Important NOTE: Beware of the fake website finanzforensik.com — officially only under finanz-forensik.de. Registered at Hanau District Court, HRB 100521.
Important NOTE: Beware of the fake website finanzforensik.com — officially only under finanz-forensik.de. Registered at Hanau District Court, HRB 100521.
Why technical transaction analyses alone will no longer be sufficient in the future — with an in-depth look at the criminal procedural asset protection and confiscation from the perspective of the injured parties, current case law from Germany, the UK and the USA, as well as chapters on smart contracts, NFT, RWA tokenization, MiCA and the new professional profile of the digital asset forensic expert.
Whitepaper 2026
Executive Summary
Blockchain forensics in the narrower sense refers to the technical analysis of transaction data on one or more blockchains. Digital Asset Forensics (Digital Asset Forensics) also encompasses the economic, civil, criminal and regulatory classification of digital assets — including smart contracts, NFTs, tokenized real assets, criminal asset protection and the requirements of MiCA.
The term is not yet standardized and is deliberately used here as a working term for a development that has long since begun in practice.
A blockchain exclusively documents technical events: which wallet signs, when, which cryptocurrency and in what amount, which fees, which blockchain. Not documented The analysis will determine who owns the assets, the legal basis for their transfer, whether the transfer was valid, whether the transferor was authorized to dispose of them, and whether any civil claims remain valid. This is precisely where purely technical blockchain analysis ends.
Possession of the private key does not automatically make one the owner. Possession initially only establishes the technical ability to access a wallet. Whether this results in a right of ownership depends, among other things, on contractual agreements, custody and trust arrangements, company assets, inheritances, insolvency proceedings, and criminal asset transfers (fraud, theft, phishing, hacking). Therefore, future expert opinions must more clearly distinguish between technical control, economic allocation, and legal ownership.
OLG Braunschweig, Decision of 18.09.2024 – 1 Ws 185/24. An IT administrator retained the 24-word seed phrase when setting up a wallet and later transferred approximately 25 million tokens belonging to the victim to his own wallets. The Higher Regional Court upheld the lifting of an asset freeze of nearly €2.5 million and rejected charges of theft (§ 242 of the German Criminal Code), espionage (§ 202a of the German Criminal Code), computer fraud (§ 263a of the German Criminal Code), and data manipulation (§ 303a of the German Criminal Code).
This case demonstrates that blockchain technology does not recognize rights of disposal in the legal sense, but only cryptographically verified capacity to dispose of assets. Remarkably, with the denial of the predicate offense, the procedural safeguards under Section 111e of the German Code of Criminal Procedure (StPO) also collapsed—without a predicate offense, there can be no asset seizure, and without asset seizure, there can be no subsequent disbursement to the victims (discussed in more detail in Chapter 14).
The real question is often not "Where did the cryptocurrencies go?" but "Did this also change ownership?" — a crucial question in recovery scams, investment fraud, wallet hacks, ransomware, insolvency and attachment proceedings, asset forfeiture and criminal asset protection, as well as inheritance, divorce, and company sale situations. Experts will increasingly need to assess whether a transfer of ownership may have occurred and what claims remain.
Initial situation. A victim loses 2.0 BTC to a supposed "recovery service" — a classic recovery scam. Redirect. The perpetrators exchange the BTC for USDT via ChangeNOW on the Tron network and deposit it into an account on the HTX trading platform. Access. The investigating authorities identify the HTX account and freeze it by way of an asset seizure.
The central question: Is the frozen USDT holding legally still the same asset as the 2.0 BTC — and how can it be returned to the victim? This example accompanies the article through chapters 7, 13, and 14.
One of the biggest changes is the increasing use of exchange and swap service providers (including ChangeNOW, FixedFloat, SimpleSwap, SideShift, and Exolix). These enable virtually any combination of blockchains and cryptocurrencies—giving rise to entirely new forensic questions.
An asset remains economically identical. Technically, however, a change of blockchain takes place. For the blockchain forensic expert, this means that tracking does not end at the deposit of the exchange service—it must continue on a different blockchain.
The situation becomes even more complex with the actual asset exchange. Here, the legal question arises for the first time: Is there merely an economic transformation? Or is a new asset actually created? This question can have significant implications for claims for restitution, damages, attachment, insolvency, and asset forfeiture.
