A crypto criminal investigation in Turkey is often misread because the visible evidence belongs to three different systems. The bank sees a transfer and an account holder. The exchange sees an order, a user profile and an internal balance. The blockchain shows an address and a movement of value. None of those records, alone, establishes who devised the offence, who controlled the final wallet, or what an intermediary knew.

That gap explains why legitimate P2P sellers, company officers, foreign residents and even victims sometimes learn about a criminal file through a frozen bank account or an invitation to give a statement. It also explains the opposite failure: a genuine fraud complaint may close prematurely because the file follows only the first IBAN and never requests the exchange ledger or traces the released crypto.

This English guide explains the investigation process for people and businesses facing a Turkey-connected crypto file. It distinguishes the roles of banks, platforms, suspects and victims, and examines account restrictions, digital evidence and defence. The task is to reconstruct conduct, control and knowledge transaction by transaction.

Current-law note, 4 October 2026: Law No. 7589 added TCK Article 158(4), a conditional one-half sentence reduction for a defined form of fraud participation limited to supplying specified payment instruments or account-access means for unjust benefit. This is not immunity or an automatic rule for crypto sellers. Its conditions and transitional provisions must be assessed against the person’s actual role and procedural stage.

For legal advice on this matter, you may contact Av. Ahmet Karaca:

WhatsApp Email

The five roles that must not be collapsed into one

Many files become confused because every person near the money is called a suspect and every wallet near the trace is described as belonging to that person. A disciplined investigation separates at least five roles:

The deceived payer or asset owner, whose account or wallet is the source of loss.
The organiser, who designs the representation, controls communications or selects payment routes.
The bank-account recipient, who may be an organiser, a knowing intermediary, a recruited account holder, a P2P trader or another victim.
The crypto account or wallet controller, who receives, trades, releases or forwards the virtual asset.
The infrastructure provider, such as a bank, exchange, custodian, telecom operator or protocol, which may hold evidence without participating in the offence.

One person can occupy several roles, but that must be proved. An exchange deposit address cannot be attributed to a customer merely because the exchange controls it; an IBAN holder is not automatically the owner of every crypto address that later receives value. The evidentiary bridge consists of orders, internal ledgers, KYC data, device records, communications and control facts.

How a Turkish crypto criminal file usually begins

A file may start with a victim complaint, a bank fraud alert, a suspicious-transaction report, a cybercrime referral, an exchange notification, intelligence from another jurisdiction or evidence found in a different investigation. The first procedural position matters. A person may be a complainant in one file, a witness in another and a suspect in a third concerning the same pattern of payments.

Before preparing a statement or demanding release of assets, identify:

the investigating prosecutor’s office and file number;
the alleged offence and the person’s procedural status;
the transaction or complaint that created the link;
whether any search, seizure, account suspension or travel measure exists;
which institutions have been asked for records;
whether related files exist in other cities; and
whether the apparent “MASAK block” is actually a bank control, prosecutorial order, court seizure or statutory postponement.

A bank call-centre explanation is not a reliable substitute for the underlying measure. The defence strategy changes significantly depending on whether the restriction is a temporary internal review, an Article 19/A postponement, a Criminal Procedure Code measure or enforcement unrelated to the crypto allegation.

The principal offence theories in Turkish crypto cases

Turkish criminal law does not contain a single offence named “crypto crime”. Existing offences are applied to technologically mediated conduct. The Turkish Penal Code No. 5237 must be read with the specific facts and general provisions on intent and participation.

Fraud and aggravated fraud

Fraud analysis concerns deception, error, disposition, benefit and loss. The aggravated forms may become relevant depending on the use of information systems, banking or credit institutions, commercial activities and other statutory circumstances. In an investment scam, the core question is not whether crypto was used; it is who made which false representation, how it caused the transfer and who obtained the benefit.

A person who simply appears later in the payment chain cannot be assumed to have made the deception. Conversely, an organiser may never receive the fiat payment personally and still direct the scheme. Communications, account creation, control over domains, device associations, wallet administration and distribution of proceeds become important.

Theft through information systems and account takeover

Where an attacker takes assets by using compromised credentials, private keys, API keys or unauthorised access, theft and computer-system offences may be examined. The distinction between a victim authorising a transfer because of deception and an attacker signing without the victim’s will affects both classification and evidence.

