Recovery windows for misappropriated digital assets are measured in hours, not weeks. When a crypto exchange is hacked, a custodian is defrauded or a wallet is drained by an insider, the legal clock starts running at the moment of the first on-chain transaction. Two disclosure instruments – the Bankers Trust order (an emergency court order compelling a financial intermediary to disclose information about a specific transaction or account) and the Norwich Pharmacal order (an order requiring an innocent third party that has become mixed up in wrongdoing to disclose the identity of the wrongdoer) – are the tools that keep a live trail from going cold. Together, they form the procedural core of crypto asset recovery litigation in the leading common-law forums.
This guide explains how each instrument works, where it is available, how a business obtains one under pressure and what the cross-border complications look like when the assets, the exchange and the wrongdoer sit in different jurisdictions.
What are Bankers Trust and Norwich Pharmacal orders, and why do they matter for digital assets?
A Bankers Trust order targets financial information in the hands of an institution; a Norwich Pharmacal order targets the identity of a wrongdoer held by an innocent enabler. In crypto recovery work, both instruments are applied to exchanges, custodians and wallet providers that hold transaction records, account details or KYC data linking a theft to a real person.
The doctrinal roots are English. In AA v Persons Unknown [2019], an English court confirmed that Bitcoin is capable of being property and granted a proprietary injunction alongside disclosure relief – the decision that opened the litigation door for the current generation of crypto recovery cases. Osbourne v Persons Unknown [2022] extended the same recognition to NFTs. Both decisions sit in the Verified Facts Registry and are cited across common-law forums worldwide.
The practical significance is timing. A Bankers Trust order can be sought on an urgent without-notice basis in England and Wales, often within hours of a firm's instruction. A Norwich Pharmacal order follows a similar urgency track. For a business watching stolen stablecoins move across chains, speed is the entire point.
In our disputes practice, we have seen the gap between instruction and first-instance relief be as short as a single working day in England and Wales when the evidence package is ready. That evidence package – transaction hashes, a professional forensic report, a sworn statement of facts – must be assembled before counsel walks into court. Neither order waits for a slow start.
Who holds the information a court will order disclosed?
Exchanges, custodians and stablecoin issuers sit at the centre of every crypto recovery chain, because KYC records, withdrawal addresses and IP logs are rarely on-chain. The on-chain trail shows movement; the off-chain records show the person behind the wallet.
For a Bankers Trust order, the target is typically the financial intermediary that processed the exit – the exchange where stolen USDT was deposited, the OTC desk that facilitated conversion, or the bank that received fiat proceeds. The order compels disclosure of account information and transaction records that the applicant could not otherwise obtain.
For a Norwich Pharmacal order, the target is the innocent party that has – without fault – become part of the mechanism of wrongdoing. In crypto, that is almost always an exchange that onboarded the recipient wallet under its KYC programme. The exchange did nothing wrong, but it holds the name behind the address. The court orders it to hand that information over.
Tether (USDT) and Circle (USDC) sit in a slightly different position. Both issuers hold contract-level freeze and blacklist authority over their issued tokens and generally act on a court order, a law-enforcement request or an OFAC designation. A Norwich Pharmacal order establishing the legal basis for a freeze request significantly strengthens any approach to a stablecoin issuer. In parallel, forensic firms – Chainalysis, TRM Labs, Elliptic and Asset Reality are the names courts and law enforcement recognise – provide the on-chain attribution reports that anchor the evidence package.
How does a business actually obtain these orders in England and Wales?
The application process for both orders follows the same broad structure: assemble the evidence, draft the application, attend an urgent hearing before a judge, and serve the order on the third-party respondent.
The evidence threshold is proportionality-based. The applicant must show a good arguable case that wrongdoing occurred, that the respondent holds information the applicant cannot otherwise obtain, and that disclosure is necessary for the applicant to advance or protect its legal position. For a Norwich Pharmacal application the applicant must also demonstrate that the respondent is mixed up in the transaction – the classic "facilitating" requirement.
Timing is compressed because exchanges can and do delete or archive records. The application is therefore brought on an urgent, without-notice basis when delay would prejudice the outcome. The duty of full and frank disclosure – the applicant must tell the court everything material, including anything adverse to its case – is strictly applied, and a failure to comply can cause the order to be set aside entirely.
