Cryptocurrency in insolvency proceedings: How insolvency administrators track down and liquidate hidden wallets
Im Vermögensverzeichnis steht eine Null. Der Schuldner erklärt in der Gläubigerversammlung, er habe nie in Bitcoin oder andere Kryptowährungen investiert. Doch in den beigezogenen Kontoauszügen taucht vor drei Jahren eine Überweisung an eine bekannte Krypto-Börse auf, über 40.000 Euro, danach keine Rückbuchung. Für einen Insolvenzverwalter ist das der Moment, in dem sich eine einfache Frage stellt: Wohin sind diese Coins geflossen, und wie lassen sie sich für die Masse zurückholen?
Cryptocurrencies are increasingly appearing in standard and consumer insolvency proceedings, and they are the easiest asset to conceal. A private key can fit on a piece of paper or in your head. No credit institution will disclose an account balance upon request. Anyone relying solely on information from the debtor risks leaving valuable assets undiscovered and thus inaccessible to creditors.
Finanz Forensik GmbH is a specialized service provider for crypto forensics and financial investigations. We locate hidden wallets for insolvency administrators, secure assets, and deliver court-admissible reports. This article explains how this process works in insolvency proceedings and highlights the typical pitfalls. Crypto forensics.
The most important information at a glance
- Part of the mass: According to Section 35 of the German Insolvency Code (InsO), cryptocurrencies generally belong to the insolvency estate and must be identified and liquidated by the administrator.
- Information is rarely sufficient: The debtor's obligation to provide information and cooperate is the starting point, but it does not replace independent investigation if assets are concealed.
- Blockchain lügt nicht: Every transaction is permanently stored. Address clustering and chain analysis can often be used to reconstruct hidden wallets.
- Securing before disposal: Without the private key, the funds are unavailable. Securing the access data is crucial for success.
- Managing price risk: Between immediate realization under Section 159 of the German Insolvency Code (InsO) and price fluctuations, a documented realization strategy is needed.
Do cryptocurrencies belong to the bankruptcy estate?
Die Ausgangsfrage ist rechtlich klar: Ja. Nach § 35 Absatz 1 InsO umfasst die Insolvenzmasse das gesamte Vermögen, das dem Schuldner bei Verfahrenseröffnung gehört und das er während des Verfahrens erwirbt. Kryptowährungen sind Vermögenswerte, weil sie sich am Markt in Geld umsetzen lassen. Bitcoin, Ether, Stablecoins wie USDT oder USDC und auch NFT-Bestände fallen deshalb in die Masse, unabhängig davon, ob der Schuldner sie in einer eigenen Wallet oder bei einer Börse hält.
Zur Masse gehört auch der sogenannte Neuerwerb. Erzielt der Schuldner während des laufenden Verfahrens Erträge aus Staking, Mining oder aus dem Handel mit Coins, fallen diese Zuflüsse ebenfalls in die Masse. Gerade bei aktiven Krypto-Nutzern lohnt deshalb ein Blick nicht nur auf den Bestand bei Verfahrenseröffnung, sondern auf die laufende Aktivität der zugeordneten Adressen. Auch Werte in ausländischen Wallets sind erfasst, denn die Insolvenzmasse kennt keine Landesgrenzen.
In practice, the distinction based on the custody method is crucial. If the coins are held with a central exchange or custodian, this third party controls the keys, and the administrator can access the funds through a request for information and disclosure. If the debtor uses their own wallet, they alone control the private keys. Without these keys, the funds are visible but cannot be transferred. This is precisely where the actual forensic work begins.
Why hidden wallets so often remain undiscovered in legal proceedings
A bank account can be located through an account inquiry with the Federal Central Tax Office. No such register exists for cryptocurrencies. A self-held wallet leaves no trace in traditional accounting records as long as no inflow or outflow via a bank account is visible. The debtor simply needs to remain silent, and the holdings remain hidden.
Furthermore, many administrators are unfamiliar with the technical approaches or lack the tools to link a blockchain address to a debtor. Simply invoking the general obligation to provide information is of little use if the debtor denies the existence of the wallet. The good news is that every transaction on a public blockchain is irrevocably and permanently recorded. Anyone who knows what to look for can trace this history. This is where pure legal advice and practical investigation diverge.
How we track down hidden wallets
Our investigations follow a fixed procedure that combines legal obligations to cooperate with technical analysis. The goal is always a complete, traceable chain of evidence from the first lead to the actual amount owed.
Step 1: Exhaust all obligations to provide information and cooperate
The starting point is the debtor's legal obligation to provide information and cooperate. They must disclose all information relevant to the proceedings, and this explicitly includes cryptocurrencies, access data, and wallets. If they refuse to provide this information or if there are doubts about its accuracy, the insolvency court can order a sworn statement and, if necessary, impose coercive measures up to and including detention. It is important to specifically ask about exchange accounts, hardware wallets, seed phrases, and email confirmations from crypto services, as blanket questions will be met with a blanket denial.
