Recovery of misappropriated digital assets is legally possible in multiple jurisdictions – but the window to act is measured in hours, not weeks. Courts in England and Wales, Singapore, Hong Kong and the DIFC have each confirmed that cryptoassets constitute property capable of being frozen, traced and returned. The legal question is not whether a remedy exists. It is whether counsel can reach the right forum, with the right evidence, before the funds move again.
This analysis maps the legal lines: where the property classification sits, which forums grant relief fastest, how cross-border enforcement actually works, and where a recovery attempt is most likely to stall. It is written for the general counsel or founder of a business that has suffered a digital-asset loss – and needs to know, right now, what is achievable and why.
Are Cryptoassets Property? The Foundation Every Recovery Rests On
Cryptoassets are recognised as property in the leading common-law recovery forums – a classification that was contested a decade ago but is now settled in the jurisdictions that matter most for business recovery. Without property status, there is no basis for a proprietary injunction, no constructive trust claim and no foundation for the freezing relief that stops funds disappearing offshore.
England and Wales reached that conclusion in AA v Persons Unknown [2019], where the High Court confirmed that Bitcoin satisfies the requirements of property under English law. The HKCFI followed in Re Gatecoin [2023] HKCFI 914, treating crypto held on an insolvent exchange as property belonging to customers. Singapore's High Court in CLM v CLN [2022] SGHC 46 granted a proprietary injunction over cryptocurrency, reinforcing the same position. The DIFC Courts have since granted worldwide freezing orders in support of foreign proceedings – a material development for UAE-seated businesses.
The practical consequence is direct: a business that has suffered theft or fraud involving digital assets can apply to these courts for injunctive relief on the same basis it would pursue any high-value commercial dispute. The challenge is speed and evidence, not legal theory.
Where property status is less settled – in certain civil-law systems and several emerging-market jurisdictions – the preferred route is typically to anchor proceedings in a common-law forum that has confirmed the classification, then use that forum's orders to compel disclosure from exchanges that operate under its regulatory reach.
Why the Recovery Window Is Hours, Not Weeks
The first twenty-four to seventy-two hours after a misappropriation are the period in which most recoveries either succeed or become impossible – because the architecture of public blockchains means that funds are visible, but not frozen, until a legal or contractual mechanism intervenes.
On-chain, every transfer is permanent and pseudonymous. A bad actor can move stolen assets through a series of wallets, bridge them to a different chain, swap them into a privacy coin or convert them to fiat at an exchange before any court order is served. Each of those steps reduces recoverability. The ledger is transparent – a professional forensic report can trace the movement – but transparency alone does not stop the funds.
Two mechanisms can interrupt the movement before a court order arrives. First, Tether (USDT) and Circle (USDC) each hold a contract-level freeze authority over tokens they have issued. Issuers generally act on a law-enforcement referral, a court order or an OFAC designation. A coordinated approach – legal counsel to the forum, compliance contact to the issuer simultaneously – is the fastest available intervention for stablecoin losses. Second, centralised exchanges can be compelled by a disclosure order or a court-directed freeze to hold balances pending litigation, but only if the funds have landed on an exchange that is reachable by the chosen forum's jurisdiction.
In our cross-border disputes practice, we have seen cases where a forty-eight-hour delay between discovery and legal engagement meant the funds had already left a reachable exchange and entered a mixer. The cost of that delay is not recoverable. This is the argument for having a recovery protocol in place before an incident, not after.
Recovery windows for misappropriated digital assets are measured in hours. If you have just discovered a loss and need immediate guidance on whether a freezing application is viable, contact OBOLUS at info@oboluslaw.com – or reach us directly via t.me/oboluslaw. The recovery clock is running.
How a Freezing Order Works Against Digital Assets
A freezing order in the context of digital-asset recovery operates in two directions simultaneously: it restrains the defendant from moving or dissipating assets, and it is typically served on exchanges and custodians who hold those assets on the defendant's behalf.
In England and Wales, a worldwide freezing order (an injunction freezing a defendant's assets globally) can be obtained on an ex parte basis – meaning without notice to the defendant – where there is a real risk of dissipation. The applicant must demonstrate a good arguable case, the existence of assets and that risk. The threshold is not beyond reasonable doubt; it is a realistic prospect of establishing the claim at trial. Courts in this jurisdiction have consistently applied that standard to crypto fraud fact-patterns.
