The rise of cryptocurrencies has revolutionized financial transactions, but has also created new challenges for the judiciary and law enforcement. As a law firm specializing in corporate and criminal law, we want to inform you about how criminal investigations are conducted in Belgium when crimes involving cryptocurrencies have been committed.
What are crypto currencies?
According to the legal definition, "virtual currencies" are digital representations of value that are not issued or guaranteed by a central bank or government. They are not necessarily linked to a legally defined currency and have no legal status as currency or money. Nevertheless, they are accepted by natural or legal persons as a medium of exchange and can be transferred, stored and traded electronically.
When we talk about blockchain - the shared digital ledger in which transactions are recorded - we often talk about cryptocurrencies, with bitcoin being the best-known example. According to a Chainalysis report from 2023 only 0.34% of all crypto transactions are related to illegal purposes ($24.2 billion of the $7.6 trillion total by 2023). The vast majority of transactions take place in a legal context.
The paradox of anonymity in cryptocurrency
An interesting fact is the contradiction between the perception and reality of anonymity in cryptocurrencies. Although bitcoin and other cryptocurrencies are often associated with anonymity, in reality this is a misconception. Most blockchains are public, with transactions not encrypted but rather completely transparent.
Ironically, it can sometimes be easier to track an address or transaction on the blockchain than through traditional channels such as banks. When a cybercriminal converts his tokens to traditional currency, the associated account, address and/or bank can be traced, leading to his identity.
In fact, one can even argue that traditional currencies are better suited for criminal activity than crypto-currencies. After all, an exchange of banknotes leaves no trace, unlike an exchange of value on the blockchain that leaves an indelible trail.
However, there are blockchains specifically designed for anonymity, such as Monero. However, these are not used by all criminals, who still often prefer the usability and popularity of bitcoin, ethereum or stablecoins such as USDT.
Why are cryptocurrencies used for criminal activities?
Despite the majority of cryptovaluta transactions being legitimate, criminals may be attracted to their use for a variety of reasons:
Increased anonymity
Cryptocurrencies offer a degree of pseudonymity; transactions are recorded but the link to real identities is not readily apparent.
Decentralization
Cryptocurrencies operate on decentralized networks, requiring no central authority such as a bank or government. This allows criminals to bypass traditional control mechanisms.
Complexity of traceability
Tracking crypto transactions can be made complex by techniques such as "mixing" and the use of specific technologies. A "mixer" (or tumbler) collects multiple transactions and divides them into smaller transactions to different wallets, breaking the linear aspect of transactions and making it more difficult for authorities to track the origin and destination of funds.
Speed of transactions
On the blockchain, money exchanges are handled quickly, usually within a few dozen minutes. With a bank, the validation time can be considerably longer, as it must approve and may need to perform additional verifications. Moreover, crypto transactions can take place 24/7.
Cross-border transactions
Cryptocurrencies enable fast and relatively cheap cross-border transactions, which can be attractive to criminals involved in international illicit activities.
European legislation
MiCA Regulation (Markets in Crypto Assets).
The European Union's MiCA Regulation introduced to legally regulate the crypto market, which is often compared to the Wild West. These regulations include:
- A legal framework for crypto assets, issuers and service providers
- Measures to protect European investors from fraud
- Preventing misuse for money laundering and terrorist financing
- Supporting innovation and adoption of new financial technologies
It was necessary to introduce rules that would better protect Europeans who invested in these assets and prevent the misuse of the crypto sector for money laundering and terrorist financing.
The MiCA regulation became applicable on December 30, 2024.
DAC8 directive
Despite the popularity and growth of the cryptocurrency market, there remains on fiscal area exist a degree of opacity. This, combined with the rapid and volatile nature of transactions, makes it difficult for tax authorities to accurately track the taxable income of crypto users.
