The Pechersk District Court of Kyiv seized a crypto wallet with almost a million dollars in USDT and transferred the funds for safekeeping to the victim, who transferred $2.15 million to fraudsters through a partner’s compromised Telegram account.
The Pechersk District Court of Kyiv seized a crypto wallet with almost a million dollars in USDT and transferred the funds for safekeeping to the victim, who transferred $2.15 million to fraudsters through a partner’s compromised Telegram account.
On January 21, 2026, the Pechersk District Court granted a motion to seize crypto assets in a large-scale fraud case. This is one of the few cases in Ukraine where the court did not simply freeze the assets, but immediately transferred them to the victim for safekeeping.
On October 23, 2025, the victim, who is involved in investments, was at his place of residence in Kyiv. He received a message on Telegram from his business partner regarding the transfer of funds that they had previously agreed upon.
Since the conversation was in the context of previous discussions and there was nothing suspicious, the victim first made a test transfer of 10 USDT to the crypto wallet address provided by the interlocutor. Confirmation of receipt of the test amount came from the same Telegram account.
After that, the victim transferred the principal amount — 2,152,385 USDT — on the same day, which at the NBU exchange rate at the time of the transaction was 90.2 million UAH. The transaction hash is recorded in the case materials.
The next day, October 24, the victim opened Telegram and found that all correspondence had been deleted. When he wrote a message to the same account, there was no response. After contacting his partner through other communication channels, he learned that his partner’s Telegram account had been hacked and that the correspondence was actually with scammers.
The Cyber Police Department used the analytical platform Chainalysis to track the movement of the stolen assets across the blockchain. The funds took a complex path through several cold wallets and conversion services.
First, all 2.15 million USDT was withdrawn from the fraudster’s wallet to a transit cold wallet, then to another cold wallet in two transactions. The criminals then withdrew 2.55 million USDT to the decentralized service Sun.io, where they converted USDT to TRX.
The assets were then sent to the crypto service MaskEX, where the fraudsters exchanged TRX back for USDT — approximately 50% of the total amount, and converted the rest into other cryptocurrencies: SOL and BNB. This is a typical way of laundering stolen funds in the cryptocurrency environment — converting and dispersing assets makes them difficult to track.
As a result, the stolen cryptocurrency ended up on three electronic wallets. The USDT wallet with the address NUMBER_1, which is serviced by Tether Limited, had 999,655 USDT (about UAH 42.4 million at the NBU exchange rate) as of November 26, 2025. The SOL wallet had 4,834.27 SOL, which is equivalent to $660,437. The BNB wallet had 460.83 BNB worth $393,091.
Cyber police officers promptly sent a letter to representatives of Tether Limited with a request to freeze the transfer. The company responded on October 29, 2025 and froze the wallet until January 27, 2026. That is why investigators urgently applied to the court with a request to seize the assets.
On November 26, 2025, the crypto wallet was recognized as material evidence in criminal proceedings, which are being investigated under Part 4 of Article 190 of the Criminal Code of Ukraine (fraud on an especially large scale).
The Pechersk District Court imposed an arrest on the crypto wallet with a ban on alienation, disposal, and use. But most importantly, the court immediately transferred virtual assets in the amount of 999,655 USDT to the victim for safekeeping.
This is an atypical decision for Ukrainian courts in cryptocurrency cases. Usually, seized assets are kept until the investigation is completed, but in this case, the court took into account that the funds belong to the victim and are physical evidence.
The decision is subject to immediate execution. Immediate execution is entrusted to the investigators and prosecutors who are part of the group in the criminal proceedings.
The decision can be appealed to the Kyiv Court of Appeal within five days from the date of announcement. The investigation is ongoing. The fraudsters who hacked the Telegram account and stole $2.15 million have not yet been identified.
The remaining funds, about $1.05 million in SOL and BNB cryptocurrencies held in other wallets, remain unclaimed. These assets are more difficult to seize because they are not held by centralized companies like Tether Limited.
The case demonstrates both the effectiveness of the Ukrainian cyber police’s cooperation with international crypto companies and the vulnerability of messengers to hacking. Even experienced crypto market participants can become victims if fraudsters gain access to a trusted person’s account.
Вивчення втрати 4.45 BTC потребує уважного аналізу того, як саме було втрачено кошти. Якщо ви підозрюєте шахрайство, рекомендується повідомити про це відповідні органи, зокрема місцеву поліцію або підрозділ з протидії шахрайству. Консультація з досвідченим фінансовим радником або юристом допоможе оцінити наявність можливих варіантів повернення коштів, таких як страхове відшкодування або судовий позов. Водночас зараз ідеальний момент, щоб переглянути свої фінансові звички та внести зміни, які можуть знизити ймовірність майбутніх втрат. Для отримання додаткових рекомендацій і порад, будь ласка, зверніться до детального посібника FundsRetriever AT Proton DoT me, TG: AT FundsRetriever, WhatsApp:+10635121448.