Operating an exchange, a custody platform, or a token treasury without a tested recovery protocol exposes the business to a simple, brutal outcome: funds move on-chain in minutes and the legal process to stop them takes days. When a wallet address is all you know about your counterpart, the instinct is to conclude the matter is hopeless. That instinct is wrong – but the window to act is genuinely narrow. Persons unknown proceedings allow a claimant to sue a defendant identified only by a blockchain address, then use that litigation to compel exchanges, issuers and data-holders to freeze and disclose. The analysis below maps the legal architecture, the cross-border pressure points, and the practical steps that determine whether recovery is possible.
Persons unknown orders are injunctions and disclosure orders granted by courts against defendants identified by a wallet address rather than a legal name. Developed primarily under the jurisprudence of England & Wales – see AA v Persons Unknown [2019], which confirmed crypto assets as property amenable to injunctive relief – the mechanism has since been applied in the DIFC Courts, Singapore, Hong Kong, and beyond. The core tools are a worldwide freezing order (an injunction freezing a defendant's assets globally) and a Norwich Pharmacal or Bankers Trust disclosure order (a court order compelling a third party who is innocently mixed up in wrongdoing to reveal identity and account information). Used together, and quickly, they convert an on-chain address into a named respondent – and a frozen balance.
What Exactly Is a Persons Unknown Order in a Digital-Asset Context?
A persons unknown order is a court order – most typically an injunction or a disclosure direction – addressed to defendants who cannot yet be named because their real-world identity is unknown at the time of filing. In crypto-asset litigation, the defendant is a wallet address. The claimant pleads the address, the transaction hashes evidencing the wrong, and the nature of the loss; the court then acts on that basis without a named natural or legal person in the caption.
The doctrinal foundation in England & Wales rests on the recognition that crypto assets are property, first confirmed in AA v Persons Unknown [2019] and reinforced by a line of subsequent decisions. Once that threshold is met, the full suite of civil remedies that attach to property claims – freezing injunctions, proprietary injunctions, delivery-up, tracing – becomes available. The DIFC Courts have taken a parallel approach, granting freezing orders in support of foreign proceedings and in stand-alone crypto matters. Hong Kong's first tokenised injunction (in proceedings indexed as HCA 2417/2024) and the Singapore court's proprietary injunction in CLM v CLN [2022] SGHC 46 confirm that the doctrinal acceptance of crypto-as-property is now broad across common-law forums.
The practical effect is significant. A claimant who moves within the first hours after a misappropriation can, in a single application, obtain an order that: (a) freezes the wallet balance, (b) freezes any assets the defendant holds at identified exchanges, and (c) requires those exchanges to produce KYC and transaction data. That data is then used to name the defendant in amended pleadings, and the litigation proceeds on standard civil terms.
Which Courts Hear These Claims – and Why Forum Choice Matters?
Forum selection is one of the most consequential decisions in a crypto recovery matter, because the speed of interim relief, the willingness of exchanges to comply, and the enforceability of any judgment all vary by court.
England & Wales remains the leading forum. The court has developed the most comprehensive body of crypto-asset property jurisprudence, its freezing-order regime is well understood by exchanges globally, and its disclosure orders – issued under the Norwich Pharmacal and Bankers Trust principles – are routinely complied with by centralized platforms. Applications for without-notice freezing relief can move very quickly when supported by strong affidavit evidence and a professional forensic report.
The DIFC Courts provide a strong alternative for losses arising in, or connected to, the UAE. In Trafigura v Gupta [2025] DIFC, the court granted a worldwide freezing order in support of foreign proceedings, signaling the court's willingness to act as an anchor forum even where the underlying dispute is elsewhere. The DIFC's common-law framework and English-language process make it accessible to international claimants.
