When misappropriated digital assets clear a centralised exchange, the business victim faces a legal race against a technical clock. An exchange disclosure order (a court order compelling a trading platform to reveal the identity and account data behind a suspect wallet address) is the principal instrument that closes that gap. Without it, the blockchain trail goes cold the moment funds are converted, bridged or withdrawn to a self-custodied address. With it, recovery counsel can identify the counterparty, apply for a worldwide freezing order (an injunction restraining a defendant's assets globally), and preserve value before it disappears offshore.
The compliance burden that an exchange disclosure order places on a platform is real, layered and cross-border in almost every case. This analysis examines how disclosure orders work in the leading common-law forums, what exchanges must actually produce and when, where the legal conflicts arise between responding jurisdictions, and how the practical mechanics of the instrument determine whether a victim gets their money back.
What is an Exchange Disclosure Order and Why Does It Matter for Asset Recovery?
An exchange disclosure order is a court order requiring a virtual asset service provider – most often a centralised exchange holding customer account data – to disclose identifying information about a wallet address or account to a claimant pursuing asset recovery. In the leading common-law forums, the instrument derives from principles well established for traditional financial intermediaries: the Norwich Pharmacal order (compelling disclosure by a party mixed up in wrongdoing) and the Bankers Trust order (compelling disclosure of financial records to trace misappropriated funds). Both have been applied to digital-asset contexts in England and Wales, and similar doctrines operate in the DIFC Courts, Singapore, Hong Kong and the Cayman Islands.
The order matters because the pseudonymous architecture of public blockchains produces a paradox. On-chain data is transparent – every transaction is visible – but identity is opaque. An exchange is often the single point at which a wallet address resolves to a verified person or entity. Exchanges operating under the FATF Travel Rule (the obligation to pass originator and beneficiary identity data with a virtual asset transfer) and under their home-jurisdiction VASP (virtual asset service provider) licensing regime hold precisely the KYC records a victim needs. The disclosure order is the legal bridge between the public ledger and the private record.
The process described above is the standard path in a well-documented matter. Your facts – the forum, the exchange's jurisdiction, the speed of conversion – change the analysis materially. For a scoped assessment of your recovery options, contact OBOLUS at info@oboluslaw.com.
Which Forums Grant Disclosure Orders Against Crypto Exchanges?
England and Wales remains the most developed forum for crypto-asset disclosure orders, and the doctrinal foundation is well settled. The courts have applied the Norwich Pharmacal and Bankers Trust principles directly to exchanges, including non-UK platforms, on the basis that the order is directed to a party within the jurisdiction or, in some cases, on an extraterritorial basis where the claimant can show a sufficient connection. The landmark decision in AA v Persons Unknown [2019] established that Bitcoin constitutes property capable of being the subject of proprietary relief – the essential gateway to freezing and tracing remedies. Osbourne v Persons Unknown [2022] extended that principle expressly to NFTs.
The DIFC Courts in Dubai have developed a parallel and increasingly used toolkit. The DIFC regime allows for worldwide freezing orders and, more significantly, has demonstrated willingness to grant relief in support of foreign proceedings – a critical capability when assets have moved across hubs. Operators and victims we advise in the Gulf frequently find that the DIFC forum offers more predictable timelines for interim relief than litigation in the mainland UAE.
Singapore courts have granted proprietary injunctions over crypto assets under established equitable principles. Hong Kong's courts have issued what practitioners describe as a "tokenised" injunction – notably in HCA 2417/2024 – and in Re Gatecoin [2023] HKCFI 914 confirmed that crypto constitutes property under Hong Kong law. The Cayman Islands, operating under the authority of CIMA and with a well-developed equitable jurisdiction, is a frequent respondent forum when the exchange or its holding entity is domiciled there.
Each forum has a different procedural tempo. In our cross-border practice, we have seen materially different timelines for interim disclosure orders between a same-day without-notice application in London and a comparable application in a different common-law hub. That gap can be the difference between frozen funds and dissipated ones.
What Must an Exchange Actually Produce Under a Disclosure Order?
An exchange served with a disclosure order must typically produce the complete customer verification file behind the target account, the transaction history for the relevant addresses and the communications associated with account opening and any withdrawal requests. In practice, this means KYC documents (government-issued ID, proof of address, beneficial ownership declarations), AML screening results, IP logs, device fingerprints, and any internal risk flags or suspicious activity notes generated during the account lifecycle.
