Home/Legal Guides/You received crypto that is now linked to a hack or fraud: what is your legal risk?

Crypto & Financial Crime | England & Wales

You received crypto that is now linked to a hack or fraud: what is your legal risk?

After a large hack, stolen crypto moves fast through peer-to-peer sellers, OTC desks and ordinary wallets. If some of it reached you, here is how the money laundering offences and sanctions rules work, and how to protect yourself.

Reviewed by
Paris Theodorou
· Principal Solicitor · Last reviewed
November 4, 2026

KEY ANSWER

The position in brief

Receiving crypto that later turns out to be stolen is not, by itself, a crime. The money laundering offences in sections 327 to 329 of the Proceeds of Crime Act 2002 require that the property is criminal property, which means the person dealing with it knows or suspects it represents the benefit of crime. What you knew or suspected at the time, and what you do once you are on notice, is therefore central. The practical risks come earlier than any charge: exchanges freeze accounts, police apply for crypto wallet freezing orders, and you may be invited to interview. Where funds are linked to a sanctioned person or regime, UK financial sanctions can apply as well.

Legal issues

The money laundering offences

  • Section 327: concealing, disguising, converting, transferring or removing criminal property.
  • Section 328: entering into or becoming concerned in an arrangement that facilitates someone else's acquisition, retention, use or control of criminal property.
  • Section 329: acquiring, using or possessing criminal property. There is a defence where adequate consideration was given, for example a genuine sale at a fair price, though it does not apply where the value given is significantly less than the value received.

Suspicion is a low threshold: more than a vague feeling, but less than belief. Swapping, bridging or moving funds after you suspect their origin can itself be the offence.

Authorised disclosures

A person who suspects property is criminal can make an authorised disclosure to the National Crime Agency and seek consent (a defence against money laundering) before dealing with it. Regulated crypto businesses also have reporting duties.

Sanctions

UK financial sanctions apply to cryptoassets in the same way as other assets. Dealing with funds owned or controlled by a designated person, including entities designated under the UK's North Korea regime, can be a criminal offence where the person knew or had reasonable cause to suspect the connection, and can attract civil penalties.

Evidence that matters

Evidence that matters most

  • The trade record: platform, counterparty profile, chat logs, price and payment proof.
  • Whether the price was in line with the market at the time.
  • Your usual pattern of trading, to show the transaction was ordinary for you.
  • Identity and source-of-funds checks you made on the counterparty.
  • What you did after any warning, flag or freeze.

Reasonable lines of enquiry

Questions to test the allegation

  • How many hops separate your wallet from the hack, and how was each attributed?
  • Did the funds pass through a large exchange or service where many users' funds mix?
  • Was anything public, at the time you dealt, that would have put you on notice?
  • Who else in the chain has been identified, and what did they say?

What happens next

An exchange may restrict your account and ask questions about a deposit. Police may seek a crypto wallet or account freezing order, then forfeiture. A criminal investigation may follow, with a voluntary interview or arrest and seizure of devices. The civil and criminal strands can run together. See crypto wallet freezing orders and money laundering pre-charge investigations.

Immediate steps

  • Stop dealing with the specific funds once you have any suspicion, and take advice on whether to make an authorised disclosure.
  • Do not try to "clean" the funds by swapping, bridging or mixing them.
  • Preserve every chat, screenshot and record of the trade.
  • Answer an exchange's questions accurately and only after advice if there is any doubt.
  • Do not attend a police interview without a solicitor.

What should you send us?

Send the trade details, the counterparty information you hold, any exchange or police correspondence and the dates.

Legal information from Theodorous. The law and procedure can change and the application of the law depends on the facts. This guide is general information, not advice on your individual case.

HOW WE CAN HELP

What Theodorous can do

We advise peer-to-peer traders, OTC desks, crypto businesses and individuals on money laundering and sanctions exposure, prepare responses to exchange compliance teams, attend interviews and respond to freezing orders. See money laundering defence.

FREQUENTLY ASKED QUESTIONS

Questions before your next step

I sold USDT to someone on a P2P platform and was paid by bank transfer. Could I be in trouble?

If the buyer paid you with stolen money, your bank account may be frozen and police may ask about the trade. Whether you committed an offence depends on what you knew or suspected. Good records of a normal, market-price trade help.

Should I send the crypto back?

Not without advice. Sending funds to an address you believe is the victim's can still be a transfer of criminal property, and you may send it to the wrong place. A disclosure route or agreed return through law enforcement is usually safer.

Does the adequate consideration defence protect me?

It applies to the section 329 offence where you gave a fair value in a genuine transaction. It does not cover the other offences, and it fails where what you gave was significantly less than what you received.

NEXT STEP

Get advice on a flagged transaction

Tell us how you received the crypto and who has contacted you. Call 0843 636 7687 or email [email protected]. We reply the same working day.

Get advice on a flagged transaction