Singapore and Hong Kong both offer proprietary injunctions and disclosure routes. Hong Kong's willingness to issue tokenised injunctions – orders specifically addressed to on-chain token positions – marks a further evolution of the toolkit. Singapore's framework under the Payment Services Act creates a regulated environment in which exchange operators have clear compliance obligations, which can facilitate voluntary compliance ahead of formal court process.
For most cross-border matters we work through allied counsel in the relevant jurisdiction to coordinate simultaneous applications – a freeze in London, a disclosure request in Singapore, a letter to a Cayman-registered exchange operator – on a single overnight timeline.
To map the recovery options for your specific loss, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the exchange, the chain, the quantum – change the analysis considerably, and early triage determines which forums remain open.
On-Chain Tracing: The Evidentiary Foundation for Court Applications
Every persons unknown application is built on a forensic tracing report that converts raw transaction data into court-admissible evidence of ownership, movement, and current location of misappropriated assets.
The blockchain's immutability is simultaneously the investigator's greatest asset and the thief's limitation. Every transfer is recorded in a public ledger. The challenge is not retrieval – it is attribution: connecting an address to a real-world actor or a regulated custodian against whom legal process can be served.
Professional forensic analysis – performed by specialist firms using proprietary clustering and attribution methodologies – traces the movement of funds from the victim's address through intermediate wallets, across bridges, and ultimately to a destination that carries a legal handle. That handle is typically a centralized exchange (a VASP, or virtual asset service provider) subject to KYC obligations under the applicable AML regime. Once funds reach a regulated VASP, a disclosure order can compel that VASP to produce the identity behind the deposit address.
The quality and completeness of the forensic report is not a technical nicety. Courts reviewing applications for without-notice relief apply a high standard to the evidence supporting the freezing request. A report that stops at transaction hashes without attribution analysis will not carry the application. In our cross-border practice, we regularly work alongside forensic partners to convert raw on-chain data into affidavit-ready analysis before the first court filing.
A common mistake at this stage is delay. Every on-chain hop the funds make reduces the probability of a clean freeze: assets may move through mixers, be exchanged into different tokens, or be withdrawn from a centralized exchange into a self-custodied wallet. The recovery window after a misappropriation is typically measured in hours to days, not weeks. The forensic analysis and the court application must proceed in parallel, not in sequence.
Can Stablecoin Issuers Freeze Funds Directly – and How Does That Interact With Litigation?
Stablecoin issuers hold a contractual and technical power to freeze token balances that has no equivalent in the traditional asset recovery toolkit, and understanding how to use it alongside – not instead of – court process is essential.
Tether (USDT) and Circle (USDC) maintain contract-level freeze and blacklist authority over their issued tokens. Issuers generally act on a court order, a law-enforcement request, or an OFAC designation. That means a claimant with a court order – even an interim one – has a direct path to requesting that the issuer freeze the balance at a designated address, regardless of which exchange or wallet currently holds it. The freeze is on-chain, immediate, and irreversible by the defendant without issuer cooperation.
This creates a sequencing question. In many matters, the optimal structure is: (1) obtain the forensic report identifying the USDT or USDC balance; (2) file for emergency without-notice freezing relief in a leading forum; (3) serve the order on the issuer simultaneously with the exchange; (4) pursue the disclosure application to identify the defendant. The issuer freeze acts as a backstop if the exchange is slow to comply or if the funds are in transit.
The interaction between issuer freeze authority and court process is, however, imperfect. Issuers may require a law-enforcement case reference before acting on a civil court order alone. Some jurisdictions do not yet have clear protocols for this interaction. Coordinating the issuer request, the exchange disclosure, and the court application across multiple time zones requires careful preparation. We have seen matters where the court order was obtained but the issuer was not approached until 48 hours later – by which point the defendant had converted to a non-freezable token. Parallel process is not optional; it is the strategy.
What Cross-Border Complications Arise When the Wallet and the Claimant Are in Different Countries?
