When misappropriated digital assets move across wallets, the recovery window is measured in hours – not weeks. A freezing order (a court injunction prohibiting a defendant from dealing with specified assets) and a proprietary injunction (which asserts an ownership claim over identifiable property) are the two primary instruments of interim relief available to businesses that have suffered digital-asset fraud. Obtaining one requires moving fast, knowing which forum has the tools, and converting on-chain evidence into court-ready proof before the trail goes cold.
This analysis examines how interim relief operates across the leading recovery forums, how courts have treated digital assets as property, what a cross-border application actually involves, and where the process breaks down for operators who wait.
Why Interim Relief Is the First Call After Digital-Asset Fraud
Interim relief is the right first response to digital-asset fraud because it immobilises funds before a defendant has the chance to disperse them further. The moment a business suspects misappropriation, two parallel clocks start running: the thief is moving assets through mixers, bridges and offshore exchanges, while courts – even the most efficient – require sworn evidence, a legal basis and service. The gap between those two speeds is the defining problem of crypto recovery, and interim relief is the only legal instrument narrow enough to close it.
In England and Wales, the courts have developed a coherent toolkit specifically suited to the mobility of digital assets. Worldwide freezing orders (injunctions restraining a respondent from dealing with assets anywhere on the globe) and Norwich Pharmacal and Bankers Trust disclosure orders (compelling third parties such as exchanges to reveal customer identity and transaction data) can be obtained on an without-notice basis in appropriate cases. The courts in England and Wales confirmed in AA v Persons Unknown [2019] that cryptoassets constitute property capable of being the subject of a proprietary injunction – a foundational holding that has since been applied and refined across common-law jurisdictions.
Speed matters more than elegance in the early hours. We have seen applicants lose recoverable positions simply because they spent the first 48 hours trying to negotiate with an exchange directly, without a court order in hand. Exchanges are unlikely to freeze or disclose on request alone; a formal legal instrument changes the calculus entirely.
If a recovery clock is running, do not wait for internal approvals. The process above describes the standard pathway, but the assets, the entity structure and the jurisdictions involved shape every application differently. Reach our disputes desk now at Map your options or write directly to info@oboluslaw.com.
What Courts Accept as Crypto Property – and Why It Matters
The property question is the threshold issue: a court cannot grant a proprietary injunction over an asset it does not recognise as property. Across the major common-law forums, that question has been answered in the applicant's favour, though the reasoning differs enough to affect how applications are framed.
In England and Wales, AA v Persons Unknown [2019] established that Bitcoin is a form of property. Osbourne v Persons Unknown [2022] extended the same logic to non-fungible tokens, holding that NFTs can be the subject of an injunction in their own right. These decisions are now the reference points for counsel in any common-law forum.
Hong Kong's Court of First Instance in Re Gatecoin [2023] HKCFI 914 held that cryptocurrency is property for the purposes of that jurisdiction's insolvency regime – a holding with direct implications for recovery in liquidation scenarios. Singapore's High Court in CLM v CLN [2022] SGHC 46 granted a proprietary injunction over cryptoassets, confirming the position under Singapore law. The DIFC Courts in Dubai have also shown willingness to grant worldwide freezing orders in support of foreign proceedings, as illustrated in recent reported decisions.
The practical consequence is significant. A business that can demonstrate a proprietary claim – that the stolen assets are identifiably its assets, not merely a debt owed by the thief – can assert priority over other creditors in an insolvency and can trace proceeds into substituted assets. The tracing analysis, which chains value through multiple wallet addresses and exchange accounts, is work that begins before the court application and supports it throughout.
Jurisdiction shopping is real and legitimate. The forum with the best toolkit is not always the forum with the closest connection to the defendant. We regularly advise on which forum to lead with and how to deploy orders across secondary jurisdictions using the recognition mechanisms available in each.
How Freezing Orders and Injunctions Work in Practice
A worldwide freezing order (WFO) prohibits a respondent from dealing with or diminishing their assets, wherever those assets are located, up to a defined value. For digital assets, the order will typically identify specific wallet addresses, exchange accounts or token balances. The three requirements a court will assess are: a good arguable case on the merits; a real risk of dissipation; and that the balance of convenience favours granting relief.
Demonstrating a real risk of dissipation is rarely difficult in the digital-asset context. The architecture of public blockchains – pseudonymous wallets, permissionless transfers, cross-chain bridges – creates an evidentiary record but also a dissipation risk that courts across all major forums have recognised explicitly. A professional forensic report mapping the transaction path from the victim's wallet to current custody is the factual foundation of any without-notice application.
