Crypto Fraud Lawyers: Criminal Defence & Blockchain Traceability
When Bitcoin becomes evidence. Technical defence and blockchain forensics in crypto scams, ICOs, and NFTs
Crypto-asset scams —rug pulls, fraudulent ICOs or crypto Ponzi schemes— are prosecuted as fraud under Arts. 248 or 249 of the Spanish Criminal Code (CP) and, where they exceed 50,000 euros or affect a large number of people, as aggravated fraud (Art. 250 CP), punished with imprisonment of 1 to 6 years and a fine, rising to 4 to 8 years where the amount defrauded exceeds 250,000 euros (Art. 250.2 CP); where a criminal organisation is involved, the offence of Art. 570 bis CP is added. Where the money moves through exchanges or wallets to conceal its origin, money laundering (Art. 301 CP) is added, with imprisonment of 6 months to 6 years, and where the tax evaded exceeds 120,000 euros, the tax offence under Art. 305 CP. Our defence provides blockchain traceability expert evidence to establish the lawful origin of the funds and to challenge the digital chain of custody of the police tracing.
You have been reported for a cryptocurrency scam: what happens now
These cases usually start with a private criminal complaint from a group of investors and are investigated as fraud. If there was prior deception that induced the transfer of funds, the provision is Art. 248 CP, with six months to three years in prison; if the transfer was obtained through computer manipulation or an unauthorised transfer of assets, it is Art. 249.1.a CP. Where the amount defrauded exceeds 50,000 euros or affects a large number of people, Art. 250.1.5 CP applies, with one to six years in prison and a six to twelve months fine. In parallel, the court usually orders asset-freezing measures over accounts and wallets, and much of the financial outcome of the case is decided there.
What to do (and what not to do) before making a statement
- Do not make a statement without a lawyer or explain the trading on your own. Arts. 118 and 520 LECrim protect silence and a prior confidential meeting with your lawyer. With crypto-assets, an improvised technical explanation usually locks in a version that the expert evidence later cannot sustain.
- Preserve the full on-chain trail. Addresses, transaction hashes, exchange statements, emails with investors and contracts. The difference between an investment loss and sufficient deception is proven through traceability, and that trail is public and verifiable.
- Do not move funds or close accounts after the complaint. Any subsequent transfer is read as concealment and can open a separate case for asset concealment or money laundering. If you need to operate, do so with the court's knowledge through your lawyer.
- Do not promise refunds or sign acknowledgements of debt. A document signed under pressure from investors is later produced as an admission of the deception. Repairing the harm can be a very valuable mitigating factor, but it is arranged procedurally and with advice.
- Prepare the defence against asset freezing from day one. Art. 589 LECrim requires the judge to demand sufficient security and, if it is not posted, to attach sufficient assets. Challenging a disproportionate figure or offering substitute security is usually the first real battle of the case.
Cryptocurrency Fraud: Bitcoin, NFTs & DeFi Under Criminal Law
The cryptocurrency frauds integrate a rapidly expanding criminal category that is reconducted to several types of the Criminal Code depending on the specific conduct: aggravated fraud and computer fraud (Arts. 248-250 CP), money laundering (Arts. 301-302 CP), offence against the Public Treasury (Art. 305 CP) when the tax evaded by concealing capital gains exceeds EUR 120,000, and, where applicable, corporate offences (Arts. 290-297 CP) in projects articulated through instrumental legal entities. Supreme Court case-law and the Criminal Chamber of the National High Court have progressively set criteria on electronic evidence, digital chain of custody and blockchain expert assessment. The EU Regulation MiCA (2023/1114), fully applicable since December 2024, has completed the European regulatory framework, requiring specific licences for crypto-asset service providers.