Step 2: Evaluate bank records and files for crypto traces
Almost every entry into the world of cryptocurrencies involves a fiat payment. We specifically analyze bank statements, credit card bills, and accounting records for payments to exchanges and payment service providers. A transfer to a well-known crypto marketplace serves as the starting point for further analysis. Tax documents and the debtor's email correspondence also provide valuable clues about the platforms used.
Step 3: Blockchain analysis and address clustering
Once a primary address or stock exchange account is known, the actual chain analysis begins. This involves using established methods. forensic methods such as address clustering We assign seemingly unrelated addresses to a common control. Heuristics such as the common-input ownership assumption and the detection of change addresses reveal which wallets actually belong together. This allows us to uncover holdings that the debtor has distributed across multiple addresses and to trace transfers to other wallets.
Step 4: Inquiries with stock exchanges and custodians
If the trail leads to a central exchange, the account holder's identity is usually known there through Know Your Customer (KYC) verification. Through the administrator or with legal support, claims for information and disclosure can be asserted against the custodian. In many cases, the custodian holds assets that the debtor has not declared in their statement of assets. Cooperation with foreign providers is more complex, but often successful through appropriate legal procedures.
Step 5: OSINT and securing data storage devices
In parallel, we analyze publicly accessible sources. Forum posts, social media profiles, trading platforms, and reused usernames surprisingly often lead to a specific wallet. If data storage devices, computers, or smartphones become accessible during the investigation, we forensically secure wallet files, seed phrases, and login credentials, meaning we document the origin of the evidence and ensure its reliability later on. Even deleted files or remnants in browser data frequently still lead to an active wallet.
Security: No access without a private key
Once the administrator has identified a valuable wallet, the work is not yet finished. They must take possession and control of all assets belonging to the estate. In the case of cryptocurrencies, possession means control of the private key. If the coins are held in a self-custody wallet, the debtor must hand over the access credentials. If they do not, technical access without the key is practically impossible. We are familiar with similar challenges from the... Determination of crypto assets in other procedures, for example in the case of a dispute over assets.
As soon as the administrator has access, we recommend immediately transferring the funds to a controlled wallet belonging to the estate, the key to which is securely stored. This prevents the debtor from secretly disposing of the funds using a copy of the key that they still possess. Each of these steps is documented to ensure that it remains traceable when and which amounts came under the control of the estate.
Realization and exchange rate risk in practice
According to Section 159 of the German Insolvency Code (InsO), the insolvency administrator must liquidate the assets immediately after the creditors' meeting. With cryptocurrencies, this requirement is at odds with the sometimes dramatic price fluctuations. If the administrator sells too early, they may miss out on potential capital gains. If they wait too long, they could be liable for losses resulting from a price decline.
We recommend a documented liquidation strategy that manages the price risk. This includes processing the sale through a regulated trading partner, staggering the sale of larger holdings to cushion market fluctuations, and clearly documenting the respective market value at the time of sale. If the holding is particularly significant for the proceedings, obtaining approval from the creditors' committee or the creditors' meeting should also be considered. Justifying and documenting the decision regarding the timing of the sale also protects against accusations of breach of duty.
The court-admissible forensic report
The best investigation is of little use if its findings don't hold up in court. Therefore, we document every step in a report that provides a complete chain of evidence: from the initial lead and the allocation of addresses to the specific credit balance. The report details the methods used, their validity, and their limitations, ensuring it can withstand critical scrutiny by the court, the opposing party, or the creditors' committee.
For insolvency administrators and the law firms they represent, this report serves as the basis for enforcing claims for the release of assets, substantiating challenges to transactions, or justifying subsequent realization. How we deal with Law firms and administrators collaborate, We tailor our approach to each individual case. If coins have already been transferred abroad or via mixers, we will provide support. Repatriation of transferred crypto assets.
Coins deferred before insolvency: the challenge
Often, the coins are no longer in the debtor's wallet when insolvency proceedings are initiated. Shortly before the application, holdings are transferred to relatives, distributed to new addresses, or sold for cash. For the insolvency administrator, this is not a reason to give up, but rather an opportunity to consider the possibility of challenging the transaction in insolvency proceedings. If an asset was given away without equivalent consideration during the critical period before the application, or if a creditor was given preferential treatment, the administrator can demand its return.
However, challenging a transaction requires proof of the transfer. Blockchain analysis provides the crucial evidence in this regard. Using the transaction history, we demonstrate when and which amounts flowed from the debtor's address to which recipient address, and we trace the recipients back to a specific individual as accurately as possible. This documented payment flow forms the factual basis for the legal claim for restitution.