A Norwich Pharmacal order (an order compelling a third party who has, innocently or otherwise, become involved in wrongdoing to disclose information identifying the wrongdoer) is the parallel tool for unmasking a pseudonymous counterparty. Served on a centralised exchange, it compels the exchange to produce KYC data, transaction records and IP logs associated with the relevant wallet addresses. This turns a pseudonymous blockchain trace into an identified defendant – the step that transforms a forensic report into a viable legal claim.
Singapore and Hong Kong have each granted equivalent disclosure and injunctive relief in crypto matters. The DIFC Courts have issued worldwide freezing orders with effect across the UAE free zones and increasingly in support of foreign-seated proceedings. For a business whose counterparty is based in the Gulf, or whose banking is in the UAE, the DIFC route can be faster than commencing in a distant common-law jurisdiction and then enforcing there.
The critical constraint in every forum is the quality of the underlying evidence. A court will not grant ex parte freezing relief on suspicion alone. A professional on-chain forensic report – mapping the transaction hashes from the victim wallet through the chain of subsequent addresses – is a practical prerequisite. Operators we advise routinely engage forensic specialists in parallel with counsel, so that the court application is supported from day one.
The Cross-Border Reality: Where Assets Sit vs. Where Courts Reach
The hardest structural problem in crypto asset recovery is not obtaining an order – it is enforcing it across the gap between where the court sits and where the assets are.
A London High Court worldwide freezing order has extraterritorial reach in principle, but it binds only parties who are within the court's personal jurisdiction and third parties who have notice of it. An exchange domiciled in a jurisdiction that does not recognise English court orders as directly enforceable must be separately approached through local counsel or through a parallel application in its home forum. That adds time – and time is the scarcest resource in a recovery.
The practical approach in our cross-border practice is to map the exchange landscape at the outset. Where are the relevant wallets? Which centralised exchanges have received funds? Are those exchanges regulated – and if so, by which authority? A regulated exchange under the Payment Services Act in Singapore, the VASP regime overseen by the SFC in Hong Kong, or VARA in Dubai is significantly easier to reach with a formal disclosure or freeze request than an unregulated offshore vehicle. Regulatory compliance creates leverage for a victim.
For businesses with a multi-jurisdiction footprint – an entity incorporated in the BVI, banking in Singapore, users across the EU – the question is which forum to anchor first. We analyse four variables: (1) where the majority of assets currently sit, (2) which forum has the fastest ex parte process, (3) which forum's orders are most likely to be recognised elsewhere, and (4) whether a VASP or stablecoin issuer with freeze authority holds any of the stolen balance. That analysis determines the sequencing, not a preference for any single jurisdiction.
Allied counsel in the relevant jurisdiction execute local steps. We coordinate the strategy across the chain. The CFAAR (Crypto Fraud and Asset Recovery network), launched in London in September 2021, has created a practitioner network that materially accelerates cross-border coordination – though recovery still depends on the jurisdiction-specific procedural steps being executed correctly.
The process above describes the standard cross-border architecture. Your facts – the exchange, the jurisdiction of your counterparty, the asset type – will change the routing. For a confidential assessment, write to info@oboluslaw.com.
What On-Chain Tracing Can and Cannot Do
On-chain tracing is a necessary condition for digital-asset recovery, but it is not sufficient on its own – the forensic output must be translated into a legal instrument before it freezes anything.
Public blockchains record every transaction permanently. A professional forensic analysis can follow stolen funds through multiple wallets, identify convergence points where balances were consolidated, flag known mixer or tumbler patterns, and pinpoint the moment funds arrived at a deposit address associated with a centralised exchange. Tools operated by specialist forensic firms achieve this in hours for most major chains.
What the trace cannot do, on its own, is identify the human behind a wallet address, compel an exchange to disclose account information or prevent a withdrawal. Those steps require legal process. The forensic report is the evidence that supports the legal application; it is not the application itself.
There is also a practical ceiling on traceability. Privacy coins and certain Layer 2 configurations reduce trace quality substantially. Cross-chain bridges complicate the picture by interrupting the ledger trail. Mixers and CoinJoin transactions can, depending on implementation, break the probabilistic link between input and output wallets. A forensic specialist will characterise the confidence level of the trace in their report; counsel must be candid with the court about that confidence level. Courts have accepted probabilistic tracing evidence, but the lower the confidence, the harder the ex parte application.
