Recovery windows for misappropriated digital assets are measured in hours, not weeks. When a business discovers that tokens have been moved without authorization — whether through a rogue insider, an exchange hack, or a counterparty fraud — the legal clock begins immediately. The chain of custody on-chain is permanent, but liquidity is not: assets move across bridges, mixers and jurisdictions within minutes. A structured recovery strategy, built before you call the forensic team, is the difference between a freeze and a loss.
On-chain tracing combined with a coordinated legal response across the right forums is the operative model for recovering misappropriated tokens. Under the leading common-law regimes — England and Wales, the DIFC Courts in Dubai, Singapore and Hong Kong — courts have recognized digital assets as property capable of being frozen, disclosed and returned. This guide sets out the seven steps that a business must work through to convert an on-chain trail into a freezing order and, ultimately, restitution.
Step 1: Triage the Loss Before You Touch the Wallet
The single most damaging mistake in crypto fraud response is interacting with the affected wallet before the forensic baseline is set. Triage means three things: preserve every transaction hash, record the block height and timestamp of the last authorized movement, and instruct your technical team to make no further transactions from the compromised address. Touching the wallet — even to move remaining assets to safety — can complicate later tracing if the movement is misread as a voluntary transfer.
In our cross-border practice, we have seen recovery matters derailed at the outset because the victim entity moved residual funds without documenting the reason. Courts and exchanges alike examine every post-incident transaction. The rule is: capture first, act second.
Document the loss in writing immediately. An internal incident report with timestamps, wallet addresses, approximate token values at time of loss, and the identity of any known counterparty is the foundation of every subsequent legal step. This document will be exhibited to your first affidavit.
Common mistake at this step: Notifying the exchange informally by support ticket before counsel has prepared a formal legal demand. Exchange compliance teams will accept a ticket but are not required to preserve data on informal notice alone. A legally framed preservation demand from counsel carries materially different weight.
Step 2: Commission a Professional Forensic Trace
A professional blockchain forensic report is not optional — it is the evidentiary spine of every recovery action. Courts and stablecoin issuers both require a forensic trace before acting. The report must identify the originating wallet, every intermediate address, any exchange deposit addresses reached, and — critically — whether the funds are still on-chain or have been converted to fiat.
Forensic analysis tools used in the market (including those deployed by firms such as Chainalysis, TRM Labs and Elliptic, which are referenced in our Verified Facts Registry as operational partners in this space) generate cluster maps that group addresses by controlling entity. Where tokens have reached a custodial exchange (an exchange that holds private keys on behalf of users), the forensic report gives legal counsel the exchange name and the deposit address — the two facts needed to draft a disclosure order application.
The cross-border note here is important. An exchange may be incorporated in the Seychelles, operated from Lithuania under a VASP (virtual asset service provider) registration, and serve users globally. The forensic report identifies the technical destination. Counsel then maps that destination to the legal forum with the highest likelihood of obtaining enforceable relief quickly.
Common mistake at this step: Using a self-generated blockchain explorer screenshot rather than a signed professional report. Screenshots are routinely challenged as inadmissible or incomplete in urgent applications. A report from a recognized forensic firm, signed by a qualified analyst, carries the weight a court needs to act on short notice.
Step 3: Select the Right Legal Forum
Forum selection is a strategic legal decision, not an administrative one — and it must happen in the first hours, not after a week of deliberation. The leading forums for digital-asset recovery have developed specific jurisprudence recognizing crypto assets as property. England and Wales was the first major common-law jurisdiction to do so; AA v Persons Unknown [2019] established that Bitcoin is capable of being the subject of a proprietary injunction. The DIFC Courts in Dubai have since issued worldwide freezing orders in support of foreign proceedings. Singapore's High Court issued a proprietary injunction over misappropriated crypto in a reported 2022 decision. Hong Kong courts have similarly granted freezing relief and, in a 2024 matter, issued the first "tokenized" injunction over an NFT.
The practical selection criteria are: (1) where is the exchange or custodian most likely to have a legal presence or serve process, (2) which forum can grant emergency relief most rapidly, and (3) does the forum's procedural rules permit service on unknown persons — critical where the fraudster's identity is not yet established.
For a business with a DIFC or UAE nexus, the DIFC Courts are well-suited to issue relief and, where needed, to support enforcement in the wider UAE through VARA-regulated entities. For a London-based entity or one whose counterparty exchange has UK operations, England and Wales remains the most developed forum. For Asia-Pacific exposures, Singapore and Hong Kong each offer strong proprietary-injunction regimes.
Allied counsel in the relevant jurisdiction execute the court application. OBOLUS coordinates the strategy, the forensic evidence and the multi-forum sequencing from a single instruction point.
Common mistake at this step: Defaulting to the victim's home jurisdiction without analyzing where the exchange is reachable by service. A freezing order obtained in a forum where the exchange has no legal presence is unenforceable. Forum analysis must follow the money, not the victim's address.
If the recovery clock is already running, reach our disputes desk now at info@oboluslaw.com. We move for freezing relief and exchange disclosure while the trail is live. The process above describes the standard path. Your facts — the entity, the exchange, the token type — change the analysis and the forum choice.
