KÜHEYLAN HUKUK
What Should a Cryptocurrency Scam Do? Criminal Complaint, Liability of the Platform and Tracking of Assets The rights of crypto asset victims have been updated as of 2026 within the framework of the provisions of Articles 35/B, 35/C, 99/A, 99/B and 109/A of the Capital Markets Law No. 6362, added by Law No. 7518, and Article 158 of the Turkish Penal Code.
Fake investment groups, hijacked platform accounts and stock exchanges in payment difficulties are among the fastest growing items of complaints in the field of finance in recent years. With the regulation that came into force in 2024, crypto asset service providers were subject to the permission and supervision of the Capital Markets Board, customer assets were separated from the platform's assets, and strict liability was brought to the platforms for losses arising from cyber attacks. However, the irreversible nature of crypto transfers makes it decisive what the victim does in the first hours. The guide explains the path to be followed according to the types of victimization, the protection of evidence, criminal complaints and seizure requests, the legal liability of the platform and other actors, and the precautions to be taken against second frauds with the promise of rescue.
Legal remedies vary depending on how the loss occurred. In practice, four basic scenarios stand out:
Fake investment and referral scams: High returns are promised through social media ads or messaging groups, the victim is first shown small profits and directed to send money to a fake platform or various IBANs. In the withdrawal request, an additional payment called "tax", "commission" or "account verification" is requested.
Account takeover: Assets are transferred to other wallets by accessing the platform account with phishing links, SIM card copying or malicious software.
Failure of the platform to fulfill its obligations: The platform stops withdrawals, falls into payment difficulties or terminates its activities.
Unauthorized foreign platforms: The possibility of collecting losses incurred on platforms that do not have permission in Türkiye is generally the weakest option.
The provisions added to the Capital Markets Law by Law No. 7518 dated June 26, 2024, bound crypto asset service providers to a comprehensive licensing and liability regime for the first time. The main rules that are important for victims are: Subject Rule Basis
Operating permit Establishment and start of operation of platforms are subject to CMB permission. CMBn article 35/B-1
Foreign platforms Activities aimed at persons residing in Türkiye (Turkish site, promotion, etc.) are considered unauthorized activities. CMBn article 99/A-1
unauthorized activity 3-5 years imprisonment and 5,000-10,000 days judicial fine SPKn article 109/A
Customer assets It is separate from the assets of the platform; cannot be seized for the platform's debts and does not enter the bankruptcy estate SPKn article 35/C-7
Terms limiting liability Contract terms that remove or limit the platform's liability to the customer are invalid. SPKn article 35/C-1
Assurance Crypto assets are not covered by the investor compensation system and deposit insurance CMBn article 35/C-4, 35/C-6
Separating customer assets from the platform's assets is the most important safeguard that prevents victims from being placed in the same line as other creditors in the event of a platform's insolvency. On the other hand, the fact that a platform has received permission from the CMB does not mean that the transactions are under public assurance (Art. 35/C-4).
1. Protecting evidence: Transaction IDs (TxID), sent and recipient wallet addresses, bank receipts and IBAN information, messaging records, site and application addresses and screenshots should be kept without deleting them.
2. Ensuring account security: Platform, e-mail and banking passwords should be changed, two-step verification should be re-established, and if there is a SIM card problem, the operator should be notified immediately.
3. Notification to the platform and bank: A written notification should be made to the platform in Türkiye to which the assets are transferred and the bank to which the money is sent, and the relevant accounts should be requested to be examined. Platforms are obliged to establish internal mechanisms to resolve customer objections and complaints (CMB article 35/C-1).
4. Criminal complaint: A criminal complaint should be made to the Chief Public Prosecutor's Office along with evidence, and the bank and platform accounts from which the money reaches should be requested to be seized (CMK article 128).
5. Notification to the CMB: If there is a platform operating without permission, a notification must be made to the CMB; The Board may block access to these sites (CMB article 99/A-3).
Transfers on the blockchain are irreversible; However, it becomes possible to track and freeze assets once they reach an authorized platform or bank in Türkiye. Measures, attachment and seizure decisions regarding customer assets are implemented directly by the platform, and the seized assets are kept in wallets in authorized depository institutions (CMB article 99/B-7). Therefore, submitting the application within hours directly affects the possibility of retrieval.
Fraud in which information systems or banks and credit institutions are used as a tool is considered qualified fraud; The lower limit of imprisonment is four years and the judicial fine cannot be less than twice the benefit obtained from the crime (TCK article 158/1-f). If the crime is committed by three or more people together, the penalty increases by half, and if it is committed within the framework of organizational activities, it increases by one fold (Art. 158/3). According to the provision added by Law No. 7589 dated July 16, 2026, the penalty of those who merely provide information that enables the use of their subsidiary bank account, card or crypto platform account to someone else is reduced by half (Art. 158/4); This regulation does not eliminate the criminal liability of those who use accounts, it only affects the amount of the penalty.