In practice, both often occur simultaneously. Several technical processes take place at once: deposit, internal exchange, liquidity provision, withdrawal, blockchain swap, and asset transfer. To outsiders, this often appears to be an interruption in the traceability. In reality, however, this is often where the actual forensic work begins—in the practical example from Chapter 3, precisely the transition point where the Bitcoin trail ends at the ChangeNOW deposit address and must be continued on the Tron blockchain to the HTX account.
Previous blockchain assessments focused on linear money flows. Today, there is an increasing need to evaluate so-called asset transformations: coin swaps, token swaps, wrapped assets, bridges, layer-2 transfers, liquid staking tokens, token migrations, and stablecoin conversions. The blockchain merely illustrates the technical process; the legal classification must be provided by an expert.
Blockchain bridges also significantly alter traditional tracking. In some cases, entirely new transaction chains emerge. While the economic identity of an asset may remain intact, several different tokens exist technically. These differences can be relevant both technically and legally.
Today, a wallet often no longer transfers directly to another wallet, but interacts with smart contracts — DeFi, lending, staking, liquidity pools, DAOs. The blockchain then only shows the transaction. Wallet → Smart Contract. The economic impact lies in the program code. Without analyzing the called contract functions, the protocol logic, and—where available—the source code, the meaning of a transaction often cannot be fully understood.
CFTC v. Ooki DAO, ND Cal., June 8, 2023. The court classified the DAO as a "person" under the Commodity Exchange Act and thus as a liable, unincorporated association—resulting in a fine of approximately $643,542 and a permanent ban on operating its website. This marks the first court ruling that a DAO can be held liable.
Van Loon v. Dept. of the Treasury, 5th Cir., November 26, 2024. Tornado Cash's immutable smart contracts are not considered "property" under US sanctions law (IEEPA); OFAC exceeded its authority. The Treasury Department lifted the sanctions in spring 2025.
For experts, this means that wallet attribution and transaction analysis alone are no longer sufficient for DeFi. A protocol and smart contract analysis is required that understands what a contract achieves—and legally classifies to whom claims, interest, or shares are attributable.
NFTs are primarily associated with digital art in the public sphere—a marginal aspect from a forensic perspective. More relevant is the fact that NFTs can technically represent any type of right: ownership rights to digital or physical objects, memberships, licensing rights, or digital certificates. In every NFT case, the first question is which right the token embodies—and whether it was validly created and transferred.
Osbourne v Persons Unknown & Ors [2022] EWHC 1021 (Comm). Following the unauthorized seizure of two NFTs from the "Boss Beauties" series, the injured party obtained a preliminary injunction in 2022 to secure the NFTs and a disclosure order against the platforms. In EWHC 340 (KB) [2023], service on unknown defendants via a specially minted "service NFT" was permitted. This was one of the first cases worldwide in which a court treated NFTs as an asset capable of being owned.
The tokenization of real-world assets (RWA) is gaining importance—from real estate, gold, and security tokens to tokenized company shares and works of art. On-chain value reached approximately US$32 billion in June 2026 (up from US$11.8 billion a year earlier); tokenized US Treasury securities account for around US$15 billion, and the BlackRock BUIDL fund for approximately US$2.9 billion across multiple blockchains.
With a risk-weighted asset (RWA) token, the question of ownership arises on two levels: Who possesses the token—and who owns the real asset? These two can diverge (issuer insolvency, multiple issuance, deviation from the relevant register). In Germany, the Electronic Securities Act (eWpG) (since 2021) provides a framework for decentralized crypto securities registers (BaFin authorization); the EU DLT pilot scheme complements it. An RWA valuation is incomplete without reconciliation with the relevant register.
With MiCA, Europe has had a unified regulatory regime for crypto assets and their service providers (CASPs) since the end of 2024. So far, only around 210 of the more than 1,200 previously operating providers have received a full license; Germany, with over 50 licensed CASPs, is among the pioneers.
