Crypto and digital asset investigations in Italy

Who finds a frozen wallet

Cryptocurrency cases rarely begin with a crime that the owner recognises. They begin with an account that stops working, and the owner learns about the investigation from the platform, not from the police.

Some are ordinary investors. They bought and sold on an exchange, moved coins to a private wallet, and a morning comes when they find their account restricted with a notice that refers to a request from an authority. They have not been told what they are accused of, and many of them have never had any contact with the justice system.

Others sold coins to a buyer they met online, on a peer-to-peer service, and later learned that the money used to pay them came from a fraud. Their position is delicate because they did not take part in the scheme, yet their wallet address now appears in a report that traces funds, and the question is what they knew.

Another situation is the person who invested in a platform or a token that promised returns and then collapsed. Investors are normally victims, but a person who recruited friends, passed on referral links or handled deposits can be treated as a participant.

Another is the trader or small business that accepts payment in digital assets and is asked by a bank to justify the origin of large transfers, then finds that the bank has closed the account and reported the matter. In every case the owner needs to understand quickly what is charged and what has been taken, because the answer decides what can be contested and how soon.

What a frozen wallet does to the household

Digital assets are often held by people who treat them as savings, and a seizure can leave a family without access to funds that were meant for rent, tuition or a business. Unlike a bank balance, a wallet seizure may take the form of an order addressed to an exchange, a seizure of devices, or a demand for recovery phrases, so you may not know which assets are affected until a lawyer reads the order.

Banks react quickly. An account linked to the activity may be closed with little explanation, a mortgage application may be refused, and a business may lose its ability to pay suppliers or staff. Some people discover that their ordinary current account has been restricted because it received transfers from an exchange that is under review. Tax advisers become involved because the way gains were declared, or not declared, can open a parallel line of inquiry.

Devices matter as much as money. A phone and a laptop taken in a search contain messages, photos, work files and authentication apps. Without them, a person cannot log in to email, employer systems or banking, and the practical consequences for work can be larger than the loss of the coins themselves. Foreign residents may find that seized devices contain data in other languages, which slows examination and lengthens the time before return.

There is also a personal cost: partners or relatives who invested alongside, or who lent money, may be drawn in. It helps to speak plainly with them early, before the authorities do.

Decisions that arise as soon as an order is served

Choices recur, and each is easier to take with the order in front of you.

Whether to provide access. When officers ask for passwords, recovery phrases or unlocked devices, handing them over may allow assets to be moved into official custody and returned later, but it also gives the investigators everything on the device, including material unrelated to the case. Refusing may lead to forced seizure of hardware and a longer dispute. The right answer depends on what is on the device, whether you are a suspect, and what the order actually authorises. It should not be improvised at the door.

Whether to explain where the funds came from. An early written explanation, supported by records, can persuade an authority that a transaction was ordinary. It can also lock you into a version that later proves unfinished. A short factual note prepared by the lawyer, with the records attached, is usually safer than a long narrative in your own words.

Whether to challenge the seizure now. Orders of this kind can be contested before a judge, and the time to do so is limited by the law. Waiting to see what the investigation shows can mean losing the opportunity. Challenging immediately reveals your arguments early but can bring assets back sooner. The lawyer needs the order and its date immediately.

Records that explain a transaction history

Blockchain records are permanent, but they say nothing about intention. The task is to supply the context that the ledger lacks, and this means collecting material that can be put in order for a lawyer and, later, for an expert.

• Account statements and downloadable transaction histories from every exchange or platform you used, in the original file format, not as screenshots.
• Wallet addresses, both those you control and those of counterparties, with the dates on which you created or began to use them.
• Identity verification emails and onboarding messages from exchanges, which show that you passed their checks and what you told them.
• Bank records showing money entering and leaving the digital asset world, since the link between ordinary currency and coins is where most questions arise.
• Messages with buyers, sellers, brokers and advisers, including social media chats, which show what you were told and what you believed.
• Invoices, contracts and receipts for any goods or services paid for in digital assets.
• Tax filings and the working papers behind them, so that declared and undeclared activity can be distinguished.
• The freezing or seizure order, with the envelope or email in which it arrived, and a list of devices and accounts affected.

Do not send recovery phrases or private keys to anybody, including your lawyer, unless a lawyer specifically explains why and how they will be protected.

Questions to put to the lawyer about digital assets

People in this position often ask whether crypto is legal. It is, and that is rarely the real question. Better questions follow.

