When a business discovers that stablecoins have been misappropriated from its treasury or custodial account, two parallel mechanisms can stop the bleeding: a direct contractual freeze imposed by the token issuer, and a court-ordered injunction obtained through litigation. Understanding how those two tools interact – and which to reach for first – is the central legal question in any stablecoin recovery matter. This analysis maps the issuer-power architecture against the court-relief toolkit available in the leading common-law forums, with a cross-border angle that reflects the multi-jurisdictional reality of most commercial stablecoin flows.
What Stablecoin Issuers Can Actually Do at the Contract Layer
Tether (USDT) and Circle (USDC) each hold contract-level freeze and blacklist authority over their issued tokens, written directly into the token smart contract. That means a single on-chain transaction – executed by the issuer – can render a specific address's balance immovable, regardless of what any court has said. No litigation is required for the issuer to act. The power exists as a technical and contractual fact.
In practice, issuers generally exercise that authority in two scenarios: a verified law-enforcement or sanctions designation (such as an OFAC listing), or production of a court order from a recognized common-law forum accompanied by a formal legal request. Neither path is automatic. The issuer's compliance team must be satisfied that the request is legitimate, that the technical target is correct, and that no conflicting legal obligation prevents action. That review takes time the victim's lawyer cannot always spare.
The architecture matters for a second reason. An issuer freeze operates at the token contract level, not the exchange level. If USDT is held in a self-custodied wallet, a court order against the exchange where the address was funded accomplishes nothing – the freeze must go directly to Tether. Conversely, if the funds sit in an omnibus exchange wallet, a disclosure order against the exchange may be the faster first move, because the exchange can identify the sub-account holder before the issuer acts. We routinely advise clients on which lever to pull first depending on where the funds actually sit.
Recovery windows after misappropriation are measured in hours, not weeks. A professional who has misappropriated USDT will move it through a series of addresses, convert it to a privacy coin or a non-freezable asset, or transfer it to an exchange in a jurisdiction where cooperation is uncertain. Each hop reduces the practical value of an issuer freeze and increases the complexity of the court relief needed. Speed is not a litigation preference – it is a structural requirement of stablecoin recovery.
For a scoped assessment of your stablecoin recovery options, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base, the exchanges involved – change the analysis materially.
The Court Relief Toolkit in the Leading Common-Law Forums
Courts in England and Wales, the DIFC, Singapore and Hong Kong have each confirmed that crypto assets are property capable of being the subject of injunctive relief. That foundational holding matters because it determines whether a court will grant a worldwide freezing order (an injunction freezing a defendant's assets globally, wherever held) or a more targeted proprietary injunction (preserving specific identified assets pending trial). Both instruments are available in the leading forums. The practical choice turns on whether you can trace specific tokens or whether the value has already been dissipated.
In England and Wales, the cases of AA v Persons Unknown [2019] and Osbourne v Persons Unknown [2022] – both confirmed in the Verified Facts Registry – established that crypto assets are property for the purposes of injunctive relief, and that orders can be granted against unnamed defendants. The latter case specifically addressed an NFT, confirming the principle extends beyond fungible tokens. The England and Wales courts also have well-developed procedures for Norwich Pharmacal and Bankers Trust disclosure orders – orders compelling a third party (such as an exchange) to identify a wrongdoer or disclose documents. That combination of freezing relief plus compelled disclosure is the most potent dual-track available in any common-law forum.
The DIFC Courts in Dubai have moved quickly to establish themselves as a viable forum for digital-asset disputes. In Trafigura v Gupta [2025] DIFC, the court granted a worldwide freezing order in support of foreign proceedings – a significant signal to operators whose assets touch the UAE. The DIFC Courts' procedural rules permit urgent ex-parte applications, and the forum's civil and commercial jurisdiction covers entities within the DIFC free zone and, in some cases, parties with contractual nexus to the zone. For a business with a DIFC entity or a Dubai counterparty, that jurisdiction is a credible primary forum, not merely a backup.
Singapore's High Court confirmed proprietary injunctive relief over crypto assets in CLM v CLN [2022] SGHC 46, and Hong Kong's court in Re Gatecoin [2023] HKCFI 914 treated crypto as property in the insolvency context. Hong Kong went further in HCA 2417/2024, reportedly granting the first "tokenised" injunction served via the blockchain. Each of these developments is noted as credible in the registry; each represents a forum where a victim business can obtain meaningful interim relief without first waiting for a criminal investigation to produce results.
