When Crypto Fraud Hits: Can the Exchange or the Bank Be Forced to Pay? A Practical Guide Under Turkish Law

Crypto fraud cases often begin with the same question: “The scammer is gone, but the money passed through a bank and a crypto exchange. Can I recover my loss from them?”

Under Turkish law, the answer is increasingly important—and increasingly nuanced.

A victim may have transferred Turkish lira from a bank account to a crypto platform, purchased USDT, Bitcoin or another crypto asset, and then sent those assets to a wallet controlled by fraudsters. In other cases, the victim’s bank account or crypto exchange account may have been taken over without authorization. Sometimes the exchange allows suspicious withdrawals despite unusual login activity, a newly added wallet address or an immediate fraud notification.

These factual differences can completely change the allocation of liability.

Turkey’s crypto regulatory framework has also changed substantially. Law No. 7518, published on 2 July 2024, brought crypto asset service providers within the regulatory framework of the Capital Markets Law No. 6362 and under the supervision of the Capital Markets Board of Türkiye (“CMB” or “SPK”). The secondary regulations published on 13 March 2025 introduced detailed rules concerning authorization, custody, transfer procedures, internal controls, technological infrastructure and capital adequacy.

Accordingly, the assumption that “crypto transactions are irreversible, therefore nobody except the scammer can be liable” is no longer legally sufficient.

The correct question is:

Did the bank or crypto exchange fail to perform a legal, contractual, cybersecurity, monitoring or due-diligence obligation that could have prevented the loss?

That question must be examined separately for the bank and the crypto exchange.

1. The First Question: How Did the Crypto Fraud Occur?

Before discussing liability, the transaction must be classified correctly.

The most common scenarios are:

Scenario 1: The Victim’s Crypto Exchange Account Is Hacked

A third party gains access to the victim’s account and transfers crypto assets to an external wallet without authorization.

Examples include:

• SIM swap attacks,
• phishing,
• stolen passwords,
• compromised e-mail accounts,
• malware,
• API key theft,
• unauthorized device registration,
• bypassing two-factor authentication.

In this scenario, the potential liability of the crypto exchange is relatively strong because the dispute concerns the security of assets entrusted to or processed through the platform.

Scenario 2: The Victim’s Bank Account Is Hacked

Fraudsters gain access to internet or mobile banking and transfer money from the victim’s account to another bank account or a crypto platform.

Here, Turkish banking case law concerning the bank’s status as a “trust institution” becomes particularly important.

Scenario 3: The Victim Personally Transfers Money to the Fraudster

The victim is contacted through WhatsApp, Telegram, Instagram, a fake investment website or telephone call.

The fraudster convinces the victim to:

1. transfer money from the victim’s bank,
2. deposit it into a legitimate crypto exchange,
3. purchase crypto assets, and
4. send the crypto to an external wallet.

This is the most difficult category in terms of bank liability because the victim has technically authenticated and authorized the transaction.

Scenario 4: The Victim Transfers Money but Immediately Reports the Fraud

The victim realizes the fraud while the transaction is still being processed or while the crypto remains within the exchange ecosystem.

The bank or exchange is notified, but no effective action is taken.

In this situation, liability may depend on what could reasonably have been stopped after the notification.

Scenario 5: A Fraudster Uses an Exchange Account as a Collection Account

Funds or crypto assets are transferred directly into an account opened on a regulated platform in the fraudster’s name or in the name of a “money mule.”

This raises separate questions concerning:

• KYC obligations,
• transaction monitoring,
• suspicious activity controls,
• withdrawal procedures,
• account ownership,
• AML obligations,
• preservation of transaction data.

2. Crypto Exchanges Are No Longer Operating in a Regulatory Vacuum

The most important development in Turkish crypto law is the amendment introduced by Law No. 7518.

Crypto asset service providers now fall within the regulatory framework of Capital Markets Law No. 6362.

The legislation expressly requires crypto asset service providers to establish systems necessary for secure operation, technological infrastructure, internal control and risk management.

This significantly strengthens the legal position of investors in cases where a loss resulted not merely from market movements, but from:

• unauthorized withdrawals,
• cybersecurity failures,
• information-security breaches,
• employee misconduct,
• failure to execute legitimate withdrawal or delivery obligations,
• improper custody,
• regulatory non-compliance.

3. Direct Statutory Liability of Crypto Exchanges

One of the strongest provisions for fraud victims is found in Article 99/B of the Capital Markets Law.

The provision establishes that crypto asset service providers are responsible for losses arising from unlawful activities and from failure to fulfil obligations relating to cash payments or delivery of crypto assets.

