Recovery windows for misappropriated digital assets are measured in hours. Once a thief bridges stolen tokens to a new chain, layers them through a mixer, or withdraws to a non-custodial wallet, the practical options narrow fast. The legal question is not merely whether funds can be traced on-chain — blockchain's permanent ledger makes tracing technically feasible in most cases — but whether the structure of your response, the sequencing of forensic work, legal filings, and exchange engagement, is tight enough to catch the funds before they move again.
On-chain asset tracing is, at its core, a race between transaction velocity and legal process. A freezing order (a court injunction preventing a defendant from dealing with assets) is the primary instrument in leading common-law forums, and it is most effective when it issues within the first 24 to 72 hours. The structuring angle examined here concerns the decisions that determine whether a business reaches that window: which forum to file in, what forensic evidence to lead, how to engage custodial exchanges, and how to coordinate across multiple jurisdictions simultaneously.
This analysis addresses each of those decisions in turn, from the immediate triage through to the cross-border enforcement picture.
Why Structure Matters in the First 48 Hours
The single most consequential decision in a crypto recovery matter is not which court to approach — it is whether the business responds in a structured way within the first two days. On-chain tracing confirms that misappropriated tokens typically pass through one or more custodial exchange addresses before reaching a self-custody wallet. That custodial passage is the vulnerability a well-structured response exploits.
The reason timing determines everything is fungibility combined with withdrawal mechanics. Stablecoins, in particular, move at settlement finality: a Tether (USDT) or USD Coin (USDC) transfer confirms in seconds. Both Tether and Circle hold contract-level freeze authority over USDT and USDC respectively, and both issuers generally act on a court order or a law-enforcement designation. But the freeze request must reach the issuer before the hacker initiates a swap or a bridge — actions that take the funds outside the issuer's contractual reach entirely.
In our disputes practice, the matters that end in recovery are almost always the ones where the client engaged counsel within hours of discovering the loss. The matters that end in nothing recoverable are often those where the business spent three days investigating internally before calling anyone.
Structure, at this stage, means: run forensics and run legal process in parallel, not sequentially. A forensic report is not a prerequisite for a court application; it is evidence to be filed alongside the application, with a professional who can swear to the trace.
What On-Chain Tracing Actually Produces — and What Courts Need
On-chain tracing produces a transaction graph: a time-stamped record of wallet addresses, amounts, and movements that is admissible in any leading common-law forum. Courts in England and Wales, the DIFC, Singapore, and Hong Kong have all treated blockchain transaction records as sufficient evidential foundation for urgent relief. The trace is not sufficient on its own — you need a statement from a qualified forensic analyst, not merely a screenshot.
Forensic analytics providers work from transaction hashes, wallet addresses, and, where available, deposit addresses at known exchanges. The output identifies whether funds have arrived at a virtual asset service provider (VASP — an exchange, custodian, or OTC desk) that is subject to AML/KYC obligations. If they have, that VASP holds identity information that a disclosure order can compel.
A disclosure order — variously styled a Norwich Pharmacal order or a Bankers Trust order depending on the jurisdiction — compels the exchange to produce the account holder's KYC data and transaction records. England and Wales has developed the most complete body of crypto-disclosure case law among common-law forums, including the landmark AA v Persons Unknown [2019] decision, which confirmed that cryptocurrency is property capable of being frozen.
The structuring question is which forum issues the disclosure order fastest and whether that forum can also issue an injunction against the identified account holder. Those are sometimes different answers.
In our cross-border practice, we regularly advise clients where the forensic trace terminates at an exchange regulated in one jurisdiction while the victim business is domiciled in another. The response then requires parallel filings — or at minimum a primary filing in the forum with the most robust crypto-property jurisprudence, with allied counsel in the relevant jurisdiction for enforcement steps.
The Exchange Engagement Problem: KYC Data, Voluntary Cooperation, and Legal Compulsion
Major custodial exchanges present a structural tension that any tracing strategy must resolve. They hold the KYC identity of the thief's deposit account. They will generally not produce that information voluntarily without a court order or a law-enforcement request. Their terms of service allow them to freeze or suspend accounts pending investigation, but they exercise that discretion inconsistently and, crucially, in their own time.
Voluntary engagement — emailing the exchange's compliance or legal team with a detailed incident report — is worth doing, but it should be treated as a parallel track, not the primary one. An exchange that is processing thousands of tickets will not move fast enough on its own to stop a determined thief from initiating a withdrawal. The legal track must move simultaneously.