The DAC8 directive (Directive on Administrative Cooperation) therefore imposes new reporting obligations on crypto service providers, such as exchanges (including Binance, Kraken, Bitpanda, Coinbase). From Jan. 1, 2026, these providers will have to share detailed information about their users' transactions with the tax authorities of EU member states, which will automatically exchange this information.
Most common financial crimes involving cryptocurrency
Scams involving fraudulent trading platforms
A common form of scam involves fraudulent online trading platforms. The process usually follows a set pattern:
- Victims are attracted through misleading ads on social media, dating sites such as Tinder, or mobile trading applications
- The platforms promise high returns and often use images of well-known personalities without permission
- To inspire confidence, they claim to be regulated by a (fake) financial authority
- A "customer service representative" contacts directly to explain the system and convinces the person to invest
- The victim first receives a small sum of money and sees incredible returns on an online dashboard
- Larger investments encouraged by telephone intermediaries
- The funds are quickly converted into cryptocurrency and transferred to private wallets of the criminal organization
- When the victim wants to withdraw money, all kinds of fees are charged (taxes, guarantees, etc.)
- Eventually, withdrawal is impossible and the investment is lost
After trust is broken, criminals often use an additional tactic to obtain more money: the "recovery room." They approach victims as a so-called insurance company or exchange (such as Binance) to offer help, claiming that only one additional payment is needed to release all their funds.
According to the FSMA victims of such fraudulent platforms have lost more than 15 million euros in the second half of 2024 alone....
Ponzi schemes
A classic example of a Ponzi scheme involving cryptocurrency is One Coin, which became known in Belgium in 2016 due to the alleged involvement of former MP Laurent Louis. One Coin, founded in 2014 by Bulgarians Ruja and Konstantin Ignatova, quickly became popular due to attractive promises of significant financial returns within months for a minimal investment. In a video, Laurent Louis explained that it was "above all a safe and fully guaranteed investment." Two months after promoting the crypto currency, his personal network had nearly 600 members. Worldwide, about three million people got caught up in the One Coin adventure.
Another important example is VITAE.CO, a social media platform and crypto currency that was used by some 223,000 people worldwide. This Swiss-based company, some of whose executive officers lived in the Antwerp region, allowed users to publish messages through a social network whose price was shared between the creator and four other people in the network. In June 2021, the Belgian federal prosecutor's office dismantled this network by conducting searches at 17 different locations in Belgium and Switzerland. Five Belgians were arrested and assets worth more than €2.6 million were seized (cash, cryptos and luxury vehicles). The charges were participation in a criminal organization, fraud and money laundering.
Money laundering
Cybercriminals are becoming increasingly creative in their money laundering processes to avoid tracking funds used. A common method is the "Money Mule," which uses social media or seemingly real job postings to recruit people to funnel money through their bank accounts for a fee.
Criminal organizations deliberately look for a specific profile: young people with lack of money, students and schoolchildren who are unaware of the criminal nature (money laundering) of what they are doing by making their account or bank card available.
Financial "mules" are then contacted via an app such as Telegram to make a purchase in crypto currency. The client sends funds to the mule's bank account, which buys crypto currencies in its own name and then transfers them to a wallet of another financial mule, which in turn sells them for traditional money. Once the money is withdrawn, the mules must send it abroad via wire transfers or through a money transfer service such as Western Union.
The darkweb and Silk Road
The darkweb refers to a part of the Internet that is intentionally hidden and inaccessible through conventional search engines. Access requires a special TOR Web browser that guarantees anonymity and user confidentiality online.
The best-known example of crypto use on the darkweb is Silk Road, one of the first major online marketplaces for illicit trade. Ross Ulbricht founded the site in 2010 after he discovered bitcoin as a solution to the payment problem for anonymous transactions. The site quickly grew to more than 100,000 customers and became notorious as a marketplace for drugs, weapons and other illegal services. Ulbricht made money by taking 7% commission on all transactions. Despite his attempt at anonymity, he was arrested in October 2013 and sentenced to life in prison by U.S. authorities in 2015.
