Nova Scotia Judge Orders Bitcoin Wallet Returned in Sandeson Case, Highlighting Proof Gap in Crypto Forfeitures

A Nova Scotia Supreme Court ruling just put a fine point on an issue courts keep grappling with: when can the state keep crypto it seizes? Justice John Bodurtha ordered that a laptop containing a Bitcoin wallet be returned to the family of William Sandeson, who was convicted in the 2015 killing of Dalhousie University student Taylor Samson. The judge found the Crown had not demonstrated the Bitcoin was connected to the crime. The disputed wallet—valued anywhere from C$8,000 to over C$200,000 depending on timing—also sat at the center of a wrongful death suit filed by Samson’s family.

What matters here isn’t the valuation spread or even the hardware. It’s the evidentiary threshold. Traditional asset forfeiture often leans on bank records and identifiable cash flows. With Bitcoin, prosecutors need to bridge a different gap: translating on-chain activity and device-level artifacts into a narrative that meets the court’s standard of proof. When that bridge is incomplete, property tends to go back.

Why the proof often falls short: - On-chain heuristics are probabilistic. Address clustering, UTXO tracing, and common-spend analysis can suggest—but not conclusively establish—ownership or intent without corroboration. - Device forensics can be ambiguous. A wallet.dat file, seed phrase remnants, or client metadata on a laptop point to potential control, yet they don’t, on their own, bind specific coins to specific crimes without time-stamped transaction evidence and exchange linkage. - Fiat touchpoints matter. Without exchange KYC records, banking trails, or counterparties tying the wallet’s inflows/outflows to the alleged act, the story remains circumstantial.

The psychological layer cuts both ways. Judges and juries often see crypto as either inherently suspect or inherently sovereign. Either bias can cloud the core question: can the state actually prove this set of coins is proceeds of, or instrumental to, a crime? In this case, the court said no.

Business-wise, this decision nudges investigators and litigants toward better crypto-native workflows: - Preserve chain-of-custody for digital artifacts the way one would for physical evidence. - Pair blockchain analytics with off-chain subpoenas—exchanges, messaging apps, marketplaces—so the on-chain graph isn’t standing alone. - Timestamp and document market prices around alleged offense windows to reduce valuation ambiguity that can distract from provenance.

There’s also an ethical tension. Victims’ families understandably seek recovery wherever assets exist. Yet property rights do not vanish because an asset is digital or volatile. When proof is thin, seizure morphs into punishment by presumption, which courts tend to resist. That’s especially true when values swing from C$8,000 to C$200,000+—volatility shouldn’t silently tax due process.

For crypto holders, clear records, labeled addresses, and documented custody can prevent misattribution. For prosecutors, tighter linkage—device logs aligned with on-chain timestamps, counterparties identified via KYC, and corroborating communications—will likely be the difference between forfeiture and return.

This ruling doesn’t make Bitcoin untouchable; it simply reaffirms that digital assets live under the same rule of law. If the state wants the coins, it needs the receipts.