The order is usually drafted to require production within a short, court-specified window – often measured in business days rather than weeks. The rationale is direct: a longer window allows a sophisticated counterparty to withdraw remaining balances, close accounts, or request address reassignment on-chain. Where the exchange has notified the account holder before production – which most platforms do as a matter of contractual obligation – that notification itself can trigger a flight of funds.
This is one of the more contested areas in practice. Claimants push for no-notification provisions; exchanges resist them on the grounds that customer confidentiality, data protection regimes (including the EU's GDPR where a European entity is involved) and their own terms of service impose obligations to the account holder. Courts in England and Wales have balanced these competing interests, typically permitting a short notification-delay window when a material risk of dissipation is established by evidence. The order will ordinarily include a provision restraining the exchange from tipping off the account holder for a specified period following service.
A practical point that many victims underestimate: the quality of what an exchange produces depends significantly on how the order is drafted. A broad but imprecise request produces a broad but partially responsive disclosure. In our practice, we have seen exchanges produce technically compliant but strategically incomplete responses to loosely worded orders, requiring a return to court to compel supplemental production. Specificity in the request – transaction hashes, exact date ranges, wallet addresses – reduces that friction.
The Compliance Burden on Exchanges: Between Duty and Exposure
Exchanges sit in an uncomfortable position when a disclosure order lands. They face legal obligations pulling in at least three directions simultaneously, and the compliance burden is not trivial regardless of where the platform is licensed.
First, there is the court obligation itself. Non-compliance with a court order in a common-law jurisdiction exposes the exchange and its responsible officers to contempt proceedings – a serious sanction that, in England and Wales and the DIFC Courts, can result in fines or, for individuals, imprisonment. Most exchanges operating in or through major hubs employ legal teams or external counsel with orders-compliance protocols for precisely this reason.
Second, there is the data-protection overlay. Exchanges licensed within the EU or processing data of EU persons must reconcile disclosure with applicable data-protection rules. A court order from a recognized jurisdiction generally provides the legal basis for disclosure without the data subject's consent, but the exchange must document that basis clearly and, in some regimes, notify its supervisory authority. Where the ordering court and the data-protection regime sit in different jurisdictions – common in cross-border crypto matters – the exchange's legal team must analyze the conflict quickly and under time pressure.
Third, the exchange faces its regulatory supervisor. A VASP producing customer data to a foreign court without a domestic legal basis may expose itself to supervisory scrutiny in its home jurisdiction. Regulators under the MiCA regime in the EU, the FCA in the UK, MAS in Singapore and VARA in Dubai each have their own views on cross-border data sharing, and none of them have published a settled position on every permutation of a foreign court order covering a local VASP.
The practical result: exchanges that do not have a clearly documented compliance protocol for handling disclosure orders often respond inconsistently, creating delays that harm claimants and generate unnecessary costs for all parties. We regularly advise platforms on building that infrastructure before the order arrives.
If a prior disclosure request stalled or an exchange response was incomplete, a second read of the order and the platform's response can surface the structural reason and the route to supplemental relief. Write to our disputes desk at info@oboluslaw.com.
How Does Cross-Border Conflict Affect Forum Selection and Enforcement?
Selecting the right forum for a disclosure order is as consequential as the order itself, because the exchange may be incorporated in a different jurisdiction from where it processes transactions, holds user data, and generates revenue. A crypto exchange providing services globally from a Cayman Islands entity, operating technology through a Singapore subsidiary and KYCing users under an MFSA-supervised process in Malta is not an unusual structure. Each element of that structure creates a separate legal hook – and a separate set of conflicts.
The leading common-law forums have developed principles for extraterritorial reach. An English court, for example, may grant a worldwide freezing order and a disclosure order against an exchange not incorporated in England if the claimant can establish jurisdiction over the defendant or a sufficient connection to the dispute. The CFAAR network (the Crypto Fraud and Asset Recovery network, launched in London in September 2021) provides a practitioner-level coordination mechanism across the key forums, facilitating parallel applications where a single-forum order will not reach all relevant entities.
Singapore and Hong Kong operate on similar principles of modified universalism in insolvency and equitable jurisdictions in civil matters, allowing courts to recognize and, to a degree, give effect to orders from trusted foreign forums. The DIFC Courts have demonstrated willingness to grant relief in direct support of proceedings elsewhere, including in England and in New York.
The forum-selection decision turns on several axes: where the exchange is incorporated and licensed; where it holds the relevant data (server location matters for data-protection analysis); whether the court can grant extraterritorial relief; and how quickly interim orders can be obtained. Victims moving quickly – and speed is essential – frequently file in the fastest-moving forum that has a plausible jurisdictional hook, then coordinate parallel or ancillary applications in the exchange's home jurisdiction.