Exchange-account takeover files should reconstruct authentication, password reset, two-factor method, IP and device history, withdrawal whitelisting, API activity, conversion trades and withdrawals. A bare blockchain record cannot show whether the customer or attacker initiated the withdrawal.

Misuse of bank or credit cards and payment credentials

Card-funded crypto purchases, compromised payment accounts and transfers through third-party payment instruments can introduce offences specific to banking credentials. The crypto leg may be the method of converting or moving value rather than the legal character of the initial taking.

Breach of trust and corporate control disputes

Where assets were lawfully entrusted and later diverted, breach of trust may be more relevant than external theft. In a company or project, examine treasury mandates, multisignature policies, board decisions, employment duties, vesting agreements and administrator privileges. A transfer made with a technically valid key may still be unauthorised under the legal relationship.

Laundering of criminal proceeds

Article 282 concerns dealing with assets derived from an offence meeting the statutory predicate threshold in ways specified by the provision, including transfers abroad or processes intended to conceal the illegitimate source or create an appearance of legitimacy. “The funds passed through crypto” is not the legal test. The prosecution must establish the predicate relationship, relevant act and required mental element for the defendant’s role.

Layering, rapid conversion and chain hopping may be evidence, but they also occur in legitimate trading, treasury and arbitrage. The meaning comes from context: relationship to the source offence, communications, compensation, repetition, false identity, use of accounts controlled by others, response to warnings and economic rationale.

Unauthorised crypto-asset service-provider or payment activity

Law No. 7518 amended Capital Markets Law No. 6362 and introduced a regulatory framework for crypto-asset service providers. Article 109/A provides criminal sanctions for unauthorised service-provider activity. A CMB principle decision has also addressed persons who regularly carry out commercial or professional P2P transactions in their own name but for another’s account. This is a business-model question; an isolated personal sale should not be equated automatically with operating a service.

Payment-services law can arise where the model receives or transmits funds for others. The Central Bank of the Republic of Turkey explains the authorisation framework under Law No. 6493 on its official payment-services page. A label such as “OTC”, “broker”, “settlement partner” or “community merchant” does not decide the perimeter.

Participation: presence in the money trail is not the end of the analysis

Articles 37, 39 and 40 of the Penal Code distinguish perpetration, assistance and rules concerning participation. A criminal judgment cannot replace the individualised inquiry with a network diagram. The file should establish what the person did, when, with what knowledge and in support of which offence.

For a P2P trader, relevant facts can include:

whether the trade was for the trader’s own account or on another’s instruction;
whether the platform order existed and was completed at a market-consistent rate;
whether the bank payer matched the verified P2P buyer;
what third-party payment rules and warnings applied;
where the crypto was released and who selected that destination;
whether the trader communicated with the victim or organiser;
volume, repetition, margin, counterparties and record quality;
what happened after the first complaint or bank warning; and
whether the trader retained the purchase price, returned it or transferred it onward.

Negligent commercial practice can create risk and undermine credibility; it does not automatically prove intentional participation in a particular fraud. Equally, producing one platform screenshot does not neutralise evidence of repeated third-party transfers or coordination. A sound defence engages the entire pattern.

The anatomy of a P2P triangular-fraud investigation

Consider a simplified sequence. A fraudster persuades a victim to pay TRY 500,000 for a non-existent vehicle. At the same time, the fraudster opens a P2P order to buy USDT from a trader. The fraudster gives the trader’s IBAN to the victim and directs the trader to release USDT after the payment. The victim’s bank statement identifies the trader; the trader’s exchange account shows a genuine sale; the fraudster receives the crypto.

The investigation must create a joined chronology:

Time	Fiat event	Platform event	On-chain/off-chain event	Communication
T1	None	P2P order created	Seller balance reserved	Buyer requests payment details
T2	Victim sends TRY to seller	Buyer marks paid	No release yet	Fraudster pressures both sides
T3	Seller sees credit	Seller confirms	USDT released to platform buyer or destination	Order closes
T4	Victim complains	Account may be restricted	USDT moved or withdrawn	Fraudster disappears

The table identifies evidence that a bank-only inquiry will miss. It also exposes variants. Sometimes the “buyer” uses a platform account opened with stolen identity. Sometimes the release is internal and no blockchain transaction occurs until later. Sometimes the trader sends crypto directly from a self-hosted wallet. Sometimes the account holder is knowingly paid a commission to accept funds. Each variant changes the evidentiary bridge.