Cross-border cases, mixers, and DeFi
Nicht jeder Fall endet bei einer einfachen Wallet. Schuldner nutzen Mixing-Dienste, um die Herkunft von Coins zu verschleiern, verteilen Bestände über mehrere Blockchains oder parken Werte in DeFi-Protokollen und Smart Contracts. Auch diese Wege sind analysierbar. Mixer hinterlassen statistische Muster, Cross-Chain-Bridges erzeugen nachvollziehbare Transaktionspaare, und Guthaben in Smart Contracts lassen sich über die zugehörigen Adressen aufdecken.
It is crucial for the administrator to identify such situations early, as they influence the investigative effort and the prospects for asset recovery. Nationwide, we respond within one business day because every day counts when transfers are already underway. Once an asset is distributed across multiple chains and services, the effort increases with each additional step.
Securing hidden crypto assets for the masses
Cryptocurrencies elude traditional asset valuation, but not forensic analysis. Those who use the right tools early on when suspicions arise can transform a blank line in the asset register into real value for creditors. We support insolvency administrators nationwide in tracking down hidden wallets, securing holdings, and realizing their value in a legally compliant manner. Describe your case to us via our Contact form, telefonisch unter +49 6057 9189145
oder per E-Mail an postfach@finanz-forensik.de. Wir melden uns innerhalb eines Werktages mit einer ersten Einschätzung.
FAQ: Frequently asked questions about cryptocurrencies in insolvency proceedings
Yes. Under insolvency law, all of the debtor's assets, including cryptocurrencies, belong to the insolvency estate. Because Bitcoin, Ether, stablecoins, and similar assets can be converted into money on the market, they have value and must therefore be identified and liquidated by the insolvency administrator. This applies regardless of whether the coins are held in a personal wallet or on an exchange.
First, the debtor's duty to cooperate is examined, along with the evaluation of bank statements showing payments to cryptocurrency exchanges. If the debtor denies the existence of a wallet, forensic blockchain analysis can help: Address clustering and the evaluation of public sources allow addresses to be assigned to a person and undisclosed holdings to be reconstructed. Subsequently, requests for information from exchanges can confirm the debtor's identity.
Yes. The debtor's obligation to provide information and cooperate also includes access data, seed phrases, and private keys. If the debtor refuses to hand them over, the insolvency court can order a sworn statement of assets and impose coercive measures, up to and including imprisonment. Without the private key, funds in a self-held wallet are technically unusable; therefore, this pressure is often crucial.
If the coins are held on a central exchange, the exchange controls the private keys. The administrator can access the funds through a right to information and disclosure, because the exchange typically knows the owner through its Know Your Customer (KYC) verification process. Often, funds are found there that were not declared in the asset register. With foreign providers, the process is more complex, but often still feasible.
Insolvency law requires the immediate liquidation of assets, which creates a dilemma when prices fluctuate. A documented liquidation strategy is advisable: selling through a regulated trading partner, staggered sales of larger holdings, and clear documentation of the market value at the time of sale. Justifying and documenting the decision regarding the timing of the sale protects against accusations of breach of duty.
Yes, in the case of particularly significant legal transactions. If the crypto holdings are substantial to the proceedings, the administrator should seek approval from the creditors' committee or the creditors' meeting. This provides backing for the liquidation decision and is an important safeguard, especially with volatile assets. The administrator can sell smaller holdings as part of their ordinary administration.
In many cases, yes, although it requires more effort. Mixing services, cross-chain bridges, and DeFi protocols obscure the origin but leave behind statistical patterns and traceable transaction pairs. Such movements can often be reconstructed using specialized analytical methods. The key is to act early, because traces within the international network become increasingly difficult to follow over time.
Blockchain data is immutable and permanently stored, making it a strong evidentiary basis. Crucially, the presentation of this data is key: a forensic report must fully document the chain of evidence, identify the methods used, and disclose their validity and limitations. This ensures it can withstand critical scrutiny by both the court and the opposing party. We document every step of the analysis to guarantee the admissibility of the results in court.
The effort required depends on the complexity of the case, such as the number of addresses, the use of mixers, and any international aspects. Generally, the effort is clearly proportionate to the assets uncovered, as even a single proven wallet can significantly increase the total amount. An early, brief initial assessment is advisable to determine whether a more in-depth analysis is worthwhile for the specific case.
Immer dann, wenn es konkrete Hinweise auf Kryptowährungen gibt, die Angaben des Schuldners aber unvollständig oder zweifelhaft erscheinen. Zahlungen an Börsen in den Kontoauszügen, widersprüchliche Auskünfte oder Hinweise auf Auslandsvermögen sind klassische Anlässe. Je früher wir hinzugezogen werden, desto besser lassen sich Bestände sichern, bevor sie verschoben werden. Für eine erste, unverbindliche Einschätzung genügt ein kurzes Gespräch unter +49 6057 9189145 or postfach@finanz-forensik.de.
