The owner of a Russian cryptocurrency exchange flew to Istanbul in June 2025. He was detained at the airport — INTERPOL had issued a Red Notice seven months earlier on charges of laundering money through digital assets. His lawyers had 48 hours to file objections before the extradition process began.
An INTERPOL Red Notice may be issued at the request of a national law enforcement authority if the owner of a cryptocurrency business is suspected of financial crimes involving virtual assets. INTERPOL coordinates international searches but has no authority to investigate cases independently or confiscate cryptocurrency. A notice can be challenged before the Commission for the Control of INTERPOL’s Files (CCF), but the time limit does not begin on the date of issuance — it begins when you learn about it. This can be critical: you wait for a court decision, arrive at the border, receive a letter from the CCF — and only then does the 90-day period begin.
A Red Notice is an international request issued by INTERPOL following an application from the National Central Bureau of a member country, requesting that a person be located and provisionally detained for subsequent extradition or similar legal proceedings, in accordance with Article 82 of INTERPOL’s Rules on the Processing of Data.
Virtual assets are digital assets, including cryptocurrencies, tokens and other forms of decentralised means of payment, which may be used in financial transactions and become subject to law enforcement scrutiny where illegal activity is suspected.
Key facts
Operation HAECHI IV (June–September 2025): USD 101 million in cryptocurrencies and USD 199 million in fiat currencies were seized. A total of 3,500 people were arrested in 34 countries.
More than 82,000 bank accounts were blocked in coordination with cryptocurrency exchanges and financial institutions.
Three types of cases accounted for 75% of investigations: investment schemes, BEC attacks involving business email compromise and e-commerce fraud, including cryptocurrency schemes.
Average time for the CCF to review a complaint: 9–14 months — one month for admissibility review, nine months for examination and one month for implementation of the decision. Plan ahead if you are waiting for a decision on the return of assets.
What is INTERPOL and why have cryptocurrencies become a focus?
INTERPOL is neither a police force nor a court. The organisation cannot arrest, confiscate or prosecute. Instead, it coordinates the National Central Bureaus of 196 member countries: it transmits search requests, exchanges data and provides analytical support.
Cryptocurrencies have become a target because they are ideal for cross-border crime. Money laundering, terrorist financing, investment schemes and ransomware payments — all of this moves through blockchains within minutes, crosses borders without customs controls and remains in public databases that are difficult, but possible, to decipher.
INTERPOL’s Constitution imposes strict limits. Article 2 prohibits involvement in political, military, religious or racial matters. Article 3 requires compliance with the Universal Declaration of Human Rights when processing data. These provisions are your main weapon when challenging a notice if it was issued under the pretext of a criminal offence but in reality serves as an instrument of competition or political pressure.
From practice: Most cryptocurrency business owners learn about a Red Notice only when crossing a border. The appeal period does not begin on the date the notice was issued, but from the moment of objective notification: detention or receipt of a letter from the CCF. This means that a notice may remain active for months before the time limit begins to run.
Does INTERPOL have the right to confiscate cryptocurrency?
No. All enforcement measures — arrest, search and confiscation — are carried out by national authorities. INTERPOL provides support: access to databases, blockchain analytics and coordination between countries.
When law enforcement authorities in one country identify a cryptocurrency-related offence with international connections, they contact their National Central Bureau (NCB). The NCB sends a request to INTERPOL. INTERPOL distributes the information to other countries. Further action is taken under national law: some countries can freeze accounts on cryptocurrency exchanges within a day, while others require a court order for every step — and this may take months.
Operation HAECHI IV: INTERPOL’s largest raid against cryptocurrency fraud
June–September 2025. INTERPOL conducted Operation HAECHI IV against cybercrime and digital asset fraud. The results demonstrate the scale of international cooperation: USD 101 million in cryptocurrencies, USD 199 million in cash, 3,500 people arrested in 34 countries and more than 82,000 bank accounts blocked.
A total of 75% of the cases fell into three categories. Investment schemes promised returns from tokens linked to non-existent projects. BEC attacks involving compromised business email accounts ended with demands to transfer ransom payments to cryptocurrency wallets. Fake cryptocurrency exchanges collected deposits and disappeared. Cryptocurrency schemes appeared in all three categories.
| Category | Cryptocurrency seized | Cash seized | Arrested |
| Investment schemes | USD 58 million | USD 112 million | 1,890 people |
| BEC attacks involving email compromise | USD 31 million | USD 64 million | 980 people |
| E-commerce fraud | USD 12 million | USD 23 million | 630 people |
Investment schemes remain the leading category. The promise of guaranteed profits attracts victims faster than traditional financial schemes because cryptocurrency technology is complex and the excitement surrounding digital assets creates an illusion of legitimacy.
