PHASE 1: BLOCKCHAIN BALANCE IDENTIFICATION
📜 LEGAL BASIS: Budapest Convention Article 32a
Blockchain = Public Ledger | No judicial authorization required for consultation
✓ Public blockchain consultation (blockchain.com, etherscan.io)
✓ Identify balances and transaction history
✓ Timestamped screenshots with local currency valuation
NOTE: This phase requires NO authorization. The blockchain is public.
Wallet addresses can be consulted freely by any citizen.
PHASE 2: WALLET DISCOVERY DURING SEARCH
📜 MANDATORY AUTHORIZATION: Search Warrant
Scope: Search and seizure of cryptocurrency wallets
⚠️ CRITICAL: Immediately isolate suspect from all devices
Reason: Crypto transfer possible in seconds and IRREVERSIBLE
TYPE OF WALLET DISCOVERED?
SITUATION 1: COLD WALLET
(NON-CUSTODIAL)
Examples:
• Ledger Nano S/X (multi-token)
• Trezor One/Model T
• Electrum (Bitcoin only)
• Exodus, Sparrow, etc.
Characteristics:
• Private keys held by suspect
• No third-party custodian
• Public blockchain
✅ NO EXTRATERRITORIALITY ISSUE
All actions occur on national territory
WALLET UNLOCKED
OR SEED PHRASE FOUND?
✓ YES - Wallet Accessible
Immediate actions:
1. Photograph all screens
2. Document seed phrase (if found)
3. Identify tokens used
4. Check blockchain for balances
⚠️ Art. 37 Albanian CPC:
NO SELF-INCRIMINATION
Suspect MUST be present during operations
Contradictory procedure:
• Suspect present
• Minimum 2 witnesses
• Lawyer present (if requested)
• Video recording
TRANSFER TO JUSTICE WALLET:
1. Specific judicial authorization
2. Justice wallet prepared
3. Transfer tokens → Justice
4. Blockchain confirmation
5. Document Transaction ID
✓ Seizure = Criminal Asset
(Crypto ≠ fiat currency = movable property)
Sealing:
• Wallet placed under seal
• Seed phrase sealed separately
• All discovered elements sealed
• Contradictory report signed
✗ NO - Wallet Locked
Situation:
• PIN unknown
• Seed phrase not found
• Wallet inaccessible
⚠️ PROHIBITION Art. 37 CPC:
NEVER compel suspect to provide PIN/seed phrase
= Prohibited self-incrimination
Preservation measures:
1. Place wallet under seal
2. Photograph in situ
3. Document serial number
4. Maintain chain of custody
5. Continue searching for seed phrase
6. Forensic analysis of device
Note: Balance remains viewable on blockchain (public addresses).
Only access to funds is blocked.
SITUATION 2: HOT WALLET
(CUSTODIAL)
Discovery:
• Live examination phone/computer
• Written notes (login/password)
• Exchange confirmation emails
• Open mobile application
Examples:
• Coinbase, Binance, Kraken
• Bittrex, Gemini, Bitstamp
• Local exchanges
Characteristics:
• Private keys held by provider
• Third-party custodian (exchange)
• Transaction history at exchange
• KYC/AML data available
LOCATION OF
SERVICE PROVIDER?
📍 NATIONAL TERRITORY
📜 DOMESTIC PROCEDURE:
Rogatory commission / Direct requisition
1. Asset freeze (URGENT):
• Immediate request to exchange
• Judicial freezing order
• Timeline: 24-48h max
• Written confirmation from exchange
2. Data production:
• Account holder identity (KYC)
• Complete transaction history
• Wallet addresses used
• IP connection logs
• Identity verification documents
• Linked banking information
⚠️ Art. 37 CPC: Suspect present
If live examination of suspect's device
✓ Timeline: Days to weeks
✓ Direct domestic cooperation
SITUATION 2B: HOT WALLET - FOREIGN SERVICE PROVIDER
⚠️ ABSOLUTE PRIORITY: URGENT DATA PRESERVATION
(Volatile data - risk of destruction/transfer)
Two parallel legal procedures must be initiated simultaneously
🇪🇺 COLUMN 1: ASSET FREEZE
(EU Member States ONLY)
📜 LEGAL BASIS:
EU Regulation 2018/1805
(Applicable since 19 December 2020)
Mutual recognition of freezing and confiscation orders
Applicability: This procedure applies ONLY if the service provider
(exchange) is located in an EU Member State. Does NOT apply to USA, Switzerland, UK, etc.
