How to Recover Stolen Crypto in Türkiye: Tracing and Seizure

Can stolen crypto be recovered? The honest answer depends on where the money is now. A blockchain transfer cannot, as a rule, be reversed; but because every transaction is recorded on a public ledger, the money can be traced, and once the asset reaches a centralised exchange or service provider that carries out identity verification, legal routes come into play. For victims searching for "how do I get my crypto back", this article explains how on-chain tracing works, the 48-hour suspension introduced by Article 128/A of the Code of Criminal Procedure (CMK), seizure and return, the crypto receivable claim and precautionary attachment, which offences wallet-draining acts (seed phrase theft, fake wallet apps, drainers) amount to, and recent decisions of the Court of Cassation. Where the technical analysis and the legal claims need to be combined in a single case, working with a crypto lawyerTR speeds up the process.

🔎 Can Stolen Crypto Be Recovered? A Picture by the Money's Final Position

Crypto is returned not through a "request" but through a measure that can be applied where the money sits. The table below shows, for the main scenarios seen in practice, which route can be pursued and what a realistic expectation looks like; in no scenario can a result be promised in advance.

The basic reality the table shows is this: the chance of recovery arises when the asset reaches an intermediary that holds identity records. Crypto asset service providers in Türkiye are obliged to verify customer identity under Law No. 5549 and to keep transfer records in a traceable form (Capital Markets Law Art. 35/C-1 and 5). Which platforms are authorised can be followed in the SPK's "List of Active Providers" (SPK list). Which authorities a complaint is filed with is explained in table form in our article where to report crypto fraud.

🧭 How Do I Get My Crypto Back? How Does Blockchain Tracing Work?

Blockchain tracing means mapping, address by address, where the money went, starting from the first transaction the victim sent. It is technical work, but its logic is simple:

1. Starting point: The TxID (transaction hash) of the victim's transfer and the network information. This record shows the first address the money reached.
2. Step-by-step following (hops): Fraudsters usually split the money quickly and move it to several addresses. Each transfer is recorded as a separate transaction.
3. Address clustering: Patterns such as inputs spent together in the same transaction or "change" addresses can show that addresses which look different are controlled by the same person or operation.
4. Entry point to an exchange: The most valuable moment of tracing from a legal point of view is when the money enters a deposit address of an exchange. If the platform that owns this address can be identified, the prosecutor's office can request the account holder's identity and transaction records from that platform.
5. Breaking points: Mixer services, cross-chain bridges, decentralised exchange (DEX) transactions and privacy-focused coins make the trail harder to follow or can break it.

A tracing report does not by itself create a right; its value lies in showing the prosecutor's office a concrete target (which platform, which account). Under CMK Art. 128/A-7, banks, payment service providers and crypto asset service providers are obliged to send the information and documents requested by the prosecutor's office or the court within ten days. How the report and the list of TxIDs are attached to a petition is shown in our article crypto fraud criminal complaint petition exampleTR.

Court of Cassation 11th Criminal Chamber 2026/2256: No decision not to prosecute without reviewing account movements

In its decision of 2 March 2026 (Docket No. (E.) 2025/4535, Decision No. (K.) 2026/2256), issued as a reversal in the interest of the law, the 11th Criminal Chamber of the Court of Cassation examined a case in which an acquaintance who presented himself as a crypto investor managed the victim's account and part of the money was allegedly lost. The Chief Public Prosecutor's Office had treated the dispute as a "civil disagreement" and issued a decision not to prosecute. The Chamber reversed the rejection of the objection, stating that the bank and crypto account movements of the complainant and the suspect should be obtained and an expert examination of both sides carried out to determine whether the whole of the money was really directed to investment. Our review of the decision is in the article acquaintance managing a crypto account – Court of Cassation 11th Criminal Chamber 2026/2256TR.

⚖️ The Criminal Route: Suspension, Seizure and Return of Crypto

The most effective tools for recovering stolen crypto are the protective measures of criminal procedure.