Step 4: Apply for a Freezing Order and a Disclosure Order
A freezing order (a court injunction prohibiting a defendant from moving, dissipating or dealing with identified assets) and a disclosure order (an order requiring a third party — typically an exchange — to disclose identifying information about the account holder) are the two primary legal instruments in a crypto recovery matter. They are typically sought together, on an urgent ex parte basis (without notice to the defendant), to prevent dissipation before the fraudster can react.
In England and Wales, the Norwich Pharmacal and Bankers Trust disclosure order procedures are well-established for compelling exchanges to produce KYC records and account information against identified wallet addresses. The CFAAR (Crypto Fraud and Asset Recovery) network, launched in London in September 2021, has further systematized coordination between forensic firms, counsel and law enforcement on exactly these applications.
For stablecoins — specifically USDT (issued by Tether) and USDC (issued by Circle) — a parallel track is available: a contract-level freeze of the token at the issuer level. Tether and Circle hold the technical authority to freeze token balances at specific addresses. They generally act on receipt of a court order or a formal law-enforcement or OFAC designation. Instructing counsel to prepare the issuer freeze request in parallel with the court application can lock the funds at the smart-contract level within hours of a recognized legal demand, before any exchange is contacted.
The cross-border dimension here is layered. The freezing order may be obtained in England, the exchange may be in Singapore, and the issuer may be incorporated in the British Virgin Islands. Each step requires a separate legal instrument — but they run concurrently, not sequentially, in a well-organized recovery. Delays arise when counsel treats each step as a new matter rather than a coordinated campaign.
Common mistake at this step: Seeking the disclosure order before the freezing order is in place. If the exchange is served with a disclosure request before the defendant's assets are frozen, the defendant — who may be in communication with the exchange — has an opportunity to withdraw or move funds before the freeze lands.
Step 5: Manage the Cross-Border Enforcement Chain
A freezing order obtained in one forum must be capable of enforcement where the assets actually sit. Cross-border enforcement of civil freezing relief in digital-asset matters is still developing, but the leading common-law forums are increasingly cooperative. The DIFC Courts have issued worldwide freezing orders in support of foreign proceedings. The Cayman Islands and BVI courts, home to many fund structures holding digital assets, have their own VASP regimes under the CIMA and BVI FSC respectively, and courts in both jurisdictions have shown willingness to recognize and enforce foreign-obtained freezing relief in appropriate circumstances.
In practice, the enforcement chain looks like this: a worldwide freezing order is obtained in the primary forum; allied counsel in the secondary forum applies to register or recognize it locally; the exchange in that secondary forum is then served with both the primary order and the local recognition order. Gaps in this chain — caused by delays in instructing allied counsel, by failing to prepare the recognition application in advance, or by choosing a primary forum whose orders are not recognized in the jurisdiction where the exchange sits — are the most common reason a recovery fails at the enforcement stage after succeeding at the application stage.
We regularly advise on sequencing this chain so that the primary application, the parallel recognition applications and the stablecoin issuer request land within the same operating window. Speed and coordination, not just legal quality, determine the outcome.
Common mistake at this step: Treating enforcement as a phase that begins after the primary order is obtained. By that time, assets have often moved. Recognition applications in secondary forums should be drafted and ready to file the moment the primary order is sealed.
Step 6: Engage Law Enforcement and Coordinate the Civil and Criminal Tracks
Civil recovery and criminal investigation are not mutually exclusive — but they must be managed carefully to avoid one undermining the other. A criminal referral to a specialist unit (such as a national cybercrime or financial crime division) can accelerate the exchange freeze: law-enforcement case references are one of the triggers on which stablecoin issuers act. They also give access to international legal assistance channels unavailable in purely civil proceedings.
The tension is disclosure. In a criminal investigation, the investigative strategy and the evidence gathered may become subject to restrictions that limit the victim's ability to use the same material in parallel civil proceedings. Counsel must advise on the sequencing: in most cases, the civil freezing and disclosure applications move first, because they operate on a faster timescale and produce the exchange KYC data that both tracks need. The criminal referral then supplements the civil record.
In our cross-border practice, we have seen situations where a business made a criminal complaint in its home jurisdiction before securing civil freezing relief in the forum where the exchange operated. The result was a months-long wait for mutual legal assistance responses while the on-chain trail went cold. The civil track, properly resourced, routinely produces identifiable account-holder information within a matter of days from a disclosure order — a timeline that criminal investigation channels rarely match.
Common mistake at this step: Waiting for law enforcement to act before beginning the civil track. Criminal investigations into digital-asset fraud move on the timetable of the investigating authority. Civil relief moves on the timetable set by counsel and the court.
Step 7: Structure the Claim and Negotiate or Litigate to Resolution
Once assets are frozen and the account holder's identity is disclosed, the matter shifts from emergency relief to claim resolution. The legal theory of recovery — proprietary claim, unjust enrichment, fraud, breach of contract, or a combination — determines the procedural route and the remedies available. Proprietary claims, where the victim asserts a continuing ownership interest in specific tokens, are typically preferred because they survive the defendant's insolvency and attach to traceable assets regardless of subsequent mixing.