Foreigners, Russian and Ukrainian clients in Turkish P2P files

Foreign nationals living in or transacting with Turkey may use P2P markets to convert legitimate salary, savings or family support into Turkish lira. Restrictions on cross-border banking, residence arrangements, language barriers and limited access to payment services can make P2P economically important. Those circumstances explain motive; they do not exempt the transaction from Turkish criminal, AML, banking or capital-markets rules.

For Russian and Ukrainian clients, a useful source-of-funds file may require records from more than one legal and linguistic system: foreign bank statements, exchange histories, employment or sale documents, migration and residence records, communications, sanctions screening and proof of beneficial ownership. The translation should preserve names, transliterations, account numbers, transaction hashes and time zones consistently.

Sanctions are not inferred from nationality. They attach under the applicable regime to designated persons, prohibited dealings or sectoral restrictions. At the same time, a Turkish bank or global exchange may operate risk controls influenced by several sanctions systems and correspondent-bank expectations. A defence or unfreezing application should identify the actual exposure instead of making a general political argument.

A foreign client also needs early advice on service and procedural rights. Interpreter assistance, address notifications, travel constraints, residence status and coordination with foreign counsel can affect the case. Submitting a poorly translated statement that equates “wallet”, “exchange account” and “bank account” can create contradictions that are difficult to repair.

MASAK and crypto investigations

MASAK is Turkey’s Financial Crimes Investigation Board. Crypto-asset service providers are obliged entities under the prevention-of-laundering framework. Their duties include customer identification, suspicious-transaction reporting, information and document production, retention and compliance measures. MASAK’s updated sector guide also addresses remote identification, enhanced measures, politically exposed persons and the Travel Rule.

A suspicious-transaction report is not a conviction and generally is not a document the customer can demand as ordinary correspondence. It is a risk-based reporting mechanism. The defence should focus on the transactions, explanations and legal measure that can be established, not speculate about confidential reporting.

Article 19/A postponement

Article 19/A of Law No. 5549 permits postponement of transactions within defined conditions and for a maximum of seven business days. The period is a maximum for that mechanism; it is not a universal deadline requiring every bank restriction to disappear. During or after it, another order or a separate compliance basis may govern. MASAK’s official frequently asked questions explain the statutory mechanism.

Enhanced crypto transfer measures

MASAK General Communiqué No. 29, published in June 2025, introduced enhanced controls for crypto-asset service providers, including rules concerning transfer descriptions, transaction limits and waiting periods for specified withdrawals. A delay that follows this sector rule should not be presented as a criminal seizure. Conversely, completion of a routine waiting period does not override a separate lawful restriction.

CMK Article 128/A and the 48-hour misconception

Law No. 7571 introduced Article 128/A into the Criminal Procedure Code. For investigations concerning specified offences committed through information systems, the provision allows a bank, payment service provider or crypto-asset service provider to suspend the relevant account for up to forty-eight hours where the statutory conditions exist, notify the public prosecutor and provide requested information and documents within the prescribed framework. The prosecutor may then take the matter through the applicable seizure process.

Three cautions are necessary. First, the provision is tied to its defined offence and fact scope. Second, forty-eight hours concerns the provider suspension described by the provision, not the duration of every later judicial measure. Third, a provider’s internal control or an Article 19/A postponement is not transformed into Article 128/A merely because it lasted a similar time.

For counsel, the provision increases the importance of an immediate evidence map. The account transaction, complaint, platform order and crypto movement must be joined before an innocent trade is treated as dissipation or a genuinely criminal route disappears behind another transfer.

Bank account freezes: diagnose before challenging

An effective application begins with the legal basis. Ask the bank for the information it can lawfully disclose: restriction date, scope, competent authority and reference. Review e-government and file records where available. Obtain the prosecutor’s file through proper procedure. Determine whether the restriction covers one amount, the account balance, all products or several institutions.