CMK Art. 128/A: 48-hour suspension and return

Article 128/A, added by Law No. 7571 of 24 December 2025, allows a bank, a payment service provider or a crypto asset service provider to suspend the account used in the offence for up to 48 hours where there is suspicion of qualified theft through information systems (Turkish Penal Code Art. 142/2-e), qualified fraud (Art. 158/1-f, l) or misuse of cards (Art. 245). The suspended value can be seized by a judge's decision or, where delay would be harmful, by a written order of the prosecutor; the report requirement of Art. 128 is not sought for this seizure. If the seized value is found to belong to the victim, it is returned during the investigation or prosecution stage (Art. 128/A-5). The provision matters because it allows return without waiting for the end of the trial.

CMK Art. 128: Seizure of accounts, rights and receivables

Where there is strong suspicion based on concrete evidence that the offence was committed and that the assets were obtained from it, the suspect's accounts at banks and financial institutions, rights and receivables held with natural or legal persons, and other assets may be seized; fraud (Turkish Penal Code Art. 157, 158) is among the offences covered by this article. Only a judge can order this seizure and, depending on the case, a report on the value obtained from the offence is requested from bodies such as the SPK or MASAK (Financial Crimes Investigation Board); the report is prepared within three months at most and may be extended by two months if necessary (Art. 128/1, 9).

Capital Markets Law Art. 99/B-7: Where are seized crypto assets held?

Every administrative and judicial request concerning measures, attachment and the like on customers' cash and crypto assets is carried out exclusively by crypto asset service providers. Assets seized by judicial authorities are kept in wallets created at custody institutions authorised by the Board. Physical devices such as hardware wallets may be taken into custody under CMK Art. 123. How seizure works for cold wallets is explained in our article seizure of crypto assets and cold walletsTR.

🏦 The Civil Route: Crypto Receivable Claim, Precautionary Attachment and Injunction

Independently of the criminal investigation, compensation can be claimed in a civil court against an identified perpetrator or the account holder who received the money. A person who causes damage to another by a wrongful and culpable act is obliged to make it good (Turkish Code of Obligations Art. 49). A compensation claim is time-barred two years from the date the damage and the liable person become known and in any case ten years from the act; where the act is an offence for which criminal law provides a longer limitation period, that period applies (Art. 72). Since the limitation period for prosecuting qualified fraud is fifteen years, this rule can work in the victim's favour.

• Precautionary attachment (Enforcement and Bankruptcy Law Art. 257): For a money claim that is due and not secured by a pledge, the debtor's assets, receivables and rights can be placed under precautionary attachment. In crypto fraud the claim is most often made on the basis of its Turkish lira equivalent.
• Injunction (Code of Civil Procedure Art. 389): Where there is concern that a change in the existing situation would make it significantly harder or impossible to obtain the right, an injunction can be ordered over the asset in dispute.
• Liability of the platform (Capital Markets Law Art. 99/B-3, 4): Crypto asset service providers are liable under Turkish Code of Obligations Art. 71 for their unlawful activities and for losses arising from cyber attacks or information security breaches.

Capital Markets Law Art. 35/C-7 provides that customers' assets on the platform cannot be attached for the platform's debts; this protection operates against the platform's creditors and does not prevent enforcement for the suspect customer's own debt. Details on injunctions and attachment over crypto assets are in our article injunction and precautionary attachment over crypto assets.

Court of Cassation 3rd Civil Chamber 2026/2209: A crypto account drained through SIM cloning

In its decision of 15 April 2026 (Docket No. (E.) 2025/5307, Decision No. (K.) 2026/2209), the 3rd Civil Chamber of the Court of Cassation examined a case in which a dealer issued a duplicate SIM card without the subscriber's knowledge and USDT was withdrawn from a crypto account using the one-time passwords sent to that line. Relying on expert reports, the court of first instance (a consumer court) found that the mobile operator had not taken the necessary security measures when changing the SIM and was at fault, and awarded material and non-material damages; the Chamber corrected the judgment as to the attorney's fee and upheld it. The decision shows that, in wallet or account draining cases, liability may not be limited to the perpetrator. A detailed review is in our article SIM cloning and a crypto account – Court of Cassation 3rd Civil Chamber 2026/2209TR; the comparable obligations of banks are covered in bank liability in investment fraudTR.