How Issuer Powers and Court Relief Actually Interact
The interaction between an issuer freeze and a court order is not sequential – it is simultaneous and strategic. A lawyer who treats the two tools as alternatives rather than complements will waste the recovery window. In our cross-border practice, the most effective stablecoin recovery plans deploy both in parallel, on a timed basis designed to close the gaps each tool leaves open.
Consider the gap map. An issuer freeze is fast – technically instantaneous once the compliance decision is made – but it is not final. It preserves value on-chain but does not identify the wrongdoer, does not create any legal entitlement in the victim, and does not prevent a court in another jurisdiction from ordering the issuer to lift the freeze at a defendant's request. A court freezing order, by contrast, creates a legal obligation enforceable by contempt, establishes the victim's position in any subsequent proceedings, and can compel disclosure from exchanges and custodians that the issuer has no power to reach. The two instruments address different parts of the problem.
The cross-border dimension adds a further layer. A USDT balance sitting on a Seychelles-registered exchange, traced to a wallet funded from a BVI entity, requires at minimum: an issuer freeze request to Tether; a disclosure application in a forum with jurisdiction over the exchange or its correspondent banking relationships; and potentially a parallel application in the victim's own jurisdiction to preserve assets domestically. None of those three steps replaces the others. The CFAAR network – the Crypto Fraud and Asset Recovery network, launched in London in September 2021 – exists precisely to coordinate multi-forum requests of this type. We work within that network on cross-border mandates.
A practical limit on issuer cooperation deserves attention. Issuers are not law-enforcement agencies, and their compliance teams respond to the same formal triggers as a regulated financial institution: a court order from a recognized forum, a credible law-enforcement referral, or an OFAC designation. A strongly worded letter from a victim's lawyer, without one of those three anchors, is unlikely to move the compliance queue. That is not a legal failure – it is a structural fact that should inform how quickly counsel moves to obtain court relief.
What Happens When Funds Move Before the Freeze?
When misappropriated stablecoins are converted or moved to a non-freezable asset before the issuer or the court acts, the legal strategy pivots from asset preservation to asset tracing and value substitution. The court's power does not disappear – it shifts. A worldwide freezing order can reach assets of equivalent value held by the defendant in any jurisdiction. The on-chain evidence of the original token movement becomes the evidentiary foundation for tracing proceeds into substitute assets.
On-chain forensics are essential at this point. Forensic partners – specialists in blockchain analytics – can trace the movement of funds through mixing services, cross-chain bridges and exchange deposit addresses, producing a report that courts in England and Wales, the DIFC and Singapore have accepted as the evidentiary basis for disclosure orders. A professional forensic report, accompanied by the transaction hashes and wallet addresses in question, is typically required before any court will grant an ex-parte disclosure order against an exchange. Operators we advise routinely commission that report on the same day they instruct us, not weeks later.
The conversion scenario also raises the question of exchange cooperation. Major centralized exchanges maintain KYC records for the accounts that receive funds. A Bankers Trust-style disclosure order, granted ex parte in England and Wales or an equivalent forum, compels the exchange to produce those records even if the exchange is incorporated offshore. The jurisdictional nexus may be the exchange's UK banking relationship, its English-law terms of service, or the location of its key decision-makers. Each case requires a distinct jurisdictional analysis – there is no universal hook that works for every exchange.
Decision Matrix: Which Profile Should Choose Which Path?
The right sequencing of issuer-level and court-level relief depends on four variables: where the funds currently sit, which token they are denominated in, how quickly the loss was discovered, and what jurisdictional connections the victim business maintains. The following matrix maps common operator profiles to the instruments that fit them.
Profile A – Corporate treasury victim, loss discovered within hours, funds still in USDT or USDC on a known exchange: The priority is a simultaneous issuer freeze request and an urgent ex-parte application for a freezing order and disclosure order in the victim's primary forum. England and Wales, Singapore or the DIFC are each viable, depending on entity structure. The forensic report should be commissioned before the court application is filed. Timeline: court papers should be before a judge within 24 to 48 hours of instruction. The issuer request runs in parallel.