The structural decision here is which instrument to use. A worldwide freezing order (an injunction freezing a defendant's assets across all jurisdictions) issued by an English court, for example, covers assets wherever they are held and can be served on an exchange operating internationally. A disclosure order issued alongside it compels the exchange to produce account data. The DIFC Courts have similarly issued freezing relief in support of proceedings in other forums, which matters for operators in the UAE whose counterparties or exchanges are based elsewhere.
The practical obstacle is not the law — it is service and enforcement. Serving a court order on an exchange domiciled in a jurisdiction different from the issuing court requires recognition steps, and some exchanges resist compliance pending local legal advice. A well-structured response accounts for that resistance in advance, selects the forum whose orders carry the widest practical reach for the exchange in question, and has allied counsel in the exchange's home jurisdiction ready to assist with enforcement if needed.
Contact OBOLUS now if a recovery clock is running. The analysis above describes the standard path. Your facts — the exchange, the chain, the domicile of the thief's account — change the sequencing entirely. Reach our disputes desk at info@oboluslaw.com.
Cross-Border Coordination: The Structuring Angle in Practice
Most significant digital-asset thefts in 2025 touch at least three jurisdictions: the victim's domicile, the exchange where stolen funds arrived, and the chain or protocol through which they were moved. Effective recovery requires a response that is legally operative in each of those places, not just one.
The structuring decisions in a cross-border matter reduce to four questions. First, which forum issues the primary relief? Second, which VASP or chain protocol is the enforcement target, and does the primary forum's order reach it? Third, is a parallel filing needed in the exchange's home jurisdiction? Fourth, if funds move again mid-proceedings, how does the response adapt?
England and Wales remains the dominant primary forum for most cross-border crypto recovery matters. Its courts have issued freezing orders and disclosure orders against exchanges and persons unknown in dozens of matters, the jurisprudence is the most developed among common-law forums, and English orders are recognised and enforced across a wide range of jurisdictions. The DIFC Courts are an increasingly strong secondary option for matters with a UAE nexus, particularly following recent decisions confirming their willingness to issue freezing relief in support of foreign proceedings.
Singapore and Hong Kong both offer strong crypto-property jurisprudence. In matters where the exchange is regulated under the Monetary Authority of Singapore's Payment Services Act or under the SFC's VASP regime in Hong Kong, a local filing may be the most direct route to compelling exchange cooperation without the additional recognition step required for a foreign court order.
The cross-border angle creates a practical risk that unsophisticated respondents consistently underestimate: filing too fast in the wrong forum generates a paper record the thief can monitor while the victim waits for recognition proceedings elsewhere. A well-structured response sequences the filings deliberately, uses urgent ex parte relief (applications made without notice to the defendant) where the forum allows it, and coordinates the simultaneous service of orders on all exchanges in the trace graph rather than approaching them one at a time.
In our experience, multi-exchange cases — those where the trace graph touches three or more custodial platforms — require a project-management discipline that is as important as the legal strategy itself. Every exchange is a separate enforcement event, potentially in a separate jurisdiction.
A Decision Matrix: How Operator Profile Shapes the Response
Not every misappropriation case warrants the same response. The structuring angle involves matching the response architecture to the profile of the loss and the likely recovery scenario.
Profile A — Large-balance stablecoin theft, funds still on a custodial exchange. This is the highest-probability recovery scenario. The stablecoin issuer can freeze the tokens if reached in time; the exchange holds KYC data that a disclosure order will produce. The optimal response is parallel: a direct freeze request to the issuer with a law-enforcement or court-order reference and a simultaneous ex parte freezing and disclosure application in England and Wales or the DIFC. Timeline to initial relief: typically a matter of days in an emergency application before a court familiar with crypto matters. The key risk is delay — every hour the funds remain unfrozen is an hour the thief can initiate a swap.
Profile B — Native token theft (non-stablecoin), funds routed through a DEX or mixer before reaching a custodial address. The issuer-level freeze is not available for non-stablecoin tokens. The trace is more complex, and the forensic burden is higher. The structuring focus shifts to the entry point into the custodial system — the exchange where the thief eventually converts — and to the disclosure order as the primary instrument. Timeline to initial relief is generally longer, and the probability of recovery depends heavily on how much of the trace the forensic team can reconstruct before the funds are withdrawn again. A freezing order against the exchange account, issued before the thief's withdrawal request clears, is the target outcome.