More importantly, the law specifically provides that crypto asset service providers may be responsible for crypto asset losses caused by:

• operation of information systems,
• cyberattacks,
• information-security breaches, and
• acts of personnel.

The statute refers to Article 71 of the Turkish Code of Obligations, which regulates liability arising from dangerous activities.

This provision may become extremely important in hacked-account litigation.

A platform cannot simply argue:

“The blockchain transaction is irreversible, so we have no responsibility.”

Irreversibility may explain why the transaction cannot technically be reversed on-chain. It does not automatically determine whether the platform is civilly liable for allowing the transaction to occur.

4. Contractual Clauses Cannot Eliminate the Exchange’s Statutory Liability

Another important investor-protection provision concerns user agreements.

Under Article 35/C of the Capital Markets Law, contractual clauses eliminating or limiting a crypto asset service provider’s liability toward its customers are invalid. The same article also requires platforms to establish internal mechanisms to resolve customer objections and complaints effectively.

Therefore, contractual wording such as:

• “All transfers are entirely the user’s responsibility,”
• “The platform shall never be liable for unauthorized withdrawals,”
• “The user accepts all risks of cyberattacks,”
• “The platform is not responsible after the transfer is broadcast to the blockchain,”

does not automatically protect the exchange.

The court must still determine whether mandatory legal obligations were breached.

5. When Can a Crypto Exchange Be Liable for Fraud?

Exchange liability is strongest when there is evidence of a failure within the exchange’s own sphere of control.

Examples may include:

Unauthorized Login Followed by Withdrawal

Suppose a customer normally connects from Istanbul using the same mobile device.

Suddenly:

• a login occurs from another country,
• a new device is registered,
• the password is changed,
• a new wallet address is added,
• the customer’s entire portfolio is converted into USDT,
• and the full balance is withdrawn within minutes.

If the exchange permits the transaction without adequate security controls, a court may examine whether the platform complied with its cybersecurity, identity-verification and risk-control obligations.

Failure of Multi-Factor Authentication

The 2025 regulatory framework requires important controls in relation to crypto transfers. Article 30 of Communiqué III-35/B.2 requires multi-factor authentication mechanisms for investor transfer orders.

If an exchange claims that a customer authorized a transfer, it may therefore become necessary to obtain technical evidence showing:

• which authentication factors were used,
• which device authenticated the transaction,
• IP address,
• device fingerprint,
• login history,
• time stamps,
• SMS or application approval logs,
• changes to security settings,
• wallet-whitelisting records.

A mere database statement saying “transaction confirmed” should not automatically end the inquiry.

Security Warnings Were Ignored

Liability may also arise where the customer informs the exchange:

“My account has been compromised. Stop all withdrawals.”

If the exchange can technically freeze the account but fails to act before assets leave the platform, causation between the failure and the eventual loss may become much easier to establish.

6. Turkish Regulations Now Impose Detailed Controls on Crypto Transfers

Communiqué III-35/B.2 contains detailed rules governing transfer processes.

Transfer orders must pass through wallet-access control procedures, and the system must verify that the transfer was properly authorized and complies with applicable regulations and internal policies. The regulations also require technological measures against attempts to bypass these controls.

The regulatory framework also requires platforms to maintain customer transactions and balances separately and accurately and imposes monitoring obligations concerning transactions that cannot reasonably be explained economically.

These rules can be highly relevant in litigation.

A claimant should therefore avoid framing the case simply as:

“I was defrauded, so the exchange must pay.”

The stronger allegation is:

“Specific regulatory and technical controls that should have detected or prevented this transaction were not properly applied.”

That distinction can determine the outcome of the lawsuit.

7. MASAK Rules May Also Be Important

Crypto platforms are also subject to anti-money-laundering obligations.

MASAK General Communiqué No. 29, published on 28 June 2025, introduced enhanced measures for crypto asset service providers.

For relevant crypto withdrawal transactions within the scope of the regulation, the Communiqué provides for waiting periods of at least 48 hours after purchase, exchange or deposit, and at least 72 hours for first-time withdrawals. It also requires platforms to adopt transaction amount and frequency limits within their risk-management policies.

The regulation additionally requires platforms to obtain information concerning the nature of crypto transfers and establishes enhanced measures in relation to customer identification and monitoring.

This can have major practical implications.

For example, if fraud occurs during a period in which the law required the crypto to remain on the platform for a certain period, but the assets were transferred out prematurely, the regulatory breach may provide powerful evidence in a subsequent compensation action.