In our cross-border practice, we have coordinated parallel proceedings in two forums simultaneously to reach exchange entities that restructured their data-holding across jurisdictions after a fraud event. That architecture – common in sophisticated fraud – is exactly what multi-forum strategy is designed to defeat.
From On-Chain Tracing to Court: The Forensic Foundation of a Disclosure Application
A disclosure order application that lacks a credible forensic foundation will fail, or will be granted in a form too narrow to be useful. Courts in England and Wales, Singapore and Hong Kong consistently require the claimant to demonstrate a proprietary claim over the specific assets traced to the target address – not merely a general allegation of theft. That means the application must be accompanied by a professional blockchain forensic report that traces the misappropriated funds from the victim's wallet, through any intermediate hops, bridges or mixers, to the deposit address at the named exchange.
Forensic infrastructure providers – including Chainalysis, TRM Labs, Elliptic and Asset Reality, all recognized in the recovery community – produce court-admissible reports mapping the transaction graph. The quality of that report determines the precision of the order and the speed at which a court will grant it. A report that identifies a single deposit address with a high confidence attribution is more useful than a cluster analysis covering hundreds of addresses, because it allows the order to be targeted and the exchange to produce a focused, timely response.
The interplay between forensics and the legal instrument is tighter than many victims appreciate. The forensic report informs the draft order; the draft order shapes what the exchange must search; what the exchange produces either confirms or requires revision of the forensic hypothesis. In a well-run matter, the forensic team and legal counsel operate in parallel from the first hour after a theft is detected.
For stablecoin losses in particular, the issuer-level freeze is a distinct and faster mechanism. Tether (USDT) and Circle (USDC) hold contract-level freeze authority over their issued tokens. Issuers act on court orders, law-enforcement requests, or OFAC designations. Securing an issuer freeze in the first hours after a theft – before conversion to another asset – is materially faster than waiting for a court order and exchange production. The two mechanisms are complementary: the issuer freeze preserves value; the disclosure order identifies the person holding it.
Decision Profile: Contrasting Approaches to Exchange Disclosure
The practical divergence between a well-resourced and a poorly resourced response to an exchange disclosure situation is worth examining through two contrasting operator profiles.
Profile A – the prepared corporate victim. A fintech operator discovers a seven-figure USDT balance has been transferred from its custody wallet to an external address. Within two hours, it has transaction hashes and a preliminary forensic trace showing funds sitting at a deposit address on a major exchange. Within twelve hours, counsel has prepared a without-notice application for a freezing order and a combined Norwich Pharmacal / Bankers Trust disclosure order in England and Wales. Within the same window, the claimant separately contacts the USDC or USDT issuer to request a precautionary freeze pending the court order. The timeline from theft to interim order is measured in days. Recovery is possible.
Profile B – the unprepared victim. A trading firm discovers the same loss three days after the fact, during a routine reconciliation. No transaction hash was preserved in an accessible format; the blockchain trace now shows funds that have passed through a decentralised bridge, been partially converted to a privacy-enhanced asset, and distributed across several deposit addresses on three exchanges in two jurisdictions. The on-chain trail is not broken, but it is significantly degraded. Each exchange requires a separately tailored order in its home jurisdiction. The timeline from theft to interim relief is measured in weeks. Recovery is uncertain.
The lesson from both profiles is consistent across the matters we see: preparation, documentation hygiene and the speed of legal mobilization determine outcome more than any single legal instrument.
In a recent recovery matter, a payments company identified a misappropriation event within hours. We coordinated a disclosure application in a leading common-law forum alongside a direct engagement with the relevant stablecoin issuer, securing a freeze on the balance before the counterparty initiated a withdrawal request. The combined approach – legal and technical acting simultaneously – was the operative factor in preserving the asset.
Addressing the Assumption That Recovery Is Impossible
A common assumption in the market is that once funds leave the originating wallet, nothing can be done. That assumption is wrong, but it is not costless to be wrong about it: every hour spent in doubt is an hour in which the trail degrades and exchange balances are withdrawn.
The legal and technical tools available to a well-advised victim are more capable than many operators believe. Courts in England and Wales, Hong Kong, Singapore and the DIFC have consistently held that crypto assets constitute property. That holding is the jurisdictional foundation for the full toolkit: freezing orders, proprietary injunctions, disclosure orders, and – in appropriate cases – Mareva-style relief against unknown persons where identity has not yet been confirmed.
