When digital assets are misappropriated, the recovery clock starts immediately. Every hour that passes allows funds to move through additional wallets, cross another exchange, or be converted into assets that are harder to trace. A well-prepared exchange disclosure application – a court-ordered demand compelling a cryptocurrency exchange to identify the account holder behind a suspect address and produce transaction records – is frequently the single step that turns an untraceable loss into a recoverable one. This guide sets out each stage of that process, the legal basis that supports it, the cross-border considerations that shape it, and the mistakes that sink applications before they reach a judge.
Exchange disclosure applications draw on established common-law tools: the Norwich Pharmacal order (compelling a third party mixed up in wrongdoing to disclose information) and the related Bankers Trust order (compelling disclosure of account information to trace assets). Courts in England and Wales, the DIFC Courts in Dubai, Singapore, Hong Kong, and the Cayman Islands have each granted such relief in digital-asset contexts. The regime is not new; it is proven. What is new – and what requires specialist handling – is the on-chain evidence layer that underpins every application.
This guide walks through seven steps: building the on-chain evidence record, identifying the correct forum, structuring the originating application, preparing the supporting evidence, meeting the disclosure test, managing the cross-border dimension, and acting on disclosure once it arrives.
Step 1: Build the On-Chain Evidence Record Before You File Anything
The foundation of every exchange disclosure application is a forensic transaction report produced before the application is drafted. Courts require you to identify, with precision, the wallet addresses that received the misappropriated assets, the transaction hashes that link those addresses to the theft event, and the exchange or custodian to which the assets were ultimately transferred. Without this record, no court will grant relief – and preparing the application itself without it wastes the most critical hours of the recovery window.
Specialist blockchain analytics firms – operating tools widely used by law enforcement and courts across leading common-law jurisdictions – can trace the movement of assets through a public ledger, identify exchange deposit addresses, and attribute those addresses to a specific platform. The output is a forensic report that the court will treat as expert evidence. That report must cover the precise path of funds from the victim's wallet to the identified exchange address, with each hop documented by hash and timestamp.
The common mistake at this step is delaying forensic work until counsel has been instructed. Instruct forensics and counsel simultaneously. The two workstreams run in parallel; the forensic report is the raw material the legal team needs, and it should arrive within hours of instruction, not days.
A cross-border note applies immediately at this stage. If the exchange is domiciled in a different jurisdiction from the victim or from the court you intend to approach, the forensic report should identify the registered entity operating that exchange – not merely the platform brand. An exchange operating under a VASP (virtual asset service provider) licence in a MiCA-regulated EU jurisdiction, under the VARA regime in Dubai, or under the MAS Payment Services Act in Singapore may have a different legal entity than the brand name suggests. Naming the wrong entity in the application is a common and avoidable error.
Step 2: Identify the Correct Forum for the Application
Choosing the right court is a jurisdictional question with direct practical consequences: the wrong forum produces an order that the exchange will not honour, or that cannot be served, or that lacks the extraterritorial reach to compel disclosure.
The leading forums for exchange disclosure in digital-asset matters are England and Wales, the DIFC Courts, Hong Kong, Singapore, and the Cayman Islands or BVI for fund-related losses. Each has recognised digital assets as property capable of supporting proprietary and disclosure relief. England and Wales – where the landmark AA v Persons Unknown [2019] decision first established crypto assets as property in the disclosure context – remains the most developed jurisdiction for this relief. The DIFC Courts have followed with their own body of practice. Hong Kong and Singapore have confirmed the same property characterisation.
The forum decision turns on several factors: where the victim is domiciled, where the exchange holds its operating licence, where assets are most likely to be located at the time of application, and where a resulting freezing order can most effectively be enforced. In our cross-border practice, we regularly see applicants default to their home jurisdiction without analysing where the order will actually compel compliance. An order from a court that the exchange does not recognise – and whose jurisdiction it can credibly dispute – may produce nothing at all.
