Operating a crypto exchange, custodial wallet, or treasury desk means dealing with a class of adversary that common commercial litigation was not designed to handle: a thief whose identity is a pseudonymous key pair and whose assets are on a chain that crosses no border and respects no venue. When those assets are misappropriated, the business victim faces two compounding legal problems simultaneously – establishing which court has jurisdiction over a defendant who may be anywhere, and effecting valid service on a party whose name, address and nationality are unknown. The combination is not academic. It determines whether a freezing order issues in hours or never issues at all.
Jurisdiction and service problems in anonymous-defendant cases sit at the intersection of procedural law, on-chain forensics, and cross-border judicial cooperation. The leading common-law forums – England and Wales, the DIFC Courts in Dubai, Singapore, and Hong Kong – have each developed doctrine that allows a court to assert jurisdiction and authorise alternative service methods over pseudonymous crypto defendants. But the pathways differ, the evidentiary thresholds differ, and the utility of any order depends on where the assets or the exchanges holding them are located. The legal question is never resolved in isolation: the seat of the court, the domicile of the exchange, and the on-chain location of funds each pull the analysis in a different direction.
This analysis maps the jurisdictional and service doctrines applied in leading forums, identifies the decision axes practitioners must work through, and explains how businesses can preserve the legal options that a slow response destroys.
Why Jurisdiction Is Genuinely Contested in Crypto Recovery
A court's ability to grant effective relief depends, first, on its jurisdiction over the defendant or over the res – the assets themselves. In conventional litigation, jurisdiction tracks physical presence or domicile. Anonymous crypto defendants provide neither. What they leave behind is a chain of on-chain transactions, an IP log held by an exchange, and – if recovery counsel acts quickly enough – assets that have not yet moved beyond the reach of a freeze.
The leading approach in England and Wales, following the line of authority from AA v Persons Unknown [2019], treats digital assets as property situated within the jurisdiction if a sufficient connection to England can be established – most commonly because the relevant exchange or custodian operates under English law or is amenable to English court orders. The court asserts jurisdiction on the basis of the location of the property, not the defendant, which resolves the first problem even when the defendant's identity and location remain unknown.
The DIFC Courts have adopted a comparable position. In recent proceedings, the DIFC has exercised jurisdiction over anonymised crypto defendants on the basis of connections to the DIFC financial free zone and the location of relevant exchanges or fiat off-ramps within the UAE. The practical consequence is that a claimant operating in Dubai may be able to move in the DIFC without first identifying its adversary.
Singapore and Hong Kong each ground jurisdiction differently. Singapore has moved toward a proprietary injunction model, recognising crypto assets as capable of supporting equitable claims; Hong Kong's VASP licensing regime and its courts' willingness to treat crypto as property create a combined pathway that has been used in recent recovery proceedings. The threshold question in each forum is the same: can the claimant identify a connection – the exchange, the fiat off-ramp, the custodian – within the court's jurisdictional reach?
How Courts Authorise Service on Unknown Defendants
Service in anonymous-defendant proceedings does not follow the usual rules, and in most leading forums the claimant must apply specifically for permission to serve by an alternative method. The alternatives courts have sanctioned include service via a smart contract embedded in a transaction to the defendant's wallet address, service via a communication channel associated with the defendant, and – in cases where the only known connection is an exchange account – service directed at that exchange with an obligation to forward.
England and Wales has moved furthest on this. Service by non-fungible token delivery to a wallet address – so-called NFT service – was sanctioned in Osbourne v Persons Unknown [2022], the case in which the court also confirmed NFTs as legal property capable of supporting proprietary claims. The practical appeal is clear: if the defendant has not yet moved assets from a wallet, serving process to that wallet ensures they are aware of the proceedings even if their physical identity remains undisclosed.
The DIFC Courts permit alternative service applications where conventional service is impossible. The standard is whether the proposed method is "reasonably likely to bring the proceedings to the attention" of the defendant – a test that, in practice, the on-chain delivery of a notice or a publicly filed court document can satisfy when the wallet address is known and active.
Singapore and Hong Kong courts both retain inherent jurisdiction to authorise alternative service, and applications on those grounds have been made in recent crypto proceedings. The common thread across all four forums is speed: an alternative service application must be made before the assets move, because no service order preserves the assets – only the freezing application does that, and it runs on its own timetable against the underlying jurisdiction analysis.
Can a Court Freeze Assets Before the Defendant Is Identified?
A worldwide freezing order (an injunction restraining a defendant from dealing with assets globally) can issue against a person or persons unknown in the leading common-law forums, provided the applicant establishes a good arguable case on the merits, a real risk of dissipation, and – critically – the jurisdictional basis described above. The defendant does not need to be named by their legal identity; they may be named by their wallet address.