Judicial investigations into cryptocurrency
Blockchain explorers: A practical application
To better understand how investigations work in practice, let's look at a concrete example:
"At the request of a scammer, a victim transfers the equivalent of 10,000 euros, transferred to a bitcoin wallet hosted at BINANCE. The perpetrator then asks to transfer these bitcoins (10,000 euros = 0.13 BTC) to the address: bc1q7cyrfmck2ffu2ud3rn5l5a8yv6f0chkp0zpemf."
The first step in the investigation is to copy the recipient's public address into a blockchain explorer such as "blockchain.com/explorer." Once this address is entered, investigators can immediately see the wallet's balance, a summary of all transactions (total bitcoins received and sent, number of transactions and total financial volume), and the wallet's full history (incoming and outgoing transactions).
This confirms the existence of the transaction, its date and time, and makes it possible to see whether the money stays on the wallet or where it goes. Investigators can also trace the origin of the funds that fed the suspect's wallet.
In another example of money laundering, where a financial intermediary used his Ethereum wallet at Coinbase used to transfer money to a criminal organization, the investigation would begin with a court request to Coinbase. The exchange confirms that the middleman has two wallets (one in USDT and one in ETH) and provides the public addresses hosted by the middleman's wallet.
With this information, researchers can track transactions through an explorer such as Etherscan.io, where they can locate suspicious transactions, track the flow of funds and identify the public keys of the receiving wallets for further investigation.
Specialized software and identification
While blockchain explorers offer valuable insights, they have limitations: they do not reveal the identity of the person who owns the wallet (pseudonymity) and usually do not indicate whether an exchange was used in the transactions.
Therefore, specialized software such as TRM, Chainalysis and CAIN are used in investigations. These tools not only allow for more effective visualization of transactions, but can also identify groups of addresses likely to be used by the same entity through "clustering" techniques.
The wallet holder's identity can then be retrieved with the cooperation of the exchange. By KYC (Know Your Customer) rules, exchanges are required to collect the full identity of an account holder. When an exchange is identified in a transaction, the judiciary can request this information.
Seizing crypto currency
Seizing cryptocurrencies is an important aspect of criminal investigations. If the "seed phrase" (recovery phrase) is discovered during an investigation, authorities can immediately gain control of the crypto currency on a wallet and transfer it.
A "seed phrase" is a recovery phrase, usually consisting of 12 to 24 English words, that can be used to reconstruct the private and public keys of a digital wallet.
The seizure of cryptocurrency can take place under the direction of the investigating judge in the same way as any other seizure. This is done using a requisition addressed to the exchange used or, with some luck, directly upon discovery of the "seed phrase." It is the Central Office for Seizure and Confiscation (COIV/OCSC). which then manages the seizure of crypto assets.
Conclusion
Cryptocurrencies can pose unique challenges to judicial investigations due to their decentralized nature and potential for pseudonymity. However, with the right partnerships, technical expertise and a thorough understanding of blockchain technology, law enforcement can successfully investigate cryptocurrency cases.
The crypto market is constantly evolving, with new crypto currencies continuing to emerge with specific features and use cases. Blockchain technology continues to evolve and find applications beyond digital currencies, such as in real estate, logistics, brand protection, decentralized finance (DeFi) and other sectors.
The challenge for all legal professionals is to stay informed and exercise caution in an ever-changing environment, lest they fall behind criminals who use all available financial products to launder money and commit new forms of fraud.
How our law firm can help you
As a specialized law firm, we can assist you in all legal aspects related to cryptocurrencies:
- Legal advice on compliance with new regulations (MiCA, DAC8)
- Defense on crypto-related crime charges
- Assistance to victims of crypto fraud
- Advice on tax implications of crypto transactions
- Preventive measures to protect you from crypto fraud
- Guidance on investigations involving cryptocurrencies
Dutch 
English