STEP 1: Emergency Preservation (24-72h)
- Via: Budapest Convention 24/7 Network
- To: Exchange Law Enforcement contact
- Request: Immediate data preservation
- Data to preserve:
- Account information
- Transaction history
- KYC/AML documents
- IP logs
- Timeline: 24-72 hours response
- Duration: 90-180 days (renewable)
⚠️ CRITICAL: Set calendar reminder for preservation expiration!
STEP 2: National Judicial Authorization
- Obtain domestic freezing order from competent court
- Specify: Account identifier, exchange, amounts, legal basis
- Must demonstrate criminal asset connection
- Authorization must be obtained BEFORE transmission to EU State
STEP 3: EU Freezing Certificate (Article 7)
- Issued by: National competent authority (prosecutor/judge)
- Form: Standard EU certificate (Annex I of Regulation)
- Content:
- Issuing authority details
- Property to be frozen (crypto assets, account)
- Grounds for freezing order
- Criminal offense description
- Transmission: Direct to executing EU Member State authority
- Translation: NOT required for standard form fields
- Recognition: Automatic (no exequatur required)
STEP 4: Execution by EU Member State
- Timeline: Must execute "without delay"
- Grounds for refusal: Very limited (Article 8)
- Result: Exchange freezes account/assets
- Confirmation: Executing State confirms freeze to issuing State
- Duration: As specified in certificate
STEP 5: Confiscation (If Applicable - Article 12)
- After final confiscation decision in issuing State
- Issue: EU Confiscation Certificate (Annex II)
- Transmission: Direct to executing State
- Execution: Transfer of assets/proceeds to issuing State
✓ Timeline: 2-6 weeks typical
✓ Advantage: Simplified vs MLAT
✓ No translation: Standard forms
✓ Direct transmission: No central authority needed
🌐 COLUMN 2: SUBSCRIBER DATA
(All Budapest Convention Parties)
📜 LEGAL BASIS:
Budapest Convention Article 18
Production order for service providers offering services on territory
Applicability: All countries that have ratified the Budapest Convention
(including USA, EU members, Albania, etc.). Separate from EU Regulation 2018/1805.
STEP 1: Emergency Preservation (24-72h)
- Via: Budapest Convention 24/7 Network
- Contact: 24/7 Point of Contact in requested State
- Request: Urgent preservation of subscriber data
- Timeline: 24-72 hours response
- Duration: 90-180 days (renewable)
Note: This is the SAME preservation request as Column 1 Step 1.
Sent simultaneously to both 24/7 Network AND exchange.
STEP 2: National Judicial Authorization
- Obtain domestic production order/court order
- Specify: Service provider, account identifier, data requested
- Must demonstrate relevance to criminal investigation
- REQUIRED: Authorization must be obtained BEFORE requesting data
STEP 3: Article 18 Production Order
- Condition: Service provider offering services in requesting State territory
- Target: Direct request to service provider (exchange)
- Via: Exchange Law Enforcement portal OR via 24/7 contact
- Attach: National production order/court authorization
- Subscriber information includes:
- Type of communication service used
- Technical provisions and period of service
- Subscriber's identity, postal/geographic address
- Telephone and other access numbers
- Billing and payment information
- Site of installation of communication equipment
⚠️ Article 18 LIMITATIONS:
• Subscriber information ONLY
• NOT content data (detailed transaction content may be limited)
• NOT traffic data (routing information)
• Some exchanges may interpret this narrowly
STEP 4: Data Production by Exchange
- Timeline: Varies by exchange (days to weeks)
- Method: Secure download link or physical media
- Data typically includes:
- Account holder identity (KYC)
- Registration information
- Email, phone, address
- Identity verification documents
- Transaction history (basic)
- Wallet addresses used
- IP login logs
- Hash verification: Verify SHA-256 hash of received data
- Chain of custody: Document receipt and handling
STEP 5: ASSET FREEZE (Non-EU) - MLAT REQUIRED
⚠️ CRITICAL FOR NON-EU COUNTRIES:
Article 18 does NOT allow asset freeze. To freeze cryptocurrency assets in non-EU Budapest countries, a separate MLAT for asset freeze is MANDATORY.
