Time limits for crypto recovery: how long do you have to act?

A client contacted us two years after losing $75,000 in a crypto investment scam. She had spent those two years hoping the police would investigate, waiting for a call that never came. When she finally decided to pursue private recovery, we traced the funds and identified the scammer's exchange account. But when we filed the civil claim, the court dismissed it — the statute of limitations had expired. The scammer walked away with the money because the victim waited too long.

Statutes of limitation are legal deadlines — the maximum time after an event within which legal proceedings must be initiated. Once the deadline passes, the claim is "time-barred" and can no longer be pursued, regardless of how strong the evidence is. In crypto fraud cases, the statute of limitations is one of the most important legal concepts to understand, because it interacts with the practical reality that crypto recovery takes time. If you start recovery efforts too late, you may trace the funds, identify the scammer, and prepare a perfect legal case — only to have it dismissed because the deadline has passed.

In this article, I explain the statutes of limitation that apply to crypto fraud cases in Switzerland, Germany, the United Kingdom, and the United States. I also explain when the clock starts (it is not always when the scam happened), the exceptions that can extend the deadline, and practical advice for ensuring your claim is filed in time.

When does the clock start?

The statute of limitations clock typically starts running when the claim "accrues" — that is, when the victim has the right to bring a claim. In crypto fraud cases, there are two possible starting points:

• When the fraud occurred: In many jurisdictions, the clock starts when the fraudulent act occurred (when the victim sent the cryptocurrency to the scammer). This is the stricter interpretation and gives the victim the least time.
• When the victim discovered the fraud: In some jurisdictions, the clock starts when the victim discovered, or should have discovered, that they were defrauded. This is the "discovery rule" and gives the victim more time — but it requires proving when the victim became aware of the fraud.

The discovery rule is particularly relevant in crypto cases because many victims do not realize they have been scammed for months. Pig butchering scams, for example, often involve months of relationship-building before the victim is asked to invest. The victim may not realize they have been scammed until the fake platform stops responding or the scammer disappears. In these cases, the statute of limitations may start from the date of discovery, not the date of the last transfer.

However, the discovery rule has limits. Most jurisdictions apply a "statute of repose" — an absolute deadline that applies regardless of when the victim discovered the fraud. For example, in the US, the statute of repose for fraud claims may be 10 years from the date of the fraudulent act, regardless of when the victim discovered it.

Switzerland: 10 years for civil claims

In Switzerland, the statute of limitations for civil claims based on fraud is 10 years from the date the claim accrued (Article 127 of the Swiss Code of Obligations). The claim typically accrues when the fraud occurs — when the victim sends the cryptocurrency to the scammer. However, if the victim was unaware of the fraud (and could not reasonably have been aware), the clock may start from the date of discovery.

Swiss law also has a "relative" statute of limitations of 1 year from the date the victim became aware of the claim and the debtor (Article 128 CO). This means that once the victim knows they have been defrauded and knows the identity of the scammer, they have 1 year to file a claim. However, the absolute deadline of 10 years applies regardless — even if the victim discovers the fraud after 9 years, they have 1 year to file (10 years from the date of the fraud).

For criminal cases, the statute of limitations depends on the severity of the crime. Fraud (Article 146 of the Swiss Criminal Code) is punishable by up to 5 years imprisonment or a fine, and the criminal statute of limitations is 7 years (Article 97 SCC). For qualified fraud (involving commercial or organized activity), the sentence can be up to 10 years, and the statute of limitations is 15 years.

Germany: 3 years for civil, 5-10 years for criminal

In Germany, the civil statute of limitations for fraud claims is 3 years from the end of the year in which the claim accrued and the victim became aware of the circumstances giving rise to the claim and the identity of the defendant (Section 195 of the German Civil Code, BGB). This means that if the fraud occurred on June 15, 2024, and the victim discovered it on August 1, 2024, the 3-year clock starts on December 31, 2024, and the deadline is December 31, 2027.

The 3-year period is relatively short compared to other jurisdictions. German victims of crypto fraud must act quickly to preserve their civil claims. However, the 10-year absolute statute of repose (Section 199 BGB) applies as a backstop — even if the victim discovers the fraud after 9 years, they have 1 year to file (10 years from the end of the year of the fraudulent act).

For criminal cases, the statute of limitations for fraud (Section 263 StGB) is 5 years for simple fraud and 10 years for commercial fraud. The criminal clock starts from the date of the criminal act, not from the date of discovery.

Germany's 3-year civil deadline is one of the shortest among major jurisdictions. If you are a German resident and have been scammed, do not wait — engage legal counsel and file your claim as soon as possible. If you are approaching the 3-year deadline, file a "conciliation attempt" (Mahnung) to stop the clock (Section 203 BGB) — this pauses the statute of limitations while the conciliation is pending.