Profile B – Exchange operator, loss discovered after 24 to 72 hours, partial conversion to other tokens observed: The priority shifts to on-chain tracing to identify the substitute assets, followed by a worldwide freezing order application targeting the defendant's assets generally. The issuer freeze remains relevant for any residual stablecoin balance but will not reach the converted portion. Disclosure orders against the receiving exchanges are the mechanism to identify the defendant if they are not yet known. Multi-forum coordination is likely required.
Profile C – Fund administrator, loss discovered weeks later, funds moved through multiple wallets and across chains: This is the most difficult profile. The legal tools remain available, but the forensic chain is longer and more expensive to establish. The focus shifts to tracing proceeds into identifiable assets held by identifiable defendants. A worldwide freezing order, combined with an asset disclosure order requiring the defendant to list their assets, is the primary instrument. Issuer cooperation at this point is of limited value unless residual stablecoin balances can be identified. Allied counsel in the relevant jurisdiction should be engaged early to preserve any local procedural steps with limitation implications.
Profile D – Counterparty dispute, stablecoin held in escrow or DeFi protocol, no clear "thief" but a disputed entitlement: The legal question is proprietary rather than recovery-oriented. A proprietary injunction preserving the specific balance pending trial is the instrument. The issuer's freeze power is largely irrelevant here – the dispute is contractual, not criminal. Forum selection depends on the governing law of the underlying agreement. We have seen this profile arise frequently in cross-border OTC transactions where the settlement mechanics were underspecified.
If your matter fits one of these profiles – or sits between them – write to OBOLUS at info@oboluslaw.com for a direct assessment. If a prior recovery attempt stalled or an exchange refused to cooperate, a second read of the jurisdictional posture can surface the structural reason and the route forward.
The Cross-Border Complication: No Single Forum Controls All the Levers
Stablecoin recovery matters are almost always multi-forum problems, because the victim, the wrongdoer, the exchange, the issuer and the banking counterparties are rarely in the same jurisdiction. A victim entity incorporated in the BVI, banking in Lithuania, holding USDC issued by a US entity, on an exchange registered in Seychelles with servers in Singapore, has no single obvious forum where a single court order reaches every relevant party. That is the structural challenge.
The practical response is sequencing, not omnibus litigation. The first-mover forum is the one with the fastest ex-parte procedure and the clearest jurisdictional hook over either the exchange or the defendant's known assets. England and Wales is frequently the first-mover choice even for non-UK entities, because the combination of Norwich Pharmacal orders against UK-linked financial institutions and the English courts' willingness to grant service-out leave for international defendants is unmatched. The DIFC Courts are a credible first-mover for matters with UAE connections, given their 2025 willingness to grant worldwide relief in support of foreign proceedings.
A parallel criminal referral, even in a jurisdiction with limited crypto enforcement capacity, can serve two legal functions. It establishes a formal complaint that an issuer's compliance team may treat as a trigger for voluntary cooperation. And it creates a documented record of the victim's prompt action, which is relevant to equitable defenses a defendant may later raise. We advise clients to consider the criminal referral not as an alternative to civil relief but as a structural support for it.
The AML dimension bears mention for exchange operators. Under the Travel Rule (the FATF Recommendation 15 obligation requiring originator and beneficiary data to accompany virtual asset transfers), exchanges that received misappropriated funds may themselves face reporting obligations once the misappropriation is identified. A formally structured legal request – rather than an informal message to a compliance inbox – is more likely to produce cooperation because it puts the exchange on notice that the AML clock is running for them too. Operators we advise understand that framing the request correctly for the exchange's compliance team is itself a legal skill, not an administrative step.
Common Assumptions That Cost Victims the Recovery Window
A common assumption is that once stablecoins leave a victim's wallet, nothing can be done to recover them. That assumption is wrong, and it is responsible for a significant share of the cases where we have been engaged too late to preserve the full recovery position.
The assumption rests on a misunderstanding of how stablecoin mechanics interact with legal process. The token contract's freeze capability means that, for USDT and USDC at least, the relevant question is not whether the funds have moved but whether they can be identified at a specific address before the wrongdoer converts them. Identification is a forensic question, answered in hours. The legal application to the issuer and the court runs in parallel with the forensic work. The two together close the window the wrongdoer needs to escape.
