Operating a digital-asset business means accepting that some counterparties will defraud you before you know their names. A persons unknown proceeding (a civil action brought against unidentified defendants, identified only by their blockchain addresses, wallet IDs or pseudonymous handles) is the primary legal instrument available to a business that has lost funds to an anonymous actor. Courts in England and Wales, the DIFC, Singapore and Hong Kong have all granted meaningful relief on this basis — freezing orders, disclosure orders and, in some cases, proprietary injunctions — without knowing who, physically, holds the stolen assets. The legal basis is established. The critical variable is speed.
This guide explains what persons unknown proceedings are, how they work across the major recovery forums, and what a digital-asset business must have ready before the clock runs out.
What Are Persons Unknown Proceedings in Digital-Asset Recovery?
A persons unknown proceeding is a civil claim naming defendants not by personal identity but by a descriptor that uniquely identifies their connection to the wrong — typically a blockchain address, a wallet cluster, or an exchange account reference. The doctrine emerged from property law in England and Wales and has been adapted by common-law courts worldwide to address the reality of pseudonymous crypto fraud. In landmark cases such as AA v Persons Unknown [2019], the English High Court confirmed that crypto assets constitute property capable of being the subject of a proprietary injunction — a foundational holding that anchors the entire recovery practice.
The proceeding serves two immediate functions. First, it restrains the defendant — whoever they ultimately prove to be — from moving the misappropriated assets. Second, it compels exchanges, custodians and blockchain analytics providers to disclose information that converts a pseudonym into a legal identity. Without a formal proceeding, neither function is available. The theft is complete and the window closes.
In our disputes practice, we advise businesses that the first strategic question after a loss event is not "who did this?" but "which forum can issue binding relief before the funds move again?" That question drives everything — the choice of jurisdiction, the shape of the application and the forensic evidence assembled in support of it.
What Is the Legal Foundation for Suing an Unknown Defendant?
The authority to proceed against persons unknown rests on the inherent jurisdiction of superior courts to do justice in novel circumstances, supplemented — in most common-law systems — by rules of civil procedure that permit alternative service and unnamed defendants where identity cannot be established without the relief sought. The circularity is acknowledged and managed: you need the disclosure order to identify the defendant, but you need a defendant to issue the disclosure order. Courts resolve this by accepting a sufficiently precise descriptor as a substitute for a name.
In England and Wales, the courts have accepted blockchain addresses as a sufficient descriptor, provided the applicant can show a direct connection between those addresses and the alleged wrong. The Civil Procedure Rules accommodate service by alternative means — including service via a non-fungible token airdrop to the defendant's wallet, as sanctioned in Osbourne v Persons Unknown [2022] in the context of NFT asset disputes. This is not a legal curiosity. It is a functioning procedural tool.
The DIFC Courts in Dubai have developed a parallel track. In recent proceedings, including matters reported in 2025, the DIFC Courts have granted worldwide freezing orders (injunctions that bind the defendant's assets globally, regardless of where those assets are held) in support of substantive claims and, critically, in support of foreign proceedings. The reach of a DIFC order extends through the network of enforcement treaties and judicial cooperation arrangements that the UAE has built with major financial centers.
Singapore and Hong Kong have followed analogous paths. In CLM v CLN [2022] SGHC 46, the Singapore High Court granted a proprietary injunction over crypto assets held by unknown defendants. The Hong Kong Court of First Instance recognised crypto as property in Re Gatecoin [2023] HKCFI 914 and, in subsequent proceedings, issued what has been described as the first "tokenised" injunction, a form of relief delivered on-chain. Each of these developments reflects a convergence: the leading commercial courts are building infrastructure for digital-asset recovery, and practitioners who know which forum fits which fact pattern will use that infrastructure far more effectively than those filing in the jurisdiction of convenience.
How Does a Freezing Order Work Against an Anonymous Crypto Defendant?
A freezing order (sometimes called a Mareva injunction) restrains the defendant from dissipating assets pending trial. Against an anonymous defendant holding crypto, the order binds the descriptor — the wallet address — and any exchange or custodian that holds assets traceable to that address. The exchange becomes a secondary obligor: once served with the order, it must freeze the relevant accounts or face contempt.
The threshold requirements are standard injunctive relief criteria: a good arguable case on the merits, a real risk of dissipation and, in most jurisdictions, an undertaking in damages by the applicant. In crypto matters, the risk-of-dissipation element is almost always satisfied — a single transaction can empty a wallet in seconds. Courts understand this. Applications are routinely heard without notice to the defendant (ex parte), precisely because advance notice would allow the defendant to move funds before the order takes effect.