United Kingdom: 6 years for civil, no limit for criminal

In the UK, the civil statute of limitations for fraud claims is 6 years from the date the cause of action accrued (Section 2 of the Limitation Act 1980). For fraud, the cause of action accrues when the fraudulent act causes the victim to suffer loss — typically when the victim sends the cryptocurrency to the scammer. However, Section 32 of the Limitation Act provides that the limitation period does not start until the victim has discovered the fraud (or could reasonably have discovered it).

This means that in the UK, the 6-year clock starts from the date of discovery, not the date of the fraud. This gives UK victims significantly more time than German victims. A victim who discovers a fraud 3 years after it occurred has 6 years from the date of discovery to file a claim.

For criminal cases, there is no statute of limitations for indictable offenses (which include serious fraud) in the UK. This means that the Crown Prosecution Service can prosecute fraud cases regardless of how much time has passed. In practice, however, old cases are harder to prosecute because evidence degrades over time.

United States: 2-6 years depending on jurisdiction and claim type

In the United States, statutes of limitation vary by state and by the type of claim. For civil fraud claims:

• Federal claims: Claims under federal securities laws (Section 10(b) of the Securities Exchange Act) have a 2-year statute of limitations from the date of discovery, with a 5-year statute of repose from the date of the violation.
• State claims: State fraud claims vary widely. California has a 3-year statute for fraud (from discovery). New York has a 2-year statute for fraud (from discovery) or 6 years (from the fraudulent act), whichever is shorter. Texas has a 4-year statute. Florida has a 4-year statute.
• Contractual claims: If the fraud involved a contract (e.g., the victim entered into a contract with the scammer), the statute of limitations for breach of contract may apply, which is typically longer (4-6 years).
• Conversion claims: Conversion (the civil equivalent of theft) typically has the same statute of limitations as fraud, but some states have longer periods for property claims.

For criminal cases, the statute of limitations for federal fraud is 5 years (18 U.S.C. Section 3282). For wire fraud and mail fraud (which are the most common charges in crypto cases), the 5-year period applies. For more serious offenses (e.g., involving organized crime or terrorism), longer periods may apply.

The US also has the Racketeer Influenced and Corrupt Organizations Act (RICO), which allows for civil claims against organized criminal enterprises. RICO claims have a 4-year statute of limitations and can be useful in cases involving organized crypto fraud rings (e.g., pig butchering operations run by organized crime).

The practical reality: time is the scammer's best friend

Regardless of the statutory deadline, the practical reality is that recovery becomes harder with every passing day. The statutory deadline is the outer limit — the maximum time you have to file a legal claim. But the effective deadline for recovery is much shorter:

• 24 hours: If you act within 24 hours of the scam, you have the best chance of freezing the funds before the scammer moves them. Exchange freeze requests are most effective when sent immediately.
• 72 hours: Within 72 hours, the funds have typically been moved through multiple wallets and possibly through a mixer or bridge. Recovery is harder but still possible if the funds end up at a compliant exchange.
• 1 week: After a week, the funds are likely at an exchange or OTC broker. Tracing is still possible, but the scammer has had time to prepare for withdrawal.
• 1 month: After a month, the funds are likely cashed out. Blockchain tracing can still identify where the funds went, but recovery requires legal action (court orders, law enforcement seizure).
• 6 months: After 6 months, the funds are long gone. The trail is cold, the scammer has likely covered their tracks, and recovery requires significant forensic and legal effort.
• 1+ years: After a year or more, recovery is extremely difficult. The statutory deadline may still be far off, but the practical obstacles are enormous. The blockchain evidence is still there (transactions are permanent), but connecting it to a real-world identity becomes much harder.

The lesson is clear: do not wait. The statutory deadline is not the relevant deadline — the practical deadline for effective recovery is measured in hours and days, not years. File your police report, contact legal counsel, and begin tracing immediately.

Exceptions and tolling

In some circumstances, the statute of limitations can be "tolled" (paused). Tolling applies when:

• The victim is a minor: In most jurisdictions, the statute of limitations does not run while the victim is under 18. The clock starts when the victim reaches adulthood.
• The defendant is absent or concealed: If the scammer's identity is unknown (which is common in crypto fraud), the statute may be tolled until the victim identifies the scammer. This is the "concealment" exception — if the scammer actively concealed their identity, the statute does not run until the identity is discovered.
• The victim is mentally incapacitated: If the victim is mentally incapacitated (e.g., due to illness), the statute may be tolled.
• Legal proceedings are pending: If the victim has initiated legal proceedings (even preliminary ones, like a conciliation attempt in Germany), the statute may be tolled while the proceedings are pending.

The concealment exception is particularly relevant in crypto fraud cases. If the scammer operated anonymously (using a wallet address with no known identity), the victim can argue that the statute of limitations did not start running until the scammer's identity was discovered (typically through a Norwich Pharmacal order or law enforcement investigation). This can extend the effective deadline by years.