The practical constraint is not legal impossibility. It is time and evidence. An exchange will close a non-compliant account in response to law-enforcement contact. A stablecoin issuer will freeze on a court order or OFAC designation. An exchange will produce KYC records when properly ordered to do so. What limits recovery is not the absence of legal instruments but the gap between when a theft occurs and when a victim engages counsel who can deploy those instruments.
The FATF Travel Rule framework, which requires VASPs to transmit originator and beneficiary identity data with transfers above defined thresholds, also means that compliant exchanges in the major hubs already hold the data a disclosure order is designed to extract. The legal mechanism and the regulatory compliance infrastructure are, for once, aligned in the victim's favor.
We move for freezing relief and exchange disclosure while the trail is live. The moment that mobilization is delayed, the outcome set narrows.
What Should Exchanges Build Before an Order Arrives?
Exchanges that receive disclosure orders without a compliance protocol in place face a compounding problem: they must simultaneously understand their legal obligations, assess their data-protection exposure, determine whether domestic authorization is required, and produce responsive records – all within a court-ordered window measured in days.
The exchanges that handle this well have built the infrastructure in advance. That means a documented escalation path from legal operations to senior counsel; a data map that identifies where customer KYC records, transaction logs and communications data are stored and in what format; a template for external counsel engagement when an order from a foreign court arrives; and a standing analysis of how the exchange's home-jurisdiction data-protection and banking secrecy rules interact with the most likely ordering courts.
MiCA-supervised entities in the EU face a specific overlay: the applicable data-protection framework requires that any cross-border transfer of personal data to a third country be covered by an adequacy decision, standard contractual clauses or another recognized mechanism – or, alternatively, that the transfer is necessary to comply with a legal obligation. The "legal obligation" basis is available where a recognized court order exists, but the exchange must document that reliance clearly and, in some member states, file a notification with its supervisory authority.
VARA-supervised platforms in Dubai and MAS-supervised entities in Singapore face analogous but differently structured requirements. None of those requirements make compliance impossible; they make preparation valuable. An exchange that has mapped these obligations before an order arrives will respond faster, generate less litigation risk, and maintain its standing with its home regulator throughout the process.
Operators we advise on licensing and compliance regularly include disclosure-order readiness as a component of the broader compliance program, not as a standalone exercise. The regulatory and the disputes practice areas intersect precisely at this point.
Related at OBOLUS
- Disputes & Asset Recovery for Digital-Asset Businesses – our practice overview covering freezing orders, disclosure and on-chain tracing
- Crypto Fraud Asset Recovery – Legal Counsel for Digital-Asset Firms – scoped recovery counsel for corporate victims of digital-asset fraud
- Redemption and Liquidity Terms – What Recent Enforcement Tells Operators – enforcement signals for fund operators managing redemption risk
FAQ
Can stolen crypto actually be recovered?
Yes – recovery is legally and technically possible in many cases, though not guaranteed. Courts in England and Wales, Singapore, Hong Kong and the DIFC have confirmed that crypto assets constitute property and are subject to the full suite of interim relief, including freezing orders and disclosure orders. The determinative variables are speed of response, quality of the forensic trace, and the jurisdiction in which the exchange holding the assets is licensed. A matter that reaches counsel within hours of the theft has materially better prospects than one identified days later.
How fast must I act after a digital-asset theft?
Speed is the operative constraint in every recovery matter. Recovery windows are measured in hours to days, not weeks. The practical priority sequence is: preserve transaction hashes and wallet records immediately; engage forensic tracing to map the on-chain path; instruct counsel to assess the forum and instrument; and, where stablecoin assets are involved, contact the issuer directly in parallel with the court application. Delay degrades the forensic trail and creates time for a counterparty to convert or withdraw the balance from the exchange.
Can a court freeze assets held on an exchange?
Courts in the leading common-law forums can and regularly do grant orders that freeze assets held at a centralised exchange. The mechanism operates in two stages: a worldwide freezing order restrains the defendant from dealing with the assets; a disclosure order compels the exchange to produce the identity and account data behind the relevant address. Both orders can be granted without notice to the defendant where a risk of dissipation is established. The exchange is then bound by the order and subject to contempt sanctions for non-compliance.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. Our disputes team coordinates freezing relief, exchange disclosure applications and on-chain tracing across the leading common-law forums, moving while the trail is live. To discuss a recovery matter or a disclosure-order compliance question, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specializing in cross-border crypto-asset recovery, exchange disclosure orders and freezing relief across common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.