Disclosure orders – either in the Norwich Pharmacal form (compelling a third party mixed up in wrongdoing to identify the wrongdoer) or the Bankers Trust form (compelling a party to disclose asset information to allow tracing) – are frequently sought alongside the WFO. Exchanges operating under regulatory supervision in common-law jurisdictions will generally comply with a court order. The practical challenge is that the exchange may be incorporated in a jurisdiction different from the one hearing the application; served-out or letter-of-request mechanisms extend the reach, but they add time.
Stablecoin issuers occupy a distinct position. Tether (USDT) and Circle (USDC) hold contract-level freeze and blacklist authority over their issued tokens and generally act on a court order, a law-enforcement referral or an OFAC designation. Securing an issuer freeze in parallel with a court WFO is the highest-value outcome in a stablecoin recovery because it immobilises the asset at the protocol level, making subsequent movement technically impossible without issuer cooperation.
What Does a Cross-Border Digital-Asset Recovery Actually Involve?
A cross-border digital-asset recovery typically requires coordinating legal action across at least two forums simultaneously – one where the victim or the assets have sufficient connection to found jurisdiction, and one where the exchange or custodian holding the funds is regulated. The mismatch between those forums drives most of the procedural complexity.
Consider a payments company whose treasury USDT is drained by a compromised internal credential. The attacker routes funds through a decentralised exchange, bridges them to a second chain, and deposits the equivalent value in USDC to an account on a centralised exchange incorporated in a common-law offshore jurisdiction. The victim's counsel must simultaneously: obtain a WFO in the most efficient forum (typically England and Wales, or Singapore, depending on the contractual and jurisdictional connections); serve the exchange with a disclosure order; approach Circle for a precautionary issuer freeze; and instruct allied counsel in the exchange's domicile jurisdiction to make those orders locally enforceable.
In our cross-border practice, we have seen this coordination completed inside 72 hours when the factual matrix is clear and the forensic report is being prepared in parallel. We have also seen the same process take weeks when the initial steps were taken without legal counsel – usually because the disclosure request was sent informally, the exchange sought further information, and by the time a court order arrived, the assets had moved again.
The CFAAR (Crypto Fraud and Asset Recovery) network, launched in London in September 2021, is a cross-referral network of insolvency and recovery practitioners across multiple forums. It provides one mechanism for coordinating parallel proceedings. For operators with assets spread across many jurisdictions, a coordinated multi-forum strategy – with one lead counsel and allied practitioners in each secondary jurisdiction – is the standard approach in our practice.
The On-Chain Evidence Problem: Tracing as a Legal Discipline
On-chain tracing converts blockchain transaction data into a legal narrative a court can evaluate. It is not simply a technical exercise; it is the factual foundation of every interim-relief application in a crypto recovery, and courts are increasingly exacting about how it is presented.
The first task is establishing a transaction hash chain from the victim's wallet to the current location of the funds. Public blockchains create an immutable record of every transfer. The difficulty is not the record's existence; it is the interpretation of mixing, bridging and cross-chain transactions, each of which can obscure the value flow without breaking it entirely. Professional forensic analysis – using tools maintained by specialists in blockchain intelligence – produces a report that identifies wallet clusters, exchange deposit addresses and, where KYC records are held, the identity behind the destination account.
Courts in England and Wales have accepted forensic blockchain analysis as expert evidence in interim-relief applications. The standard requirement is a report from a suitably qualified expert, served with the without-notice application, explaining the methodology and the certainty of the attribution. Where the destination exchange is identified, the forensic report also provides the evidentiary basis for the accompanying disclosure order.
We work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications. The quality of that forensic work determines how quickly a court will act and how persuasively the case is put. A weak or incomplete chain of attribution – for example, one that terminates at a mixing service with no identified output address – substantially weakens the case for proprietary relief, though it may still support a freezing order framed on a Mareva basis if the risk of dissipation is sufficiently established.
A common mistake at this stage is commissioning a forensic report that is written for an internal audience rather than for a court. Internal reports use technical shorthand, omit methodology notes and assume familiarity with blockchain architecture. A court-ready report must explain every inference, disclose its limitations and be signed by an individual prepared to give evidence on it.
Decision Matrix: Which Forum and Which Instrument?
The choice of lead forum and primary instrument turns on four variables: the location (or identifiable domicile) of the respondent; the jurisdiction of the exchange or custodian holding the assets; the governing law of any relevant contract; and the speed with which the chosen court can move without notice.