Most digital-asset theft is inherently cross-border: the claimant is in one jurisdiction, the exchange holding the funds is registered in a second, the defendant's IP address traces to a third, and the forensic evidence sits on servers in a fourth. Managing this fragmentation is the central practical challenge in persons unknown litigation.
The first issue is service. A without-notice order is obtained quickly; serving it on a defendant whose identity is unknown requires the court to authorize alternative service – typically by NFT drop to the defendant's wallet address, by email to an address associated with the account, or by social media message. England & Wales courts have authorized NFT-based service in appropriate cases. This is a powerful mechanism, but it requires careful drafting in the application to ensure the alternative service method is proportionate and traceable.
The second issue is exchange cooperation. Centralized exchanges registered in the BVI, the Cayman Islands, or other offshore centers may not be subject to direct English court jurisdiction. Compliance with a UK freezing order is often voluntary, underpinned by the exchange's own compliance program and the reputational consequences of non-compliance, rather than mandatory in a strict jurisdictional sense. Where a major exchange has a UK-regulated subsidiary, that subsidiary can be served directly. In our practice, we regularly assess which entity within an exchange group has the cleanest connection to a forum willing to issue process before deciding where to file.
A third complexity is recognition of orders across borders. A Singapore court will not automatically enforce an English freezing order; a parallel application may be needed. The CFAAR network (Crypto Fraud and Asset Recovery network, launched in London in September 2021) exists in part to facilitate this kind of multi-forum coordination, connecting practitioners across the major recovery centers.
Tax consequences are a fourth angle that operators frequently overlook. In our cross-border practice, the structure of a recovery – whether it is treated as a return of capital, a compensatory receipt, or something else – can have material tax implications depending on the claimant's domicile and the form of the recovered asset. This should be mapped before settlement discussions begin. For a detailed discussion of the tracing and tax interaction, see our related analysis on on-chain asset tracing: the disputes angle.
Decision Matrix: Which Recovery Path Fits Your Profile?
Not every claimant should pursue the same route. The right mechanism depends on the quantum of the loss, the nature of the assets, the identifiability of the defendant, and the jurisdiction in which evidence and legal handles exist. The following profiles describe the main scenarios we encounter.
Profile A – Large loss, assets on a centralized exchange, defendant identity partially known. This is the strongest recovery profile. The combination of an exchange KYC record and on-chain forensic evidence supports a full persons unknown application: emergency freezing order, Norwich Pharmacal / Bankers Trust disclosure against the exchange, and an accelerated route to naming the defendant. The forum of choice is typically England & Wales or, for UAE-connected matters, the DIFC Courts. The expected arc – from forensic instruction to order in hand – is compressed but achievable within a matter of days for a well-prepared application. Key risk: delay; each additional transaction hop reduces the probability of a clean freeze.
Profile B – Mid-range loss, assets partially on-chain in a self-custodied wallet, defendant unknown. The disclosure order remains the primary instrument, but there is no exchange to serve. The claimant needs to identify a VASP somewhere in the transaction chain – a fiat off-ramp, a DeFi protocol with a KYC gate, an NFT platform. The forensic analysis must be more granular. Stablecoin freeze authority (where the assets are USDT or USDC) may be the most effective interim measure. Indicative timeline from instruction to freeze request is longer, and the outcome is more dependent on the specific chain topology. Key risk: clean on-chain assets moving to a privacy protocol or being bridged beyond traceable reach.
Profile C – Smaller loss, assets through a mixer or privacy protocol, defendant entirely unknown. The toolkit is narrower. A court application remains possible but the cost-benefit ratio shifts. Law-enforcement referral – to the relevant national authority and, for OFAC-designated actors, to US enforcement channels – becomes relatively more attractive. Civil action should focus on any residual centralized touch points in the transaction chain. Key risk: cost of litigation exceeds recoverable quantum.