Profile C — Insider misappropriation or smart-contract exploit, identity known or inferrable. Where the perpetrator is identifiable — a former employee, a known counterparty, a DeFi protocol team with on-chain connections — the relief sought shifts from anonymous ("persons unknown") to named-defendant proceedings. The tracing work is still essential, but the disclosure-order stage may be abbreviated. The primary instrument becomes a freezing order against the named individual and a proprietary claim over the misappropriated assets. The cross-border complexity depends on where the defendant is located and where they hold assets.
In each profile, the structuring principle is the same: the forensic trace and the legal process must move together, and the choice of forum must account for where enforcement actually has to happen, not just where jurisdiction is technically available.
How Your Corporate Structure Affects Who Can Bring the Claim
A dimension of the structuring angle that many operator clients overlook is the interaction between their corporate structure and their standing to seek relief. Courts issue freezing orders and disclosure orders in favour of the claimant — the party bringing the claim. Where the business that suffered the loss operates through multiple entities, or where the wallet that was compromised is held by a subsidiary or an SPV, the question of which entity has standing to be the claimant is not merely formal: it affects which forum is available, which governing law applies, and how quickly an application can be prepared.
We have seen cases where a parent company in one jurisdiction sought relief in respect of assets held by a subsidiary in another, only to face a standing challenge that added days to the proceedings. In a recovery context, days matter. The structuring work ideally happens before an incident, not during one.
Operators with complex group structures — a common arrangement in the digital-asset industry, where the licensing entity, the wallet-holding entity, and the revenue entity are frequently separate — should conduct a pre-incident structuring review that maps the relationship between the entity that would suffer a loss and the entity that would have standing to bring a claim. That review should also identify in advance which forums the relevant entities could access and what preliminary evidence package a court in each forum would require.
The same logic applies to clients who are creditors of a failed exchange rather than victims of a direct theft. A creditor's claim in an insolvency proceeding in a jurisdiction such as the Seychelles may require a different standing analysis and a different evidentiary structure than a direct proprietary claim in a common-law recovery forum.
The AML Angle: How VASP Obligations Work For — and Against — Recovery
The global Travel Rule — the obligation under FATF Recommendation 15 and its implementing regimes to pass originator and beneficiary data with virtual asset transfers — creates a paper trail that is directly useful in tracing. VASPs subject to Travel Rule obligations in the EU under MiCA, in Singapore under MAS requirements, in the UK under FCA rules, and in other leading hubs are required to collect and transmit the identity of the sender and receiver of a transfer above the applicable threshold. That data, combined with the on-chain transaction graph, can often identify the beneficial owner of a receiving account without a court order.
The structural tension is that most of the exchanges most useful for recovery — particularly those operating in emerging markets or in jurisdictions with lighter oversight — are not fully Travel Rule compliant. For those platforms, the disclosure order remains the primary tool for identity production.
MiCA's entry into full effect for CASPs (crypto-asset service providers) across the EU brings a more uniform compliance baseline for the European market. An exchange authorised as a CASP under MiCA and supervised by a national competent authority or by ESMA has statutory obligations that a freezing or disclosure order can enforce against. MiCA's Travel Rule alignment means that EU-regulated exchanges are increasingly compelled to retain the originator and beneficiary data a claimant needs — the legal vehicle for production becomes the procedural question, not whether the data exists.
The AML regime in the UAE under VARA's rulebooks similarly requires licensed virtual asset service providers to maintain KYC and transaction records. A freezing order from the DIFC Courts, or a law-enforcement request coordinated through the relevant UAE authorities, can reach that data in a well-structured response.
Objection Handler: The Myth That Crypto Theft Is Irreversible
A common assumption among business clients who have suffered a digital-asset theft is that the pseudonymous nature of blockchain transactions makes recovery impossible. That assumption is wrong, and it is costing businesses recoverable funds every day.
Blockchain is pseudonymous, not anonymous. Every transaction is permanently recorded on a public ledger. A professional forensic analyst can trace the movement of specific tokens — identified by transaction hash and amount — through wallet addresses, across bridges, and into custodial platforms with a high degree of precision. The pseudonymity breaks at the point of exchange, where KYC obligations require the account holder to register with a real identity. That is the structural exploit that makes recovery feasible.
