Before definitive seizure —which requires a judgment— the process allows the precautionary attachment of crypto assets (Art. 589 LECrim) to secure civil liability and an eventual seizure. Effectiveness depends on timing: when assets are at an exchange with seat or representation in Spain, a judicial order can immobilize them quickly; when they are in self-custodied wallets, material immobilization is unfeasible and the measure is redirected to a prohibition to dispose and to criminal liability for concealment.

Restitution to the Victim

Seizure does not always benefit the State: when there is an identified victim, the crypto assets —or their converted value— are allocated to restitution as ex delicto civil liability. The victim's defense should appear early so that their assets are not diluted among other creditors and to participate in the decisions on custody and timing of conversion, which directly affect the amount they will recover.

Criminal Classification of the Conduct and Sentencing Framework

Confiscation of crypto-assets is never an end in itself: it presupposes that an underlying offence has been charged, and the precise classification governs both the penalty and the intensity of the asset measures. Where digital assets stem from deception used to obtain a transfer of property, the conduct fits the basic fraud of Article 248 of the Criminal Code, or its computer-fraud variant under Article 249.1.a) when a technical manipulation effects a non-consented transfer. If an aggravating factor is present —exceptional gravity by amount, abuse of personal relationships or an organised structure— the classification shifts to Article 250.1, and to its hyper-aggravated form in Article 250.2.

Channelling illicit funds through wallets, mixers or exchanges to conceal their origin falls under money laundering in Article 301, punishable by six months to six years of imprisonment plus a fine, while the negligent form in Article 301.3 carries six months to two years. Evading tax through undeclared crypto-assets triggers the tax offence of Article 305 (one to five years) or, above the qualified threshold, Article 305 bis (two to six years). Correctly pinning down the applicable offence is the first line of defence, because it conditions limitation, jurisdiction and the reach of extended confiscation.

Limitation Periods and the Window for Prosecution

Limitation is often the most decisive defensive argument in crypto-asset cases, where the underlying events may date back years and an on-chain trail can revive dormant investigations. Article 131 of the Criminal Code sets the periods according to the maximum penalty attached to the offence: where the maximum does not exceed five years, the period is five years; where it exceeds five years, the period is ten; and minor offences punished by a fine become time-barred after one year. There is no intermediate three-year band, so any calculation must start from the maximum penalty of the specific offence.

Applied to the usual figures: the fraud of Articles 248 and 249.1.a) is time-barred after five years, whereas the aggravated fraud of Articles 250.1 and 250.2 is time-barred after ten. Intentional laundering under Article 301 is time-barred after ten years given its six-year maximum, while negligent laundering under Article 301.3 is time-barred after five. The tax offence of Article 305 is time-barred after five years and its qualified form in Article 305 bis after ten. Verifying the starting date, any interruptions caused by procedural acts and the existence of a continuing offence is essential, because a properly established limitation extinguishes liability and, with it, the basis that sustains any confiscation.

Investigation Stage, Competent Court and Forensic Expert Evidence

Criminal proceedings for economic offences involving crypto-assets run through the preliminary stage of the abbreviated procedure or, in the most complex and high-value matters, through the ordinary summary procedure. The investigation falls to the Investigating Court of the place of commission and, where the fraud spreads beyond a single judicial district or shows a cross-border, organised dimension, it may draw the jurisdiction of the National Court. It is at this stage that protective asset measures are ordered, the digital estate is attached and custody of the private keys is decided —a critical moment for the defence.

The decisive evidence is usually expert in nature: tracing transactions on the blockchain, attributing addresses to a person and quantifying flows all rest on forensic reports. The defence must scrutinise the traceability of the digital chain of custody, the reliability of the on-chain analysis tools and the strength of the link between a public address and a specific holder, since mere statistical correlation is not authorship. A court weighs the expert evidence under the rules of sound judicial reasoning, testing it against the rest of the material; a rigorous counter-expert report can neutralise attributions presented as conclusive and prevent the valuation of volatile assets from being fixed at an artificially unfavourable moment.

International Cooperation, Corporate Criminal Liability and Plea Agreements

The global nature of crypto-assets makes international cooperation a structural element of these cases. The European Investigation Order, letters rogatory and freezing and confiscation certificates allow assets held on foreign exchanges to be located, immobilised and recovered, while coordination with authorities in third States conditions the success of any securing measure. For the defence, this scenario opens fronts: the cross-border chain of custody, the lawfulness of evidence obtained in another jurisdiction, and the proportionality of measures imposed on assets whose ownership or lawful origin has not been established.

Where the conduct occurs within a company —a platform, manager or digital intermediary— the criminal liability of the legal person under Article 31 bis of the Criminal Code may be engaged, with exemption or mitigation available where an effective organisation and prevention model was in place. Demonstrating the adequacy of the compliance programme and diligence in anti-money-laundering matters is therefore a defence avenue in its own right. In parallel, a well-negotiated plea agreement can reduce the sentence, order restitution and shape the scope of confiscation, while cooperation through repairing the harm or regularising the tax position operates as a mitigating factor. Distinguishing, moreover, when a dispute admits an administrative or civil response rather than a criminal one prevents criminalising what belongs to a different jurisdiction.