This is the relief that a business victim needs most acutely in the first hours after a theft. The sequence in our cross-border practice is: obtain a transaction hash and on-chain trace confirming the destination address; instruct forensics to produce an attribution report; move for the freezing order on an ex parte basis (without notice to the defendant); and simultaneously seek a disclosure order compelling the relevant exchange or custodian to identify the account holder and freeze the balance.
The disclosure order mechanism – derived in England from Norwich Pharmacal and Bankers Trust principles – is the procedural bridge between the anonymous defendant and the freeze. It compels a third party (the exchange) to disclose documents identifying the wrongdoer, on the basis that the third party has become mixed up in the wrongdoing even without fault. The DIFC, Singapore, and Hong Kong each have analogous mechanisms, though the procedural route and the threshold for granting disclosure differ. In each forum, the application must explain why the defendant's identity cannot otherwise be obtained and why the exchange is the appropriate disclosure target.
The mid-page reality check is this: the freezing order covers assets, but it does not identify the defendant. The disclosure order identifies the defendant, but it does not by itself preserve assets. Both must often run in parallel, sometimes in the same application, to achieve the combined effect: assets frozen, identity revealed, service validated against the revealed identity, and proceedings able to continue in the ordinary way.
The process above describes the standard pathway. Your facts – the exchange's domicile, the chain, the fiat off-ramp jurisdiction – change the analysis materially. For a scoped assessment of your situation, contact OBOLUS at info@oboluslaw.com.
Cross-Border Coordination: When One Forum Is Not Enough
In the majority of cases we see, the defendant has interacted with exchanges in more than one jurisdiction, the assets have passed through multiple chains, and the fiat off-ramp – if there is one – is in a third country. This fragmented geography means a single court order is rarely sufficient. The English worldwide freezing order is powerful, but it only compels compliance from parties amenable to English law. The DIFC order reaches entities within the UAE. A Singapore order reaches entities regulated by MAS. None of them automatically reaches an exchange registered in, for example, a Caribbean jurisdiction that has not yet been served with the proceedings.
The practical response is parallel proceedings or a strategy for enforcing a primary order abroad. England and Wales has well-developed doctrine on the recognition of foreign freezing orders, and courts in Singapore and Hong Kong have each, in recent practice, given effect to orders from other common-law forums in appropriate cases. The CFAAR (Crypto Fraud and Asset Recovery network), launched in London in September 2021, exists specifically to coordinate cross-border crypto asset recovery among practitioners who understand both the legal mechanisms and the on-chain dimensions of each case.
The coordination question also surfaces at the exchange level. A major exchange may have entities incorporated in multiple jurisdictions, each of which is only amenable to the local court. A freezing application directed at one entity may not extend to another entity in the group that actually holds the relevant balance. We routinely advise clients on how to identify the correct legal entity, the correct forum, and the correct procedural mechanism for each layer of the recovery structure, treating the cross-border picture as a single strategic problem rather than a sequence of disconnected applications.
Allied counsel in the relevant jurisdiction handles the local procedural steps where OBOLUS is directing strategy from a coordinating seat. The choice of that allied counsel, the timing of parallel applications, and the sequencing of service and disclosure relative to the freeze are the decisions that determine whether the recovery succeeds before the funds are dissipated.
On-Chain Evidence and Its Role in Jurisdictional Arguments
On-chain tracing is not just a forensics tool. In anonymous-defendant cases, it is the foundation of the jurisdictional argument itself. The trace establishes where the assets went, which exchanges received them, and – where a fiat off-ramp is identified – which regulated entity holds the funds in a form that a court order can reach.
A forensic attribution report produced by a specialist – the market includes firms such as Chainalysis, TRM Labs, Elliptic, and Asset Reality – translates raw transaction data into a format courts can act on. The report needs to establish: the origin wallet and the theft transaction; the path through intermediary wallets and mixing services, if used; the destination exchange or custodian; and, where possible, an attribution of the destination address to a known entity or cluster. Courts in England and Wales, the DIFC, Singapore, and Hong Kong each expect a professional forensic report as a condition of the ex parte application for freezing and disclosure relief.
The jurisdictional utility of this evidence is direct. If the trace shows that the assets reached an exchange regulated by MAS in Singapore, that establishes the connection to Singapore jurisdiction. If the trace shows assets held at a DIFC-regulated custodian, that grounds the DIFC application. Forensics does not merely support the claim – it defines the forum options available to the claimant.
A practical point that is often missed: the forensic report needs to be prepared quickly and to a court-ready standard simultaneously. A report produced too slowly loses the window for freezing relief; a report produced quickly but not to the evidentiary standard the court expects may be rejected on the ex parte application. We advise clients to engage forensics counsel and legal counsel together from the first hour after discovery of the theft, so that both workstreams run in parallel against the same urgent timeline.
