Asset recovery for corporate fraud victims is time-critical work. When digital assets are misappropriated – whether through internal fraud, a counterparty default, an exchange insolvency or a coordinated theft – the window to freeze funds, compel disclosure and preserve evidence is measured in hours, not weeks. Asset recovery counsel operating in this environment must move across jurisdictions simultaneously: the stolen assets may travel through wallets in one country, an exchange registered in another and a beneficiary bank in a third. The legal question is not whether a remedy exists. It is whether counsel can reach the right forum, secure the right order and engage the right intermediaries before the trail goes cold.
This page maps the legal lifecycle of a corporate fraud-victim engagement at OBOLUS: the regimes that matter, the process we follow, the decisions a business facing misappropriation must make quickly and the forums we work in. It is written for general counsel, CFOs and boards who need to understand what recovery actually involves before the clock is already running.
The Recovery Window Is the First Strategic Question
The most important fact in digital-asset fraud is that on-chain assets move fast and irreversibly. Once a transaction is confirmed on-chain, the sending party has no unilateral recall right. Recovery therefore depends entirely on speed: speed of detection, speed of legal action and speed of engagement with exchanges and stablecoin issuers who can freeze at the contract level before a withdrawal clears.
In our disputes practice, we treat the first twenty-four to seventy-two hours of an engagement as a triage phase. We assess the transaction trail immediately, identify which assets are still accessible – whether on a centralised exchange, in a custodied wallet or denominated in a freezable stablecoin such as USDT (Tether) or USDC (Circle) – and determine which emergency relief is available in the relevant forum. Tether and Circle hold contract-level freeze authority over their issued tokens and generally act on a law-enforcement case reference or a court order. That means a properly filed application, supported by a forensic trace and a professional report, can result in a freeze before the beneficiary moves funds off the platform.
The AUDIENCE_PAIN is real and it shapes everything downstream: every hour of delay is a degree of separation between the stolen assets and a recoverable position. We build our process around that constraint.
What Is the Legal Toolkit for Digital-Asset Recovery?
Corporate fraud victims have access to a layered toolkit – but each instrument requires the right forum, the right facts and, in most cases, specialist on-chain evidence to deploy effectively.
A worldwide freezing order (an injunction freezing a defendant's assets globally, sometimes called a Mareva injunction) is the primary emergency instrument in common-law jurisdictions. England and Wales has long been the leading forum for crypto asset recovery: the courts there have confirmed that digital assets are property, issued freezing orders over wallets and exchange accounts, and developed the proprietary injunction for crypto contexts. The landmark decision in AA v Persons Unknown [2019] established that cryptocurrency is capable of being held as property under English law – a foundation that every subsequent recovery action in that forum has built on.
A Norwich Pharmacal order or Bankers Trust order is the disclosure instrument: it compels an exchange, custodian or bank to identify the account holder behind a wallet address or transaction. These orders are critical when the defendant is unknown or pseudonymous. In our practice, we regularly use disclosure applications in tandem with freezing relief – secure the freeze, then compel disclosure to identify the person behind the account.
Beyond England and Wales, the forums we work in include the DIFC Courts in Dubai, Singapore, Hong Kong and New York. The DIFC Courts have issued worldwide freezing orders in support of foreign proceedings and have shown a willingness to engage with crypto-specific fact patterns. In Hong Kong, the courts have recognised cryptocurrency as property and issued what is reported to be the first "tokenised" injunction. Singapore's courts have granted proprietary injunctions over digital assets. Each forum has its own procedural requirements; the choice of where to apply turns on where the defendant, the exchange or the assets are located.
How Does On-Chain Tracing Support a Legal Claim?
On-chain tracing is the evidentiary engine of every digital-asset recovery action. A court order without a coherent trace report is unlikely to survive challenge; a trace report without legal process to enforce it has no compulsive force. The two must work together.
On-chain forensics reconstruct the movement of assets from the victim's wallet through every intermediary address to the current location of the funds. Professional forensic providers use clustering algorithms, exchange deposit-address databases and risk-scoring models to connect pseudonymous addresses to identified entities. The output – a transaction-graph report with entity attribution – forms the evidentiary backbone of a freezing application or a disclosure request.
We work with forensic partners who can produce court-ready reports rapidly. The report must establish: the origin of the funds (the victim's wallet or account), the movement through intermediate addresses, and the current custodian – typically a centralised exchange, an OTC desk or a stablecoin issuer. Where the funds reach a regulated exchange, that exchange is subject to AML obligations under the applicable VASP (virtual asset service provider) regime – the FATF Travel Rule obliges VASPs to hold originator and beneficiary data for transactions above the applicable threshold – which means the exchange holds the KYC records needed to identify the account holder.
The forensic report also supports a direct approach to the exchange's compliance desk, which, alongside the legal process, can accelerate a voluntary hold. We coordinate both channels simultaneously.
To engage our disputes desk while the trail is still live, contact OBOLUS now at info@oboluslaw.com or via t.me/oboluslaw. The process above maps the standard path. Your facts – which assets, which exchange, which jurisdiction, how long since the event – change the analysis and the urgency level materially. Map your options before the window closes.