Doubly relevant for digital asset forensics: First Investigative work is shifting from pure blockchain analysis to the evaluation of compliance data from CASPs (KYC, wallet screening, internal risk assessments) — often more informative than the blockchain alone. Secondly Since December 30, 2024, the Travel Rule has been in effect: CASPs must collect and forward information on the principal and beneficiary, generally without a de minimis threshold. In the practical example from Chapter 3, HTX acts as a CASP in this role—the KYC and Travel Rule data stored there regularly provide the grounds for asset seizure under Section 111e of the German Code of Criminal Procedure.
For victims of investment fraud, recovery scams, wallet hacks, phishing, or ransomware, the civil law question of ownership only answers half the story. The crucial follow-up question is: Can the identified crypto assets actually be secured in criminal proceedings and ultimately returned? In German criminal proceedings, there are three legally separate stages between forensic identification and actual repatriation: the Security level (Security or attachment of assets, §§ 111b, 111e, 111f of the Code of Criminal Procedure), which decision-making level (Confiscation order in the judgment, §§ 73 ff. German Criminal Code) and the enforcement level (Disbursement to the victims, §§ 459h, 459k StPO).
In practice, asset seizure for exchange-listed cryptocurrencies is carried out by enforcing the claim for surrender against the exchange as the third-party debtor—not by technically seizing the blockchain address. Due to the volatility, the emergency sale provision (§ 111p of the German Code of Criminal Procedure) is consistently used: The sale proceeds deposited in euros replace the coin. preliminary According to current case law, release to victims under Section 111n of the German Code of Criminal Procedure (StPO) is not possible for crypto assets — restitution only occurs after legally binding confiscation under Section 459h of the StPO; the claim is valid within six months Claims must be filed after notification of the judgment becoming legally binding (§ 459k of the German Code of Criminal Procedure). Additionally, victims can have their claims established in civil proceedings (§§ 403 et seq. of the German Code of Criminal Procedure); the EU Asset Recovery Directive (Directive (EU) 2024/1260) will further strengthen the position of victims.
Cryptocurrency assets held in an exchange wallet were secured through an asset freeze, enforced by garnishing claims against the exchange as the third-party debtor. The court ordered that not specific Bitcoins, but a cryptocurrency worth 7.41598504 Bitcoin be seized—the exchange transferred this value, in the form of Solana, to an official wallet.
At the same time, the court rejected an analogous application of Section 111n of the German Code of Criminal Procedure (StPO): Provisionally seized crypto assets—and their substitutes—cannot be released to victims before a legally binding confiscation order. In the practical example from Chapter 3, this means that after an emergency sale, the victim receives the euro proceeds according to Section 459h Paragraph 2 of the StPO—not the later market value of their 2.0 BTC.
Consequences for expert opinions: An expert report intended to provide a reliable assessment of the ownership situation for victims should in future regularly document whether an asset seizure order (§§ 111b, 111e of the German Code of Criminal Procedure) has been issued or is being considered, how its enforcement (§ 111f of the German Code of Criminal Procedure) is feasible, what consequences an emergency sale (§ 111p of the German Code of Criminal Procedure) has for the identity of the value, which legal basis for confiscation (§§ 73, 73b, 73c of the German Criminal Code) applies, and what the disgorgement process (§§ 459h, 459k of the German Code of Criminal Procedure), including the six-month deadline, looks like. Only then will a technical transaction analysis become a reliable answer to the question that actually interests victims: Will I get anything back — and when?
The valuation of ownership, effective transfer and continuing claims must become an integral part of modern expert opinions — civil law ownership issues, rights of possession and disposal, safekeeping, trusteeship, insolvency and inheritance law, private international law, regulatory requirements, criminal procedural asset protection and confiscation (§§ 111b ff. StPO, §§ 73 ff. StGB, § 459h StPO) and economic considerations.
Cologne Higher Regional Court, Decision of 26 June 2024 – 11 W 15/24. Cryptocurrency assets are subject to seizure—whether on an exchange or in a private wallet—and debtors must, within the bounds of reasonable cooperation, also avail themselves of technical assistance from third parties. Previously, the Higher Regional Court of Düsseldorf (7 W 44/20) and the Regional Court of Heilbronn (Sa 8 O 368/20) classified the transfer as a fungible act under Section 887 of the German Code of Civil Procedure.