Decision Matrix: Which Forum for Which Fact Pattern
No single forum is right for every anonymous-defendant recovery. The choice turns on a set of decision axes that interact: the location of the exchange holding the funds; the governing law of any contract between the victim and the defendant; the claimant's own domicile and its legal relationship with the available forums; the size and nature of the asset; and the likely nationality and location of the defendant if partial identification is possible.
Profile A – Exchange domiciled in England or operating under English law: England and Wales is the primary forum. The combination of worldwide freezing order jurisdiction, the Norwich Pharmacal / Bankers Trust disclosure route, the accepted doctrine on crypto as property, and the NFT-service mechanism makes this the most developed framework. Timeline from instruction to ex parte order: a matter of days in urgent cases, subject to the court's listing and the quality of the forensic evidence presented.
Profile B – Exchange or custodian within the UAE (mainland Dubai or DIFC): The DIFC Courts offer a developed alternative, particularly for claimants with operations or contracts connected to the DIFC free zone. VARA's regulatory reach over Dubai-based exchanges means a freezing application can be combined with a regulatory notification to VARA, compressing the timeline for exchange cooperation. The DIFC is also an effective enforcement forum for claimants seeking to give effect to an English order within the UAE.
Profile C – Assets reached a MAS-regulated Singapore exchange: Singapore's Payment Services Act regime and the court's recognition of crypto as property capable of supporting equitable claims make Singapore an appropriate forum when the exchange connection is there. The procedural route for the proprietary injunction and disclosure is well-established, though Singapore courts are attentive to forum shopping and expect genuine connection to jurisdiction.
Profile D – Multi-chain, multi-exchange theft with fragmented geography: This is the most common profile in practice. No single forum reaches every exchange. The correct approach is to identify the anchor forum – typically the jurisdiction holding the largest or most accessible balance – and to file in that forum first, using the order as the basis for international enforcement in the secondary jurisdictions. The CFAAR network is relevant here as a coordination mechanism for practitioners working across multiple forums in parallel.
Micro-Matter: Parallel Proceedings and a Pre-Dissipation Freeze
In a recent recovery matter, a digital-asset trading firm discovered a seven-figure balance had been misappropriated through a series of transfers across two chains, ultimately reaching an exchange with a regulated entity in a Gulf jurisdiction. The defendant's identity was unknown beyond a pseudonymous wallet address. We instructed forensics within hours of notification, obtained a transaction-level attribution report sufficient for court use, and filed for freezing and disclosure relief in the relevant forum on an ex parte basis before the end of the second business day. The court granted the freeze and ordered the exchange to disclose the account holder's identity and freeze the balance. The defendant's identity was revealed within days of the disclosure order. Parallel recognition proceedings were initiated in a second jurisdiction where a secondary balance had been identified. The combined freeze held through to settlement. No outcome guarantee applied; the result reflected the speed of the forensic and legal response working as a single operation.
What Goes Wrong: Common Mistakes in Anonymous-defendant Proceedings
Businesses that delay acting in the hope that law enforcement will handle the matter lose the legal window entirely. Law enforcement timelines operate on scales of weeks and months; a freezing application operates on a scale of hours and days. By the time a police reference number is assigned, the assets are typically gone. We have seen cases where a business had all the factual evidence needed for an ex parte freezing application but spent two weeks filing reports before engaging legal counsel.
A second common mistake is engaging forensics without legal counsel, producing a report that is thorough on the blockchain analysis but does not address the evidentiary requirements of the forum being used for the application. Courts expect a professional forensic report in a specific form. A report structured for an internal investigation does not automatically become a court-ready exhibit.
The third mistake is jurisdictional overconfidence – assuming that because the victim is English or because the original contract was English-law governed, England is automatically the right forum regardless of where the assets are held. Jurisdiction in anonymous-defendant crypto cases turns on the connection of the assets or the exchange to the forum. A victim in London whose stolen funds are on an exchange incorporated in a jurisdiction that does not recognise English freezing orders may need to file locally, not in London.
A common assumption is that once funds leave the original wallet, nothing can be done. This is incorrect. On-chain tracing can follow assets through multiple hops, through mixing services (with some constraints), and across chains. Exchanges regulated under regimes such as MiCA, the MAS Payment Services Act, and the VARA rulebooks are obligated to cooperate with court-ordered disclosure. The combination of forensics and legal process creates a path even when the defendant is anonymous and the assets have moved.
If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. Contact OBOLUS at info@oboluslaw.com or via t.me/oboluslaw to discuss your situation.
