{"id":1469,"date":"2026-10-15T10:20:34","date_gmt":"2026-10-15T08:20:34","guid":{"rendered":"https:\/\/sentinelegal.ch\/?p=1469"},"modified":"2026-10-18T15:24:14","modified_gmt":"2026-10-18T13:24:14","slug":"stolen-crypto-switzerland-recovery","status":"publish","type":"post","link":"https:\/\/sentinelegal.ch\/en\/stolen-crypto-switzerland-recovery\/","title":{"rendered":"Stolen Crypto in Switzerland: Can You Get It Back?"},"content":{"rendered":"

In short.<\/strong> Stolen crypto is not automatically lost. Every transfer recorded on a public blockchain stays visible. Recovery becomes realistic when the funds still sit with an exchange that knows its customers, or in a token its issuer can freeze, and an authority has them frozen in time. A freeze is not yet a refund: you then have to link the funds to the offense and establish your right to them, sometimes against other victims. Everything happens within days, sometimes hours. And no genuine process asks you to pay to “release” your money.<\/p>\n

Your wallet shows zero. The “technical support” agent who walked you through a screen-sharing session yesterday no longer answers. Or the investment platform where you placed CHF 40,000 shows superb returns, but refuses any withdrawal until you pay an “unlocking fee”.<\/p>\n

You are far from alone. In 2025, the Swiss Federal Office for Cybersecurity (FOCS) received 65,675 reports across all categories, 55.5% of them about attempted scams. In the United States, the FBI put reported losses involving cryptocurrency at USD 11.4 billion, across all types of fraud. The money has left your control. It has not necessarily vanished. What happens next depends on where it stopped, and on how fast an authority can reach it.<\/p>\n

What to do if your crypto is stolen: the first hours<\/h2>\n

Within the hour, cut any remote access (AnyDesk, TeamViewer, or whatever app you were told to install “for support”) and change the passwords of your email and your exchange accounts. Then tell two situations apart. If you only signed a token approval for an unknown contract, revoke it and move what is left to a new wallet created on a clean device. If you gave away your recovery phrase (usually 12 or 24 words), treat the wallet as compromised: a bot can drain anything that arrives in it, including the gas you would send to rescue the balance. Send nothing to it without specialist advice. Either way, delete nothing.<\/p>\n

The same day, note the transaction IDs (the “hash”) and the addresses that received the funds. If a block explorer shows they were sent to an address labeled as a known exchange, write to its fraud team at once, with screenshots. The explorer’s label is a clue that only the exchange can confirm, and it does not tell you whether the funds are still there. Some exchanges freeze an account on a documented report while they wait for an order from an authority. Then file a criminal complaint, at a police station or in writing with the Public Prosecutor’s Office. The FOCS is clear on this: in case of financial loss, it recommends filing a criminal complaint.<\/p>\n

Within two days, put the file together. Statements from the exchange where you bought the crypto and the matching bank transfers. The full conversations (WhatsApp, Telegram, emails), the name and address of the fake site, the phone numbers used, screenshots of the “investment” dashboard. A one-page dated timeline saves the police, and your lawyer, a great deal of time.<\/p>\n

And pay nothing to anyone offering to “release” or “unlock” the money for a fee. More on this below. It is the usual sequel to the first scam.<\/p>\n

Where did the funds go?<\/h2>\n

Four situations, from the most favorable to the hardest. A block explorer (Etherscan, Blockscout, Blockchair or Tronscan, depending on the chain) often lets you make this first assessment yourself. Beyond that, a tracing report by a specialist helps target the requests. It is not a precondition for filing a complaint, and it should not delay one.<\/p>\n

The funds reached a Swiss exchange that identifies its customers<\/h3>\n

The best case. A Swiss platform subject to the Anti-Money Laundering Act knows who holds the account. The Public Prosecutor can order it to freeze the assets and to hand over identification data and transaction history (Art. 263 and 265 CrimPC). If the platform has reported its own suspicions to the Money Laundering Reporting Office (MROS), it must block the assets as soon as MROS tells it that the file has been passed to a criminal authority, and keep them blocked until that authority decides, for five working days at most (Art. 10 para. 1 and 2 AMLA).<\/p>\n

