Key Takeaways
- • AMLBot conducted blockchain investigation training for specialists at ARMA, Ukraine's National Agency for Finding, Tracing, and Management of Assets Derived from Corruption and Other Crimes, covering onchain tracing and court-admissible fund-flow documentation.
- • ARMA took control of seized cryptocurrency for the first time in June 2026, with seized virtual assets in a hacking case reported at more than UAH 372 million, and the company said 8.3 million USDT was involved in the case.
- • The total value of seized assets in the underlying case exceeds $11.1 million, while estimated losses from the international hacking group's activities exceed $100 million.
- • AMLBot CEO Slava Demchuk argues that the hardest task is ensuring the legal defensibility of seized crypto over many years, not the seizure itself.
- • Ukraine's draft virtual assets law No. 10225-d remains unfinalized, and the National Bank has said it cannot support the current version.
Summary
AMLBot, a blockchain analytics and transaction tracing company, conducted training for specialists from ARMA on blockchain investigations, according to the company, which told Incrypted about the session. The training covered methods for tracing onchain transactions, entity attribution, and procedures for documenting fund-flow analysis so that it holds legal force in criminal proceedings rather than remaining a chart on an analyst's dashboard. ARMA's specialists are already testing AMLBot Tracer and AI Tracer tools to analyze transactions and prepare materials for criminal proceedings, according to an ARMA representative.
ARMA is Ukraine's asset tracing and management agency, established under a November 2015 law and operating since 2016 under EU visa liberalization commitments. Its mandate covers tracing assets subject to seizure and managing assets once seized. Historically this involved real estate, vehicles, and corporate rights. In June 2026, the Office of the Prosecutor General announced on June 27 that seized virtual assets had been transferred to ARMA for management for the first time, based on a court ruling. The transfer followed a joint ARMA and Prosecutor General's Office order signed February 23, 2026 and registered by the Ministry of Justice on March 20.
The assets relate to an investigation into an international hacking group that attacked individuals and companies in Europe and the US, stole confidential data, demanded ransoms, and laundered funds in Ukraine through real estate and vehicles. Four participants were detained, including the alleged organizer. The State Bureau of Investigation led the case jointly with the Internal Security Department of the National Police and US law enforcement agencies.
Demchuk, CEO of AMLBot, said seizure is the easiest stage while ensuring legal defensibility over years is the hardest, noting courts will require confirmation of the source of every dollar and proof that no funds moved. The training covered tracing across intermediary wallets and chains, distinguishing exchange and service addresses from pass-through wallets, analyzing mixer interactions, screening against sanctions lists, and producing documentary fund-flow reports for case files. AMLBot states it works with law enforcement in Kazakhstan, Thailand, India, Georgia, and the Czech Republic.
Legislatively, draft law No. 10225-d passed its first reading in September 2025, and parliament's finance committee approved it for a second reading in November 2026. The National Securities and Stock Market Commission would be the main regulator, with the National Bank overseeing e-money and currency, a model similar to MiCA. If adopted, the rules would take effect July 1, 2027. The National Bank has said it cannot support the current text, citing financial stability and competition risks. MP Yaroslav Zhelezniak noted at Incrypted Conference 2026 that freezing and seizure of assets remains under negotiation.
ARMA is Ukraine's asset tracing and management agency, established under a November 2015 law and operating since 2016 under EU visa liberalization commitments. Its mandate covers tracing assets subject to seizure and managing assets once seized. Historically this involved real estate, vehicles, and corporate rights. In June 2026, the Office of the Prosecutor General announced on June 27 that seized virtual assets had been transferred to ARMA for management for the first time, based on a court ruling. The transfer followed a joint ARMA and Prosecutor General's Office order signed February 23, 2026 and registered by the Ministry of Justice on March 20.
The assets relate to an investigation into an international hacking group that attacked individuals and companies in Europe and the US, stole confidential data, demanded ransoms, and laundered funds in Ukraine through real estate and vehicles. Four participants were detained, including the alleged organizer. The State Bureau of Investigation led the case jointly with the Internal Security Department of the National Police and US law enforcement agencies.
Demchuk, CEO of AMLBot, said seizure is the easiest stage while ensuring legal defensibility over years is the hardest, noting courts will require confirmation of the source of every dollar and proof that no funds moved. The training covered tracing across intermediary wallets and chains, distinguishing exchange and service addresses from pass-through wallets, analyzing mixer interactions, screening against sanctions lists, and producing documentary fund-flow reports for case files. AMLBot states it works with law enforcement in Kazakhstan, Thailand, India, Georgia, and the Czech Republic.
Legislatively, draft law No. 10225-d passed its first reading in September 2025, and parliament's finance committee approved it for a second reading in November 2026. The National Securities and Stock Market Commission would be the main regulator, with the National Bank overseeing e-money and currency, a model similar to MiCA. If adopted, the rules would take effect July 1, 2027. The National Bank has said it cannot support the current text, citing financial stability and competition risks. MP Yaroslav Zhelezniak noted at Incrypted Conference 2026 that freezing and seizure of assets remains under negotiation.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.