The Cross-Border Reality: Multiple Regimes, One Timeline
Most corporate crypto-fraud cases are multi-jurisdictional from the first transaction. The victim may be a company incorporated in one country, operating in another, banking in a third. The fraudster uses an exchange licensed in a fourth jurisdiction and bridges assets to a fifth. That structure is not accidental – it is often designed to frustrate recovery.
Effective counsel must therefore work across regimes simultaneously rather than sequentially. The practical checklist at the outset of any engagement includes: which court can grant the fastest freezing relief; which jurisdiction governs the exchange's disclosure obligations; whether the assets are in a form susceptible to a stablecoin issuer freeze; whether an OFAC designation or equivalent sanctions measure is available or has already been triggered; and whether allied counsel in the relevant jurisdiction needs to be briefed for parallel proceedings.
In our cross-border practice, we have managed matters where proceedings ran concurrently in two common-law forums while simultaneously engaging stablecoin issuers and exchange compliance teams across three time zones. The coordination burden is significant. The alternative – sequential applications, one jurisdiction at a time – is almost always too slow for digital assets.
The cross-border dimension also creates a risk that courts may decline jurisdiction or decline to assist if the victim's evidence is not tailored to the forum's procedural expectations. A freezing application drafted for an English court does not translate directly to Singapore or Hong Kong without adjustment. We draft for the specific forum from the outset.
Decision Matrix: Which Approach Fits Your Situation?
Not every fraud victim has the same fact pattern. The appropriate strategy depends on where the assets are, who the defendant is and how much time has passed. The following matrix describes four common profiles and the likely approach for each.
Profile A – Assets on a regulated centralised exchange, defendant unknown, under 48 hours since the theft. This is the best-case scenario for recovery. The priority is a parallel action: a direct approach to the exchange's compliance desk with forensic evidence, a freezing application in the most proximate common-law forum and, if the assets are in USDT or USDC, a simultaneous request to the stablecoin issuer. Timeline to a freeze is potentially a matter of hours to a few days. Key risk: the exchange operates outside a common-law jurisdiction and its cooperation is discretionary.
Profile B – Assets bridged to multiple wallets, partially on-chain in self-custody, defendant identity partially known. The trace is more complex and the freeze more difficult to target. The priority shifts to a disclosure order against any known exchange that the assets passed through, and a proprietary injunction over the identified wallets. Timeline is longer – typically weeks for the disclosure process. Key risk: the defendant moves remaining assets before the order is served.
Profile C – Internal fraud by an employee or director, assets moved to personal accounts and converted, discovered weeks later. The on-chain trail may be partially cold. The priority is a worldwide freezing order over all the defendant's assets (not just the crypto), civil asset tracing across banking and crypto accounts together and, where appropriate, a criminal referral to accelerate exchange cooperation. Key risk: the delay means assets may already have been dissipated.
Profile D – Exchange insolvency or counterparty default with assets owed to the victim held by the insolvent estate. This is an insolvency and restructuring question rather than a pure fraud-recovery action. The priority is filing a proprietary claim in the insolvency to distinguish the victim's assets from the general pool. Key risk: the insolvency estate treats all crypto as fungible estate property unless the victim can establish a proprietary interest.
What Mistakes Do Fraud Victims Most Commonly Make?
The most damaging mistake is delay. A business that spends the first forty-eight hours internally deliberating – gathering evidence, escalating approvals, briefing internal counsel who have not handled crypto recovery – typically loses the optimal window for a stablecoin freeze or an exchange hold. Every hour matters.
The second most common mistake is treating the matter as a domestic dispute. If the assets have left the jurisdiction, domestic-only counsel cannot help efficiently. Multi-jurisdictional cases require counsel who can identify the right forum quickly and engage allied counsel in parallel where needed.
A third mistake is contacting the exchange without legal process. A direct contact from a fraud victim, without a legal hold request or a court order, may trigger the account holder's awareness that proceedings are coming. We coordinate exchange engagement as part of the legal strategy, not as a first step taken independently.
Finally, some clients assume that a forensic trace by itself constitutes a claim. It does not. On-chain tracing is evidence. It must be converted into legal process – a pleading, an application, an affidavit – before it has any compulsive force against a third party.
A common assumption in this area is that once funds leave a wallet, nothing can be done. That is the myth we work against daily. Blockchain's transparency is the victim's structural advantage: every movement is recorded, every address potentially attributable, every exchange subject to legal process. The question is whether counsel moves fast enough to use that advantage before the trail crosses into a non-cooperative jurisdiction or the assets are converted to cash.
A Recent Recovery Matter: Stablecoin Freeze Across Two Exchanges
In a recent engagement, a digital-asset payments company discovered in the early hours of a weekday morning that a significant balance of stablecoins – denominated in USDT – had been moved without authorisation from a custodied account. We were briefed within hours of detection. Working with a forensic partner, we traced the assets through two intermediate wallets to deposit addresses at two regulated exchanges in different jurisdictions.
We filed an emergency without-notice freezing application in a leading common-law forum the same morning, supported by a forensic transaction-graph report and an affidavit from the client's operations lead. Simultaneously, we coordinated a direct legal hold request to both exchanges' compliance desks, citing the pending court application. We also engaged the stablecoin issuer with the transaction hash, a professional forensic report and the case reference number from the court filing.
