Recovery windows for misappropriated digital assets are measured in hours, not weeks. A business that discovers a theft at midnight and waits until Monday morning for legal advice may find the funds already layered through three exchanges and converted to a privacy coin. The question is not whether the law can help – it can, and meaningfully so – but whether you engage it fast enough. This guide walks through each step in obtaining a freezing order (a court injunction that prohibits a respondent from dealing with or dissipating identified assets), with the legal basis, the cross-border angle, and the common mistake at each stage.
Why Speed Is the Legal Question
The single most critical factor in crypto asset recovery is not the strength of your evidence – it is how quickly you convert that evidence into interim relief. Digital assets move in seconds. A thief who controls a private key faces no clearing house, no settlement delay, and no correspondent bank that might flag an unusual transfer. In our disputes practice, we have seen well-documented cases fail not for want of law but for want of speed: by the time the victim instructed counsel, the funds had crossed four blockchains.
Courts in the leading recovery forums – England and Wales, the DIFC Courts, Singapore, and Hong Kong – all recognise that crypto assets are property capable of being frozen. The English High Court established this principle in AA v Persons Unknown [2019], a decision that remains foundational across common-law jurisdictions. That recognition gives claimants the legal hook. Urgency gives it teeth.
The practical implication is blunt: your legal team must be mobilised on the same day you discover the loss, not the next business day. A without-notice application – one made to the court without alerting the defendant – is available precisely because advance notice would enable dissipation. Capturing that option requires a lawyer, a forensic report, and a draft order, all ready to file before the defendant knows litigation is coming.
Step 1: Secure the Evidence Before Anything Else
Before calling a lawyer, secure every piece of data you currently control – and do nothing that overwrites or compromises it. The foundation of any freezing application is a clear, documented chain: the wallet address that sent the funds, the transaction hash, the timestamp, and the destination address. Courts expect this level of precision. An injunction sought against "my crypto" without a transaction hash will not survive scrutiny.
Capture screenshots with visible timestamps. Export transaction histories from every wallet or exchange account involved. If the misappropriation occurred through a platform, preserve login logs, IP records, and any communications with the perpetrator. Do not attempt to "recover" funds yourself by pushing transactions – you may overwrite state data or, worse, trigger legal complications around self-help remedies.
The common mistake at this step is trying to contact the receiving exchange directly before involving a lawyer. Exchanges will not freeze funds on a victim's say-so. Premature contact also alerts the fraudster if the account is monitored. Leave exchange engagement to counsel acting on a court order.
Step 2: Commission a Professional Blockchain Forensic Report
A blockchain forensic report is not optional – it is the document that converts a transaction hash into a legal argument. Courts require expert evidence that traces funds from the victim's wallet to identifiable addresses, preferably to a named custodian or exchange where the funds are currently held or recently transited. Without this, a freezing application lacks the specificity courts demand.
Forensic firms use on-chain analytics to map transaction paths, identify clustering patterns, flag connections to sanctioned addresses or known-fraud wallets, and attribute addresses to named entities where exchange KYC data is accessible. The quality of this report determines whether a court will act on an emergency basis. A credible forensic trace that terminates at a named exchange or custodian significantly strengthens the case for without-notice relief, because the court can see that freezing is both necessary and targeted.
In a recent matter, a payments company traced misappropriated stablecoins through two intermediary exchanges before the trail terminated at a custodian in a common-law jurisdiction. We had a forensic report and a draft injunction ready within 36 hours of instruction; the court granted without-notice relief that same day, and the funds were frozen before any further movement.
The cross-border angle matters here. If the funds are on a centralised exchange headquartered outside your home jurisdiction, the forensic report must identify that exchange precisely, because your application will need to be filed – or recognised – in the forum where that exchange operates or where it has assets. A report that simply says "funds went offshore" is not enough.
The common mistake at this step is commissioning a brief internal trace and presenting it as expert evidence. Courts assess forensic reports for methodology, tool transparency, and the expert's independence. An in-house analysis rarely meets that bar.
Step 3: Choose the Right Forum
Forum selection in a crypto recovery is a strategic decision, not an administrative one. The correct forum is determined by where the assets currently sit, where the defendant has a presence, and which court's orders the relevant exchange or custodian will recognise and act upon. Getting this wrong wastes days you do not have.
England and Wales remains the most developed forum for crypto asset freezing. The courts have issued worldwide freezing orders (WFOs) – injunctions that freeze a defendant's assets globally, not only within England – and have granted Norwich Pharmacal and Bankers Trust disclosure orders compelling exchanges to reveal account-holder identity. The DIFC Courts in Dubai have demonstrated comparable willingness, with recent decisions confirming the court's power to grant WFOs in support of foreign proceedings under the applicable DIFC rules. Singapore and Hong Kong have each issued proprietary injunctions over crypto assets, with Hong Kong courts having issued what practitioners describe as a "tokenised" injunction in proceedings against identified wallets.
For a business whose funds are held on an exchange in the UAE, a DIFC Courts application may be more efficient than an English one, even if the victim is domiciled elsewhere. For funds on a US-regulated exchange, a New York court or a federal court may be the right primary forum – potentially combined with a FinCEN or OFAC referral if the fact pattern supports it. We regularly advise on this forum triage and the sequencing of parallel proceedings where multiple jurisdictions are in play.