The CFAAR network – the Crypto Fraud and Asset Recovery network, launched in London in September 2021 – connects specialist practitioners across these forums. Multi-forum matters may require parallel or sequential applications coordinated through allied counsel in the relevant jurisdiction.
Contextual note for readers at this stage. If you have identified your forum and have the forensic report in hand, the next step is structuring the application itself. The process above describes the standard analytical path. Your facts – the entity operating the exchange, the jurisdictions involved, the nature of the assets – change the analysis. For a scoped assessment of your recovery options, contact OBOLUS at info@oboluslaw.com.
Step 3: Structure the Originating Application Correctly
An exchange disclosure application is typically made without notice to the defendant – ex parte – because advance notice would defeat its purpose by triggering withdrawal or further movement of assets. This means the applicant carries a heightened duty of full and frank disclosure to the court: every material fact, including anything that might count against the application, must be placed before the judge.
The application itself consists of several components. First, the originating process (a claim form or originating application depending on the forum's procedural rules). Second, a witness statement or affidavit from the applicant or their representative, setting out the factual basis for the claim, the evidence of wrongdoing, and the identity of the exchange or exchanges to be compelled. Third, the forensic expert report. Fourth, a draft order in the precise terms the applicant seeks. Fifth, in most forums, a skeleton argument or written submissions setting out the legal basis for relief.
The draft order deserves particular care. Courts in England and Wales, the DIFC Courts, and Singapore have each emphasised that a disclosure order must be framed with specificity: it must identify the category of information sought, the time period, the wallet addresses or account identifiers at issue, and the mechanism and deadline for compliance. Overbroad orders invite rejection or appeal. Underspecified orders produce partial disclosure that does not advance the recovery.
The common mistake at this step is treating the draft order as a formality. It is not. The order is the operational document: every term in it will be tested by the exchange's compliance team against the platform's terms of service, its privacy obligations, and the applicable local law in the jurisdiction where it operates. Ambiguity in the order creates ambiguity in compliance.
Step 4: Prepare Supporting Evidence That Meets the Legal Threshold
Meeting the threshold for a Norwich Pharmacal or Bankers Trust order requires the applicant to establish, on the evidence available at the time of application, that wrongdoing has occurred, that the target exchange is mixed up in that wrongdoing (even innocently, as a platform through which assets passed), and that disclosure is necessary and proportionate to enable the victim to pursue its claim.
The witness statement is the primary vehicle for this evidence. It must narrate the loss event precisely: when the assets were held, when and how the misappropriation occurred (a hack, a fraudulent transfer instruction, a rug-pull by a counterparty), the value at the time of loss, and the steps already taken to trace the assets. Supporting exhibits include screenshots of the wallet or custodial account at the time of loss, communications evidencing the fraud, blockchain explorer outputs corroborating the forensic report's findings, and correspondence with the exchange (if any) attempting to resolve the matter before legal action.
In our practice, we have seen applications fail at the evidence stage not because the underlying loss was unclear but because the witness statement conflated inference with evidence. A statement that "the funds were stolen and went to Exchange X" without the documentary chain connecting each step will not satisfy the threshold. Each step in the movement of funds must be documented, sourced, and attributed to a specific exhibit.
A cross-border consideration: if the victim is a corporate entity rather than an individual, the witness statement must be made by an officer or authorised representative with personal knowledge of the loss event. Board minutes or a corporate resolution authorising the proceedings may be required. In some forums, an undertaking in damages – a commitment to compensate the exchange if the order turns out to have been wrongly obtained – must be offered and supported by evidence of the applicant's financial standing to honour it.
Step 5: Satisfy the Disclosure Test and the Proportionality Analysis
Every court that grants disclosure relief conducts a proportionality analysis: does the value of the information sought justify the intrusion into the exchange's operations and the privacy of its account holders? This analysis requires the applicant to do more than assert that disclosure is needed – it requires a reasoned account of why the specific information sought is necessary for the specific relief contemplated.
