AMLBot conducted training for specialists from Ukraine’s Asset Recovery and Management Agency, or ARMA, on tracing cryptocurrency and documenting blockchain investigations for use in criminal proceedings. The training followed ARMA’s first receipt of seized virtual assets for management on June 27, 2026, establishing a need for specialists who can trace and document the funds over the course of a case.

The program covered methods for tracing onchain transactions, attributing entities and documenting fund-flow analysis so that it can carry legal weight in criminal proceedings, rather than remain only a chart on an analyst’s dashboard, AMLBot told Incrypted.

“Training from AMLBot gave our specialists the practical skills needed now that the Agency is managing seized virtual assets — from tracing funds across blockchains to documenting fund-flow analysis for court. We thank the AMLBot team for their professionalism, and our specialists are already testing the Tracer and AI Tracer tools in their work,” an ARMA representative said.

ARMA’s first seized cryptocurrency transfer

ARMA is responsible for finding and tracing assets that may be seized in criminal proceedings and managing assets already under seizure until a court determines their ultimate disposition. It was established under a November 2015 law and began operating in 2016 as part of Ukraine’s commitments on European Union visa liberalization. Its model is based on European Asset Recovery Offices.

On June 27, the Office of the Prosecutor General announced that seized virtual assets had been transferred to ARMA for management for the first time in Ukraine. ARMA said more than 8.3 million USDT, worth over UAH 372 million, had been credited to its official wallet under a court ruling.

The assets were seized in an investigation into an international hacking group whose members attacked individuals and companies in Europe and the United States, stole confidential data, demanded ransoms and laundered funds in Ukraine through real estate, vehicles and other valuable property. Authorities detained four participants, including the alleged organizer, according to the statement.

Total assets seized in the case exceed $11.1 million and include houses, apartments, vehicles and $1 million in cash. Estimated worldwide losses from the group’s activities exceed $100 million. The State Bureau of Investigation worked on the case with the Internal Security Department of the National Police and U.S. law enforcement agencies.

The transfer followed a joint order by ARMA and the Office of the Prosecutor General, signed on February 23, 2026, and registered by the Ministry of Justice on March 20. The order sets out how prosecutors transfer seized assets to ARMA.

Tracing and documenting seized funds

Unlike real estate, which has registry records establishing ownership, a cryptocurrency wallet presents investigators with a transaction graph. Determining which part of a balance is linked to alleged criminal activity can require tracing inbound funds through intermediary wallets, identifying counterparties and separating mixed funds from assets directly related to a case.

ARMA must also monitor publicly visible state-controlled addresses, account for changes in market value and maintain an audit trail showing that funds did not disappear and that checks were documented when performed. Because seizure does not amount to confiscation, courts may order restitution to victims, including victims abroad, rather than transfer assets to the state.

The training covered tracing funds through intermediary wallets and across blockchains; distinguishing exchange, bridge and service addresses from transit wallets; assessing interactions with mixers; checking addresses against sanctions lists and known illicit-activity clusters; and producing fund-flow reports suitable for case files.

AMLBot CEO Slava Demchuk said seizing cryptocurrency was the easiest stage, while maintaining the legal defensibility of the assets over several years was more difficult. He said courts would require evidence about the source of the funds and confirmation that no assets had been moved.

Virtual-asset rules remain under consideration

Ukraine’s draft virtual-assets law, No. 10225-d, passed its first reading in September 2025. Parliament’s finance committee approved it for a second reading in early November 2026, with that reading scheduled for November. If adopted, the rules will take effect on July 1, 2027.

The proposed model would make the National Securities and Stock Market Commission the main regulator, while the National Bank would oversee electronic money and currency matters. The text is not final, and the National Bank has said it cannot support the current version because of risks to financial stability and competition. At Incrypted Conference 2026 in June, lawmaker Yaroslav Zhelezniak said provisions governing the freezing and seizure of assets remained under negotiation.

Founded in 2019, AMLBot provides wallet screening, transaction monitoring, KYC and KYB verification, blockchain investigations and asset-recovery services. Its investigation products include AMLBot Tracer, which traces cross-chain funds and generates court-ready reports, and AI Tracer, launched in July 2026 to build annotated fund-flow graphs from a transaction hash across more than 14 blockchains.

Source: Incrypted