FinmadiG (27.12.2024) / KMAG. Since the turn of the year 2024/2025, a special insolvency law for cryptocurrencies has been in effect: According to Section 46i Paragraph 1 of the German Banking Act (KWG), crypto assets and keys generally do not fall into the insolvency estate of a crypto custodian, but are considered to be allocated to the investor.
Traditional blockchain analysis will only answer some of the questions in the future. Additional tools will include: wallet attribution and OSINT, smart contract and protocol analysis, economic analysis and document forensics, contract analysis, regulatory assessment (MiCA, KWG, KMAG), civil law classification, criminal law assessment including asset forfeiture and confiscation, assessment of potential changes in ownership, analysis of cross-chain transactions and asset transformations, and the assessment of international jurisdictions. Only their interplay enables a complete reconstruction.
Anyone wishing to prepare legally sound expert opinions on digital assets needs knowledge in an unusually broad combination: computer science, cryptography, blockchain technology, economics and accounting, civil, criminal and insolvency law, private international law, anti-money laundering, regulatory law (MiCA, KWG, KMAG), and the law of evidence. In practice, this combination is currently the exception—regularly resulting in expert opinions that are either technically impressive but legally incomplete, or vice versa. Digital asset forensics should be recognized and developed as an independent, interdisciplinary profession.
Germany The Higher Regional Court of Braunschweig made the clearest higher court ruling that technical control and criminal assessment are separate; the Regional Court of Verden specified the criminal procedural securing, confiscation and disbursement of crypto assets; the Higher Regional Court of Cologne confirmed the attachability; FinmadiG/KMAG created a special insolvency law. The United Kingdom Established digital assets as a „third category“ of personal property — legally (Tulip Trading, D'Aloia, Osbourne) and legally since December 2, 2025. The USA Celsius, Ooki DAO and Van Loon demonstrated how unclear the classification of program code still is.
Regarding the scenarios described in Chapters 4–9—whether a coin swap, a cross-chain bridge transaction, or an asset transformation constitutes a legal change of ownership or merely an economic conversion—current research indicates that no published supreme or higher court rulings exist. It is precisely the most technically complex and commonplace processes that are least legally clarified.
| country | Court / Legal Act, Date, File No. | Key message |
|---|---|---|
| DE | OLG Braunschweig, 18.09.2024 – 1 Ws 185/24 | Unauthorized token transfer using a known seed phrase does not constitute theft, espionage, computer fraud, or data manipulation; the asset seizure based on this was lifted. |
| DE | LG Verden, Decision (2 Qs 35/25) | Asset seizure and attachment of crypto assets against the exchange as third-party debtor are permissible; no analogous application of Section 111n of the Code of Criminal Procedure — no provisional release to victims. |
| DE | Sections 111b, 111e, 111f, 111n, 111p, 459h, 459k of the Code of Criminal Procedure; Sections 73, 73b, 73c of the Criminal Code | Legal framework for the securing, confiscation and disbursement of assets to victims under criminal procedure; applicable to crypto assets. |
| EU | Directive (EU) 2024/1260 (Asset Recovery Directive) | Obliges member states to implement more effective restitution mechanisms for victims; implementation in Germany is still pending. |
| DE | Cologne Higher Regional Court, 26 June 2024 – 11 W 15/24 | Crypto assets are subject to seizure; the debtor must provide reasonable cooperation, if necessary with technical assistance from third parties. |
| DE | OLG Düsseldorf, 7 W 44/20; LG Heilbronn, Sa 8 O 368/20 (2021) | Transfer of crypto assets is a fungible act; enforcement according to § 887 of the German Code of Civil Procedure. |
| DE | FinmadiG (27.12.2024) / KMAG; Section 46i para. 1 KWG | Crypto assets and cryptographic keys generally do not fall into the insolvency estate of the crypto custodian. |
| EU/DE | MiCA (since 30.12.2024); Travel Rule; eWpG (2021); DLT pilot scheme | CASP licensing requirement; travel rule obligations without de minimis threshold; legal framework for tokenized securities/RWA. |
| UK | Tulip Trading v Bitcoin Association [2024] EWCA Civ 83 | Digital assets form a separate third category of personal property. |
| UK | D'Aloia v Persons Unknown [2024] EWHC 2342 (Ch) | USDT is capable of being owned and is accessible to a constructive trust (lawsuit failed due to lack of tracing evidence). |
| UK | Osbourne v Persons Unknown [2022] EWHC 1021; [2023] EWHC 340 | NFTs are being treated for the first time as assets capable of being owned and protected in court. |
| UK | Property (Digital Assets etc) Act 2025, in force December 2, 2025 | Legal anchoring of digital assets as a third category of personal property. |
| USA | In re Celsius Network LLC, SDNY, January 4, 2023 | Crypto assets in customer accounts became the property of the platform and part of the bankruptcy estate via a transfer-of-title clause. |
| USA | CFTC v. Ooki DAO, ND Cal., June 8, 2023 | For the first time, a DAO is classified as a liable „person“ under the Commodity Exchange Act. |
| USA | Van Loon v. Dept. of the Treasury, 5th Cir., November 26, 2024 | Immutable smart contracts are not a sanctionable "property"; OFAC exceeded its authority. |
Overview of the evaluated decisions and regulations (DE · UK · USA). Research status: July 2026. File numbers and references must be verified in each individual case before use.