Regulators in the leading hubs increasingly expect exchanges to maintain full on-chain audit trails as part of their AML compliance obligations – under MiCA, the Payment Services Act and equivalent regimes. That expectation creates a secondary lever: an exchange that fails to retain records may face regulatory exposure of its own, which sharpens its incentive to cooperate with a properly framed disclosure request.
Which Legal Route Fits Which Profile?
The right recovery strategy depends on the asset type, the identity of the defendant and the jurisdiction of the exchange – not on a single preferred forum.
Profile A – Stablecoin theft, defendant unknown, funds on a major centralised exchange. The fastest path combines an emergency contact to the issuer (Tether or Circle, per the freeze-authority mechanism) with a parallel ex parte application in a common-law forum for a disclosure order against the exchange. England and Wales, Singapore or Hong Kong are the lead candidates, depending on which forum has jurisdictional reach over the exchange. Timeline is measured in days, not months, if the funds have not yet left the exchange.
Profile B – Mixed-asset theft (BTC, ETH, tokens), defendant partially identified, assets already moved through multiple wallets. A Norwich Pharmacal order against the exchange where funds arrived is the primary tool. A worldwide freezing order may follow once the defendant is identified. The forensic report is the threshold document. If assets have moved to a jurisdiction where a common-law court order is not directly enforceable, allied counsel in that forum must commence parallel proceedings. Timeline extends to weeks; the probability of full recovery decreases with each additional hop.
Profile C – Internal misappropriation (employee or counterparty, known identity), funds in a cold wallet or custodian. Here the identity problem is solved; the challenge is jurisdiction. If the custodian or the defendant is in a regulated jurisdiction – the UAE under VARA, Singapore under MAS, the UK under FCA registration – a well-drafted court application in that forum can compel the custodian to freeze and the defendant to disclose. The cross-border complication is typically the enforcement of any judgment, which requires local recognition proceedings.
Profile D – DeFi protocol or DEX, no identifiable counterparty, no custodian holding funds. This is the hardest case. On-chain tracing may terminate at a smart contract address with no human behind it that a court can reach. Recovery depends on funds eventually moving to a centralised exchange or a wallet controlled by someone within personal jurisdiction of a court. In our practice, we counsel clients on the realistic probability before they commit to the cost of proceedings – and in some cases the honest answer is that legal process cannot reach the funds in their current position.
A Common Assumption: Once the Funds Leave the Wallet, Nothing Can Be Done
This is the most consequential myth in digital-asset recovery – and it costs businesses the recovery window they might otherwise have used.
The assumption has a rational basis. Crypto transactions are irreversible at the protocol layer. There is no central bank to call. There is no payment-card chargeback mechanism. But irreversibility at the protocol layer does not mean irrecoverability at the legal layer. Courts do not reverse blockchain transactions. They freeze assets at the point of custody, compel exchanges to hold balances and order defendants to return funds from their own holdings – which may include but is not limited to the specific tokens that were stolen.
The cases decided in England and Wales, Hong Kong and Singapore confirm this. A defendant who receives stolen crypto holds it on constructive trust for the victim. The victim can trace the proprietary interest into assets that represent the stolen value, even if they have been converted. That tracing principle – applied by courts across multiple jurisdictions – is what makes recovery viable after the initial transfer.
The practical limit is not legal theory. It is the speed of the defendant's movement and the reach of the chosen forum. Where a defendant converts assets to cash and withdraws to an unregulated account in a non-cooperative jurisdiction, enforcement becomes extremely difficult. But that is a facts-and-forum problem, not a rule that recovery is impossible.
Operators we advise who have been through a recovery matter consistently report that the decision to contact counsel within the first twenty-four hours was the single most important variable in the outcome.
A Recovery in Practice: Tracing Through Two Exchanges
In a recent matter handled by our disputes team, a payments company domiciled in a common-law jurisdiction discovered that a seven-figure balance of stablecoins had been transferred out of its operational wallet by a counterparty in breach of a settlement agreement. The funds moved through two centralised exchanges within a thirty-six-hour window.
