AMLBot, a blockchain analytics and transaction tracking company, conducted training for specialists of ARMA (the National Agency of Ukraine for Finding, Tracing and Management of Assets) on blockchain investigations. In July of this year, the agency for the first time took control of seized cryptocurrency: 8.3 million USDT in a hacking attack case. Incrypted was informed about this by the company.
The press release said that the training session covered methods of tracking on-chain transactions, attribution of entities, and the procedure for documenting fund-flow analysis so that it has legal force in criminal proceedings rather than remaining merely a chart in an analyst's dashboard. ARMA took over seized funds worth more than 372 million hryvnias in June.
“Training from AMLBot gave our specialists the practical skills needed now, when the Agency manages seized virtual assets — from tracing funds across blockchains to documenting the analysis of fund movements for court. We thank the AMLBot team for their professionalism, and our specialists are already testing the Tracer and AI Tracer tools in their work,” noted an ARMA representative.
What is ARMA?
ARMA is a Ukrainian agency for the tracing and management of assets. It was created in accordance with the law of November 2015, and it began its work in 2016 as part of Ukraine's fulfillment of its obligations regarding visa liberalization with the EU. The agency's model is based on European Asset Recovery Offices.
Its mandate consists of two parts. The first is the search for and tracing of assets that may be seized in criminal proceedings. The second is the management of already seized assets, preserving them or their value until a court decision on their subsequent fate.
For most of the agency's existence, this meant working with real estate, vehicles, and corporate rights. Each of these objects is subject to a well-established procedure: describe the asset, evaluate it, appoint a manager, and report to the court on its condition.
June 2026
In June 2026, the state received seized cryptocurrency for the first time. In particular, on June 27, the Prosecutor General's Office announced that seized virtual assets had been transferred to ARMA's management for the first time in the country's history. The agency confirmed that the funds had arrived in its official wallet on the basis of a court ruling, as reported by Incrypted and CoinDesk.
Assets were seized as part of an investigation into the activities of an international hacker group whose members attacked individuals and companies in Europe and the US, stole confidential data, demanded ransom, and laundered funds in Ukraine through real estate, cars, and other valuable property. Law enforcement officers detained four members, including the alleged organizer, according to the statement.
The total value of seized assets in the case exceeds $11.1 million, including houses, apartments, cars and $1 million in cash. The estimated losses from the group's activities worldwide amount to more than $100 million. Investigators from the State Bureau of Investigations worked on the case jointly with the internal security department of the National Police and US law enforcement agencies.
The transfer took place on the basis of a joint order of ARMA and the Prosecutor General's Office, signed on February 23, 2026 and registered by the Ministry of Justice on March 20, which defines the procedure for prosecutors to transfer seized assets to ARMA. Until that moment, as ITC.ua noted, Ukrainian practice had no clear answer to the question of who and how should manage seized cryptocurrency.
“If criminals use digital tools to hide illegal income, the state must also be ready to work effectively with such assets, ensuring their preservation and the enforcement of court decisions,” ARMA stated on June 27, calling this transfer the “first practical case” of seized digital assets coming under its management.
Why does seized cryptocurrency need analysts, not just custodians?
The joint order answered the legal questions. However, the analytical questions remain open:
- Provenance. Real estate has a registry record that unambiguously determines ownership. A wallet has only a graph of transactions. To establish which specific portion of the balance is connected to a crime, it is necessary to trace incoming flows through intermediate wallets, match counterparties with known services, and separate mixed funds from those directly related to the case. When the defense claims that part of the balance has no connection to the crime, the answer is on-chain analysis, not a paper request;
- monitoring. A state-controlled address is visible to all, and its value fluctuates with the market rather than remaining unchanged between sessions. The agency needs continuous monitoring and a valuation methodology it can defend in court, rather than merely recording the balance on the day of transfer;
- duration. Court investigations last for years. Ultimately, the state must provide an audit trail proving that nothing disappeared from the address and that every inspection was documented at the time it was conducted;
- restitution (return of property). Seized is not yet confiscated. If the victims are abroad, the court may order restitution rather than confiscation in favor of the state. Therefore, the analysis of the movement of funds must be sufficiently convincing to identify the ultimate owner. This attribution cannot be done retrospectively at the confiscation stage; it must be in the case materials from the very beginning.
What did the training program cover?
The training session focused on the practical skills necessary for this work:
- tracking of funds through intermediate wallets and across different blockchains;
- distinguishing exchange, bridge, and service addresses from pass-through wallets;
- analysis of interaction with mixers — what they prove and what they do not;
- verification of addresses against sanctions lists and known clusters of illegal activity;
- formation of a documentary report on the movement of funds, suitable for attachment to the case materials.
According to the CEO of the blockchain analytics and compliance company AMLBot, Slava Demchuk, the process of seizing cryptocurrency is the easiest stage, while the most difficult task lies in ensuring its legal protection over many years.
He emphasized that in court they will demand confirmation of the source of every dollar and evidence of the absence of any movements of funds. Slava Demchuk noted that although the training of a state body is a longer and less visible process compared to high-profile investigations, it is precisely this that determines whether the management of the next seized wallet will be competent or turn into improvisation. In his opinion, Ukraine developed these skills in advance, and such a consistent approach is worthy of emulation.
The press release states that AMLBot works with law enforcement agencies on several continents. In Kazakhstan, the company signed a memorandum of cooperation with the Department for Combating Cybercrime. In Thailand, it cooperates with the Pathum Thani police in investigating "pig-butchering" fraud schemes. The company also worked with the Whitefield Cyber Cell unit of the Karnataka police in India, the Ministry of Finance of Georgia, and the police of the Czech Republic.
The legislation is still catching up
The Ukrainian draft law on virtual assets No. 10225-d passed its first reading in September 2025. In early November 2026, the parliament's finance committee supported it for the second reading, scheduled for November. The National Securities and Stock Market Commission is to become the main regulator, while the National Bank will be responsible for electronic money and currency supervision — following a model similar to the European MiCA regulation. If adopted, the rules will take effect on July 1, 2027.
The text of the document is not yet final. The National Bank stated that it cannot support the current version, citing risks to financial stability and competition.
At the Incrypted Conference 2026 in June, People's Deputy Yaroslav Zhelezniak noted that the freezing and seizure of assets is precisely the part of the draft law on which negotiations are still ongoing. Whatever the final text may be, ARMA is already operating under conditions that legislators have not yet finished regulating.
About AMLBot
AMLBot is a blockchain analytics and crypto compliance company founded in 2019. It provides wallet screening, transaction monitoring, KYC/KYB verification, blockchain investigations, and asset recovery services for businesses and government agencies. Investigation tools include AMLBot Tracer (for cross-chain fund tracing and generating court-ready reports) and AI Tracer (launched in July 2026), which builds a labeled fund-flow graph based on a single transaction hash across more than 14 blockchains. More details at amlbot.com.