Profile D – Institutional loss, multi-chain, multi-exchange, organized actor. This requires a coordinated multi-forum strategy. English proceedings provide the anchor; parallel applications in Singapore, Hong Kong, or the DIFC address exchange entities in those centers. Issuer freezes on all stablecoin balances should be pursued simultaneously. A specialist forensic firm should be instructed at day one, not as an afterthought. Key risk: jurisdictional fragmentation slowing the overall timeline; the answer is pre-approved legal and forensic protocols before an incident occurs rather than improvisation after one.
Addressing the Objection: "Once Funds Leave the Wallet, Nothing Can Be Done"
This is the most persistent and damaging misconception in digital-asset fraud response, and it costs victims real money every time it delays a professional instruction.
The premise has a kernel of truth: pseudonymity makes instant identification impossible, and the absence of a central intermediary means there is no single point of control. But the conclusion does not follow. The blockchain is a permanent, public record of every transfer. Pseudonymity is not anonymity. The vast majority of misappropriated assets eventually touch a centralized exchange, a stablecoin issuer, or another regulated entity – and those entities are subject to legal process.
The evidence base is clear at a qualitative level. Courts in England & Wales, the DIFC, Singapore, and Hong Kong have all granted meaningful relief in crypto recovery matters. Freezing orders have been obtained against unknown defendants. Disclosure orders have produced KYC records that identified defendants who were then served in the conventional way. Issuer freezes have locked balances on-chain pending proceedings. None of this is guaranteed – outcomes depend on the facts, the speed of action, and the quality of the application – but the assertion that nothing can be done is simply incorrect as a matter of law and as a matter of practice.
In our cross-border practice, we regularly advise business clients who arrive at our door days or even weeks after a loss, having been told informally that recovery was not possible. In some cases the window has already closed. In others, critical evidence remains available and a targeted application can still produce results. The cost of the "nothing can be done" assumption is that clients never find out which category they were in.
A second common assumption is that law enforcement is the primary route. For institutional and business losses, civil proceedings are typically faster and more targeted than a police investigation. They operate on a lower evidential threshold for interim relief, allow the claimant to drive the timeline, and produce enforceable court orders rather than investigative outcomes. Law enforcement and civil proceedings are complementary, not alternatives; but civil action should not wait for a police reference number.
How Should a Business Build a Recovery-Capable Legal Posture Before an Incident?
The businesses that recover the most are the ones that prepared before the loss occurred. A recovery-capable posture does not require anticipating every attack vector; it requires having the legal and operational infrastructure to act within hours.
The first element is forensic readiness. Having a nominated forensic partner under a standing engagement – or at minimum a pre-agreed instruction protocol – means the tracing process begins within the hour of detection rather than after a procurement process. Courts reviewing emergency applications are sensitive to whether the claimant acted promptly; a delay in instructing forensics is a delay in the application, and it will be noticed.
The second element is a tested internal escalation path. The legal team, the compliance officer, and the CISO need to know, in advance, who makes the call to commence proceedings and who has authority to execute an emergency instruction letter. In large organizations, the chain of approvals for legal spend can take longer than the recovery window itself.
The third element is exchange relationships. Many centralized exchanges have a compliance or legal affairs channel that responds faster to an organized, evidence-supported request from a known counterpart than to a cold inbound claim. Establishing that relationship before an incident – as part of counterparty due diligence – is a legitimate and low-cost risk management step.
The fourth element is legal protocol. Working with counsel in advance to draft a standard affidavit template, to identify the right forum for your most likely loss profile, and to agree the scope of a first-night application removes the drafting time from the critical path. In matters we have handled, the difference between a five-hour and a fifteen-hour application timeline is almost always the quality of the preparation that existed before day zero.
In a recent matter, a digital-asset custodian retained us on a standing advisory basis specifically to develop this protocol. When an unauthorized withdrawal was detected, the forensic instruction and the court filing were initiated within three hours of the incident being confirmed. A freezing order was obtained the following morning, and a disclosure application against the receiving exchange followed within 24 hours. The timeline worked because the preparation existed – not because the facts were unusually favorable.