🔓 My Wallet Was Drained: Which Offence Do Seed Phrase Theft, Fake Wallets and Drainers Amount To?

Most "my wallet was drained" complaints rest on one of three schemes: recovery words (the seed phrase) being obtained through a fake support team or a fake site; a fake wallet app that copies the real application; and a wallet being emptied through a malicious approval that the victim signs under the pretext of an "airdrop" or "reward" (a drainer). The classification of the offence changes according to what the deception was aimed at.

In its decision of 27 May 2024 (Docket No. (E.) 2024/5233, Decision No. (K.) 2024/8532), the 2nd Criminal Chamber of the Court of Cassation considered a case in which the account details and password of a person were obtained through a fake website and the perpetrator himself moved money out of the account. It held that the deception was aimed only at obtaining the password and that the transfer was made not by the victim's misled will but by the perpetrator's own act, so the conduct amounts to qualified theft through the use of information systems (Turkish Penal Code Art. 142/2-e). The same decision notes that obtaining the information by deceit may also constitute the offence of unlawfully seizing data under Turkish Penal Code Art. 136.

The classification of the offence affects both the competent court and the application of CMK Art. 128/A; both provisions (Art. 142/2-e and 158/1-f) fall within the suspension scope. The technical workings of the drainer scheme are described in our article wallet drainer and airdrop approval fraud; the general framework of cybercrime is in internet fraud.

🌍 Overseas Exchanges and Mutual Legal Assistance

The most common difficulty in Bitcoin recovery claims is that the money has gone to an exchange based abroad. In that case, obtaining identity and transaction information and freezing the asset generally requires correspondence with foreign authorities under Law No. 6706 on International Judicial Cooperation in Criminal Matters; the time needed varies with the legislation of the country concerned and the level of cooperation. In practice some overseas exchanges respond to requests from official authorities through their own compliance units; however, this is not the practice of every platform.

On the other hand, Capital Markets Law Art. 99/A treats overseas platforms operating towards persons resident in Türkiye as unauthorised crypto asset service providers; opening a Turkish-language website or advertising in Türkiye is an indication of such targeting. This allows the legal position of the platform itself to be assessed in the investigation as well.

🚨 Fake Recovery Firms Promising a "Crypto Recovery Service"

Victims who search for how to get their crypto back may soon be approached by people calling themselves "fund recovery", "blockchain forensic analysis" or "recovery" services. The common features of these operations are that they ask for an upfront service fee, a "tax" or a "withdrawal commission", present themselves as an official body, an international law firm or a well-known cybersecurity company, and put pressure by saying the money has been "found". In the case that is the subject of Court of Cassation 11th Criminal Chamber decision 2026/1903, too, the victim is alleged to have sent money a second time on the promise that the lost money could be recovered.

The power to seize and return crypto assets belongs only to the judge and the public prosecutor; no private person or company can reverse a transfer on the blockchain in return for payment. Many operations working with this scheme have been examined on our site; for examples, see recovery scam (money recovery) fraudTR and Mempool Recovery fake crypto recovery fraud. Similar return processes in forex cases are explained in our article refund of money in forex fraudTR.

❓ Frequently Asked Questions

The answer to whether stolen crypto can be recovered is not a promise; recovery is a process that depends on prompt notification, correct tracing and the appropriate protective measure being applied together. The general path followed in similar situations is described in our article what happens after being defrauded, and running the criminal and civil dimensions together is described on our fraud lawyerTR page. For detailed information and legal support, you can contact Savun Law & Consultancy.