However, AML rules should not be interpreted as creating automatic compensation liability in every fraud case. The claimant must still establish an adequate causal connection between the regulatory breach and the loss.

8. What About the Bank?

Banks are subject to a different legal analysis.

Turkish Court of Cassation jurisprudence has traditionally imposed a particularly high duty of care on banks because banks are regarded as institutions of trust.

The General Assembly of Civil Chambers of the Court of Cassation, in its decision numbered 2017/2224 E., 2018/1753 K., emphasized that banks are subject to an objective and aggravated duty of care and may be liable even for slight negligence. The Court also stressed that banks are expected to protect deposited funds against fraudulent transactions.

This principle is highly significant in crypto fraud cases when money leaves a bank account before entering the crypto ecosystem.

9. Unauthorized Banking Transactions: The Strongest Case Against the Bank

Consider the following example:

A fraudster obtains the customer’s credentials and accesses mobile banking without permission.

The fraudster then:

• takes out an instant loan,
• increases transaction limits,
• closes a foreign-currency account,
• converts funds into Turkish lira,
• transfers the money to another account,
• and ultimately purchases cryptocurrency.

The fact that the money later became cryptocurrency does not eliminate the bank’s potential responsibility.

The main issue remains whether the bank permitted an unauthorized banking transaction.

Turkish case law generally recognizes that banks must maintain contemporary technological security measures and may be responsible when funds are transferred without the customer’s genuine authorization.

The customer may nevertheless bear contributory fault if, for example, passwords, verification codes or security information were negligently disclosed. The Court of Cassation has recognized that such conduct may reduce compensation under the principles of contributory negligence.

Thus, an unauthorized banking fraud case is usually analyzed through:

1. whether genuine authorization existed,
2. whether bank security measures were sufficient,
3. whether the customer contributed to the loss,
4. whether unusual transactions should have triggered additional controls.

10. A Crucial Distinction: What If the Customer Personally Authorized the Transfer?

This is where many crypto fraud claims become difficult.

Suppose a fraudster calls the victim and pretends to be:

• a bank officer,
• a police officer,
• an investment adviser,
• a crypto analyst,
• an employee of a well-known exchange.

The victim is persuaded to log into their own banking application and personally transfer the money.

The transaction is legally different from an account takeover.

A particularly important example is the decision of the Court of Cassation 11th Civil Chamber dated 6 June 2024, E. 2023/1184, K. 2024/4757.

In that case, the victim had been deceived through voice phishing. However, the disputed banking operations—including the transfers—had been performed personally by the claimant through the registered device and authentication mechanisms. The lower courts found no attributable fault on the bank, and the Court of Cassation upheld the rejection of the claim.

This decision demonstrates an important practical rule:

Being the victim of fraud does not automatically make the bank liable if the customer personally instructed the bank to execute the transfer.

Therefore, a lawsuit against the bank must identify an independent breach by the bank.

11. When Can the Bank Still Be Liable Even If the Customer Initiated the Transfer?

Customer authorization does not necessarily end every case.

Bank liability may still be argued where additional circumstances exist.

For example:

• the customer expressly notified the bank of suspected fraud before completion of later transactions;
• transfers were dramatically inconsistent with the customer’s previous banking profile;
• multiple unusual events occurred simultaneously;
• substantial instant credit was issued immediately before unusual transfers;
• a new recipient was added and the account was immediately emptied;
• security limits were increased abnormally;
• the bank ignored an active fraud notification;
• technical or regulatory controls were improperly bypassed.

The stronger the evidence that the bank had actual or constructive knowledge of a fraud risk, the stronger the potential negligence argument.

Nevertheless, the recent Court of Cassation decision shows that courts will not treat banks as universal insurers against every mistake induced by social engineering.

12. What About the Bank Receiving the Fraud Proceeds?

Another frequently overlooked defendant is the bank holding the fraudster’s account.

Many crypto scams use “mule accounts.”

For example:

• a newly opened account receives money from dozens of unrelated persons,
• funds are immediately transferred elsewhere,
• the account has no economic activity consistent with the transaction volume,
• money is systematically converted into cryptocurrency.

Such patterns may raise questions concerning customer due diligence and AML monitoring.

However, proving civil liability against the receiving bank is generally more difficult than proving liability against the victim’s own bank.

The claimant must normally establish:

1. a specific duty breached by the receiving bank,
2. that the breach was legally relevant to protecting against the type of loss suffered,
3. causation between the breach and the inability to recover the money.

The existence of AML obligations alone should therefore not be treated as an automatic guarantee that the victim will recover compensation from the receiving bank.