Practical advice

Based on my experience, here is the practical advice for managing the time limits in crypto recovery:

• Do not wait: The most important advice. Regardless of the statutory deadline, the practical deadline is much shorter. Act immediately.
• File a police report: This establishes a timestamp and may toll the statute of limitations (as the beginning of legal proceedings).
• Consult a lawyer early: A lawyer can assess the applicable statute of limitations and ensure your claim is filed in time. Do not wait until the deadline is approaching — the lawyer needs time to prepare the case.
• File preliminary legal actions: If the deadline is approaching, file a preliminary legal action (a freeze request, a Norwich Pharmacal order application, or a conciliation attempt) to stop the clock. Your lawyer can advise on the best action for your jurisdiction.
• Document your discovery date: If you are relying on the discovery rule (which starts the clock from the date you discovered the fraud, not the date of the fraud), document when you discovered it. Save emails, messages, or notes that show when you first realized you were scammed.
• Keep the scammer's identity unknown: If you do not know the scammer's identity, do not guess. The concealment exception may apply, and the statute may be tolled until you identify the scammer through legal process.

Case study: the deadline that almost passed

A German client contacted us 2 years and 9 months after being scammed out of 8 BTC. Under German law, the civil statute of limitations was 3 years from the end of the year of discovery. The client discovered the fraud in January 2023, so the 3-year clock started on December 31, 2023, and the deadline was December 31, 2026. The client contacted us in September 2026 — 3 months before the deadline.

We immediately filed a conciliation attempt (Mahnung) with the German court, which tolled the statute of limitations. This gave us time to trace the funds (which had been moved through Thorchain to Ethereum, then to a Kraken deposit address), file a Norwich Pharmacal order to identify the Kraken account holder, and prepare the civil claim. The conciliation was pending while we completed the investigation, and we filed the full civil claim within 6 months — well before the extended deadline.

The client recovered 70% of the lost Bitcoin. If the client had waited 3 more months, the claim would have been time-barred. The lesson: even if you think you have plenty of time, you may not. Consult a lawyer early and file preliminary actions to protect your rights.

Cross-jurisdictional cases: which statute applies?

Crypto fraud cases often involve multiple jurisdictions — the victim is in one country, the exchange is in another, the scammer is in a third, and the blockchain exists nowhere. Which statute of limitation applies? The answer depends on the jurisdiction where the lawsuit is filed and the nature of the claim:

• If you file in your home country: The statute of limitation of your home country typically applies. A Swiss resident filing in Switzerland is subject to the 10-year Swiss deadline, regardless of where the scammer is located.
• If you file in the scammer's country: The statute of that country applies. If the scammer is in the UK and you file in the UK, the 6-year deadline applies.
• For international claims: If you file in a country other than where you or the scammer are located, the court may apply the statute of limitation of the country with the closest connection to the dispute. This is a complex area of private international law (conflict of laws) and requires legal advice specific to your case.

In practice, the best strategy is to file in the jurisdiction with the longest applicable statute of limitation and the strongest legal framework for crypto recovery. Switzerland is often a good choice — the 10-year civil deadline is one of the longest among major jurisdictions, and the Swiss legal framework for crypto (the DLT framework, FINMA supervision, fast provisional measures) is among the most developed. Germany, despite its short 3-year deadline, has a strong legal framework and courts that understand crypto. The UK offers the discovery rule (starting the clock from discovery rather than from the fraud date), giving victims more time. The US has a complex patchwork of state and federal deadlines that requires careful analysis. See our article on Swiss crypto law for more details.

The bottom line

Statutes of limitation set the outer deadline for pursuing crypto fraud recovery. In Switzerland, the civil deadline is 10 years. In Germany, it is 3 years from discovery. In the UK, it is 6 years from discovery. In the US, it varies by state (2-6 years). But the practical deadline is much shorter — effective recovery requires action within days or weeks, not years. The statutory deadline is the legal maximum, not the practical target. File your police report, contact legal counsel, and begin tracing immediately. The faster you act, the more options you have. The slower you act, the fewer doors remain open until none are left. File your police report, contact legal counsel, and begin tracing immediately. If the statutory deadline is approaching, file preliminary legal actions to toll the statute and protect your rights while you complete the investigation. The combination of prompt action, proper tolling, and strategic jurisdiction selection can make the difference between recovery and total loss. Many victims who contact us too late discover that their claims are time-barred and there is nothing we can do. Do not be one of them.

If you have been scammed and are concerned about time limits, contact us immediately. We can assess the applicable statute of limitations in your jurisdiction and ensure your claim is filed before the deadline. We can also file preliminary legal actions to toll the statute and protect your rights while we trace the funds and prepare the full case. Time is the one resource you cannot recover — once it is gone, your legal options are gone with it. Every day you wait is a day closer to losing your right to pursue recovery entirely. Do not let the deadline pass — act now.