We engaged forensic specialists immediately and delivered a trace report mapping each transaction hash through both exchanges to identified deposit addresses. On the basis of that report, we applied ex parte in a leading common-law forum for a disclosure order against the first exchange and a worldwide freezing order over the defendant's assets. The exchange complied within the court's directed timeline, producing KYC records that confirmed the defendant's identity and the second exchange where a residual balance remained.
We coordinated with allied counsel in the jurisdiction of the second exchange, who served the freezing order locally. The balance was frozen before a scheduled withdrawal. The matter proceeded to a negotiated return of funds on terms reflecting the full loss. No judgment was required; the combination of freezing relief and identified defendant resolved the commercial position.
The outcome depended on three things: the quality of the forensic trace, the speed of the ex parte application, and the regulatory reachability of both exchanges. If either exchange had been domiciled in a non-cooperative jurisdiction with no regulatory obligation to respond to foreign court orders, the result would have been different.
Self-Assessment: Is Your Business Recovery-Ready?
A business is recovery-ready when it can provide, within hours of an incident, the evidence and instructions a disputes lawyer needs to file an emergency application.
The practical checklist is short but demanding. Does your operations team retain full transaction logs, including wallet addresses and counterparty identifiers, in a format that can be handed to a forensic specialist immediately? Do you know which centralised exchanges hold balances associated with your business and which regulated jurisdiction each one falls under? Have you documented your contractual arrangements with any custodian, counterparty or protocol in a way that establishes the proprietary basis for a tracing claim? Do you have a protocol for the first twenty-four hours – who calls counsel, who contacts the forensic team, who informs the board?
Most businesses that contact us in the aftermath of a loss have partial answers to each of these. The gap between partial and complete can be bridged quickly with the right preparation. We regularly advise businesses on recovery-preparedness as a standalone engagement, before any incident occurs – because the cost of preparation is a fraction of the cost of a delayed response.
If a prior recovery attempt stalled – because an application was filed in the wrong forum, because the forensic report was insufficient for the court's standard, or because the exchange was not reachable – a second read of the facts can surface the structural reason and identify whether an alternative route remains open. Write to info@oboluslaw.com with the background, and we will assess what options the current position supports.
Related at OBOLUS
- Disputes & Asset Recovery for Digital-Asset Businesses – our full disputes and recovery practice, covering injunctive relief, disclosure orders and cross-border enforcement
- Stablecoin Freeze Requests in Singapore – how to engage the MAS-regulated framework to freeze USDT and USDC balances under Singapore law
- MiCA Whitepaper Review in South Africa – cross-border regulatory structuring where EU and African market obligations intersect
FAQ
Can stolen crypto actually be recovered?
Yes – in many cases, provided counsel acts quickly and the funds can be traced to a custodian or exchange within a court's reach. Courts in England and Wales, Singapore, Hong Kong and the DIFC have each confirmed that cryptoassets are property capable of being frozen and returned. Recovery depends on the speed of the response, the quality of the forensic trace, and whether the exchange holding the funds is reachable by a court with jurisdiction. Full recovery is not guaranteed, but the legal mechanism exists and has been used successfully in multiple jurisdictions.
How fast must I act after a digital-asset theft?
Immediately. The practical window for effective intervention – before funds are moved to a non-reachable position – is typically measured in hours to a few days. Stablecoin issuers can freeze tokens on a law-enforcement or court-order basis, but they require a case reference and supporting documentation. Courts can grant ex parte freezing orders without notice to the defendant, but the application must be supported by a forensic trace report. Every hour of delay allows another transfer, another conversion, another withdrawal. Contact disputes counsel the moment the loss is confirmed.
Can a court freeze assets held on an exchange?
Yes. A freezing order served on a centralised exchange that is regulated in the forum's jurisdiction – or that has assets or operations there – compels the exchange to hold the relevant balances pending litigation. A disclosure order can also compel the exchange to produce the KYC records and transaction logs associated with the relevant wallet addresses. Both instruments have been used against exchanges under the regulatory oversight of the FCA, MAS, SFC and equivalent authorities. Unregulated exchanges in non-cooperative jurisdictions are harder to reach, which is why the jurisdiction of the exchange is one of the first variables we assess.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice – and in our disputes work, we move for freezing relief and exchange disclosure while the trail is still live. To discuss a recovery matter or prepare your business for an incident before one occurs, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialises in cross-border digital-asset recovery, freezing orders and on-chain forensic evidence strategy.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.