From a Ukrainian lawyer to the FBI: how to accompany international cryptocurrency fraud cases

Cybercrime and cryptocurrency fraud cases demonstrate that a modern lawyer’s work is no longer confined by national borders. A victim in the United States may communicate with a perpetrator through a messenger and purchase cryptocurrency on a US exchange, while only minutes later the assets pass through dozens of addresses across multiple jurisdictions.

Statistics from the US Federal Bureau of Investigation clearly demonstrate the scale of these crimes. According to the Internet Crime Complaint Center (IC3), it received 1 008 597 reports of suspected internet crime in 2025. The total losses reported by victims reached nearly USD 21 billion — 26% more than the previous year.

The FBI separately identifies crimes involving virtual assets. In 2025, IC3 received 181 565 such reports, with victim-reported losses exceeding USD 11 billion. Cryptocurrency investment fraud caused the greatest financial losses among individual categories: USD 7.2 billion in a single year.

It is important to understand that these figures represent cases and losses reported by victims. They do not mean that a court has already established that a crime occurred or determined the final amount of loss in every case. Nevertheless, even these figures show the scale of the problem facing US law-enforcement authorities today. This raises a practical question: what can a Ukrainian lawyer do when the victim is in the United States and a potential investigation falls within the jurisdiction of US law enforcement?

This was precisely the type of case we discussed during a podcast with US attorney Arkady Bukh. In my practice, I have received requests from US citizens who became victims of cryptocurrency fraud. These cases show that a Ukrainian lawyer’s role need not be limited to legal advice. A substantial part of the initial work can be conducted remotely: documenting the circumstances, preserving digital materials, analysing transactions and preparing a structured information package for the competent authority. Subsequent procedural steps remain the responsibility of the authorities in the relevant country and, where necessary, local attorneys. This model most realistically reflects what a Ukrainian lawyer can do in international cases.

After discovering fraud, a victim often focuses on one question: how to recover the money. For the work that follows, however, it is more important first to preserve the information needed to reconstruct the course of events.

It is necessary to establish when and under what circumstances the first contact with the perpetrator occurred, which names and accounts were used, which messengers or websites carried the communications, and where the funds came from and were sent. In a cryptocurrency case, this also means collecting wallet addresses, transaction identifiers (hashes), the type of crypto asset, the amount of each operation, the date and time of each transaction, and information about exchanges and other services through which the assets passed.

This approach is consistent with the FBI’s own recommendations. In cryptocurrency fraud reports, the Bureau asks victims to provide the fullest possible transaction information: cryptocurrency wallet addresses, the type and amount of cryptocurrency, the operation’s date and time, and the transaction hash. A lawyer’s first task is therefore to turn the client’s fragmented information into a clear structure for a future investigation. See also how to check a transaction by TxID.

Victims commonly make the mistake of treating cryptocurrency as a completely anonymous way to move funds. Transactions on public blockchains leave a digital trail. Given a starting address or hash, it is possible to trace the entire route of the assets, identify related wallets and locate points where they interacted with centralised services. This is where legal and technical work intersect. After a victim contacts us, we always conduct a technical analysis of the cryptocurrency’s movement. The primary objective is to reconstruct the asset route and identify addresses and services that may be relevant to a subsequent investigation.

Blockchain analysis alone will not reveal a perpetrator’s name because wallet addresses are pseudonymous. The situation changes fundamentally, however, when assets reach a centralised exchange. That service may hold the user’s KYC data, login history, IP addresses and device information. Access to these data depends on the jurisdiction, the service’s legal status and the appropriate procedural mechanism. In this situation, a technical report helps show law enforcement where key evidence may be found.

The second stage begins with the legal organisation of the information obtained. First, the client executes the documents required for legal assistance and representation within the lawyer’s authority. A chronology of events, a description of the fraud mechanism, and a list of identified persons, accounts, telephone numbers, email addresses, domains and other digital identifiers are then prepared.

The blockchain analysis may be prepared as a separate appendix, identifying the initial transactions, subsequent asset movements and services discovered. This structure serves a practical purpose: an investigator does not have to begin with dozens of Telegram screenshots, photographs of banking operations and a disorganised list of cryptocurrency addresses. Instead, the investigator receives a coherent account of the case and technical data that can be verified.

At the same time, it is important not to conflate a private inquiry with formal evidentiary procedures. The conclusions of a lawyer or private specialist do not replace FBI investigative measures, court procedures or the official acquisition of information from US and foreign companies. The purpose of this work is to identify directions for further investigation and preserve the initial data. See also the step-by-step guide to recovering stolen cryptocurrency and what to do when an investment platform will not release funds.

The Internet Crime Complaint Center, or IC3, collects reports of cybercrime in the United States. The FBI recommends that victims of cryptocurrency fraud submit a complaint through IC3 or contact the appropriate local FBI field office as soon as possible.

One detail is particularly important for legal practice: the IC3 form accommodates situations in which another person submits a report on the victim’s behalf. In that case, the form separately records the details of the victim and the person submitting the information for them. This allows a lawyer to help a client prepare a report that includes the facts and technical information required for an initial assessment from the outset. Submission to IC3 does not, however, automatically open a federal criminal investigation. IC3 receives and analyses reports, then forwards relevant information to FBI field offices, other law-enforcement agencies and regulators for further action where appropriate. The competent US authorities make the subsequent decision.

In our practice, materials prepared for cases involving US victims have been submitted to the FBI and the matters have progressed further. An individual positive outcome, however, must not be treated as a guarantee that every report will receive the same response.

After receiving funds, perpetrators may rapidly transfer assets between addresses and use multiple blockchains, exchange services and other tools to make tracing more difficult. The FBI therefore recommends reporting cryptocurrency fraud immediately and providing the most complete transaction data possible. If analysis shows that funds reached a service capable of identifying its user, law enforcement gains a specific point from which to proceed.

A lawyer must nevertheless manage the client’s expectations carefully because tracing asset movement and recovering funds are different tasks. Blockchain analysis may establish the route of the funds, but it does not itself give a lawyer the power to freeze another person’s wallet, obtain KYC data or seize assets. Depending on the jurisdiction and circumstances, this may require action by an exchange, law-enforcement authority, prosecutor or court.

We do not replace the FBI and cannot guarantee that a US investigation will begin. Our role is to ensure that, by the time the competent authority is contacted, the case consists not merely of an allegation that cryptocurrency was stolen, but of a chronology, preserved digital data, identified transactions and legally structured materials. In cases where funds cross several national borders within minutes, the quality of this initial work often determines how clearly law enforcement can identify the next step.