The legal Attribution of stolen cryptocurrencies It is steadily gaining in importance with the increasing prevalence of Bitcoin, Ether, and other digital assets. In particular Phishing attacks regularly lead to the loss of significant crypto assets, without the application of classic property law mechanisms of the German Civil Code.
The article examines the following using a practical case study: Civil and criminal law grounds for claiming the return of stolen cryptocurrencies, the role of Blockchain as evidence as well as the practical limits of enforceability. The focus is on claims under the law of unjust enrichment pursuant to Section 812 Paragraph 1 Sentence 1 Alternative 2 of the German Civil Code (BGB), tortious liability issues, and the problem of personal attribution in pseudonymous wallet structures.
Legal challenges with stolen cryptocurrencies
Cryptocurrencies enable the decentralized management of substantial assets without intermediaries. At the same time, new forms of asset theft have emerged, particularly phishing, hacking, and social engineering attacks. Victims regularly face the problem of legally attributing stolen assets. Cryptocurrencies are not subject to traditional property rights. can be done.
There Cryptocurrencies are not things within the meaning of § 90 of the German Civil Code (BGB)., Claims for restitution under property law are excluded. Instead, recovery is achieved functionally through instruments of contract and tort law. This article analyzes the legal basis for attributing stolen cryptocurrencies, the claims available to the injured party, and the significance of blockchain as evidence.
Facts: Phishing and theft of cryptocurrencies
A is a private investor and held Bitcoin and Ether with a total value of approximately €75,000 in a self-managed wallet. The private keys and seed phrase were exclusively A known.
In January 2025, it was received A A deceptively authentic-looking email from an alleged crypto service provider. Under the pretext of a security check, A He was asked to verify his wallet via a provided link. In good faith, he gave A He entered his seed phrase there. Shortly afterwards, all his cryptocurrencies were transferred to several unknown wallets without his consent.
A portion of the cryptocurrencies was subsequently transferred to an account with a European trading platform that collects Know Your Customer (KYC) data. The account holder is... B. It is unclear whether B was involved in the phishing attack himself or merely received and forwarded the cryptocurrencies. A He demanded the release of the cryptocurrencies or compensation and filed a criminal complaint for fraud.
Key legal issues surrounding stolen cryptocurrencies
The case raises several fundamental legal questions:
- Cryptocurrencies defy the classic property law classification (§ 90 BGB).
-
Control over private keys establishes only de facto, not legal, dominion.
-
The legal classification is functionally based on the legal grounds for acquiring the power of disposal.
-
In the absence of property law claims for restitution, the law of unjust enrichment is of central importance.
-
Acquiring cryptocurrencies in good faith is impossible.
-
Blockchain data is legally valid, but it does not replace personal identification.
-
Criminal law primarily serves to identify perpetrators and secure evidence, not to reverse the proceedings.
Civil claims in cases of stolen cryptocurrencies
Claim under Section 812 Paragraph 1 Sentence 1 Alternative 2 of the German Civil Code (BGB).
A claim based on unjust enrichment requires that the defendant has obtained something without legal justification at the expense of the claimant.
B has gained a financial advantage through the receipt of the cryptocurrencies. This was achieved at the expense of [the other party]. A, since the transfer took place without his effective consent. There is no legal basis, as the seed phrase was obtained through deception and there was no effective disposition of the A is given.
The claim is for the return of the obtained cryptocurrencies or, if these are no longer available, for compensation for their value. Practical enforceability depends significantly on whether the receiving wallet is subject to the claim. B can be legally attributed.
Tort claims
Tort claims pursuant to Section 823 Paragraph 2 of the German Civil Code (BGB) in conjunction with Section 263 or Section 263a of the German Criminal Code (StGB) are only possible if B was involved in the phishing operation himself or at least intentionally contributed to the damage.
Has B If cryptocurrencies are merely received or forwarded without knowledge of their illegal origin, tort liability is generally excluded. In these cases, claims based on unjust enrichment remain the only recourse.