A technical blockchain forensic expert reconstructs the path assets have taken, identifying the wallets and service providers involved, the smart contracts invoked, and the asset transformations that occurred. Legal assessment requires legal review; conversely, even a specialized lawyer can rarely reconstruct complex blockchain analyses in a way that will stand up in court. Therefore, demanding cases will likely be handled by interdisciplinary teams in the future: The forensic expert answers "What happened technically and economically?", while the lawyer addresses "What are the legal consequences—both civil and criminal?" Interdisciplinary collaboration is a prerequisite for this—the goal is the development of an independent forensic expert discipline.
„"The blockchain answers the question: What happened technically? Courts also need to know who owned the assets and whether ownership rights have changed."“
Conclusion · Financial Forensics, July 2026
The future of blockchain forensics no longer lies solely in the technical analysis of transactions. It is evolving into an interdisciplinary field of digital asset forensics that combines computer science, blockchain technology, civil, criminal, and regulatory law, as well as economic valuation—supplemented by an independent understanding of smart contracts, NFTs, RWA, criminal asset protection and confiscation, and the MiCA supervisory architecture. Only in this way can legally sound expert opinions be produced that also answer the crucial question for victims: whether and when they will actually receive any compensation. The case law presented demonstrates that this development has long since begun. Digital asset forensics is no longer a vision of the future, but a discipline whose fundamental principles are already evident in court decisions, legislation, and market developments.
The assessment of ownership transfers, claims for surrender, or the consequences of an asset or network change, a smart contract interaction, or RWA tokenization depends on the applicable legal system and the circumstances of the individual case. A technical swap, transfer, or contract call does not automatically lead to a specific legal consequence. The cited case law reflects the state of affairs at the time of publication and may be superseded by more recent developments.
David Lüdtke
Managing Director · OSINT Analyst & Crypto Forensic Expert · Financial Forensics GmbH
Court-admissible crypto transaction analysis, OSINT-based asset investigation, and expert reports for defense attorneys, insolvency administrators, and companies. Certified Crystal Expert (CECF, CEEI, CEUI). Financial Forensics Supports law firms, companies, investigative bodies and insolvency administrators — focus areas: Blockchain forensics, wallet analysis, court-admissible documentation, OSINT.
We reconstruct cross-chain money flows, smart contract interactions and asset transformations in a legally sound manner — and classify them under civil, criminal and regulatory law together with specialized lawyers.
We expressly point out that the website finanzforensik.com [This company] has no business or legal connection to our company. You can officially reach us exclusively at [phone number/email address]. finanz-forensik.de.
We have already filed a criminal complaint and submitted the case to the relevant authorities. You can independently verify who we are at any time: Finanz Forensik GmbH is registered with the Hanau District Court under [number of names missing in original text]. HRB 100521 registered.
We provide you with the complete commercial register extract and our detailed documentation of the process here.
You are currently viewing a placeholder content from Vimeo. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from YouTube. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou need to load content from reCAPTCHA to submit the form. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from Google Maps. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from Vimeo. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from YouTube. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from Instagram. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from Google Maps. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou need to load content from hCaptcha to submit the form. Please note that doing so will share data with third-party providers.
More informationYou need to load content from reCAPTCHA to submit the form. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from Turnstile. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More information