The cross-border angle is inherent. A without-notice order from one court may need recognition or registration in another jurisdiction before an exchange will honour it. Build that step into the timeline before you file.
The common mistake at this step is filing in the victim's home jurisdiction as a reflex, without checking where the exchange is regulated and where it will respond to court process. An English order served on an exchange with no English presence requires additional steps – and time.
For a scoped assessment of your recovery position and forum options, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the exchange, the asset type – change the analysis significantly.
Step 4: Prepare and File the Without-Notice Application
A without-notice freezing application requires the claimant to satisfy the court on several grounds simultaneously: a good arguable case on the merits, a real risk of dissipation, and full and frank disclosure of all material facts – including facts that might count against the claimant. That last requirement is frequently underestimated. Courts in the leading forums take non-disclosure at the without-notice stage extremely seriously; an order obtained without full disclosure may be discharged with costs consequences.
The application bundle typically includes a claim form or originating process, a detailed witness statement attaching the forensic report, a draft order, and a cross-undertaking in damages (the claimant's promise to compensate the defendant if the order is later found to have been wrongly granted). Counsel must attend and present the application, often on the same day it is filed. In urgent matters, applications can be made to a duty judge outside ordinary court hours.
The applicable threshold in English proceedings – and adopted with variations in Singapore and Hong Kong – is that there must be a good arguable case and a real risk that assets will be dissipated absent the order. "Real risk" in a crypto context is typically straightforward to establish: the entire structure of a self-custodied wallet is that the holder can move funds instantly and without third-party consent.
The order itself should be drafted with precision. It should identify the specific assets – the wallet addresses, the exchange accounts, the token type – rather than sweeping in everything the defendant owns. Overbroad orders invite discharge applications and damage the claimant's credibility. In our practice, we draft orders that are specific enough to survive a return date while broad enough to capture the identified fund flows.
The common mistake at this step is presenting a formulaic injunction template without crypto-specific asset identification. A generic "bank account freezing order" adapted for crypto often fails to address on-chain wallet addresses, creates ambiguity about which assets are frozen, and may not be enforceable against a centralised exchange whose compliance team has no established protocol for non-standard orders.
Step 5: Serve the Order and Engage the Exchange or Custodian
A freezing order granted but not served achieves nothing. The mechanics of service in a crypto recovery differ from a standard commercial dispute: the exchange or custodian must receive the order promptly, through the right channel, with enough supporting context that its compliance team can act without escalation delays.
Leading centralised exchanges – particularly those regulated under MiCA in the EU, the Payment Services Act in Singapore, the VASP regime in Hong Kong, or equivalent regimes in other major hubs – have compliance teams that understand court orders and have internal protocols for responding. Tether and Circle, as issuers of the two most widely held stablecoins, hold contract-level freeze authority over USDT and USDC respectively, and they will act on a law-enforcement request or a court order, typically also requiring a case reference number from an enforcement agency. That dual requirement – court order plus law-enforcement reference – is something to plan for, not discover after the order is granted.
For assets held in self-custodied wallets rather than on an exchange, the order must be served on the defendant directly (or on a person unknown, using the court's rules on alternative service including, in some forums, service via an NFT dropped to the wallet address). The defendant is then personally bound. The order does not technically freeze the blockchain – it creates a personal obligation that puts the defendant in contempt of court if they move the assets.
The cross-border note is critical here. If the exchange is in a jurisdiction that does not automatically recognise the order, a parallel recognition or enforcement step is required. Counsel in the relevant jurisdiction – what we refer to as allied counsel – should be engaged before the order is granted so they are ready to move immediately.
The common mistake at this step is sending the order to a generic customer-support email address. Exchanges have legal or compliance departments that handle court orders; sending to the wrong contact adds hours of delay while the email is forwarded internally. In our practice, we identify the correct legal-notice address as part of the pre-filing preparation.
Step 6: Pursue Disclosure and the Merits
A freezing order is interim relief – it preserves the status quo while the underlying claim is resolved. Within days of the order being granted, the claimant must typically serve proceedings on the merits and prepare for the return date, when the defendant has the opportunity to challenge the order. Interim relief that is not followed through collapses.
Parallel to the merits proceedings, disclosure orders are the tool that converts a frozen balance into identified ownership. A Norwich Pharmacal order compels a third party – typically the exchange – to disclose information about the account holder: identity documents, KYC records, IP addresses, and linked accounts. A Bankers Trust order goes further, compelling disclosure to enable the claimant to trace assets and identify additional defendants. These disclosure orders are available in England and Wales and have been applied in equivalent forms in Singapore, Hong Kong, and the DIFC Courts.
In a recent matter, we obtained a disclosure order against an exchange operating across three jurisdictions. The KYC data disclosed identified a beneficial owner in a fourth jurisdiction. That information allowed us to add that individual as a named defendant in the main proceedings and extend the freezing order to cover assets held elsewhere. The process took several weeks from initial instruction to a named defendant with frozen assets in two forums.
