Ukraine’s Asset Recovery and Management Agency, known as ARMA, has received training from blockchain analytics firm AMLBot as the agency begins handling seized cryptocurrency for the first time. The program focused on blockchain investigations, transaction tracing and how to document the movement of funds in a form that can be used in criminal proceedings.

The training comes after ARMA took control of seized cryptoassets worth more than UAH 372 million in June 2026. According to the source material, the assets were transferred to the agency in a case involving an international hacking group, and ARMA staff are already testing AMLBot’s Tracer and AI Tracer tools in their work.

First transfer of seized crypto to ARMA

The case marked a first for Ukraine. On June 27, the Office of the Prosecutor General announced that seized virtual assets had been transferred to ARMA for management for the first time in the country’s history. ARMA later said the funds had been credited to its official wallet on the basis of a court ruling.

The assets included 8.3 million USDT connected to an investigation into an international hacking group. According to the source article, the group is accused of attacking individuals and companies in Europe and the United States, stealing confidential data, demanding ransoms and laundering funds in Ukraine through real estate, cars and other property.

Law enforcement detained four participants in the case, including the alleged organizer. The total value of seized assets exceeds $11.1 million, including homes, apartments, cars and $1 million in cash, while estimated global losses from the group’s activity exceed $100 million.

Why tracing matters after a seizure

ARMA’s core role is to find, trace and manage assets derived from corruption and other crimes. Since its launch in 2016, that work has mainly involved conventional property such as real estate, vehicles and corporate rights. Seized cryptocurrency creates a different set of problems because ownership, provenance and later restitution depend on onchain analysis rather than registry records.

The source article notes that a state-controlled wallet remains publicly visible, can fluctuate in value during lengthy court proceedings and may contain mixed funds that must be separated from amounts directly tied to a case. That means authorities need more than custody of the assets. They also need a documented audit trail showing where funds came from, whether anything moved and how conclusions were reached at each stage.

That documentation can become especially important if a defense argues that part of a wallet balance is unrelated to a crime, or if a court later orders restitution to victims rather than confiscation in favor of the state.

What AMLBot covered in the training

According to the press release described in the source, the training session covered practical methods for tracing funds through intermediary wallets and across multiple blockchains, attributing entities and distinguishing exchange, bridge and service addresses from transit wallets. It also addressed how to assess interactions with mixers, screen addresses against sanctions lists and known illicit clusters, and prepare documentary reports suitable for inclusion in a case file.

An ARMA representative said the training gave agency specialists practical skills needed now that ARMA is managing seized virtual assets, from tracing funds across blockchains to documenting fund-flow analysis for court. The representative added that staff are already testing AMLBot Tracer and AI Tracer to analyze transactions and prepare materials for criminal proceedings.

AMLBot describes Tracer as a tool for cross-chain fund tracing and court-ready reporting. Its AI Tracer product, launched in July 2026, is said to build an annotated fund-flow graph from a single transaction hash across more than 14 blockchains.

Rules are still evolving

The transfer to ARMA was made under a joint order of ARMA and the Office of the Prosecutor General signed on February 23, 2026 and registered by the Ministry of Justice on March 20. The source says that document set out the procedure for prosecutors to transfer seized assets to ARMA, addressing a gap in Ukrainian practice over who should manage seized cryptocurrency and how.

At the same time, broader legislation on virtual assets remains unfinished. Draft law No. 10225-d passed its first reading in September 2025, and in early November 2026 parliament’s finance committee approved it for a second reading planned for November. If adopted, the rules are expected to take effect on July 1, 2027, although the text is not yet final.

That leaves ARMA building procedures for seized digital assets while the wider regulatory framework is still being settled. For now, the confirmed next step is practical rather than legislative: the agency’s specialists are testing the tracing tools and applying the new workflow to support ongoing criminal cases.

Source: incrypted.com