Profile A – Centralised exchange, identified respondent, funds in common-law jurisdiction. Lead with England and Wales or Singapore. Both forums have confirmed that cryptoassets are property, both have well-developed without-notice procedures, and both will grant a WFO with a disclosure order in a single application. Timeline from instruction to order, on a clear set of facts, is typically measured in days rather than weeks in England and Wales. Singapore follows a comparable timeline. Allied counsel in the exchange's jurisdiction handles local enforcement of the disclosure order.
Profile B – Decentralised exchange, pseudonymous respondent, stablecoin funds. Start with a proprietary injunction against persons unknown (a device confirmed as available in England and Wales) and a simultaneous approach to the stablecoin issuer for a precautionary freeze pending the court process. The issuer freeze is the most valuable step here because it does not depend on identifying the respondent. The court order then supports the issuer freeze and provides a basis for disclosure orders against any centralised on-ramp or off-ramp exchange through which the funds passed.
Profile C – Offshore custodian, disputed asset ownership, insolvency risk. The DIFC Courts in Dubai or the Cayman courts may be the lead forum if the custodian is incorporated there. Both have shown willingness to grant interim relief in digital-asset matters. The proprietary claim must be pleaded carefully to establish priority in any potential insolvency; the tracing work feeds directly into the priority analysis. Allied counsel at the seat of the custodian is essential.
Profile D – Cross-chain funds, multiple exchanges, unclear domicile. This is the hardest profile. The lead forum is wherever jurisdiction can be established most quickly – typically the victim's home jurisdiction. The strategy layers multiple disclosure orders across exchanges in different jurisdictions while the forensic work continues in parallel. Outcomes are harder to assure; qualitatively, the earlier in the movement chain the application is made, the higher the recovery prospect.
The Myth That Lost Crypto Cannot Be Recovered
A common assumption is that once digital assets leave the victim's wallet, nothing can be done. That assumption is wrong, and it costs operators real money by causing them to delay or abandon recovery efforts that would have succeeded.
The myth persists for understandable reasons. Early crypto-recovery efforts, before courts had recognised digital assets as property and before forensic tooling reached its current capability, often failed or produced no meaningful result. That was a different environment. Today, the combination of established property-recognition case law, a functioning ecosystem of forensic blockchain analysis, and courts with without-notice procedures adapted to the speed of on-chain movement creates a genuinely viable recovery path in many cases.
The honest qualification is this: recovery is more likely when it begins quickly, when the destination assets are held on a regulated centralised exchange in a common-law forum, and when the victim has retained and preserved all relevant evidence – transaction hashes, wallet addresses, internal communications and access logs. Recovery is harder – but not impossible – when funds have passed through multiple bridges and mixing services, or when the destination is a self-custody wallet with no exchange connection.
In our practice, we have seen operators dismiss recovery as hopeless and then, on instruction, establish a viable proprietary claim against funds sitting in a regulated exchange account for weeks unclaimed. We have also been honest with clients when the forensic trail does not support a court application – because proceeding without an adequate evidential basis wastes cost and time that could be spent on other remedies.
The correct framing is not "can we recover?" but "what is the current location of the assets, who can we compel to act, and how quickly can we move?" Those are questions of analysis, not attitude.
Receivers and Asset Management Pending Final Judgment
A receiver by way of equitable execution (an officer appointed by the court to take custody of and manage assets pending judgment) is a less frequently used instrument in digital-asset recovery, but it has a specific and important application: cases where the respondent holds assets in a form that could depreciate materially before trial, or where the respondent is likely to dissipate crypto holdings through market activity rather than simple transfer.
Courts in England and Wales have appointed receivers over digital-asset wallets in appropriate cases, granting the receiver authority to transfer assets to a stable or custodied form pending the outcome of the substantive proceedings. This is particularly relevant in cases involving volatile tokens – where a WFO prevents dealing but does not prevent the value of the frozen assets from falling to zero – or in cases involving staking positions and yield-bearing instruments where the assets generate ongoing income that needs to be preserved.
The practical challenge of a crypto receivership is custody: the receiver must be able to actually hold or control the assets, which requires either private key access (rarely available without the respondent's cooperation) or a transfer order directing the respondent to deliver assets to a specified wallet or custodian. Courts have shown willingness to make such orders where the factual basis for the receiver appointment is clear.
Receivers also appear in a different context: post-judgment enforcement. Where a judgment has been obtained but the defendant refuses to satisfy it, a receiver appointed over the defendant's crypto assets – identified through tracing – provides a direct enforcement mechanism without the need for a further tracing application. In our cross-border practice, coordinating the appointment of receivers across multiple jurisdictions is a known but logistically demanding step that requires allied counsel at each seat.