If a recovery clock is already running, reach our disputes desk now at info@oboluslaw.com. If a prior application stalled or an account closure interrupted the process, a second read of the facts can surface the structural reason and the route back.
Self-Assessment: Is Your Business Ready to Pursue Persons Unknown Relief?
A business in or near a loss event should work through the following questions before instructing counsel. The answers determine both the viability of proceedings and the urgency of the instruction.
First: do you have the transaction hashes documenting the unauthorized transfer? Without these, no forensic analysis can begin and no application can be filed. If your wallet infrastructure does not log transaction IDs automatically, this is a gap that needs closing before an incident occurs.
Second: have you identified any centralized exchange touch point in the transaction chain? Even a single deposit to a regulated VASP gives the application a target for a disclosure order. If the funds went directly to a self-custodied address with no intermediate exchange, the application is harder but not impossible.
Third: are the assets denominated in USDT or USDC? If so, issuer freeze authority is available in parallel with court process. This is one of the most powerful tools in the recovery toolkit and should be considered from hour one.
Fourth: how much time has elapsed since the transfer? Each day adds complexity. If the answer is less than 48 hours, priority-one action is warranted. If it is more than a week, a frank assessment of the remaining evidence trail is needed before deciding whether to file.
Fifth: what is the quantum? Courts apply a proportionality analysis to the granting of without-notice relief, and the cost of the proceedings must be weighed against the probable recovery. For smaller losses, a law-enforcement referral or a complaint to the relevant regulator – the FCA in the UK, the SFC in Hong Kong, MAS in Singapore – may be the more cost-effective first step, with civil proceedings reserved for assets above a threshold where litigation economics support them.
Sixth: is there a cross-border element that requires coordinating counsel in more than one forum? If the exchange is registered offshore and the defendant's trail leads to a second jurisdiction, a multi-forum strategy needs to be structured from the outset. Acting in one forum and ignoring the others creates a gap that a sophisticated defendant will exploit.
Related at OBOLUS:
- Disputes & Asset Recovery for Digital-Asset Businesses – full-service recovery and litigation capability for institutional claimants
- On-Chain Asset Tracing: The Disputes Angle – how forensic tracing intersects with tax and structural consequences on recovery
- MLRO and Compliance Officer Function in Guernsey – compliance infrastructure for regulated digital-asset businesses in a leading offshore center
FAQ
Can stolen crypto actually be recovered?
Yes – in many cases, but the outcome depends on speed, the quality of the forensic evidence, and whether the assets have touched a regulated exchange. Courts in England & Wales, the DIFC, Singapore, and Hong Kong have all granted freezing and disclosure orders in crypto matters. Where assets remain at a centralized exchange or in a traceable stablecoin balance, recovery is a realistic objective. The window is narrow; professional legal and forensic instruction within hours of detection is the decisive variable.
How fast must I act after a digital-asset theft?
The recovery window is measured in hours to days, not weeks. Each on-chain hop the misappropriated assets make – to a new wallet, through a bridge, to a mixer – reduces the probability of a clean freeze. Courts expect claimants seeking without-notice emergency relief to have acted promptly; delay weakens the application as well as the underlying evidence trail. A forensic instruction and a legal triage call should happen within the first few hours of confirmed loss.
Can a court freeze assets held on an exchange?
Yes. A worldwide freezing order – available in England & Wales and in a number of common-law forums including the DIFC and Singapore – can be addressed to the exchange as a third party, requiring it to freeze any assets connected to the defendant's account. This can be combined with a Bankers Trust or Norwich Pharmacal disclosure order compelling the exchange to produce KYC and transaction records. Most major centralized exchanges comply with orders from leading jurisdictions, particularly where they have a regulated subsidiary in that forum.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We move for freezing relief and exchange disclosure while the trail is live, and we work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialist in cross-border digital-asset litigation, on-chain tracing strategy, and emergency injunctive relief across common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.