If the perpetrator completely repairs the damage before the prosecution begins, the penalty can be reduced by up to two-thirds, and if the offender repairs the damage during the prosecution, it can be reduced by up to half (TCK Article 168). In practice, this opportunity is an important tool that ensures that the victim's damage is compensated within the criminal process.
Platforms are responsible for damages arising from their unlawful activities and their failure to fulfill their cash payment and crypto asset delivery obligations (CMB article 99/B-3). They are responsible for losses arising from the operation of information systems, cyber attacks, information security violations and personnel behavior, on the basis of danger liability in Article 71 of the Turkish Code of Obligations, that is, without seeking fault (Art. 99/B-4). If the damage cannot be collected from the platform, platform administrators may be held responsible to the extent of their fault. Temporary access interruptions that occur through no fault of the platform are excluded from this responsibility.
The Supreme Court approved the decision that in the case of issuing a spare SIM card by the operator dealer without the user's knowledge and transferring assets from the crypto account with single-use passwords coming over this line, the operator who neglects its security obligations is responsible for paying the transferred amount and non-pecuniary damages (3rd HD, 15.04.2026, E.2025/5307, K.2026/2209). The operator's liability for losses due to SIM copying should be evaluated separately.
Owners of the IBAN or platform account to which the victim sent the money may, in addition to criminal liability, also have legal liability according to the provisions of tort and unjust enrichment. This issue is discussed in detail in Küheylan Law Firm's article on the legal consequences of using IBAN.
K.T. holds assets worth approximately 18,000 USDT in his account on a platform licensed to operate in Türkiye. One night, he realized that his phone was disconnected from the network, and the next morning he learned that a spare SIM card had been issued in his name at the operator dealer without his knowledge. The same night, his account was logged in from a new device, the assets were sold and transferred to an account on another local platform and from there to foreign wallets.
On the day the incident was learned, a criminal complaint was filed with evidence and a request was made to seize the account on the local platform where the assets were transferred. The part that did not go abroad was kept frozen and returned to the victim at the end of the investigation. A compensation claim was made against the operator for the remaining loss on the grounds that the identity verification obligation was violated when issuing a replacement SIM card; The fact that the platform approves high-amount transactions made from unusual devices and locations without additional verification has also been claimed as a separate reason for liability.
Can lost crypto assets really be recovered?
If the assets have reached an authorized platform or bank in Türkiye, it is possible to freeze and return them with a quick criminal complaint and seizure request. The probability of recovery is significantly reduced for assets transferred to foreign wallets or mixing services; In this case, compensation against account holders and other responsible parties comes to the fore.
Are companies that promise to return lost money trustworthy?
The promise to “take crypto assets off the blockchain” in exchange for a fee is a common secondary scam against victims. The recovery of assets is only possible with the confiscation decisions of the judicial authorities and within the legal process.
What can be done for a loss experienced on a platform abroad?
Since unauthorized activity against persons resident in Türkiye constitutes a crime, criminal investigations can be carried out in Türkiye. In legal claims, the representative of the platform in Türkiye, its assets and the authority requirement in the contract are decisive; Collection opportunities are generally limited. Which court has jurisdiction in disputes with the crypto platform? Disputes between the platform and the customer are subject to general provisions (CMB article 35/C-4). Depending on the purpose of the transaction and the nature of the parties, the civil, commercial or consumer courts of first instance may have jurisdiction; Since there are different decisions among regional courts of justice, the issue of duty should be carefully evaluated before filing a lawsuit.
Deleting correspondence: Correspondence and transaction IDs with fraudsters are essential evidence for seizures and compensation claims.
Postponing the application: Assets can be transferred to new wallets at any time; The criminal complaint and platform notification must be made on the same day. Paying a "withdrawal fee": Tax, commission or guarantee payments required for withdrawal of earnings will not result in anything other than a new loss.
Relying on promises of recovery: Promises to restore assets in exchange for a fee are sometimes made by the original fraudsters or people associated with them.
Using a platform without permission: Whether the platform has CMB permission should be checked in advance from the lists on the Board's website.
The opportunities offered by the law in crypto asset grievances have been significantly strengthened by the 2024 regulation: customer assets are protected against the platform's creditors, the platform is liable for losses caused by cyber attacks without any fault, and unauthorized activity is subject to heavy sanctions. However, the effectiveness of these opportunities depends on the rapid tracing of assets, the presentation of evidence with technical accuracy, and the combination of criminal and legal remedies. Küheylan Law Firm manages the legal process of crypto asset victims from start to finish, from the preparation of criminal complaints and seizure requests in the first hours to compensation cases against platforms, banks and operators, from CMB applications regarding unauthorized platforms to the follow-up against those who use accounts.
Important Legal Notice: The legal explanations, tables and case studies in this guide have been prepared by Küheylan Law Firm for general information purposes based on the legislation and judicial decisions in force as of 2026 and do not constitute legal advice. Since contract provisions, notification dates and periods directly determine the outcome in banking and finance disputes, it is recommended that each concrete case be evaluated separately by a lawyer. © 2026 Küheylan Law Firm. All rights reserved.
KÜHEYLAN HUKUK