You open your wallet and see that assets have been transferred to another address without your authorisation. The incident may stem from a phishing link, malware, a fake application or a compromised exchange account. In the first hours, securing the remaining assets and preserving evidence should be treated as parallel priorities.
In brief: The fact that a blockchain transfer can be traced does not mean that the assets can automatically be recovered. Addresses, transaction hashes, platform logs and security records can nevertheless be important for identifying the route of the assets and investigating the person responsible. Acting promptly and preserving reliable records is critical.
Immediate security steps
Do not reopen a suspicious link or continue using a device that may be compromised for sensitive account access. Use a trusted device to change relevant credentials and, where an exchange account is involved, contact the platform through its official support channel to request account protection, termination of active sessions and preservation of logs.
Anyone who knows a wallet’s seed phrase or private key may be able to control the assets. Do not disclose these credentials to anyone claiming to be a bank employee, platform representative, recovery specialist or lawyer. If technical intervention is required, consider whether it could alter evidence or put remaining assets at further risk.
Records to preserve
- The blockchain network, sending address and receiving address.
- The transaction hash, date, amount and asset for each unauthorised transfer.
- Exchange or platform account statements and security notifications.
- The URL of any fake website, messages and redirect links used.
- Records showing how and when the assets were originally acquired.
- The time the incident was discovered and reference numbers for reports made to platforms or banks.
A wallet address may have the same format on different networks, so the network itself should also be recorded. Keep original files as well as screenshots and save accessible blockchain explorer links. A private key or seed phrase should never be attached to a complaint as evidence.
How to describe the incident in a criminal complaint
Explain why the transaction was unauthorised and provide a clear chronology: which link was opened, where an application was downloaded from, whether an authentication message was received and when control was lost. Do not present technical assumptions as established facts if you cannot verify them.
The legal characterisation may differ depending on the method used and can involve offences concerning information systems, fraud or other conduct. The application can identify specific records that should be obtained from platforms or service providers. A complainant does not need to know the offender’s real identity before reporting the incident.
What if the assets reached an exchange?
If there is a reasonable indication that a receiving address belongs to a platform, a report can be made through that platform’s official channel. Whether the platform can disclose account information or restrict assets depends on its rules and on requests from competent authorities. A blockchain analytics attribution is not the same as final identification of the individual controlling an account.
Intermediary addresses, pooled wallets and transfers across networks can complicate attribution. Where a foreign service provider is involved, international cooperation and the applicable legal framework may also become relevant.
Criminal investigation and compensation are separate questions
Investigating the offender, locating the assets and determining from whom compensation may be claimed are different issues. If liability of an exchange or service provider is alleged, account security, the contractual framework, how the incident occurred and the provider’s conduct must be assessed. It cannot be assumed that a platform must reimburse every loss.
Frequently asked questions
If the transfer is visible on-chain, is recovery guaranteed?
No. Visibility of a transaction and the practical or legal ability to control the assets are different matters.
Should I pay a “recovery service” in advance?
Be particularly cautious where someone guarantees recovery, asks for private keys or demands another crypto transfer to “unlock” the assets. Recovery scams can create a second loss.
Is it worth preserving evidence if the amount is small?
Yes. The same address or method may be connected with other incidents, and any later application will be easier to assess if reliable records have been retained.
DISCUSS YOUR CASE
Discuss legal options after crypto theft
We can review transaction identifiers, wallet activity and the timeline of events to assess your options under Turkish law.
A brief summary and important dates are enough for an initial enquiry. Send documents only when requested by our lawyers, through the channel they specify. Do not share passwords, one-time codes or wallet keys.
Sources and legislation
Turkish Criminal Code No. 5237
Code of Criminal Procedure No. 5271
Capital Markets Board (SPK): Crypto-asset service providers and current lists
Originally prepared on 8 September 2026. This article provides general information on Turkish law. Remedies and deadlines should be assessed against the documents and circumstances of each case. The image is illustrative.
Related reading
I Cannot Withdraw Funds from a Crypto Exchange
I Sent Money to a Fake Crypto Investment Platform
Related practice area: Crypto Assets & Blockchain Law.