The funds reached a major foreign exchange<\/h3>\n

In principle, this requires international mutual legal assistance, which takes months. For the Netherlands, the Federal Office of Justice guide cited by the Federal Supreme Court in 2026 indicates one to fifteen months. A Bern decision opened another route, on specific facts. In 2023, the Bern Supreme Court upheld a freeze order sent directly to Binance through its law enforcement portal, without a mutual assistance request, because the exchange had no identifiable seat and the crypto could not be located in any one place (BK 23 310 of December 4, 2023). As far as we know, the Federal Supreme Court has not ruled on this route, and it is for the Public Prosecutor to decide whether to follow it. A voluntary freeze is a different matter. On a documented report, some exchanges block an account of their own accord, provisionally, while an authority acts.<\/p>\n

The funds sit in a self-custody wallet, or went through a mixer<\/h3>\n

No one holds these assets on behalf of a customer, so there is usually no one to send a freeze order to. Until the funds reach an identifiable platform, the practical obstacle is gaining control of the means to move them (keys, devices, access), which usually requires identifying who holds them. Seizing a device is not enough if the keys have been copied. That leaves tokens their issuer can freeze, covered in the next section. Mixers and cross-chain bridges blur the trail. They do not always break it.<\/p>\n

You “invested” on a fake platform<\/h3>\n

Most of the time, nothing was invested. The dashboard shows fictitious gains, and the real movement is elsewhere, in the transfers you made from your own exchange account to the address you were given. Tracing starts there, and you are back in one of the three situations above. The clearest red flag is a demand for a new payment, presented as a tax or fee, to “unlock” a balance you cannot withdraw.<\/p>\n

Bitcoin, stablecoin or utility token: who can still freeze the funds?<\/h2>\n

Since 2018, FINMA has distinguished payment tokens, utility tokens and asset tokens. For a theft victim, the useful question is more down to earth. Apart from the thief, does anyone still have a hand on the token?<\/p>\n

For bitcoin or ether, no. No issuer can block an address, and only an intermediary holding the funds for a customer, an exchange or a custodian, can immobilize them.<\/p>\n

Stablecoins are different. The USDT (Tether) and USDC (Circle) contracts on Ethereum include a blacklist function that lets the issuer block the USDT or USDC held by an address, and only those, even in a self-custody wallet. These issuers respond to requests from authorities. When stolen funds have been swapped into stablecoins, this is a route to explore first.<\/p>\n

For a utility token issued by a project, it all depends on the smart contract. Some include a pause or blacklist function, many do not. When the contract is verified, its code can be read on a block explorer, which does not make it audited. You also need to know who currently holds the contract’s admin rights, which are not always in the issuer’s hands, especially when the contract is upgradeable. If the issuer is a Swiss foundation or company, it at least gives you an identifiable counterpart. And if the money was not stolen but swallowed by a project that failed to deliver, that is a different question, covered in our article on the disappointed investor in a Swiss crypto project<\/a>.<\/p>\n

Criminal seizure: what the Public Prosecutor can freeze<\/h2>\n

The Criminal Procedure Code allows assets to be seized when they are likely to have to be returned to the injured party (Art. 263 para. 1 let. c CrimPC) or confiscated (let. d). During the investigation, the Public Prosecutor orders it, and the court once the case has been sent to trial. The police may secure assets on their own initiative only when there is imminent danger (Art. 263 para. 3 CrimPC). Hence the value of sending a reasoned seizure request to the Public Prosecutor, even if the complaint was filed at a police station.<\/p>\n

Time works against the victim, first for a practical reason. Crypto changes address within minutes, and what can no longer be located can no longer be frozen. There is also a legal limit, less frequent. A very late request can be found disproportionate. In 2026, the Federal Supreme Court upheld the refusal of seizures against third parties in the Netherlands, requested only after the case had been sent to trial, when the private claimant had known for years who received the funds (Federal Supreme Court 7B_382\/2026 of June 2, 2026, consid. 3.4). A victim who acts as soon as they find out where the funds are is not in the same position, even if the events date back a few months.<\/p>\n

Once frozen, crypto can be sold before the end of the proceedings, with the proceeds remaining under seizure (Art. 266 para. 5 CrimPC). The Federal Supreme Court allows such early realization, provided the interests of the State and of the person concerned are protected as far as possible (BGE 148 IV 74). If you want your bitcoin back in kind rather than its value in francs, say so in the seizure request. The prosecutor is not bound by that wish, but must give reasons that address the specific case. In 2025, the Federal Criminal Court set aside, on an appeal by the private claimant, an order to seize and sell cryptocurrencies that lacked adequate reasons (Federal Criminal Court BB.2025.51 of October 24, 2025).<\/p>\n