The common mistake at this step is treating the freezing order as the end of the matter rather than the beginning. The order preserves the position; the merits claim – in unjust enrichment, constructive trust, or fraud – is what ultimately determines ownership. Claimants who do not follow through with credible substantive proceedings risk having the order discharged at the return date, often with a costs order against them.
If a prior application stalled or a disclosure request was refused, a second analysis of your position can surface the structural reason and the route forward. Write to OBOLUS at info@oboluslaw.com or message us via t.me/oboluslaw.
Addressing the Common Assumption: Funds Gone Means Recovery Impossible
A common assumption among businesses that have suffered a digital-asset theft is that once funds leave the wallet, nothing practical can be done. That assumption is wrong, and it is worth addressing directly because it causes victims to delay the very action that would have preserved their options.
Blockchains are permanent, public ledgers. Every transaction is recorded and, with the right tools, traceable. The question is not whether a trace is possible – it almost always is – but whether the assets have reached a point of irreversibility: converted to a non-seizable form, transferred to a jurisdiction with no applicable treaty, or held in a self-custodied wallet whose owner cannot be identified. Even in those cases, the merits claim against the original wrongdoer survives; what changes is the practical enforceability.
The cases where recovery fails are almost uniformly cases where the victim waited. The thief had time to layer the funds, withdraw fiat through an unregulated exchange, or disperse assets across dozens of wallets. The cases where recovery succeeds – and we have seen them succeed – are cases where legal and forensic resources were deployed while the trail was live. Speed is not a luxury. It is the determinative variable.
We move for freezing relief and exchange disclosure while the trail is live. Digital assets are the entirety of our practice, and we act only for businesses.
Decision Matrix: Which Path for Your Situation
Not every misappropriation follows the same path to relief. The right combination of steps depends on the asset type, the location of the funds, and the identity (or anonymity) of the wrongdoer.
Profile A – Funds on a regulated exchange, wrongdoer unidentified. The priority is a freezing order combined with a disclosure order (Norwich Pharmacal) against the exchange to identify the account holder. Forum is driven by where the exchange is regulated. Timeline is days from instruction to application, weeks to identification. Key risk: the exchange's compliance team may require additional procedural steps before acting.
Profile B – Funds in a self-custodied wallet, wrongdoer identified. The freezing order is served personally on the defendant. The order creates a contempt-of-court obligation. The cross-border note matters if the defendant is outside the forum's jurisdiction – a worldwide freezing order extends the reach, but enforcement of a contempt order across borders requires separate proceedings. Timeline is days to the order, longer for substantive resolution. Key risk: defendant moves funds before service.
Profile C – Funds partially on an exchange, partially in DeFi protocols. A hybrid approach: exchange assets frozen by court order and exchange notification; DeFi assets require a combination of on-chain injunction (where the protocol's governance allows) and a direct order against the defendant. This is the most complex profile and typically requires simultaneous applications in more than one forum. Key risk: DeFi protocol governance may not respond to a court order in the way a centralised custodian does.
Profile D – Stablecoin (USDT or USDC) theft. Engage the issuer's compliance team immediately alongside the court application. Tether and Circle both hold the technical ability to freeze tokens at the contract level and will act on a law-enforcement referral or a court order. This parallel track can freeze the specific tokens within hours of a request being received – faster than a court order alone. Key risk: the freeze must be requested before the stablecoin is converted or redeemed.
Related at OBOLUS
- Disputes and Asset Recovery Practice – OBOLUS's full disputes and on-chain recovery service for businesses
- Smart Contract Dispute Resolution – what recent enforcement tells operators about on-chain legal risk
- GP/LP Structuring for Digital Assets – the structuring angle for digital-asset fund vehicles
FAQ
Can stolen crypto actually be recovered?
Yes – in the right circumstances. Blockchain transactions are permanent and traceable. Where funds have reached a regulated custodian or exchange, a freezing order combined with a disclosure order can identify the account holder and freeze the balance. The critical variable is speed: recovery rates drop sharply once funds are layered through multiple exchanges or converted to non-custodial instruments. A same-day legal response gives the best available prospect of preservation.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows are measured in hours, not days. The moment you identify a misappropriation, secure all transaction data, identify the destination wallet or exchange, and contact specialist counsel. Courts in England and Wales, the DIFC, Singapore, and Hong Kong can grant without-notice freezing relief on an urgent basis – but counsel must have a forensic report and draft order ready to file. Every hour of delay is an hour in which the wrongdoer can move the funds further.
Can a court freeze assets held on an exchange?
Yes. A freezing order served on a regulated exchange operates as a binding injunction requiring the exchange to prevent the account holder from withdrawing or transferring the identified assets. Leading regulated exchanges – including those supervised under MiCA, the Payment Services Act, the SFC's VASP regime, and equivalent frameworks – have established compliance protocols for responding to court orders. For stablecoin balances, parallel engagement with the token issuer can also produce a contract-level freeze of the specific tokens.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice. Operators we advise routinely face cross-border recovery situations where multiple forums must be engaged in parallel; we coordinate that process from a single instruction. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialist in on-chain asset tracing, freezing relief, and cross-forum enforcement for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.