Then build a source-and-purpose schedule:

incoming bank transfer and sender;
related order or contract;
crypto acquisition, release or withdrawal;
gross value, cost and actual margin;
counterparty verification performed;
communications and warnings;
economic source of the crypto; and
portion of the balance unrelated to the disputed transaction.

A generic petition saying that the money is needed for living expenses may establish hardship but leave the allegation unanswered. A stronger submission explains why the restriction is factually overbroad or no longer necessary, supports lawful source and separates disputed value from unrelated funds. Our Turkish article on crypto-related bank restrictions and the seven-business-day rule examines this distinction further.

Exchange restrictions and evidence requests

An exchange may restrict trading or withdrawals because of security, KYC refresh, sanctions screening, law-enforcement contact, suspicious activity, chargeback risk, Travel Rule gaps or internal terms. Counsel should request a specific explanation where it can be given and answer requests with a coherent account. Flooding the compliance team with unrelated documents can delay review and create inconsistency.

The evidence most often needed from an exchange includes:

account-opening and verification records;
login, IP, device and session history;
password, two-factor and security-setting changes;
P2P orders, advertisements, counterparties and chats;
fiat deposits and withdrawals;
spot, conversion and derivatives trades;
internal user-to-user transfers;
on-chain deposits and withdrawals with addresses and transaction hashes;
API keys and activity; and
linked accounts or referral relationships within lawful scope.

Graph from our case files: Branch B reached an e-money institution, a custodian, two exchanges, an instant swap, a crypto card and a bridge service; records to request — **From our case files: seven institutions holding identity records.** For each institution reached by Branch B we stated the deposit address, the amount and the minute range (UTC), and listed the records to request: KYC, IBAN or card, login IPs, orders and payout addresses. Case data anonymised and amounts changed. Prepared by Av. Ahmet Karaca. Click the image to open it in full size.

The critical distinction is between platform ledger and blockchain. A trade or internal transfer may never appear publicly. A withdrawal may leave from a pooled wallet that serves many customers. A defence report should not assign the platform’s entire wallet activity to one customer.

How blockchain evidence should be tested in a criminal file

Blockchain evidence is powerful because transaction records can be independently verified. It is also easy to overstate because attribution and control are not always public.

For each asserted connection, ask:

Is the chain and token contract correct?
Is the transaction directly observed on a canonical source?
Does the address belong to a service, a deposit account, a smart contract or a self-hosted wallet?
What is the basis of the service label?
Could batching, pooling, change, a router or internal ledger explain the flow?
What provider record would identify the user?
What evidence links that user to the defendant?
Does the timing support knowledge, or only sequence?

A risk score or “exposure percentage” should never be treated as an offence finding without examining its construction. The FATF virtual-asset red-flag guidance expressly frames indicators as matters that require context, not automatic proof of illicit conduct. This is equally important for prosecution and defence.

Our pillar on blockchain forensics and digital evidence in Turkey sets out reproducibility, attribution confidence, cross-chain tracing and expert-report design in greater depth.

Source of funds and source of wealth are different questions

Source of funds explains the origin of assets used in a transaction: salary saved in a bank account, proceeds of a property sale, earlier exchange purchases, mining revenue, business income or a loan. Source of wealth explains how the person accumulated overall wealth. A bank or exchange may reasonably ask for one or both, depending on risk and activity.

A defensible crypto reconciliation runs from original economic source to present asset:

employment income → bank savings → exchange deposit → asset purchase → self-hosted withdrawal → later deposit → sale → Turkish bank receipt.

Each arrow needs a record. Name variations, multiple exchanges, chain bridges and old wallets should be reconciled openly. Screenshots showing a balance without account identity or transaction history are weak. Tax treatment should be reviewed with qualified tax advisers; an unexplained label such as “investment savings” does not solve legal provenance.

Preparing a suspect or witness statement

A crypto statement should be factually precise without turning into an improvised technical lecture. Before testimony, reconstruct the relevant dates, platforms, accounts, devices, wallets and counterparties. Separate personal knowledge from information learned later.

Useful preparation includes:

a verified timeline in the correct time zone;
a glossary of the specific services and wallet types actually used;
original P2P orders and trade history;
bank and crypto reconciliation;
explanation of how addresses were obtained and controlled;
response to third-party payment issues;
records showing the economic rationale and margin; and
identification of material the authority can obtain to verify the account.