In practice, a significant proportion of frozen-asset matters resolve by negotiated settlement once the defendant's identity is known and the freeze is in place. The asymmetry of position — defendant frozen, claimant with a court-backed disclosure of identity — creates strong incentives for early resolution. Where negotiation fails, the substantive claim proceeds to trial or arbitration in the selected forum.
The cross-border tax and structuring note: any settlement involving a return of tokens or a fiat equivalent triggers reporting and potentially tax obligations for the recovering entity. In our practice, we flag this at the claim-structuring stage so that settlement terms are drafted with the right legal and tax treatment in mind from the outset, rather than creating a secondary compliance problem after recovery.
Common mistake at this step: Accepting a settlement that returns the principal without accounting for the legal costs, the tax treatment of the recovered amount, and any continuing undertakings (such as confidentiality or non-disparagement clauses) that might limit the business's ability to report the fraud publicly or to regulators. Claim structure at the end of the matter requires the same discipline as the initial triage.
If a prior recovery attempt stalled or an exchange refused to cooperate, a second read of the evidence and the forum selection can identify the structural reason and the route forward. Write to info@oboluslaw.com to review the file. A second-look engagement has surfaced recoverable positions in matters that initial counsel had assessed as closed.
Recovery in Practice: A Cross-Border Illustration
In a recent matter, a payments company discovered that a counterparty had diverted a substantial stablecoin balance — a sum in the low seven figures — through a rapid sequence of transfers across two centralized exchanges. We instructed a forensic firm within hours of the initial instruction, traced the balance to deposit addresses at both exchanges, and filed for a worldwide freezing order and parallel disclosure orders in a leading common-law forum before the end of the same business day. A contact-level freeze request was submitted to the stablecoin issuer simultaneously. The exchange disclosure produced verified KYC data within days. Settlement discussions commenced within a fortnight of the initial theft. The recovered amount exceeded the client's net loss after legal costs. The matter resolved without a trial.
Related at OBOLUS
- Disputes and Asset Recovery for Digital-Asset Businesses – our full practice overview for exchange, custodian and fund disputes across 25+ forums.
- Exchange Disclosure Orders in Georgia – how disclosure relief operates against exchanges in the Georgian jurisdiction.
- VAT Treatment of Crypto Services Under Heightened Scrutiny – the tax dimension of settlement and recovery receipts for digital-asset businesses.
A Common Assumption That Costs Businesses Their Recovery
A common assumption among businesses that have suffered token theft is that once funds leave the wallet, nothing can be done. This is incorrect, and it is one of the most expensive myths in the digital-asset space. On-chain transactions are permanent and public. Every token movement leaves a traceable record. The practical question is not whether the record exists — it does — but whether legal action can outpace the fraudster's conversion of on-chain assets into off-ramp fiat.
The answer turns on speed, forum choice and legal preparation. Courts in England and Wales, the DIFC, Singapore and Hong Kong have each granted injunctive relief over digital assets and have compelled exchanges to produce account-holder data. Stablecoin issuers have demonstrated the technical ability to freeze balances at the smart-contract level on the basis of a recognized legal demand. The tools exist. The question is whether they are deployed before the trail goes cold — and that is a question of hours, not weeks.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses — not retail claimants. We move for freezing relief and exchange disclosure while the trail is live. To discuss a recovery matter, contact info@oboluslaw.com or reach us at t.me/oboluslaw.
FAQ
Can stolen crypto actually be recovered?
Yes, in a meaningful proportion of cases — provided legal action begins quickly. On-chain tracing produces a permanent transaction record. Where misappropriated tokens have reached a custodial exchange, courts in England and Wales, Singapore, Hong Kong and the DIFC Courts have each ordered exchanges to disclose account-holder data and to freeze balances. For stablecoins such as USDT and USDC, a parallel issuer-level freeze is also available. Recovery is not guaranteed, but the legal tools are real and have been used successfully in cross-border matters.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows are measured in hours. Funds can be converted to fiat, bridged to a privacy chain, or dispersed across dozens of wallets within a single day. The forensic trace and the legal demand to the relevant exchange or stablecoin issuer must begin as soon as the loss is identified. Every hour of delay increases the probability that the on-chain trail leads to a withdrawal that has already been processed to fiat — at which point recovery requires a fully litigated civil claim rather than a fast-moving freeze.
Can a court freeze assets held on an exchange?
Yes. A worldwide freezing order obtained in a leading common-law forum — England and Wales, Singapore, the DIFC Courts or Hong Kong — can be served on an exchange directly, prohibiting it from releasing the identified balance. A parallel disclosure order compels the exchange to produce the account holder's KYC information. Both orders are typically sought on an urgent ex parte basis. The exchange's legal presence in, or subjection to the jurisdiction of, the chosen forum is the critical threshold for enforceability.
By Glen Sorensen, Disputes & Recovery Analyst — specialist in cross-border on-chain asset recovery, freezing-order applications and multi-forum enforcement strategy for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.