What the court needs from the applicant, in that ex parte hearing, is evidence. Specifically: the transaction hashes that trace the stolen funds from the applicant's wallet through intermediate addresses to the current holding address, a professional forensic report prepared by a blockchain analytics firm establishing that chain of custody, and a clear statement of the quantum — the value alleged to be frozen. An application unsupported by forensic analysis will fail. Courts are not equipped to read raw blockchain data; they require expert interpretation, and they expect that expert to be independent.
Operators we advise routinely prepare a forensic package within hours of a loss event, precisely because the ex parte hearing window is narrow. If the funds have already moved to a cold wallet or a privacy-mixing protocol, the evidential position becomes harder — not impossible, but materially more difficult. The forensic report must account for every hop.
What Disclosure Orders Can Compel Exchange Cooperation?
Freezing the assets is only half the solution. To pursue a substantive claim — to recover the funds permanently, not merely to restrain them — the business needs to identify the defendant. Two disclosure mechanisms are central to this: the Norwich Pharmacal order and the Bankers Trust order.
A Norwich Pharmacal order compels a third party that has, however innocently, been mixed up in wrongdoing to disclose information in its possession that will identify the wrongdoer. Applied to an exchange: the exchange holds KYC data — name, address, identity document — linked to the wallet address. It is mixed up in the chain of events by virtue of having accepted the deposit. A court can compel it to disclose that data to the applicant, even though the exchange is not itself a wrongdoer.
A Bankers Trust order operates similarly but is specifically grounded in the equitable obligation to account for misappropriated funds — it is historically the more natural tool where the target is an account-holding institution. In practice, in crypto matters, practitioners often apply for both, framed as a composite disclosure order, and leave the court to determine which basis is more applicable to the specific defendant.
The cross-border dimension here is acute. A London court can issue a Norwich Pharmacal order against an exchange incorporated in the Cayman Islands, registered in Malta under the VFA framework transitioning to MiCA, and hosting its infrastructure in Singapore. Whether the exchange complies depends on whether the order is enforceable in its operating jurisdiction and whether it has taken legal advice on its obligations. We have seen exchanges take broadly cooperative positions once they receive a properly served order from a respected forum — and we have seen exchanges resist, requiring a second enforcement application in the relevant local court. Both scenarios need to be planned for before the first application is filed.
How Does a Cross-Border Recovery Strategy Work in Practice?
For a business that has suffered a significant misappropriation, the recovery strategy is multi-jurisdictional from the first hour. The stolen funds rarely stay in one place. They move: from the initial receiving wallet through mixing services, through peer-to-peer exchanges, through privacy coins, and ultimately to an off-ramp — a centralized exchange where the thief converts the proceeds to fiat. Each hop in that chain crosses a potential jurisdiction. The recovery strategy must anticipate the route.
In our cross-border practice, the standard first-day protocol involves three parallel tracks. The first is obtaining emergency freezing relief from the most accessible forum that has jurisdiction over the applicant or over assets on a known exchange. England and Wales is the default for many matters given the speed of the Commercial Court and the global reputation of its orders. The DIFC Courts provide a strong alternative for matters with a UAE nexus or where an enforcement step in the Gulf is anticipated.
The second track is engaging directly with the stablecoin issuers — specifically, Tether (USDT) and Circle (USDC), both of which hold contract-level freeze and blacklist authority over their issued tokens and generally act on court order or law-enforcement designation. Where stolen funds have moved into stablecoin form, contacting the issuer with a formal legal notice and, ideally, a law-enforcement case reference, can result in an issuer-level freeze while the court application is pending. This is not a substitute for court process — it is a parallel measure that buys time.
The third track is working through the CFAAR (Crypto Fraud and Asset Recovery) network, launched in London in September 2021, which connects practitioners, forensic specialists and enforcement agencies across major jurisdictions. CFAAR membership means shorter communication lines to the forums where enforcement will ultimately be needed.
The decision about which forum to anchor the primary application turns on four factors: where the applicant is incorporated or regulated, where the exchange holding the funds is regulated, where the defendant is most likely to have recoverable assets, and which court's orders are most widely enforced in the anticipated enforcement jurisdictions. These factors point in different directions for different matters. There is no universal answer.