What types of cryptocurrency fraud does INTERPOL investigate?
Four main types. All of them are cross-border in nature.
Investment schemes. Organisers register companies in offshore jurisdictions and attract investors through social media by promising high returns from tokens or mining. After collecting a critical amount of funds, the project shuts down and the money disappears.
BEC attacks involving cryptocurrency ransom demands. Criminals hack corporate email accounts, impersonate company executives and demand an urgent transfer to a cryptocurrency wallet. The victim does not verify the request through an alternative channel — and the money is transferred.
Fake exchanges and wallets. Fraudsters create websites imitating the interfaces of well-known platforms. They collect usernames, passwords and private keys. The funds are transferred to anonymous wallets within minutes.
Token giveaway phishing. The victim is offered free tokens from a new project, but activation requires payment of a cryptocurrency fee. After the transfer, the tokens never arrive and the website closes.
How does INTERPOL track anonymous cryptocurrency transactions?
INTERPOL does not analyse blockchains itself. It cooperates with specialised blockchain analytics companies and national cybercrime police units.
Bitcoin and Ethereum have public blockchains: every transaction is recorded in an open ledger showing addresses and amounts. Addresses do not contain names, but the sequence of transfers makes it possible to trace the movement of funds. When a law enforcement authority identifies a suspicious wallet, requests are sent to cryptocurrency exchanges. Exchanges apply KYC procedures for customer identification. If funds from a cryptocurrency wallet reach an exchange where the user has completed verification, the user’s details are transferred to investigators.
Privacy-focused cryptocurrencies such as Monero and Zcash make tracking more difficult, but account for less than 10% of cryptocurrency fraud volume. The main barrier is not technology, but time and resources.
The most difficult task is returning seized assets to victims. The procedure depends on national legislation: recognition of cryptocurrency as property, valuation at the time of seizure, a court confiscation order and distribution among victims. A year or more may pass between seizure and return, depending on the complexity of the case and cooperation between jurisdictions.
From practice: When a Red Notice is deleted following a CCF decision, INTERPOL notifies the National Central Bureau within seven days. However, the bureau is not required to notify the national prosecutor’s office — your clients may remain in local wanted-person databases for months after deletion from INTERPOL’s system.
Red Notices and cryptocurrency offences: how international searches work
A Red Notice is issued at the request of the National Central Bureau of the country in which the person is accused of a criminal offence. INTERPOL does not examine the evidence — it only checks formal compliance: the notice cannot be politically motivated, the allegation must concern a criminal offence and the applicable penalty must exceed two years of imprisonment.
Cryptocurrency cases lead to Red Notices on two main charges. Fraud — where a person obtained funds from investors or clients through deception. Money laundering — where a person transferred funds between wallets or exchanges to conceal their origin. The second charge is often brought against owners of legitimate cryptocurrency exchanges if criminals conducted transactions through the platform — this is a critical point for the defence.
INTERPOL’s privileges protect the organisation from interference by national authorities. Official correspondence is inviolable, and communication channels are not subject to censorship under an international treaty. This ensures the rapid exchange of data between countries, but at the same time makes access more difficult
| Stage of the CCF procedure | Time limit | Action |
| Admissibility review of the complaint | 1 month | The CCF checks whether the complaint falls within the Commission’s jurisdiction |
| Examination on the merits | 9 months | The CCF requests documents from the requesting country and analyses compliance with the Constitution |
| Implementation of the decision | 1 month | If the CCF decides to delete the notice, INTERPOL notifies the National Central Bureaus |
| Access to the file | 4 months | If the CCF grants access, the applicant receives a copy of the data held in INTERPOL’s system |
Nine to fourteen months is the full complaint review cycle. A CCF decision is final and binding on INTERPOL. But this is important: deletion of a Red Notice does not close the national case. The prosecutor’s office in the requesting country may continue the investigation and submit a new request with additional evidence, even after the first notice has been deleted from the system.