Service on an overseas exchange is a recurring complication. An order granted in England and Wales binds parties that are served within the jurisdiction and, in certain circumstances, overseas. Where the exchange is incorporated in a non-UK jurisdiction, the applicant may need to seek recognition or parallel relief in that jurisdiction. We regularly advise on that multi-step process.
The costs of these applications are typically recoverable from the wrongdoer in the main proceedings, not from the innocent respondent exchange. Courts have, however, ordered applicants to pay the respondent's reasonable compliance costs – a factor that affects the overall budget for a contested matter.
How do these orders work when the exchange and the assets are offshore?
The cross-border reality of crypto asset recovery means that a single theft almost always involves at least two jurisdictions, and often five or more. The victim may be in the EU, the first receiving wallet on a Cayman-regulated exchange, the second hop through a Singapore-incorporated OTC desk, and the exit via a Dubai-based broker.
England and Wales remain the leading forum for crypto asset recovery precisely because English courts have shown consistent willingness to grant worldwide freezing orders and disclosure orders with extraterritorial reach. A worldwide freezing order (a Mareva injunction applied globally, preventing a defendant from dealing with any assets anywhere in the world) can be granted alongside Norwich Pharmacal disclosure, creating simultaneous pressure on the wrongdoer and on any exchange holding that person's assets.
The DIFC Courts in Dubai have demonstrated similar receptiveness. Trafigura v Gupta [2025] DIFC confirmed the DIFC Courts' willingness to grant a worldwide freezing order in support of foreign proceedings – a significant development for businesses whose counterparties are UAE-based. In Hong Kong, the first "tokenised" injunction (HCA 2417/2024) and Re Gatecoin [2023] HKCFI 914 – in which the court confirmed that crypto assets constitute property – make Hong Kong a credible parallel forum.
Singapore's position, crystallised in CLM v CLN [2022] SGHC 46, is similarly clear: proprietary injunctions over crypto assets are available, and the Monetary Authority of Singapore's licensing regime under the Payment Services Act creates a regulatory pressure point for compliant exchanges operating in the jurisdiction.
The CFAAR network – the Crypto Fraud and Asset Recovery network, launched in London in September 2021 – connects practitioners across these forums and provides a practical mechanism for coordinating parallel applications. Multi-jurisdictional cases benefit from coordinated filing: an English order and a Singapore order served simultaneously on two exchanges creates freeze coverage before the wrongdoer can shift funds.
In a recent cross-border recovery matter, a payments company traced misappropriated stablecoins through two exchanges on separate continents. Working with allied counsel in the relevant jurisdictions, we secured a disclosure order in a leading common-law forum and parallel preservation relief in a second jurisdiction; the funds were frozen before withdrawal was attempted. The matter concluded within weeks of instruction.
For a scoped assessment of your recovery position, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the exchange's domicile, the on-chain footprint – change the analysis. Map your options
How does a freezing order interact with disclosure relief?
A freezing order (an injunction restraining a defendant from dissipating assets pending judgment) and disclosure orders are routinely sought together and serve complementary functions: the freezing order stops the movement of assets, the disclosure order identifies who controls them and where they are.
In crypto, that pairing has particular force. A worldwide freezing order naming "persons unknown" – the defendants in most crypto theft cases before attribution is established – can be served on exchanges as third parties who must then not facilitate withdrawals by the account holder. Once a Norwich Pharmacal order establishes the wrongdoer's identity, the proceedings are amended to name a real defendant and the freezing order continues against that person.
The ancillary disclosure obligation that accompanies a freezing order is itself a powerful tool. A defendant subject to a freezing order is typically required to swear an affidavit disclosing all assets above a threshold. Lying in that affidavit is contempt of court. The combination of the exchange's KYC records (from the Norwich Pharmacal order) and the defendant's compelled disclosure creates a cross-referenced picture that is difficult to deny.
Practically, the sequencing matters. We advise clients to treat the first seventy-two hours after a theft as the evidence-gathering window: preserve wallet addresses, document on-chain movements with a forensic report, identify the receiving exchange, and assemble the factual narrative for a without-notice application. A well-prepared application served at the start of business Monday morning – where the facts are documented and the evidence package is complete – has the highest probability of obtaining urgent relief.
Does obtaining a disclosure order trigger any licensing or regulatory question for the applicant?
Disclosure orders are litigation tools, not regulated activities, and seeking one does not itself require a licence. The regulatory interaction arises at a different level.