To map the specific forum strategy for your loss event, contact OBOLUS at info@oboluslaw.com. The process above describes the standard analytical path. Your facts — the asset type, the exchange involved, the volume, the cross-border trail — change every element of the analysis. Map your options.
What Evidence Does a Business Need Before Filing?
The evidence package for a persons unknown application has three components, and a weak component in any one of them will cost the applicant the ex parte hearing or, worse, the return date when the matter is contested.
The first component is the factual narrative — a clear, chronological account of the loss event, the relationship between the applicant and the stolen assets, and the basis for the assertion that the defendant holds those specific assets. For crypto matters, this means knowing the exact wallet addresses from which funds departed, the exact addresses to which they arrived, and the current best evidence of where they now sit. A forensic report prepared by a recognised blockchain analytics firm — Chainalysis, TRM Labs, Elliptic or Asset Reality are among the practitioners we coordinate with — is the backbone of this component.
The second component is the legal basis. The applicant must articulate a claim: theft, fraud, unjust enrichment, breach of trust — whichever cause of action fits the facts. Persons unknown proceedings are not a freestanding cause of action; they are a procedural vehicle for an underlying substantive claim. The quality of the underlying claim determines the strength of the application.
The third component is the jurisdictional basis — the connection between the matter and the chosen court. Courts are alert to forum-shopping, particularly in crypto matters where the applicant may have a free choice of several competent forums. The connection must be real: the applicant's domicile, the exchange's regulatory presence, the applicable law of the contract that was breached.
In a recent recovery matter, a payments company discovered that a seven-figure stablecoin balance had been misappropriated by a counterparty whose identity was entirely pseudonymous. We assembled the forensic package within the first working day, filed for a without-notice freezing order and a composite disclosure order in a leading common-law forum, and obtained both before the end of that week. The order was served on the relevant exchange by alternative service, and the defendant's KYC data was disclosed within the following fortnight. The matter resolved before trial, with the funds returned as a condition of settlement. Speed and forensic preparation were determinative.
Addressing the Myth: Is Recovery Actually Possible After Crypto Theft?
A common assumption is that once funds leave a wallet, legal recovery is not feasible — that the pseudonymous nature of blockchain transactions and the absence of a traditional defendant make litigation pointless. That assumption is incorrect, and it costs businesses real money by causing them to delay seeking legal advice until the recovery window has closed.
The legal position across the leading forums is now settled at the foundational level: crypto assets are property. They can be the subject of proprietary claims. They can be frozen, traced and returned through court process. The question is not whether recovery is legally possible but whether it is practically achievable in the specific case — and that turns almost entirely on timing and forensic quality.
The practical obstacles are real. Funds that have passed through a mixing protocol are harder to trace than funds that moved directly between exchange accounts. A defendant who has converted stolen crypto to cash and withdrawn it has made recovery significantly more difficult, though not impossible — the fiat trail has its own forensic architecture. A defendant located in a jurisdiction that does not enforce foreign civil judgments presents a collection problem even after a successful freezing order. None of these obstacles is insurmountable, but each requires a specific tactical response.
The businesses that recover funds are those that act within hours of discovering the loss, not those that wait to "see if it resolves itself." Recovery windows for misappropriated digital assets are measured in hours to days. That is not a sales proposition; it is the operational reality of blockchain settlement finality and the speed at which sophisticated bad actors move assets across chains and off-ramps.
If a recovery clock is running, reach our disputes desk now at info@oboluslaw.com. We move for freezing relief and exchange disclosure while the trail is live. Map your options.
How Do AML and KYC Obligations Interact With Recovery Proceedings?
The intersection of recovery proceedings with AML and KYC obligations is one of the less-discussed but practically important dimensions of persons unknown cases. It runs in two directions.
First, the AML obligations of the exchange holding the frozen assets create a legal basis for cooperation that supplements — and sometimes precedes — the formal court order. Under the Travel Rule (the FATF obligation to pass originator and beneficiary data with a virtual asset transfer), exchanges subject to that obligation in their licensing jurisdiction may have independent duties to report and freeze suspicious transactions. Where a court order reinforces those existing obligations, exchange compliance is markedly faster.
Second, businesses that are themselves regulated VASPs must be careful about how they manage the loss event internally from an AML reporting perspective. A significant theft may trigger a suspicious activity reporting obligation in the business's own licensing jurisdiction — whether under the MiCA regime in the EU, the VARA rulebooks in Dubai or the Payment Services Act provisions in Singapore. Failure to file that report while simultaneously pursuing civil recovery can create a regulatory complication. The civil recovery track and the AML compliance track must be managed in parallel, not sequentially.