• What exactly is suspected: the origin of the assets, the way they were moved, or an unauthorised activity I may have carried on without realising?
• Is my position that of a suspect, a witness or a person whose property is affected, and could it change?
• Which assets are under the order, and are accounts that were not named also at risk?
• Does the investigation rely on a blockchain expert, and can I appoint my own?
• If a specialist tool linked my wallet to a suspect, how reliable is the link and what can be asked of the person who produced it?
• How does the investigation treat the exchange where I traded, and will it be asked to provide my records?
• Can part of the frozen assets be released for living costs or business needs while the case continues?
• What are the tax consequences of what I am about to explain, and who coordinates with my accountant?

The point of these questions is to find out whether the file contains an actual accusation or only a suspicion generated by a pattern of transfers.

When the exchange, the wallet or the counterparty is abroad

Digital assets cross borders without effort, but investigators do not. A platform registered in another country answers to its own law, and the Italian authorities must ask for records through channels that take time. The effect is that parts of a file can arrive in stages, and an order served on you may refer to material that has not yet been seen.

For the owner, the cross-border element creates several practical difficulties. Records held by a foreign exchange are in its own language and format, and a translation will probably be needed before an Italian expert can use them. Time differences complicate calls with support teams, who may answer slowly or only by form. If the platform is itself under investigation elsewhere, its records may be seized there, and the owner may need to follow a procedure in that country to recover them.

Counsel in both countries is often the sensible arrangement. A lawyer in the country where the platform sits can ask for records, explain local rules about customer data and confirm whether the platform has received a request. The Italian lawyer deals with the order, the investigation and the court. They must share a common account of the facts and agree on what is disclosed to whom, because material given to an authority may travel. Your consulate has no role in the investigation, but can help with certified copies and identity papers. Any foreign tax declaration should be looked at in parallel, since explanations given in Italy will be compared with returns filed abroad.

How the studio works on investigations of this kind

The studio starts with an inventory. In a short call or message, which can be in English, you describe what has been frozen, what has been taken and what papers you have received. You are asked to send the order, the notice from the platform and the main account histories, as files by email. The lawyer reads them before the meeting, so that the opening discussion is about your position and not about reading.

The instruction is formalised in a letter that explains the work, the costs and what the studio will and will not do, and in a power of attorney. The studio then identifies the authority behind the order, confirms what it covers, and tells you whether a challenge is possible and what the deadline is. Where an expert is needed to examine transactions or to question the reliability of a tracing report, the studio proposes a candidate and explains the cost.

Offices in Rome, Milan and Naples allow meetings in person when documents have to be shown. The studio is reachable at any hour for urgent cases such as a search under way. It does not hold or move your assets, it does not advise you to transfer funds, and it does not predict the result of the investigation. It prepares the file so that the explanations you give are consistent, full in substance and supported by documents.

What to leave untouched

Panic produces actions that look sensible and are not. The following should wait for advice.

• Do not move coins from the frozen account or from any other wallet to a new address. Movements after an order can be read as concealment, and they add transactions that an expert must explain.
• Do not use a mixing service or a privacy tool to protect what remains. Using it now will be portrayed as evidence of intent.
• Do not delete accounts, chats or wallets. Deleted material is often recoverable, and the deletion itself becomes a fact.
• Do not agree to a remote request from somebody who claims to be a recovery service. These approaches are common after a freeze and are generally scams.
• Do not publish a message on social media about your losses or the platform. Statements are collected and compared with what you tell the authorities.
• Do not contact other investors or the counterparty to compare stories. Coordinated accounts look like coordination.
• Do not sign an authorisation for an exchange to disclose all your data without a lawyer reading it, since it may be wider than the request.

The common thread is restraint. Each of these actions feels like taking control, yet each adds a fact that the investigators will later have to be told about. Doing nothing for a short while, while the lawyer reads the order, is a decision in its own right and usually the least costly of them.

Terms the order and the platform's letter may contain

Documents from the Italian side use a vocabulary that is easier to follow after the main words are explained.

• Riciclaggio is laundering: replacing, transferring or otherwise handling money or assets from an offence so as to hide their origin. The person must have had no part in the original offence.
• Autoriciclaggio is self-laundering, which concerns a person who committed the underlying offence and then reinvested the proceeds in a way that conceals their source.
• Truffa is fraud, deception that leads somebody to part with property, often the label used for investment schemes.
• Frode informatica is computer fraud, interference with a system or data to gain an advantage, which is how some wallet thefts and account takeovers are described.
• Sequestro is seizure, an order that takes assets or devices out of your control during the investigation, well before any judgment.
• Indagato is a person under investigation. It does not mean guilty, and it triggers rights that a witness does not have.

If a notice mentions a term that does not appear here, send a picture of the page to the lawyer and do not rely on an automatic translation of the Italian. A mistranslated word such as the label of a charge can send a family in the wrong direction for days, and the lawyer can usually tell from the layout of the page which authority issued it and what it asks of you.