A person should not guess whether a destination address was “my wallet” merely because it appeared in an old withdrawal export. It may have been a counterparty, exchange deposit or contract. If records are incomplete, say so and identify the route to confirmation.

Search, seizure and digital devices

Phones and computers can contain wallet applications, authentication data, chat histories, browser artefacts, API credentials and address books. They can also contain privileged, private and unrelated material. Search and examination must follow the Turkish Criminal Procedure Code and the scope of the relevant decision.

From a forensic perspective, uncontrolled browsing of a live device can change data, trigger remote wiping, refresh application states or expose assets. Preservation should record the condition of the device, acquisition method, handler, timestamps, hash values and subsequent access. A screenshot of a wallet app is not equivalent to a forensic image, and possession of an app is not proof of control over every displayed address.

Seed phrases and private keys create a special operational issue. Recording them in an ordinary exhibit can expose the asset. If authorities take custody of digital assets, transfer procedures, key management, valuation and logging should preserve both security and evidentiary integrity.

Challenging overbroad attribution

A technical defence is not an attempt to make the blockchain disappear. It identifies what the data proves and what it does not.

Claim in the file	Technical issue to test	Confirming evidence
“The suspect owns this wallet”	Is it a personal wallet, service wallet or contract?	Provider records, device artefacts, signatures, address reuse and corroboration
“The suspect sent the crypto”	Was it an internal transfer, withdrawal or smart-contract call?	Exchange ledger, withdrawal request, IP/device and transaction trace
“The funds were laundered through swaps”	Is there a predicate link and concealment evidence?	Chronology, communications, control, economic rationale and onward use
“The account received victim money”	Did the account holder know the payer or deception?	P2P order, chats, payer matching, pattern and response to alerts
“The balance is criminal proceeds”	Does the measure distinguish disputed and unrelated funds?	Tracing, source-of-funds schedule and proportionality analysis

The same testing can strengthen a victim’s complaint by preventing it from targeting the wrong person. Accurate narrowing is not merely defensive; it directs investigative resources toward the organiser and recoverable asset.

When the investigation should be expanded

A file focused only on the first bank recipient may be incomplete where the record identifies an exchange order, wallet transfer, device, domain or repeat beneficiary. A reasoned request to expand the investigation should specify the missing act and evidentiary source.

Examples include requesting:

the P2P order and buyer account corresponding to a bank payment;
the account credited by a particular blockchain deposit;
internal transfers after that deposit;
domain registration and hosting records for a counterfeit platform;
telecom records tied to a SIM-swap timeline;
linked complaints involving the same wallet or communication identifier;
cross-border preservation before a retention period expires; and
a technically scoped expert examination.

“Investigate all wallets” is not a useful request. A good application explains which transaction creates probable relevance, who holds the record and how it would distinguish competing hypotheses. See also our detailed Turkish analysis of crypto fraud investigations and objections to non-prosecution decisions.

Pre-trial detention, judicial control and proportionality

Detention and judicial-control measures are governed by the Criminal Procedure Code, including reasonable-suspicion and proportionality requirements applicable to the measure. The use of cryptocurrency, international travel or a large transaction does not eliminate individual assessment. At the same time, access to portable assets, foreign links, evidence-tampering risk and organised conduct can be relevant facts.

A defence submission should address the actual risk with verifiable information: residence, employment, family and company ties; passport and travel record; cooperation; preservation of accounts and devices; absence of control over the alleged destination; the scope of secured evidence; and whether a less restrictive measure can address the concern. Boilerplate assurances are weaker than a documented alternative.

Parallel files, venue and conflicting narratives

P2P traders and account holders may be reported in several provinces because different victims transferred to the same account. Separate files can develop inconsistent accounts of the same platform activity. Counsel should map file numbers, dates, complainants, transactions, procedural status, restrictions and decisions, then assess joinder, coordination or consistent expert material under the applicable rules.

A favourable development in one file does not automatically bind another with different evidence. An adverse label in an old police note is not a substitute for proof in the current case. A master transaction schedule helps prevent the client from giving fragmented statements that appear contradictory merely because each authority sees only one payment.