In our practice, we regularly advise clients on managing both tracks simultaneously — ensuring that the civil strategy is not compromised by premature regulatory disclosure, and that the regulatory filing does not inadvertently alert the defendant before the freezing order is served. The sequencing matters. It requires coordination between the disputes team and the compliance function, and it requires clarity about the jurisdictional obligations applicable to the business's specific regulatory status.
Which Recovery Path Fits Your Situation?
The appropriate recovery strategy depends on the profile of the loss event. Three broad profiles emerge from the matters we encounter.
Profile A: Exchange-to-exchange theft, recent (within 72 hours). The funds are most likely still on a centralized exchange. The priority is an ex parte freezing order from the fastest available competent forum — England and Wales for a London-incorporated business, the DIFC Courts for a UAE-based operator, Singapore for an MAS-regulated entity — combined with an immediate issuer-level notice to any stablecoin issuer if the funds have been converted. The timeline from instruction to filed application is typically measured in business days, not weeks, assuming forensic evidence is available. The key risk at this stage is a concurrent withdrawal while the application is being prepared.
Profile B: Cross-chain laundering, elapsed time of one to four weeks. The funds have moved through multiple addresses and potentially through a bridge or privacy protocol. The forensic task is more complex and the trail may be partially cold. The priority shifts from pure speed to forensic quality — a weaker forensic report at speed is worse than a strong report at a slightly longer timeline. The forum selection becomes more deliberate: which jurisdiction has the best enforcement reach into the exchanges likely holding the current balance? A Norwich Pharmacal order strategy across two or three exchanges simultaneously may be required.
Profile C: Sophisticated fraud, identity partially known. The defendant has an exchange account in their real name but has transferred funds to a secondary wallet controlled by an unknown third party. The persons unknown framework applies to the secondary defendant; a conventional claim applies to the primary. The two claims run in parallel. The cross-border angle is central: the primary defendant may be in a jurisdiction with a civil enforcement treaty; the secondary may not. Asset location and enforcement jurisdiction drive the entire strategy.
Related at OBOLUS
- Disputes & Asset Recovery for Digital-Asset Businesses – Our full practice overview for businesses pursuing cross-border digital-asset recovery.
- On-Chain Asset Tracing: Legal Counsel for Digital-Asset Firms – How forensic tracing integrates with court proceedings to establish the evidential chain.
- Token Legal Classification in Mauritius – How token classification under the VAITOS Act affects regulatory and structuring decisions.
FAQ
Can stolen crypto actually be recovered?
Yes — provided action is taken quickly and the forensic evidence is strong. Courts in England and Wales, Singapore, Hong Kong and the DIFC have all granted freezing orders and disclosure orders against unknown defendants holding crypto assets. Recovery depends on the speed of the legal response, the quality of blockchain forensic analysis, and the current location of the funds. The foundational legal question — whether crypto is property capable of recovery through court process — is settled in the leading common-law forums.
How fast must I act after a digital-asset theft?
Within hours, not days. Blockchain transactions are final on settlement; a determined bad actor can move funds across chains and to an off-ramp before a next-business-day application is even drafted. The first action is to preserve every piece of evidence — transaction hashes, wallet addresses, communications — and instruct legal counsel immediately. An ex parte freezing application can often be filed within one to three business days of instruction, assuming the forensic package is assembled in parallel. Every hour of delay reduces the probability of a successful freeze.
Can a court freeze assets held on an exchange?
Yes. A freezing order served on an exchange binds it as a third party: the exchange must freeze the relevant accounts or risk contempt of court. Exchanges operating under regulatory regimes — including those licensed under MiCA in the EU, the VARA framework in Dubai, or under the Payment Services Act in Singapore — are acutely sensitive to court orders and generally comply once properly served. The practical challenge is ensuring the order is served before the defendant withdraws. This is why ex parte, without-notice applications are the standard approach in urgent crypto matters.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses. In disputes and recovery matters, we move while the trail is live — assembling forensic packages, filing for emergency relief and coordinating across forums on the same timeline as the fraud itself. To discuss a loss event or a recovery strategy, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst — specialising in cross-border digital-asset recovery, persons unknown proceedings and on-chain forensic strategy across common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.