13. Is the Crypto Exchange Liable When the Victim Personally Sends Crypto to the Scammer?

Again, not automatically.

Suppose the investor personally:

• opens an exchange account,
• deposits money,
• purchases USDT,
• enters the fraudster’s wallet address,
• confirms the withdrawal with multi-factor authentication.

If the platform has complied with all regulatory and contractual obligations, proving exchange liability may be difficult.

The platform is not generally responsible for guaranteeing that every external wallet chosen by a customer belongs to a legitimate investment company.

However, the analysis can change if:

• the receiving wallet has already been flagged as associated with fraud,
• the customer’s transaction pattern is extraordinarily unusual,
• platform security measures were bypassed,
• legally required transfer waiting periods were ignored,
• the customer contacted the platform before withdrawal,
• the platform failed to respond to a freeze request,
• the fraud occurred through a user account controlled by the same exchange,
• the exchange failed to comply with KYC or transfer regulations.

Therefore, technical transaction data becomes central.

14. Evidence That Should Be Preserved Immediately

Crypto fraud cases are often won or lost during the first days after the incident.

Victims should preserve:

• bank transfer receipts,
• IBAN numbers,
• recipient names,
• crypto exchange account details,
• wallet addresses,
• transaction hashes,
• blockchain transaction URLs or records,
• screenshots of account balances,
• e-mails,
• SMS messages,
• WhatsApp and Telegram correspondence,
• phone numbers,
• social-media profiles,
• website URLs,
• advertisements,
• IP-related information if available,
• exchange support tickets,
• fraud notifications sent to the bank or exchange,
• exact timestamps.

The transaction hash is particularly important because blockchain records can allow investigators to follow the movement of cryptocurrency even where the identity of the wallet owner is not immediately known.

15. What Should Be Requested From the Exchange?

A lawyer acting for a victim should consider requesting preservation of:

• account-opening documents,
• KYC records,
• login logs,
• IP addresses,
• device information,
• two-factor-authentication records,
• security-setting changes,
• wallet-whitelisting history,
• withdrawal approval logs,
• internal fraud alerts,
• transaction-monitoring alerts,
• deposit and withdrawal history,
• wallet ownership information,
• related customer accounts.

Where the fraudulent crypto has entered another centralized exchange, identifying that exchange quickly can be decisive.

If the assets remain within a custodial exchange, freezing may still be technically possible.

Once assets have passed through several self-custody wallets, mixers, bridges or privacy-enhancing services, recovery becomes substantially more difficult.

16. A Criminal Complaint Should Usually Be Filed Quickly

Civil proceedings are only one part of the recovery strategy.

Crypto investment fraud may constitute aggravated fraud depending on the method employed, particularly where information systems, banking systems or digital technologies are used.

A criminal investigation may allow authorities to request:

• account-holder information,
• banking records,
• exchange KYC files,
• telephone records,
• IP information,
• asset movements,
• seizure of assets,
• digital forensic examination.

Where the legal conditions are satisfied, measures concerning seizure of assets may also become relevant.

For practical recovery purposes, speed can be more important than the final criminal conviction.

The primary objective during the first phase is often to identify and preserve recoverable assets before they disappear.

17. Can the Victim Obtain an Injunction or Attachment?

Depending on the circumstances, several provisional protection mechanisms may be considered.

Where the responsible person’s identity and monetary liability can be demonstrated, a creditor may evaluate a request for provisional attachment (ihtiyati haciz) under the Enforcement and Bankruptcy Law.

In other circumstances, an interim injunction (ihtiyati tedbir) may be appropriate.

In the criminal investigation, seizure mechanisms under the Criminal Procedure Code may provide a more effective route where assets constitute proceeds of crime.

The correct procedural tool depends on:

• whether the defendant has been identified,
• the nature of the claim,
• where the assets are located,
• whether the property belongs to the suspect,
• whether the relevant crypto assets remain on an exchange.

18. What If the Exchange Is Located Abroad?

Foreign exchanges present additional difficulties.

Law No. 7518 expressly addresses foreign platforms targeting persons resident in Türkiye.

Activities directed at Turkish residents by foreign platforms may constitute unauthorized crypto asset service provision where statutory conditions are met. The legislation specifically considers factors such as establishing a place of business in Türkiye, operating a Turkish-language website, or conducting marketing activities directed at Turkish residents.

However, establishing regulatory infringement and actually recovering money are two different problems.

Cross-border cases may require:

• determining the exchange’s legal entity,
• identifying its country of incorporation,
• analysing its terms of service,
• determining jurisdiction,
• identifying the applicable law,
• obtaining foreign disclosure,
• seeking international criminal cooperation,
• enforcing a Turkish judgment abroad.