⚠️ Every day counts — do not delay
Get a free assessment of your case
Our team specialises in cases involving an international element. We will review the applicable treaties, assess the risks and prepare an action plan.
🔒 Confidential · We respond within 24 hours · No obligation
Commission for the Control of INTERPOL’s Files: who protects your rights and how
- The CCF was established as an independent body overseeing INTERPOL’s databases. It consists of seven members with legal education and experience in data protection or human rights, appointed for five-year terms. The key point is that the CCF is not subordinate to INTERPOL’s General Secretariat and is not dependent on pressure from the initiating countries.
Anyone who is the subject of a Red Notice may apply to the CCF for access to data, correction of data or deletion of the notice. A complaint must be submitted in writing in English, French, Spanish or Arabic. The applicant must explain why the notice violates the Constitution or the Rules on the Processing of Data — a mere allegation is not sufficient.
The CCF requests documents from the National Central Bureau that initiated the notice: the legal basis for the allegations, a description of the evidence and confirmation that there are no political motives. The applicant has the right to respond to the bureau’s position. The CCF then chooses one of three outcomes — complete deletion of the notice, correction of the data or rejection of the complaint.
The statistics reflect the reality: approximately 15% of complaints result in complete deletion and 10% result in correction of data. The rest are rejected because the applicant failed to prove a violation of the Constitution or because the allegation genuinely concerns real offences without a political background. The CCF publishes anonymised decisions in its annual report.
When a legitimate cryptocurrency business comes under suspicion
There are three main scenarios. First: the company operates in a country where cryptocurrencies are completely prohibited or strictly regulated. An exchange serves clients from that country without a local licence — and law enforcement authorities classify this as illegal financial activity.
The second scenario is that the exchange unintentionally made it easier for fraudsters to use the platform. The administration failed to block suspicious accounts in time. Prosecutors charge the owner with money laundering, claiming that customer verification procedures were insufficient.
Third: a conflict of interests. A cryptocurrency business threatens the monopoly of state banks or influential groups. A criminal case is initiated on formal grounds — licensing violations or tax debts — but the real purpose is to force a competitor out of the market.
The main trap for defendants is that cryptocurrencies are not regulated by a single international standard. What is legal in Estonia is a criminal offence in Algeria. An exchange with a European virtual asset licence serves clients around the world. One client from a country where cryptocurrency is prohibited files a complaint — and the exchange owners receive a Red Notice.
First steps if you are accused of links to cryptocurrency fraudsters
Request access to INTERPOL data through the CCF. Four months is the period provided for obtaining information about which country initiated the search and what allegations the notice contains. Only with this information can you assess the legal basis and develop a defence strategy.
The second step is to check whether the notice complies with INTERPOL’s Constitution. If the requesting country demands the transfer of client data without a court order and this contradicts your national legislation, it may provide grounds for relying on Article 2. Example: European data protection rules prohibit such transfers — therefore, the notice may be challenged as interference in matters unrelated to a criminal offence.
The third step is to collect evidence of legality. Licences. Audit reports. Records of KYC and AML procedures. Correspondence with regulators. All of this confirms that the business acted in good faith. If the CCF sees compliance with all requirements of the jurisdiction of registration, the likelihood of deletion of the notice increases.
Which countries use INTERPOL to search for cryptocurrency businesses?
INTERPOL does not publish statistics on initiating countries, but practice reveals certain patterns. China, Algeria, Egypt and Morocco — countries with a complete ban on cryptocurrencies — actively use INTERPOL to search for owners of exchanges that served their citizens. The charge is described as illegal financial activity or unlicensed foreign exchange operations.
Russia, Turkey and Kazakhstan use criminal cases against cryptocurrency businesses as an instrument of pressure. A notice is issued after the owner leaves the country or refuses to comply with unofficial demands from the authorities. The formal charge — fraud or money laundering — is supported by complaints from several clients.
The United States, the United Kingdom and Singapore act differently. They issue Red Notices less frequently, but for more serious reasons. The United States Department of Justice requests searches for owners of exchanges that served sanctioned jurisdictions or refused to cooperate with investigations. The United Kingdom’s National Crime Agency pursues platforms through which funds belonging to drug traffickers or hacking groups were transferred.
This article is published by an independent law firm for informational purposes and does not represent or claim any affiliation with government agencies, international organisations or official authorities.