AML and Regulatory Levers in Asset Recovery
Recovery proceedings do not exist in isolation from the regulatory environment. Under the FATF Recommendations – specifically Recommendation 15 (virtual assets) and the Travel Rule (the obligation to pass originator and beneficiary data with a transfer) – regulated exchanges and VASPs are required to cooperate with lawful requests for transaction information. A well-structured legal application to an exchange can invoke both the court order and the exchange's regulatory obligations simultaneously, creating a dual-track pressure that accelerates cooperation.
Under MiCA and the national VASP regimes transitioning into it, European-regulated exchanges and custodians are subject to AML supervision by their national competent authority and ultimately by ESMA. A claimant who notifies the relevant NCA alongside a court application may find that regulatory pressure moves faster than the court order alone. This is not a substitute for the legal application – only the court can freeze assets – but it is a supplementary lever that experienced practitioners use.
Where the misappropriated asset is a stablecoin such as USDT or USDC, a further lever exists. Tether (USDT) and Circle (USDC) hold contract-level freeze and blacklist authority over their issued tokens, and issuers generally act on a court order or a law-enforcement or OFAC designation. A coordinated application to the issuer, backed by a court order from a recognised forum, can result in the token balance being frozen at the protocol level regardless of which exchange holds it. This mechanism is time-sensitive: the issuer needs to act before the holder redeems or converts the stablecoin.
Self-Assessment: Does Your Business Have the Recovery Infrastructure in Place?
A business that waits until after a theft to consider its recovery options has already lost significant time. The following questions identify the gaps that most commonly determine whether recovery is possible.
First: do you have a retained relationship with a digital-asset law firm that can file an ex parte freezing application outside business hours? The recovery window is often a weekend or an off-hours event. The answer to this question is frequently no.
Second: do you have a forensics partner on pre-agreed terms, capable of producing a court-ready attribution report within 24 hours? The legal application cannot proceed without this report, and procurement under time pressure consistently produces inferior evidence.
Third: does your incident response plan include a legal notification step alongside the technical and operational response? Most plans address the blockchain response; fewer address the parallel legal steps with the same urgency.
Fourth: do you know which forum you would file in, given where your counterparties, exchanges, and banking relationships are domiciled? The forum question is one that should be resolved before the event, not under pressure after it.
Fifth: do you have OFAC screening and AML compliance processes that would allow you to identify a VASP-regulated counterparty quickly, enabling the regulatory notification track to run alongside the court application?
If the answer to two or more of these questions is no, the risk to the business in the event of a theft is materially higher than it needs to be.
Related at OBOLUS
- Disputes and Asset Recovery for Digital-Asset Businesses – OBOLUS's full cross-border recovery and freezing-order practice
- Stablecoin Freeze Requests in Jersey – the procedural route for stablecoin freezing in a leading offshore forum
- Sanctions Screening for Crypto Firms – AML and Travel Rule compliance counsel for digital-asset businesses
FAQ
Can stolen crypto actually be recovered?
Recovery is achievable in a meaningful proportion of cases, provided action is taken within hours of the theft. On-chain tracing can follow assets across chains and exchanges. Courts in England and Wales, the DIFC, Singapore, and Hong Kong each have the procedural tools – freezing orders, disclosure orders, alternative service – to act against anonymous defendants. The limiting factor is almost always speed, not legal mechanism. The longer the delay, the more likely the assets have been moved to a forum or converted to a form that resists legal process.
How fast must I act after a digital-asset theft?
The recovery window is typically measured in hours to days. Assets on a major regulated exchange can be frozen via a court-ordered disclosure and freeze before withdrawal if the application is filed promptly. Stablecoin issuers can freeze protocol-level balances on receipt of a recognised court order or law-enforcement request. Once funds are converted to privacy-enhanced assets or reach an unregulated exchange in a non-cooperative jurisdiction, the legal options narrow substantially. The practical benchmark is: legal counsel and forensics engaged within the first two to four hours after discovery.
Can a court freeze assets held on an exchange?
Yes. Courts in England and Wales, the DIFC, Singapore, and Hong Kong have each granted freezing orders over digital-asset balances held at exchanges, directed both at the defendant personally and at the exchange as a third party holding the assets. The exchange is typically served with the freezing order and a disclosure order simultaneously, requiring it to freeze the balance and identify the account holder. Regulated exchanges – including those supervised under MiCA, the MAS Payment Services Act, and the VARA regime – are legally obliged to comply with orders issued by a court of competent jurisdiction.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice. We move for freezing relief and exchange disclosure while the trail is live – that speed is the product of a practice built around a single asset class. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes and Recovery Analyst – cross-border crypto asset recovery, anonymous-defendant proceedings, and freezing-order strategy across leading common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.