Corporate exposure: exchanges, projects and company officers

Companies can enter criminal files as victims, evidence holders, regulated entities or through the potential responsibility of officers. A platform may receive orders for customer records and asset restrictions. A project may face an exploit or treasury diversion. A trading company may need to explain wallet governance and source of funds.

The response should coordinate criminal procedure with regulatory and operational duties. Preserve relevant records; verify the authority and scope of requests; protect privileged and unrelated data; document implementation; prevent unauthorised asset movement; and assess reporting obligations. A company should not rewrite policies or logs after an incident. Gaps should be documented and remediated prospectively.

For regulated-market questions, our separate guide to crypto exchange licensing and compliance in Turkey addresses CMB authorisation, custody, AML and technical controls.

What a criminal-case blockchain report must contain

A report intended for a Turkish criminal file should be narrower and more transparent than a commercial intelligence dashboard. It should state the mandate, materials, networks, token contracts, tools, data sources, relevant block ranges and observation date. Transaction tables should include hashes, addresses, asset units and time zones. Figures should be reproducible from the table.

Most importantly, use an assertion ladder:

Observed: the canonical ledger records a transfer.
Calculated: an amount or balance follows from stated arithmetic.
Attributed: an address is associated with a service based on stated evidence.
Corroborated: provider, device or other records support the attribution.
Inferred: a proposed relationship follows from defined heuristics and carries limitations.

Do not describe an attribution vendor’s confidence as a legal burden of proof. Do not omit transactions that weaken the instructed party’s theory. An expert-grade report makes disconfirming evidence visible.

Questions foreign clients ask before the first hearing

Can I be prosecuted in Turkey if I live abroad?

Potential Turkish jurisdiction depends on the offence, location of conduct or result, nationality and other statutory connecting factors. Living abroad does not by itself end the inquiry. Counsel should identify the exact Turkish connection, service status and any cross-border procedural step rather than rely on general statements.

Does selling USDT through P2P make me guilty of fraud?

No automatic rule makes a seller guilty merely because a victim’s money reached the seller. The file must assess the seller’s acts, knowledge and relationship to the fraud. However, third-party payments, professional volume, account lending, false explanations and continuing after warnings can create serious evidence and separate regulatory risk.

Will the seven-business-day period release my bank account?

Only if the restriction is solely the Article 19/A mechanism and no other lawful basis governs. Confirm the authority and measure. Court seizure, prosecutorial action and internal compliance controls have different rules.

Can blockchain analysis prove I did not control the destination?

It may show that the address is a service, contract or part of a flow inconsistent with the allegation. Definitive control often requires exchange records, device evidence or other corroboration. Negative propositions should be framed carefully: absence of public linkage is not proof that no linkage exists.

Should I send my seed phrase to prove ownership?

No. Seed phrases should not be placed in ordinary correspondence or pleadings. Ownership or control can often be demonstrated through a safe message-signing protocol, controlled transfer, account records or forensic procedure designed for the case. Disclosing the seed phrase can destroy asset security.

A defence methodology that survives technical scrutiny

The most reliable sequence is to define the allegation, freeze the record, reconcile fiat and crypto, test attribution, identify missing evidence, then prepare the legal response. Starting with a conclusion—“this is innocent trading” or “the wallet proves laundering”—creates blind spots.

Years of files involving banks, exchanges, projects, P2P traders and foreign clients reveal a recurring pattern: the decisive record is often held in the system between the two records already in the file. The bank transfer is known and the blockchain withdrawal is known, but the exchange’s internal order or transfer connecting them is absent. Finding that missing system is more valuable than expanding the graph indiscriminately.

A technically literate defence also knows when not to over-argue. If a client failed to check payer identity or kept poor records, acknowledge and contextualise the failure. The legal question remains whether the elements of the alleged offence and the client’s individual participation are proved. Credibility is built by separating an operational mistake from a criminal agreement, not by pretending the mistake did not occur.

Related Pega Hukuk analysis

Official sources

İlgili çalışma alanı: Kripto P2P Uyuşmazlıkları — Eşler arası (P2P) kripto alım satımı yapan bireyler; sahte dekont mağdurları ve işlem nedeniyle hesabı bloke edilenler.

Related English guides on Turkish P2P law

Use these guides for the transaction-specific questions:

Crypto Criminal Investigations in Turkey: MASAK, P2P and Defence