A Wartime First
On June 27, 2026, Ukraine's Asset Recovery and Management Agency (ARMA) received more than $8.3 million in cryptocurrency — approximately UAH 372 million in USDT — into its official digital wallet following a court order. The funds were seized from an international hacking group accused of ransomware attacks on individuals and companies across Europe and the United States, causing an estimated $100 million in damages. Four suspects, including the alleged organizer, are in pretrial detention. Kyiv's stated intent: convert the stablecoin holdings to hryvnias and purchase Ukrainian military government bonds to fund defense operations.
This is the first time in Ukrainian history that seized digital assets have been placed under ARMA's active management rather than left frozen in a wallet pending legal proceedings. The State Bureau of Investigation, which led the case alongside Ukraine's National Police and U.S. law enforcement agencies, said the group laundered ransomware proceeds through Ukrainian real estate, vehicles, and other high-value purchases. Total assets seized across the investigation exceed $11.1 million — combining crypto, real estate, and approximately $1 million in cash.
What ARMA Is, and Why the Distinction Matters
ARMA — Ukraine's National Agency for Finding, Tracing and Management of Assets — was established to manage the full lifecycle of assets seized in criminal proceedings: apartments, vehicle fleets, corporate stakes, and now, digital tokens. The agency has been explicit about its legal posture: it is acting as custodian, not owner. Formal confiscation of the $8.3 million requires a criminal conviction. Until that happens, ARMA holds the USDT under a court-authorized management mandate, not a title transfer.
That framing is legally meaningful. But the plan to convert the USDT into hryvnias and invest them in war bonds is an irreversible act: once liquidated and deployed, the original digital asset cannot be restored to its pre-liquidation form. If any suspect were acquitted, or if a procedural defect were found in the seizure, the remedy would have to be monetary rather than in-kind. Wartime urgency does not dissolve that risk — it merely raises the political cost of naming it.
The Legal Foundation — and the Gap
Ukraine's Virtual Assets Law (No. 2074-IX), adopted by the Verkhovna Rada on February 17, 2022, gave virtual assets legal status as "intangible goods" subject to civil rights — in principle making them seizable alongside any other property. President Zelensky signed it one week after Russia's full-scale invasion began. The timing was not coincidental: Ukraine had already received substantial crypto donations for defense by that point, and a legal framework was urgently needed.
Yet the law has never fully entered into force. Its activation was tied to accompanying amendments to Ukraine's Tax Code — amendments that remain pending. Ukraine's National Securities and Stock Market Commission presented a MiCA-aligned draft regulatory framework in June 2023, but a comprehensive licensing regime for virtual asset service providers still does not formally operate. Ukraine's crypto market has therefore been running on legal goodwill: large by volume — Chainalysis ranked it fourth in Europe, with $206.3 billion in transaction activity from mid-2024 to mid-2025 — but without a fully operative statutory backbone.
ARMA's management authority in this case derives from Ukraine's criminal procedure code and ARMA's founding statute, not from the Virtual Assets Law. That makes the legal basis for pre-conviction liquidation of digital assets genuinely novel — functional under existing law, but untested on appeal in a crypto-specific context.
The Steelman Case for Caution
The strongest civil-liberties argument against this move is not about these particular suspects, who face serious coordinated charges backed by an international investigation. It is about what happens in the next case, where the evidence is murkier and the ransomware designation is contested. If Ukraine establishes that ARMA may liquidate seized crypto pre-conviction by court order, that template travels into cases where it is far less obviously appropriate. Critics of asset forfeiture regimes — particularly in the civil-liberties tradition — rightly note that pre-trial asset liquidation can function as punishment before conviction, especially when the liquidated asset is volatile and the conversion is irreversible.
A proportionate-regulation framework would address this with explicit statutory clarity: a provision permitting pre-conviction liquidation of volatile assets when specific conditions are met — judicial authorization, documented volatility risk, an international cooperation threshold — and guaranteeing a monetary remedy equal to liquidation proceeds plus interest in the event of acquittal. Ukraine does not have that provision yet.
Why the Policy Balance Still Holds
That said, the June 27 case clears several bars that matter for proportionality:
- Judicial oversight: The transfer followed a court order, not an executive determination. Judicial authorization is a meaningful, independent check.
- International coordination: The SBI worked alongside U.S. law enforcement agencies, raising the evidentiary floor substantially and reducing the risk of a solo overreach.
- Custodial framing: ARMA has not claimed title — it explicitly acknowledged the funds are under management pending conviction. That framing preserves the acquittal-remedy argument as a live legal avenue.
- Wartime proportionality: The assets were extorted from victims across multiple democracies. Repurposing them for Ukraine's defense carries a moral coherence that peacetime asset forfeiture debates rarely achieve.
Other democracies have also directed seized digital assets toward public purposes. The U.S. Department of Justice has auctioned billions in seized Bitcoin from Silk Road and Bitfinex-related forfeitures, depositing proceeds into the Treasury. The UK and EU have developed crypto tracing and forfeiture capabilities. Ukraine's move extends this established pattern into a direct defense-financing instrument — novel, but not without precedent in spirit.
What This Signals
Ukraine has also declared interest in developing a national crypto strategic reserve, modeled on the U.S. strategic Bitcoin reserve. The war-bond conversion is simultaneously an immediate wartime measure and a proof of concept for the government's institutional capacity to handle digital assets.
For the broader policy world, the takeaway is this: a country under sustained military pressure has demonstrated that seized digital assets can be managed in a legally coherent, institutionally grounded way, even without a fully operative licensing regime. The Virtual Assets Law of 2022 has stalled. But ARMA's first crypto management action shows the underlying legal architecture is functional enough to support serious enforcement action under existing criminal procedure law.
The pre-conviction liquidation gap is real and will need statutory resolution — ideally through the pending virtual assets legislation Ukraine's parliament still owes to the market. But as emergency wartime measures go, the ransomware-to-war-bonds pipeline is proportionate, judicially authorized, and internationally anchored. For a country that has been improvising its own survival for four years, that is a higher standard than many expected.