Within two business days, the issuer had frozen the identified wallet addresses at the contract level, and both exchanges had placed voluntary holds pending service of the court order. The freezing order was granted without notice and served on the exchanges before the end of the week. The matter moved to a contested hearing at which the defendant's identity – disclosed by one exchange under a Norwich Pharmacal-style order – was confirmed. The client recovered a seven-figure position. No specific timeline beyond what is stated here can be guaranteed; the speed in this matter reflected the facts and the promptness of the initial instruction.
The CFAAR Network and Professional Infrastructure
The CFAAR (Crypto Fraud and Asset Recovery network), launched in London in September 2021, connects lawyers, forensic providers and insolvency practitioners who specialise in digital-asset recovery across common-law jurisdictions. Membership of that professional community matters for victims because it means counsel has established relationships with forensic partners, exchange compliance teams and courts that have handled crypto cases before.
Recovery actions that fail often do so not for lack of legal theory but for lack of operational coordination: the right court order obtained a day too late, a forensic report that does not meet the court's evidentiary standard or an exchange approached through the wrong channel. Professional infrastructure – established working relationships with the people and institutions that sit between a court order and a frozen wallet – is as important as the legal argument itself.
In our disputes practice, we maintain direct working relationships with forensic providers who can produce court-ready reports at pace and who have operational relationships with major exchanges. We do not outsource the coordination of those relationships to the client at a moment of crisis.
If you have already engaged a forensic provider or have a case reference from a prior attempt that stalled, our disputes team can review the existing position and advise on the path forward. A second read on a stalled recovery frequently surfaces the structural reason the first application did not proceed. Contact OBOLUS at info@oboluslaw.com or map your options here.
Self-Assessment Checklist Before You Brief Counsel
When you contact recovery counsel, the following information materially accelerates the triage phase. Not all of it will be available immediately – that is understood. But the more of it you have, the faster the legal analysis moves.
- The transaction hash or hashes for the unauthorised movement.
- The wallet addresses involved (sender and recipient, as far as known).
- The approximate time and date of the movement.
- The denomination and approximate volume of the assets affected.
- Whether any of the assets are stablecoins (USDT, USDC or similar).
- The name and jurisdiction of any exchange through which the assets passed.
- Any prior contact made with the exchange or any other party about the incident.
- Whether a police or law-enforcement report has been filed and, if so, the reference number.
- The corporate structure of the victim entity and the jurisdiction of its principal operations.
- Whether the fraud involved an internal actor, an external counterparty or a third-party attacker.
This list is not exhaustive. We will ask for more once the matter is live. The purpose is to ensure that the triage call is productive rather than preliminary.
Related at OBOLUS
- Disputes and Asset Recovery for Digital-Asset Businesses – our full practice overview for exchange operators, custodians and funds facing legal disputes.
- Jurisdiction and Service in Anonymous-Defendant Cases – a detailed analysis of how courts handle service on unknown defendants in crypto fraud matters.
- Correspondent Banking Access in Luxembourg – how digital-asset businesses structure their banking relationships in a leading EU jurisdiction.
FAQ
Can stolen crypto actually be recovered?
Yes – in the right circumstances. Recovery depends on speed, the form of the stolen assets and the jurisdiction of the exchange or custodian holding them. Where assets remain on a regulated exchange or in a freezable stablecoin, a court order or a direct legal hold request can stop movement. Blockchain's transparency means the trail rarely disappears entirely; the question is whether counsel acts before the assets move to a non-cooperative jurisdiction or are converted. No outcome can be guaranteed, but recovery is achievable in a meaningful proportion of properly handled cases.
How fast must I act after a digital-asset theft?
The first twenty-four to seventy-two hours are the critical window. Stablecoin issuers can freeze at the contract level rapidly, but they require a transaction hash, a professional forensic report and typically a law-enforcement reference or pending court application. Exchanges place voluntary holds more readily when approached within hours of the incident while the deposited funds have not yet been withdrawn. Courts in leading common-law forums can grant without-notice freezing relief within a business day when the application is properly supported. Every hour of delay reduces the options available.
Can a court freeze assets held on an exchange?
Yes. Courts in England and Wales, Singapore, Hong Kong and the DIFC regularly issue freezing orders that extend to assets held at named exchanges. A worldwide freezing order covers all of a defendant's assets, wherever located, including exchange accounts. Separately, a Norwich Pharmacal or disclosure order can compel the exchange to identify the account holder. Most regulated exchanges in common-law jurisdictions will comply with a properly served court order; the practical challenge is obtaining and serving the order before assets are withdrawn. We handle both the court process and the direct exchange engagement simultaneously.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions, on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance structures that sit around them. Digital assets are the whole of our practice – not a sub-group within a general commercial department. We move for freezing relief and exchange disclosure while the trail is live. To discuss your recovery situation under NDA, contact info@oboluslaw.com or message us via t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specialist in cross-border digital-asset fraud recovery, on-chain tracing and emergency injunctive relief across common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.