The typical modalities in this sector are diverse and constantly sophisticated. Fraudulent ICOs and IDOs (Initial Coin/DEX Offerings): token sales with a white paper promising non-existent technology or utility, multi-million fundraising and disappearance of the promoters. Rug pulls: sudden abandonment of a crypto, NFT or DeFi project by its developers after draining the liquidity pool. Crypto Ponzi schemes disguised as yield-farming or staking platforms paying interest with new-investor money. Market manipulation in NFTs through wash trading, pump and dump and abusive bot trading. Specialised phishing for wallet drainers emptying victim wallets. Impersonation of real exchanges and platforms with cloned domains and applications. And crypto mules: people recruited with fake job offers to receive and forward criminal funds.
The penalties in the crypto-fraud field can be severe due to real concurrence. Aggravated fraud (Arts. 248, 249 and 250 CP) is punished with prison from 1 to 6 years and a fine, and with 4 to 8 years where the amount defrauded exceeds 250,000 euros (Art. 250.2 CP); membership of a criminal organisation or group is punished separately (Arts. 570 bis and 570 ter CP). Money laundering (Art. 301 CP) adds prison from 6 months to 6 years and a fine of one to three times the value of the assets. The tax offence (Art. 305 CP) for concealment of crypto capital gains carries prison from 1 to 5 years and a fine of one to six times the amount evaded. To custodial penalties is added the confiscation of crypto assets, frequently amounting to millions of euros, the professional disqualification, criminal-record registration and reparative civil liability in favour of investor victims. The criminal liability of the legal entity (Art. 31 bis CP) may be activated against instrumental companies used in the fraud.
The technical defence and private-prosecution strategy articulate several lines. When representing the investor victim, we execute forensic blockchain traceability with specialised experts to follow fund flows through wallets, mixers, cross-chain bridges and exchanges; we request urgent precautionary measures to freeze funds in regulated exchanges through judicial order under KYC; we coordinate with foreign authorities via Eurojust and MLAT when funds cross jurisdictions. When defending the investigated for alleged laundering or fraud, we articulate the certification of lawful origin of funds (tax documentation, inheritances, asset sales), the mistake or ignorance in recruited crypto-mule cases, the expert challenge of the traceability chain presented by the prosecution and the voluntary tax regularisation under Art. 305.4 CP in tax-concealment cases.
In current forensic practice we observe sustained growth in crypto-asset criminal proceedings, with particular intensity in illegal Forex/CFD-type platforms with misleading marketing addressed to retail investors, memecoins with coordinated manipulation on social media, celebrity-linked NFTs and DeFi platforms with smart-contract vulnerabilities maliciously exploited. The EU Regulation MiCA (2023/1114), the EU Travel Rule Regulation (2023/1113) on crypto-asset transfers and Act 11/2021 on measures to prevent and combat tax fraud (which extended the Form 721 reporting duty to virtual currencies held abroad) have transformed the regulatory framework. At Alonso Sala we tackle each file with a multidisciplinary team combining economic criminal law, blockchain technical expertise and MiCA regulatory knowledge, articulating a technically solid and procedurally active defence or prosecution.
BLOCKCHAINForensic Blockchain Traceability
The blockchain doesn't lie: every transaction is recorded forever. We coordinate with blockchain-analysis experts to follow the fund flow from the scammer's wallet to the exchange where it was converted to fiat. This tracing is key both for recovering funds (victim) and dismantling the accusation (accused).
Transaction tracking through multiple wallets, mixers, and exchanges
Exchange KYC: judicial order to obtain holder identity
Precautionary fund freezing on exchanges before withdrawal
ART. 301Crypto Money Laundering
Using crypto to launder money from drug trafficking, corruption, or tax fraud is one of the most prosecuted crimes. Police have advanced blockchain traceability tools. Our defence focuses on proving the lawful origin of funds and challenging the police tracing chain of custody.
See more about Money LaunderingWhy Alonso Sala for Crypto Fraud?
- Blockchain traceability experts.
- Applications for court-ordered freezing of funds on crypto-asset platforms.
- Defence in crypto tax crimes: Form 721 and regularization.
- Private prosecution for victims of rug pulls, ICOs, and Ponzi schemes.