Common Mistakes That Destroy Recovery Prospects
Several avoidable errors consistently damage recovery prospects in digital-asset disputes, and they appear with enough regularity in our practice to warrant explicit treatment here.
The first is delay. Every hour of inaction after a suspected misappropriation is an hour in which assets move further down the chain, through more intermediaries, into more obscure wallets. The without-notice application was designed for exactly this situation; using it requires having counsel instructed and the factual matrix mapped before the full picture is clear. Acting on partial evidence, with full disclosure to the court of its limitations, is the correct approach. Waiting for certainty is not.
The second is informal engagement with exchanges before securing a court order. An informal disclosure request puts the exchange on notice that it is a target of recovery proceedings, without creating any legal obligation to act. Some exchanges will respond helpfully; others will alert the account holder, or simply decline. A court order changes the legal position entirely. It creates a binding obligation; it protects the exchange from liability for disclosure; and it creates a record that the exchange can point to when the account holder complains.
The third is failing to preserve evidence. The transaction hashes, wallet addresses, timestamps and internal communications that exist at the moment of discovery are the raw material of the forensic report. Businesses that overwrite logs, fail to screenshot wallet interfaces or delete communication records before instructing counsel create evidential gaps that complicate every subsequent step.
Fourth – and this applies specifically to operators in the UAE and other civil-law influenced jurisdictions – is assuming that the common-law toolset is unavailable. The DIFC Courts in Dubai sit as a common-law court and have demonstrated, including in recent reported decisions, that they will grant freezing relief in digital-asset cases. Operators domiciled in the UAE are not confined to civil-law remedies if their contracts or their counterparties have a connection to the DIFC.
A micro-matter from our recent practice illustrates the stakes: a treasury operations team at a mid-sized exchange discovered an unauthorised outbound transfer of stablecoin holdings early one morning. Within 24 hours, we had mapped the transaction chain through two intermediate exchange accounts, prepared a without-notice application in a leading common-law forum, and made a precautionary freeze request to the stablecoin issuer supported by the forensic chain. The issuer froze the identified balance at the protocol level that same day. The court order followed the next morning, providing the basis for a formal disclosure order against the destination exchange. The funds remained frozen pending the substantive hearing. Acting within the first 24 hours was the determinative factor.
If a prior application stalled or an account was closed without explanation, a second read of the underlying facts can surface the structural reason and the route back. For a scoped assessment of your recovery position, Map your options or contact info@oboluslaw.com.
Related at OBOLUS
- Disputes & Asset Recovery practice – the full scope of our recovery and litigation services for digital-asset businesses
- Worldwide Freezing Orders: the compliance burden in practice – how WFOs operate once granted and what they require of third parties
- VAT treatment of crypto services in the United Kingdom – the UK tax dimension for businesses structuring cross-border digital-asset operations
FAQ
Can stolen crypto actually be recovered?
Yes, in many cases. Courts across England and Wales, Singapore, Hong Kong and the DIFC have confirmed that cryptoassets are property capable of being frozen, traced and returned through a proprietary claim. Recovery is most likely when action begins quickly, the destination funds are held at a regulated centralised exchange, and the forensic chain of attribution is clear. It is harder – though not impossible – once funds pass through multiple bridges or self-custody wallets. Each matter turns on its specific facts.
How fast must I act after a digital-asset theft?
As fast as possible – ideally within hours. Recovery windows close as funds move further through wallets, bridges and exchanges. Without-notice applications to courts and precautionary freeze requests to stablecoin issuers can be made on the same day as discovery, provided a professional forensic report is being prepared in parallel. Delay is the single most common reason recoverable positions are lost. Instruct counsel at the same time you are gathering transaction data, not after.
Can a court freeze assets held on an exchange?
Yes. A worldwide freezing order granted by a court in England and Wales, Singapore or other common-law forums can reach assets held in exchange accounts, wherever the exchange is incorporated. The order is typically served on the exchange directly, creating a binding legal obligation to freeze the relevant account. A concurrent disclosure order compels the exchange to provide account identity and transaction data. Exchanges operating under regulatory supervision in common-law jurisdictions generally comply with court orders promptly.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on disputes and on-chain asset recovery across more than 25 forums, on licensing across more than 70 jurisdictions, and on the tax, banking and compliance structures that sit around them. Digital assets are the whole of our practice. We move for freezing relief and exchange disclosure while the trail is live, and we work alongside forensic partners to convert on-chain evidence into court-ready applications. To discuss your recovery situation, contact info@oboluslaw.com or reach us via t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specialising in cross-border digital-asset recovery, interim relief applications and on-chain tracing across common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.