An exchange that receives a court-issued disclosure order is obligated to comply, and compliance typically requires disclosure of KYC data, transaction records and wallet addresses that would otherwise be protected by data privacy and banking confidentiality regimes. The court order provides the lawful basis for that disclosure under most data protection frameworks, including the EU GDPR and its national equivalents. The exchange's legal team will confirm the order's adequacy before producing documents.
The more pointed question is whether the applicant – the victim business – has its own regulatory obligations in the jurisdiction where it seeks relief. A crypto exchange applying in England and Wales will be asked by the court to describe its regulatory status. If it operates without FCA registration under the Money Laundering Regulations, or without a required licence in the jurisdiction where the relevant activity occurs, that gap may be raised by the respondent as part of the application. Courts have not uniformly refused relief on that basis, but it is a litigation risk worth managing.
Similarly, under MiCA, a CASP authorised in one EU member state and seeking disclosure in a second member state will need to consider whether the applicable CASP provisions require separate notification or cooperation with the relevant national competent authority. In our practice, we see inbound businesses assume that a passporting authorisation covers all ancillary legal steps in every member state – it does not.
The regulatory and litigation teams must work together from the outset of a recovery matter. Treating the two workstreams as parallel and non-communicating is a structural mistake that creates both delay and avoidable risk.
A common assumption: "once the funds have moved, nothing can be done"
This assumption is wrong in a material number of cases – and it is the single most expensive myth in crypto asset recovery work.
The view that blockchain irreversibility equals legal irreversibility confuses the technology with the legal system. On-chain transactions cannot be reversed by the protocol. Courts, however, do not reverse on-chain transactions. They impose obligations on people and entities: on an exchange to freeze a wallet; on a stablecoin issuer to blacklist a contract address; on a wrongdoer to return proceeds under threat of contempt sanctions. Those obligations are entirely independent of blockchain immutability.
The practical barrier is time, not law. An exchange that has already processed a withdrawal and closed the account has fewer records to produce and fewer assets to freeze. A stablecoin issuer asked to freeze a wallet that has already been drained has nothing to act on. That is why the recovery window matters – not because the legal mechanism expires, but because the factual trail cools and the assets disperse.
In our cross-border recovery practice, we have managed matters where attribution was achieved months after the initial theft, producing viable Norwich Pharmacal applications from cold but preserved blockchain data. It is harder, and the prospects depend heavily on whether the wrongdoer subsequently used a KYC-regulated exchange. But the legal machinery does not simply turn off at the seventy-two-hour mark.
The correct framing for any business facing a crypto theft is: act as fast as possible, document immediately, and take legal advice before concluding the matter is hopeless. The question is not "can anything be done?" – it is "what can be done from this starting position, and how much will it cost relative to the balance at risk?"
If a recovery clock is running, reach our disputes desk now at info@oboluslaw.com. If a prior application stalled or an exchange closed cooperation, a second read can surface the structural reason and the route back. Map your options
Which recovery path fits which operator profile?
Different fact patterns call for different sequencing and forum choices. The following profiles illustrate the principal decision branches.
Profile A – Theft from a regulated exchange with a known receiving wallet. Where the victim is a regulated entity and the receiving exchange is identifiable and FCA-registered or EU/MiCA-authorised, the fastest path is a without-notice Norwich Pharmacal application in England and Wales or a parallel application in the exchange's home jurisdiction, combined with a request to the exchange's compliance desk under CFAAR protocols. Timeline to first-instance disclosure is typically a matter of days in an urgent track. Key risk: the receiving exchange may have already processed withdrawals before the order is served.
Profile B – Stablecoin theft where assets remain on-chain. Where USDT or USDC is involved and the funds remain in a reachable wallet, the priority action is a parallel approach to Tether or Circle for a voluntary freeze, supported by law-enforcement liaison and a contemporaneous court application. The issuer freeze is faster than any court order but requires a law-enforcement case reference or court order for permanence. Timeline is measured in hours for the initial freeze request; legal permanence takes longer. Key risk: the issuer may decline absent a court order, creating a race between the freeze request and the wrongdoer's next transaction.