Why so many complaints go nowhere<\/h2>\n

Better to know before you start. When the offender is unknown, the Public Prosecutor may suspend the investigation, after securing evidence at risk of being lost and carrying out searches (Art. 314 para. 1 let. a and para. 3 CrimPC). In 2021, the Bern Supreme Court upheld such a suspension in a fake bitcoin and ether investment, pitched by someone met on a dating app, involving about CHF 172,200. The police considered that digital traces rarely led to the offenders, and that a request to the exchange, based in Asia, would only reach a money laundering intermediary (BK 21 378 of December 13, 2021).<\/p>\n

What changes the picture is a lead that can be used. An identifiable exchange account, a bank transfer, a Swiss phone number, a stablecoin the issuer can freeze. A complaint that arrives with tracing already done and a precise target stands a different chance from a complaint against persons unknown with nothing to hold on to.<\/p>\n

From freeze to restitution<\/h2>\n

Where it is undisputed that the assets were taken directly from an identified person through the offense, the criminal authority returns them to the rightful owner before the proceedings close (Art. 267 para. 2 CrimPC). That is the ideal case. It becomes rarer as soon as the holder of the receiving account claims the funds or disputes where they came from.<\/p>\n

Otherwise, restitution is decided in the final decision (Art. 267 para. 3 CrimPC). The court confiscates assets resulting from an offense, unless they are to be returned to the injured party (Art. 70 para. 1 SCC). And where the damage, caused by a felony or misdemeanor, is not covered by insurance and the offender is unlikely to pay compensation, the court awards confiscated assets to the victim on request, up to the damages set by a judgment or a settlement, against assignment to the State of the corresponding part of the claim (Art. 73 SCC).<\/p>\n

In practice, state expressly in your complaint that you are joining the proceedings as a private claimant, in both the criminal and the civil part (Art. 118 CrimPC), then quantify your claim with supporting documents. That gives you access to the file and the right to appeal, and puts you in the best position to obtain restitution or an award of the funds. When several victims claim the same funds, as often happens with fake platforms, the court can decide how they are allocated or refer some claimants to the civil courts (Art. 267 para. 4 and 5 CrimPC).<\/p>\n

The fake recovery service trap<\/h2>\n

They usually find you. An email, a call, sometimes a message claiming to come from a law firm, FINMA, Europol or the FOCS. Your funds have supposedly been “found”. All that is missing is an administration fee. The Zurich cantonal police sum up what follows: once the payment is made, contact stops and the money is gone.<\/p>\n

The FOCS received 462 reports of this kind in 2025, as of December 23, against 91 the year before. It cites a person who lost CHF 10,000 in 2023 and was asked, two years later, for a CHF 22,000 “recovery fee”. As the FOCS puts it, “Reputable organizations will never ask for advance payments.” In the United States, the FBI recorded 10,516 complaints about fake recovery schemes for 2025, with USD 1.4 billion in losses, a figure that may include money lost in the original scam.<\/p>\n

A few markers. No authority asks you to pay a “tax” to release recovered funds. A lawyer or a tracing expert may ask for an advance for defined work, but will not promise a result and will never ask you to pay to “release” funds. A Swiss lawyer’s admission can be checked in the cantonal bar register kept by the supervisory authority, and since fraudsters also impersonate lawyers who are genuinely registered, contact the firm using details you found yourself, never those in the message you received. No one needs remote access to your computer, or your recovery phrase. As for the “hacker” offering to “get the funds back”, at best you lose more money, at worst you end up in proceedings yourself.<\/p>\n

If you live outside Switzerland<\/h2>\n

Report the theft to the police where you live first. If the tracing shows that the funds reached a Swiss exchange or a Swiss bank, two routes open up. Your authorities can ask Switzerland for mutual assistance. And a Swiss lawyer can assess whether a complaint in Switzerland is possible, for instance for money laundering through a Swiss account, which depends on the facts. Either way, the Swiss side moves faster when it receives the transaction hashes, the receiving addresses and the exchange concerned.<\/p>\n

What it costs, and when it is worth it<\/h2>\n

Filing a criminal complaint is free. Costs can, however, be charged to a private claimant in some situations, for instance after an unsuccessful appeal (Art. 428 CrimPC). What costs most is the work around it: the tracing report, a reasoned and documented seizure request, following up on mutual assistance, the civil claim. A first meeting usually makes it possible to say whether that work has a chance of succeeding, based on the transactions and where the funds went.<\/p>\n

Frankly, for a few hundred francs, a well-documented complaint to the police is enough. When the amount runs into tens of thousands and tracing leads to an identifiable exchange, or to freezable stablecoins, acting fast can change the outcome. In between, it all depends on where the funds went, and that is the first thing to have checked.<\/p>\n

Deadlines at a glance<\/h2>\n