Crypto Assets and Digital Evidence

Digital material tends to enter a Turkish file as a conclusion rather than as evidence. A report states that a wallet belongs to the suspect, that a device sent a message, that a transaction chain leads somewhere. How that was established, and what it can properly support, is often not asked until someone asks it.

Two questions are involved and merging them is the common error. Whether the material was lawfully obtained and reliably preserved is a procedural question, decided by what the authorising decision permitted and how acquisition was carried out. Whether the material supports the inference drawn from it is an evidential question that survives even where acquisition was faultless — a wallet address associated with a person is not the same as that person controlling it at a given moment.

Search, copying and seizure of devices and records are governed by Article 134 of the Code of Criminal Procedure, which is more restrictive than practice sometimes reflects: seizure is the fallback rather than the default, devices are to be returned once decryption and copying are complete, and a copy from the system backup is owed to the suspect or their lawyer and recorded in the report. The Constitutional Court has annulled Article 134 in its entirety, with effect from 25 February 2027; the rule remains in force at the date of this page, but the planned Digital evidence in Turkish criminal procedure: Article 134 in practice must begin with the replacement legislation.

Crypto asset service providers came within the Capital Markets Law by Law No. 7518, published on 2 July 2024, and now require authorisation from the Capital Markets Board. A supervised sector keeps records to a defined standard and can be required to produce them — which changes what is obtainable, for the prosecution and on application for the defence.

Questions the file must answer

• Establishing what was acquired, under what decision, and whether the acquisition fell within it

• Testing attribution: what connects a wallet, an account or a device to the client, and what it does not establish

• Applications for return of devices, and for the defence copy where it was not provided

• Obtaining platform and exchange records, including through mutual assistance where the provider is outside Türkiye

• Instructing and testing technical analysis, and identifying where a report states an inference as a finding

For a foreign proceeding, the starting point is narrower than expected: the search or seizure decision, the report recording acquisition, and the technical report relied on. Those three documents determine most of what is capable of being tested.

For further information, see Insights.