The legal instruments exist in every leading common-law forum to compel exchanges to produce that identity data and to freeze the account before withdrawal. The CFAAR (Crypto Fraud and Asset Recovery network), launched in London in September 2021, is a cross-border practitioner network specifically established to coordinate these responses across forums. The courts in England and Wales, the DIFC, Singapore, and Hong Kong have all shown willingness to grant urgent relief in crypto recovery matters.
What limits recovery is not the law and not the technology. It is time. The businesses that recover funds are the ones that run a structured response immediately. The businesses that do not recover funds are, in our experience, almost always the ones that delayed because they assumed nothing could be done.
If you have suffered a digital-asset loss, the question is not whether legal tools exist — it is whether you are using them fast enough. For a scoped assessment of your recovery position, contact OBOLUS at info@oboluslaw.com.
A Micro-Matter: Coordinated Cross-Border Stablecoin Recovery
In a recent matter, a digital-asset payments company discovered a large-value USDC balance had been misappropriated from its operational wallet. The transaction graph showed the funds had moved through two intermediate addresses before arriving at deposit addresses at two separate custodial exchanges — one regulated in an EU member state, one in Asia. We engaged a forensic analytics firm to produce a verified trace report within hours of the client's notification. Simultaneously, we prepared an ex parte application for a freezing order and a disclosure order in a leading common-law forum, supported by the forensic report, transaction hashes, and a statement from the client's technical team.
The court granted both orders within days of the loss, before the thief had initiated a withdrawal from either exchange. We served both exchanges with the orders and coordinated with the USDC issuer on a parallel freeze request referencing the court proceedings. The funds were frozen across both accounts. We then used the disclosure orders to obtain the KYC identity data of both account holders and commenced named-defendant proceedings. The cross-border element required allied counsel in the exchange's home jurisdictions to assist with enforcement recognition, but neither exchange contested compliance once served with a valid court order.
The recovery was not certain at the time of filing. What made it possible was the decision to run the forensic and legal tracks in parallel from the first hour — not sequentially.
Related at OBOLUS
Related at OBOLUS
- Disputes & Asset Recovery for Digital Asset Businesses – the full practice overview, covering freezing orders, disclosure, and enforcement strategy across 25+ forums.
- Creditor Claims in Crypto Insolvency in the Seychelles – how to protect and advance a creditor position when an exchange fails in a key offshore hub.
- Airdrop Legal Structuring – Counsel for Digital Asset Firms – pre-launch structuring that reduces the regulatory and recovery exposure at the token level.
FAQ
Can stolen crypto actually be recovered?
Yes, in a meaningful proportion of cases — particularly where stolen funds arrive at a custodial exchange subject to KYC obligations. The on-chain ledger permanently records the movement of tokens, and forensic analysts can trace specific amounts to custodial deposit addresses. Courts in England and Wales, the DIFC, Singapore, and Hong Kong have all issued freezing and disclosure orders compelling exchanges to freeze accounts and produce identity data. Recovery probability falls sharply with time: the structuring of a fast, parallel legal and forensic response is the primary determinant of success.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows are measured in hours, not days. Once a thief converts or bridges the stolen tokens out of a custodial exchange, the leverage a freezing order provides over that specific balance is gone. Stablecoin issuers — Tether and Circle — can freeze USDT and USDC at the contract level on a court order or law-enforcement reference, but only if the freeze request reaches them before a swap or bridge transaction executes. Engaging counsel within hours of discovering a loss is not an overreaction. It is the threshold condition for a viable recovery.
Can a court freeze assets held on an exchange?
Yes. Courts in leading common-law forums — England and Wales, the DIFC, Singapore, Hong Kong — regularly issue freezing orders over assets held at custodial exchanges. The order may be directed at the exchange directly, requiring it to freeze the relevant account, or at the named (or anonymous) account holder. A disclosure order can accompany the freeze, compelling the exchange to produce the account holder's KYC data. The exchange's location matters: where the exchange is domiciled in a different jurisdiction, recognition and enforcement steps may be needed, and allied counsel in that jurisdiction are essential.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking, and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses. We move for freezing relief and exchange disclosure while the trail is live — because recovery in this space is a race, and preparation determines who wins it. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst — specialises in cross-border on-chain asset tracing, freezing order strategy, and coordinated multi-forum recovery proceedings for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.