Home // COURSES // FRAUD AND DIGITAL CRIME

The money became crypto: how to trace it and request a freeze

The client transferred money to an investment platform that promised high returns. Within minutes the money became a crypto-asset and changed wallets. The question reaches the firm the same afternoon: can it still be frozen?

The course

Why this course

Blockchain for lawyers, what tracing identifies and where it stops, and the technical data a freeze request needs.

Crypto-assets do not vanish. Every transaction is recorded on a public blockchain, and anyone can look it up. What the record does not carry is the name: the blockchain shows addresses, not people.

The name appears at a few gateways: the exchange where the criminal has an account, the stablecoin issuer that can freeze balances, the platform that identifies its customers. The freeze request must point to the right gateway, with network, address, transaction hash and time. A generic request, such as "freeze the defendant's cryptocurrencies", comes back unanswered.

The course explains blockchain in the language of litigation, shows what tracing identifies and where it stops, and provides the data sheet for the request. It covers Law 14,478/2022 (Brazil's virtual assets act) and the Central Bank of Brazil's rules for virtual asset service providers, in force since February 2026.

Length2 hours
TrackFraud and digital crime
FormatIn person or live online, open class or in-house. Taught in Portuguese, under Brazilian law
Who it is forCivil, criminal, banking and asset recovery lawyers; legal and compliance teams at crypto exchanges and fintechs.
InstructorAdriano Vallim, Forensic Expert and Digital Crime Specialist
CertificateCertificate of attendance stating the course hours, for every participant

I want this course

Pick as many courses as you like: they are kept and arrive ticked on the registration form.

By the end, you will be able to

What changes in your next case

  • Explain to the judge, in plain language, address, transaction, wallet and pseudonymity.
  • Distinguish a wallet held at an exchange, which has customer records, from self-custody, which does not.
  • Identify in the tracing report what is demonstrated, what is INFERRED and what is SPECULATIVE.
  • List the technical data for the freeze request: network, asset, address, hash, time and the addressee of the order.
  • Recognise the limits: mixers, cross-chain bridges and self-custody.
  • Preserve, on the victim's side, the path of the money up to the first wallet.
Programme

2 hours, block by block

0:00
Opening: the command centre inside a blockchain 15 min
  • The case of the hacked payment platform
  • The immutable record as evidence
  • Tracing is not identifying
0:15
Blockchain for lawyers 25 min
  • Address, private key, wallet and transaction
  • Hash: the blockchain's receipt
  • Exchange and self-custody
  • Stablecoins and the issuer that freezes
0:40
What tracing identifies and where it stops 25 min
  • From the first address to the exit gateway
  • Address clustering: an inference
  • Mixers, bridges and self-custody
  • Time in UTC
1:05
The freeze request: technical data and legal framework 35 min
  • The fields of the request
  • Whom to address the order to
  • Law 14,478/2022 and the Central Bank resolutions
  • Exercise: the technical data sheet
1:40
Questions and cases from the audience 20 min
  • Cases from the room and review of the data sheet
Cases in class

The cases used in class

REAL CASE · ANONYMISED

The command centre hidden in a public blockchain

A payment platform was hacked and had data destroyed, and the intruder erased his own tracks. The examination showed that the malicious program's command channel was written into smart contracts on a public blockchain, and recovered the deleted control address, because the record is immutable. It mapped dozens of wallets and more than one hundred thousand transactions, solely by querying the public record. The report gave the authorities the international exchange holding the central wallet, the stablecoin issuers able to freeze funds and the platforms holding the account holders' customer records.

Related page →

ILLUSTRATIVE EXAMPLE

The investment platform that did not exist

A client sends money by Pix (Brazil's instant payment system) to the account indicated by an "investment platform". The account holder buys crypto-assets at an exchange and sends them to another address, which passes the funds on. Tracing links the Pix transfer to the purchase, follows the wallets and looks for the next gateway with customer records.

Practice and materials

Ready to use the next day

Hands-on exercise

In pairs, the class receives the simulated record of a crypto-asset transfer (illustrative example): hash, source and destination addresses, network, asset, amount and time in UTC. In 15 minutes, each pair fills in the technical data sheet for the freeze request, converts the time to Brasília time, identifies the addressee of the order and writes the technical justification in three lines.

Materials provided
  • Technical data sheet for a crypto-asset freeze request: the fields the request must contain.
  • Blockchain glossary for litigation: the terms used in the report, one line each.
  • Expert questions for crypto-asset tracing: questions that test method and limits.
  • Preservation checklist for victims of crypto-asset scams: what to keep from day one.
Questions on the topic
Does blockchain tracing identify the person?
It identifies addresses and the path of the money. The person appears when the trail reaches someone who holds customer records: an exchange, a stablecoin issuer, a platform that identifies its customers. The report states how far the trace goes.
Can crypto-assets in self-custody be frozen?
As a rule, there is no one to address the order to: only whoever holds the private key can move the wallet. Tracing remains useful, because it shows when the funds leave it for a gateway with customer records.
Does the examination need to interact with the scammer's wallet?
No. Tracing is done by querying the public record, without contact with the infrastructure of the person under investigation. It does not alert the perpetrator and can be repeated by another expert.

Laws and rulings discussed

Law 14,478/2022 (Brazil's virtual assets act)  ·  Decree 11,563/2023, art. 1º  ·  BCB Resolution No. 520/2025 (Central Bank of Brazil)  ·  BCB Resolutions No. 519 and 521/2025  ·  STJ (Brazilian Superior Court of Justice), REsp 2,104,122  ·  STJ, REsp 2,250,674  ·  CNJ (National Council of Justice), CriptoJud  ·  Brazilian Code of Civil Procedure (CPC), art. 301

See also

Representative Cases →   Financial Fraud and Payment Systems Forensics →   Digital Authorship and Subscriber Data Disclosure →   See all courses →

Bring this course to your firm

Open class or in-house for your team, in person or online. Tell us the group size and preferred date: you will hear back within 24 business hours.

I want this course

The technical evidence your case requires. The authority courts respect.

Initial feasibility consultation at no cost. Reply within 24h on business days.
Request an Examination