Profile C – Multi-hop theft across three or more exchanges in different jurisdictions. Where funds have moved across several platforms on different continents, the strategy is to identify the weakest link – the exchange with the most complete KYC records and the strongest legal framework for compelled disclosure – and open proceedings there first. CFAAR coordination allows parallel applications in two forums simultaneously. Timeline is longer and costs are higher. Key risk: the wrongdoer may be monitoring the investigation and moving funds ahead of each application.
Profile D – Insider misappropriation with a known identity. Where the wrongdoer is already identified – a rogue employee or a known counterparty – the proceedings skip the attribution phase. The priority shifts to a worldwide freezing order naming the defendant directly, combined with proprietary relief over the assets and contempt proceedings if the defendant fails to comply with disclosure obligations. Timeline compresses significantly once a real defendant is named. Key risk: the defendant may have already converted and transferred assets beyond the initial wallet.
Self-assessment: is your business ready to move at speed?
The gap between a well-advised business and an unprepared one in the first hours of a crypto theft is not primarily a legal knowledge gap. It is a readiness gap. The following steps can be taken before any incident occurs.
First, confirm that your business retains – or has a standing instruction to engage – litigation counsel in at least one primary common-law recovery forum. England and Wales is the baseline. If your exchange operations are concentrated in Asia, Singapore is a credible alternative seat.
Second, maintain clean and current records of all wallet addresses your business controls, all counterparty exchange accounts and all transaction hashes for material movements. A Bankers Trust or Norwich Pharmacal application is built on documented evidence. Courts do not accept reconstructed narratives assembled weeks after a theft.
Third, establish a relationship with a recognised forensic provider. The professional forensic report – tracing funds from the originating wallet through each hop – is a mandatory exhibit in most common-law disclosure applications. Having a firm on retainer or on a named panel shortens the evidence-assembly phase from days to hours.
Fourth, confirm your regulatory status in the jurisdiction where you operate. A victim exchange whose own licensing position is in question faces an avoidable litigation complication. Under the FCA's MLR registration regime, under MiCA's CASP authorisation, and under the applicable VASP provisions in the BVI, Cayman and other offshore centres, clean regulatory status is both a commercial and a litigation asset.
Fifth, brief your CFO and COO on the response protocol. Recovery litigation moves at the speed of decision-making. If authorisation to instruct counsel requires a board resolution that takes three days to convene, the recovery window may already be closed.
In our experience advising crypto exchanges, custodians and funds, the businesses that recover the most assets are not necessarily those with the most sophisticated technology. They are the ones that treat litigation readiness as an operational function, not an afterthought.
Related at OBOLUS
- Disputes and Asset Recovery for Digital-Asset Businesses – full overview of our recovery practice, forums and process
- Smart-Contract Dispute Resolution: Where the Legal Lines Are Drawn – on-chain disputes, governing-law questions and enforcement
- Tokenised Fund Structuring in Brazil – cross-border structuring for digital-asset fund managers with Latin American exposure
FAQ
Can stolen crypto actually be recovered?
Yes, in a meaningful proportion of cases – particularly where the wrongdoer used a KYC-regulated exchange at any point in the movement chain. Courts in England and Wales, Singapore, Hong Kong and the DIFC have each confirmed that crypto assets constitute property and are subject to proprietary relief. Recovery is not guaranteed; it depends on timing, the exchange's jurisdiction and the completeness of the on-chain trail. Acting quickly materially improves the outcome.
How fast must I act after a digital-asset theft?
As fast as possible. Recovery windows are measured in hours rather than weeks. The priority actions in the first twenty-four hours are: preserve all transaction hashes and wallet addresses, instruct forensic tracing, and brief litigation counsel on an urgent basis. A court application for without-notice disclosure relief can be filed in England and Wales within a day of instruction when the evidence package is complete. Delay allows assets to move and records to be deleted.
Can a court freeze assets held on an exchange?
Yes. A worldwide freezing order in England and Wales, or equivalent injunctive relief in Singapore, Hong Kong or the DIFC, can be served on an exchange as a third party, requiring it not to process withdrawals from the relevant account pending further order. Separately, a Norwich Pharmacal order can compel the same exchange to produce the KYC identity behind the recipient wallet. Both remedies are available on an urgent without-notice basis when delay would defeat the purpose of the application.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We move for freezing relief and exchange disclosure while the trail is live – because speed is not optional in crypto recovery. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or reach us at t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specialising in on-chain asset tracing, cross-border freezing relief and disclosure applications in common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.