- When needed: To freeze cryptocurrency assets (prevent transfers/withdrawals)
- Process: Mutual Legal Assistance Treaty (MLAT) request
- Via: National central authority → Foreign central authority
- Purpose: Request judicial freezing order from foreign State
- MLAT Package must include:
- Translated warrant/court order for asset freeze
- Investigation description
- Specific account/assets to freeze
- Legal basis for freeze
- Preservation reference number
- Preservation expiration date (URGENT)
- Duration of freeze requested
- Timeline: 6-18 months (USA: 10-18 months average)
- Risk: Preservation expires before MLAT → Data/assets may be lost
⚠️ CRITICAL: Submit MLAT immediately after preservation! Monitor expiration and request renewals!
ADDITIONAL MLAT: If Full Content Data Needed
- When needed: If Article 18 data insufficient (very detailed transaction analysis)
- Note: Article 18 typically covers user data + transaction history
- If more needed: Submit additional MLAT request for comprehensive data production
- Timeline: Same as asset freeze MLAT (6-18 months)
✓ Timeline Article 18: Days to weeks
✓ Timeline MLAT: 6-18 months
✓ Advantage: Direct to provider (Art. 18)
✓ Applicable: All Budapest parties
IMPORTANT CLARIFICATION - Two Independent Procedures:
EU Regulation 2018/1805 (Column 1):
• Applies ONLY to EU Member States
• Purpose: Freeze and confiscate criminal assets
• Procedure: Mutual recognition of judicial orders
• Does NOT cover data production
Budapest Convention Article 18 (Column 2):
• Applies to ALL Budapest Convention parties (including EU and non-EU)
• Purpose: Obtain subscriber information and transaction data from service providers
• Procedure: Direct production order to provider offering services on territory
• Does NOT cover asset freeze/confiscation
• Timeline: Days to weeks
If EU Member State (exchange located in EU):
• Use BOTH procedures simultaneously:
- EU Regulation 2018/1805 for asset freeze (2-6 weeks)
- Budapest Article 18 for data production (days to weeks)
If Non-EU Budapest Party (e.g., USA, UK, Switzerland):
• Budapest Article 18 for data production (days to weeks)
• MLAT MANDATORY for asset freeze (6-18 months)
• Emergency preservation FIRST (24-72h), then submit MLAT immediately
• Critical: Monitor preservation expiration and renew while waiting for MLAT
PHASE 3: FORENSIC ANALYSIS AND DOCUMENTATION
Blockchain Analysis:
• Transaction tracing (forward/backward)
• Identification of recipient exchanges
• Detection of mixing services
• Address clustering
• Flow diagram creation
• Timestamped asset valuation
Device Forensic Analysis:
• Forensic imaging of devices
• Search for wallet files
• Search for seed phrases (text/photos)
• Browser history extraction
• Exchange email analysis
• Credential recovery
Legal Documentation:
• Complete forensic report
• Chain of custody
• Blockchain screenshots
• Timestamped valuation
• Transaction flow diagrams
• List of all identified wallets
• Signed contradictory reports
MAGISTRATE DECISION SUMMARY
1. Blockchain balance identification: No authorization needed (Art. 32a Budapest)
2. Wallet search: Search Warrant mandatory
3. Cold Wallet (Ledger/Electrum):
• No extraterritoriality issue
• If unlocked/seed found: transfer to Justice possible
• If locked: seal only (Art. 37 CPC - no coercion)
• Suspect must be present (contradictory procedure)
4. Hot Wallet - Domestic:
• Urgent freeze + domestic rogatory commission
• Timeline: days to weeks
5. Hot Wallet - Foreign (EU Member State):
• Asset Freeze: EU Regulation 2018/1805 (2-6 weeks)
• Data Production: Budapest Article 18 (days to weeks)
• Both procedures run in parallel
• Emergency preservation via 24/7 Network first (24-72h)
6. Hot Wallet - Foreign (Non-EU Budapest Party):
• Data Production: Budapest Article 18 (subscriber info + transactions) - Days to weeks
• Asset Freeze: MLAT REQUIRED (no EU Regulation available) - 6-18 months
• Emergency preservation via 24/7 Network FIRST (24-72h)
• Submit MLAT immediately for asset freeze
• Monitor preservation expiration and renew
7. Cryptocurrency = Criminal Asset (not fiat currency = movable property)
8. Art. 37 Albanian CPC: No self-incrimination right, suspect must be present during operations
✓ COMPLETE DOCUMENTED PROCEDURE
✓ LEGAL BASES CLEARLY ESTABLISHED
✓ SECURE CHAIN OF EVIDENCE
✓ PARALLEL PROCEDURES COORDINATED