Therefore, early identification of the actual corporate entity behind the platform is essential.

19. Crypto Investors Are Not Covered by the Ordinary Investor Compensation System

Another important point concerns expectations of compensation.

The Capital Markets Law expressly provides that crypto assets are not covered by the investor compensation mechanism applicable under Article 82. In addition, crypto assets and related customer cash held within the statutory custody structure are not automatically protected by the ordinary deposit insurance regime applicable to bank deposits.

This makes direct liability claims against the responsible exchange, bank, fraudster or other relevant persons particularly important.

There is no general state guarantee that reimburses every crypto fraud victim.

20. Who Should Be Sued?

A properly structured crypto fraud case should not automatically be filed against every institution appearing in the transaction chain.

Possible defendants may include:

• the fraudster,
• the holder of the receiving bank account,
• persons controlling mule accounts,
• the crypto exchange,
• the custody provider,
• the victim’s bank,
• the receiving bank,
• corporate entities operating the fraudulent platform,
• directors or personnel in exceptional statutory circumstances.

The strongest defendant will depend on where the legally relevant failure occurred.

21. A Practical Liability Test for Lawyers and Victims

When analysing a crypto fraud file, the following questions should be answered chronologically:

First: Who actually performed each transaction?

Was it the victim, a fraudster or an automated system?

Second: Was the transaction genuinely authorized?

Entering the correct password does not necessarily prove genuine customer authorization if the account itself was compromised.

Third: What warning signals existed?

Examples include:

• new device,
• new IP address,
• new country,
• SIM change,
• password reset,
• new withdrawal address,
• exceptionally large transaction,
• account emptied in one session.

Fourth: Which institution could technically stop the transaction?

A bank, exchange and self-custody wallet have fundamentally different levels of control.

Fifth: Was that institution notified before the loss became irreversible?

Precise timestamps are critical.

Sixth: Which regulatory rule applied?

The analysis may include:

• Capital Markets Law No. 6362,
• Law No. 7518,
• SPK Communiqués III-35/B.1 and III-35/B.2,
• MASAK legislation,
• Turkish Code of Obligations,
• Turkish Commercial Code,
• banking regulations,
• consumer law,
• criminal law.

Seventh: Would compliance with the rule probably have prevented the loss?

This is the causation question.

22. Who Has the Strongest Case?

As a general practical assessment:

Strong Case Against the Exchange

The investor’s exchange account was hacked and assets were withdrawn because security controls failed.

Potentially Strong Case Against the Bank

The customer’s banking account was accessed without authorization and funds were transferred despite inadequate security measures.

Fact-Dependent Case

The victim informed the bank or exchange during the fraud, but the institution failed to stop transactions that were still preventable.

More Difficult Case

The victim personally authorized all banking and crypto transactions after being deceived by a third-party scammer, while the bank and exchange complied with applicable security requirements.

The Court of Cassation’s 2024 decision demonstrates the difficulty of the last scenario.

23. Final Assessment: “Blockchain Transactions Cannot Be Reversed” Is Not the End of the Legal Analysis

Crypto fraud litigation should not focus exclusively on whether a blockchain transfer can technically be reversed.

The real question is whether someone legally responsible allowed the assets to leave when the transaction should have been detected, delayed, rejected or stopped.

Turkey’s post-2024 regulatory framework materially strengthens this analysis.

Crypto asset service providers are now subject to explicit obligations concerning:

• secure systems,
• internal controls,
• technological infrastructure,
• customer identification,
• transfer authentication,
• custody,
• transaction records,
• risk management,
• complaint mechanisms.

The Capital Markets Law also expressly imposes responsibility for certain unlawful activities, failures to deliver customer assets, cybersecurity breaches and information-security failures.

Banks, meanwhile, continue to be treated by Turkish courts as institutions of trust subject to an aggravated duty of care. But this does not mean that a bank automatically becomes liable whenever a customer voluntarily transfers funds after being deceived. The decisive issue is whether there was an independent failure attributable to the bank.

For this reason, a successful crypto fraud recovery strategy should normally combine three separate tracks:

asset tracing, criminal investigation and civil liability analysis.

The sooner these steps begin, the greater the possibility of identifying the destination of the assets, obtaining KYC information, freezing funds still held by centralized institutions and preserving evidence necessary for a compensation claim.

In modern crypto fraud litigation, the blockchain may make a transfer irreversible—but it does not necessarily make the resulting financial loss legally irrecoverable.