Cybercrime in Spain: Hacking, Phishing & Digital Fraud — Defence Guide
Cybercrime encompasses illegal access to computer systems (Art. 197 bis CP), computer damage and ransomware (Art. 264 CP), phishing and digital fraud (Art. 249.1.a CP), and the production or distribution of hacking tools (Art. 197 ter). Spain's prosecution of cybercrime has intensified dramatically, with specialised units in the National Police (BIT) and Guardia Civil (GDT) leading investigations. Defence requires a unique combination of criminal law expertise and advanced technical knowledge.
Penalty Table: Cybercrime
| Offence | Article | Description | Penalty |
|---|---|---|---|
| Illegal access to systems | Art. 197 bis | Unauthorised access breaching security measures | 6 months – 2 years |
| Interception of data | Art. 197 bis.2 | Intercepting non-public data transmissions | 3 months – 2 years |
| Production/supply of hacking tools | Art. 197 ter | Creating or distributing tools designed for cybercrime | 6 months – 2 years |
| Computer damage (basic) | Art. 264.1 | Deleting, damaging or making data inaccessible | 6 months – 3 years |
| Aggravated damage (critical infrastructure) | Art. 264.2 | Affecting essential services or critical infrastructure | 2 – 5 years prison |
| Cyber fraud (phishing) | Art. 249.1.a | IT manipulation to obtain unlawful transfer of assets | 6 months – 3 years |
Key Defence Strategies
IP Attribution Challenge
An IP address does not identify a person. Shared Wi-Fi networks, VPNs, Tor exit nodes and NAT configurations mean multiple users may share one IP. The prosecution must prove the accused was the actual user at the relevant time.
Chain of Digital Custody
Digital evidence is extremely fragile. If the police failed to image the hard drive with a write-blocker, if hash values don't match, or if evidence was handled improperly, the defence can seek exclusion of the entire digital evidence chain.
Authorised Security Testing
Ethical hacking and penetration testing carried out with the system owner's authorisation is legal. If the defendant had a written engagement contract, bug bounty agreement or responsible disclosure policy, there is no criminal offence.
Lack of 'Breaching Security Measures'
Art. 197 bis requires that security measures were breached. If the system had no password, no firewall, or the access point was public, the element of 'breaching security' may be absent, negating the offence.
Key Case Law
The Supreme Court confirmed that 'access' requires effectively entering the system, not merely attempting it. The prosecution must prove: (1) access occurred, (2) it was unauthorised, and (3) security measures were breached. Port scanning alone does not constitute the offence.
The Court ruled that ransomware attacks may constitute a concurrent offence of computer damage (Art. 264) and extortion (Art. 243 CP). The encryption of data satisfies the 'damage' element even if data is technically recoverable upon payment.
In phishing operations, the Court distinguished between the organiser and the 'money mule' (account holder). The mule's liability depends on proof of knowledge that the funds were illicit. Wilful blindness may suffice, but mere negligence does not.
Crypto Fraud FAQs
Is investing in crypto legal in Spain?
I was scammed with crypto, can I recover the money?
What is a 'rug pull'?
Is Bitcoin used for money laundering?
What is a fraudulent ICO?
I'm accused of laundering for using an exchange?
What are 'crypto mules'?
Can tax authorities track my crypto?
What about fraudulent NFTs?
What is the penalty for crypto fraud?
Looking for a Cryptocurrency Fraud Lawyer in Spain?
As a national firm, we offer specialized criminal defence in cryptocurrency fraud, crypto laundering, fraudulent ICOs, and NFTs. We combine legal knowledge with forensic blockchain traceability.
Need urgent criminal defence?
Contact our specialist criminal defence lawyers. We evaluate your case confidentially.
Tools for your case
We also serve
View all locations →This page is for information purposes only and does not constitute legal advice: every case requires individual assessment. How this content is produced and verified: editorial policy.
Do you need specialised legal assistance?
The judicial system is complex. We have the criminal-law specialisation and technical resources required to take on the defence.