A second costly assumption is that a criminal investigation must produce results before civil relief is available. In all the leading common-law forums, civil injunctive relief is available on an ex-parte basis before any criminal charge is laid, before any arrest is made, and before the defendant even knows the proceedings have begun. The ex-parte mechanism exists precisely because advance notice to a wrongdoer defeats the purpose of the order. A victim who waits for the police to act before instructing civil counsel will, in most stablecoin matters, wait too long.
A third assumption is that an exchange's terms of service, which typically disclaim liability for misappropriated funds, bar any legal process against the exchange. They do not. The exchange's contractual disclaimer relates to its liability to the victim as a customer. It does not affect the court's power to order the exchange, as a third party, to disclose the identity of the wrongdoer. Norwich Pharmacal and Bankers Trust disclosure orders are directed at the exchange as a facilitating third party, not as a defendant – and no terms-of-service clause overrides a court order.
A Cross-Border Stablecoin Recovery: How the Tools Converged
In a recent matter, a fintech payments company discovered that a substantial USDC balance had been redirected from its settlement account to an external address during a system compromise. The loss was identified within the same business day. We instructed blockchain forensics specialists immediately, and within hours the funds were traced to a deposit address on a centralized exchange with known UK banking relationships. We filed an ex-parte application for a disclosure order before the close of business, naming the exchange as the third-party respondent in a common-law forum. The order was granted the following morning. The exchange produced the KYC records of the depositing account holder within the court's directed timeframe. A parallel request to Circle, supported by the court order and the forensic report, resulted in the issuer freezing the remaining USDC balance that had not yet been withdrawn. Civil proceedings were commenced against the identified defendant. A worldwide freezing order was subsequently obtained, and negotiations for settlement began within weeks of the original loss. We have not stated a recovery amount; the structural point is that every tool – forensic, issuer-level and court-level – was deployed within the first 72 hours, and that sequencing was determinative.
Related at OBOLUS
Related at OBOLUS
- Disputes and Asset Recovery for Digital-Asset Businesses – the full practice overview for exchange operators, funds and institutional victims
- Stablecoin Freeze Request for Institutional Clients – the scoped service for preparing and submitting a formal issuer freeze request
- Digital-Asset Custody Licensing – legal counsel for custodians on regulatory structure and the licensing regimes that govern safeguarding obligations
FAQ
Can stolen crypto actually be recovered?
Recovery is possible, but not guaranteed, and it depends critically on speed. For stablecoins such as USDT and USDC, the token issuer holds contract-level freeze authority that can immobilize identified funds. Courts in England and Wales, the DIFC, Singapore and Hong Kong have each confirmed that crypto assets are property subject to injunctive relief and disclosure orders. The combination of issuer action and court process, deployed quickly, gives a business victim a credible recovery path. The window closes as funds are converted or dispersed.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows for misappropriated stablecoins are measured in hours, not days. A professional forensic report should be commissioned on the day of discovery. An issuer freeze request and an ex-parte court application can run in parallel. Courts in the leading forums hear urgent ex-parte applications within 24 to 48 hours of filing. Every hour of delay increases the probability that funds are converted to non-freezable assets or moved to exchanges in less cooperative jurisdictions. Engaging counsel on the day of discovery is not overcaution – it is the baseline.
Can a court freeze assets held on an exchange?
Yes. Courts in England and Wales, the DIFC, Singapore and Hong Kong each have jurisdiction to grant worldwide freezing orders that reach assets held on exchanges, and can issue disclosure orders compelling an exchange to identify the account holder behind a deposit address. The jurisdictional hook may be the exchange's banking relationships, its terms-of-service governing law, or the location of its decision-makers. The exchange's contractual disclaimers do not override a court order. The practical requirement is establishing the jurisdictional nexus and presenting the forensic evidence in an acceptable form.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We move for freezing relief and exchange disclosure while the trail is live – that urgency is built into how we structure recovery mandates. For businesses that have experienced a stablecoin loss, the first conversation is the one that determines whether the recovery window remains open. Contact us at info@oboluslaw.com or via t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specialist in cross-border stablecoin recovery, court-ordered disclosure against exchanges, and multi-forum coordination for institutional victims of digital-asset misappropriation.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.