Exclusion of acquisition in good faith
Acquisition in good faith analogous to Sections 932 et seq. of the German Civil Code (BGB) is excluded, as cryptocurrencies are not tangible property. Even with multiple transfers, the original illegality of acquisition remains. Any recipient without legal basis can, in principle, be held liable for restitution or compensation.
Criminal law classification
Under criminal law, fraud (§ 263 of the German Criminal Code) or computer fraud (§ 263a of the German Criminal Code) are particularly relevant. Filing a criminal complaint primarily serves to identify the perpetrators, secure evidence, and, if necessary, confiscate the proceeds of the crime.
The recovery of the cryptocurrencies, however, does not occur within the criminal proceedings themselves, but rather through civil claims. Criminal law thus serves a supplementary function.
Blockchain as evidence in crypto theft cases
Blockchain technology offers a complete and immutable transaction history. Transfers can be technically traced and documented with absolute certainty. This data carries significant evidentiary weight in civil proceedings.
However, for a claim to be successful, it is also necessary to link the respective wallet to a natural or legal person. This is regularly done using KYC data from trading platforms, IP addresses, communication histories, or other external evidence.
European and international connections
The European MiCA regulation obliges crypto service providers to comply with extended due diligence and transparency requirements. However, it does not create an independent legal framework for classifying cryptocurrencies as assets.
In cross-border cases, additional questions arise regarding the applicable law, the international place of jurisdiction, and the enforceability of civil claims.
Expert opinion result
-
claim of the A against B The conditions of § 812 para. 1 sentence 1 alternative 2 of the German Civil Code (BGB) are generally met.
-
Enforceability depends on the personnel assigned to the receiving wallet.
-
Tort claims exist only if the B in the phishing operation.
-
Acquiring cryptocurrencies in good faith is impossible.
-
Blockchain data has evidentiary and indicative value, but does not replace attribution.
-
Criminal law primarily serves to clarify the facts, not to reverse the outcome.
Conclusion
The legal Stolen cryptocurrencies are not attributed based on ownership., but functionally based on the legal grounds of acquiring control. The law of unjust enrichment constitutes the central civil law mechanism for recovery in phishing attacks. Blockchain provides valuable evidence, but cannot replace personal accountability.
The existing legal system is fundamentally suitable for responding to crypto thefts. In practice, however, the reversal of transactions often fails due to the pseudonymous structure of decentralized systems. In the long term, the development of an independent legal doctrine for digital assets seems advisable.
FAQs – Frequently Asked Questions on the Legal Classification of Stolen Cryptocurrencies
No. Cryptocurrencies are not considered property under Section 90 of the German Civil Code (BGB). Therefore, property law does not permit the assignment of ownership, and consequently, traditional claims for restitution are not applicable.
The legal classification is functionally based on the legal grounds for acquiring the power of disposal, not on ownership. The decisive factor is whether the recipient obtained the cryptocurrencies without legal justification.
Yes. The central recovery mechanism is the claim under the law of unjust enrichment pursuant to Section 812 Paragraph 1 Sentence 1 Alternative 2 of the German Civil Code (BGB), provided that a personal attribution of the wallet is possible.
Section 812 of the German Civil Code (BGB) is the most important legal basis for claims, since, in the absence of ownership of the property, no vicarious claims exist. It allows for restitution or compensation for value in cases of unlawful acquisition.
No. Acquisition in good faith analogous to Sections 932 et seq. of the German Civil Code (BGB) is excluded, as cryptocurrencies are not tangible property. Subsequent purchasers can also be liable under the law of unjust enrichment.
No. Liability requires that the recipient obtained the cryptocurrencies without legal justification. Tortious liability only exists if there is knowledge of or participation in the act.
No. The blockchain provides an immutable transaction history with high evidentiary value, but it does not replace the assignment of the wallet to a specific person.
KYC data from trading platforms is crucial for linking wallets to natural persons. Without this linkage, the practical enforcement of civil claims often fails.
Criminal law primarily serves to identify perpetrators and secure evidence. The recovery of cryptocurrencies is generally not handled through criminal proceedings, but rather through civil law.
In theory, yes. In practice, however, the reversal of transactions often fails due to the pseudonymous structure of decentralized systems. In the long term, an independent legal doctrine for property law is being discussed.