In digital-asset matters, the proportionality argument is typically compelling. The account-holder identity behind a deposit address is the single piece of information that converts an on-chain transaction record into a legal claim against an identifiable person or entity. Without it, the victim has a forensic map but no defendant. Courts across the leading forums have consistently recognised this as a sufficient basis for disclosure, treating the exchange as an innocent third party with information that enables justice to be done.
The proportionality analysis also requires the applicant to consider whether less intrusive means are available. If the victim already has information identifying the defendant – for example, from a prior contractual relationship or from KYC information obtained before the loss event – the threshold for disclosure is higher, because the need for the order is correspondingly lower. If the defendant is genuinely unknown (a Persons Unknown claim), the court will expect the applicant to confirm that reasonable steps have been taken to identify them through available means before resorting to a court order.
The common mistake at this step is failing to address proportionality explicitly in the written submissions. Counsel who assume the court will reach the right conclusion without the argument are occasionally correct. They are wrong often enough that the risk is not worth taking.
If a prior application stalled or an account was closed before you could act, a second read of the record often surfaces the structural reason and the route forward. To discuss a stalled recovery or a disclosure application that did not produce the expected result, write to OBOLUS at info@oboluslaw.com.
Step 6: Manage the Cross-Border Dimension at Every Stage
Most exchange disclosure applications involve at least two jurisdictions: the forum where the order is obtained and the jurisdiction where the exchange is incorporated or licensed. In many cases, the exchange processes compliance through a third entity in a third jurisdiction. Each additional jurisdiction introduces a legal variable that must be managed, not assumed.
The first cross-border issue is service. An order obtained in England and Wales must be served on the exchange in a manner that the exchange's legal team – and, if challenged, the courts of the exchange's home jurisdiction – will recognise as valid. Serving a Cayman entity through its registered office in the Cayman Islands, or a MAS-regulated entity in Singapore through its local legal representative, requires compliance with the procedural rules of those jurisdictions as well as those of the forum that granted the order.
The second cross-border issue is local legal privilege. An exchange operating under a VASP regime that carries strong customer data-protection obligations – whether under EU GDPR, the applicable Singapore framework, or the data-protection provisions of the VARA rulebooks in Dubai – may take the position that it cannot comply with a foreign disclosure order without a local court confirming the obligation. This is not obstruction; it is legal compliance. The answer is a parallel or recognition application in the exchange's home jurisdiction, coordinated with allied counsel there.
The third issue is the stablecoin dimension. If misappropriated assets include USDT or USDC, the issuers – Tether and Circle respectively – hold contract-level authority to freeze those tokens on the blockchain. They generally act on a court order or a verified law-enforcement request. Engaging the issuer in parallel with the exchange disclosure application can freeze the assets at the chain level while the disclosure process identifies the account holder. The two tracks are complementary, not alternatives. Coordination between the forensic team, the exchange disclosure application, and the issuer engagement is a specialist task that requires all three workstreams to proceed simultaneously.
In a recent recovery matter, a payments company traced misappropriated stablecoins through two exchanges operating in different jurisdictions. We coordinated a disclosure application in a leading common-law forum, parallel issuer engagement, and a cross-border recognition step in a second jurisdiction. A freezing order was obtained and the funds were preserved before further withdrawal. The matter resolved within weeks of instruction.
Step 7: Act on Disclosure Immediately – and Correctly
Disclosure from an exchange is not the end of the process; it is the beginning of the next phase. The information produced – typically KYC data, account registration details, transaction logs, and in some cases IP address records – must be converted into a legal claim against an identifiable defendant as quickly as possible.
If the disclosed information identifies a natural person, the immediate step is to assess whether assets remain on the exchange or have been withdrawn. If they remain, a worldwide freezing order (an injunction freezing a defendant's assets globally) can be sought on the same application or in a new expedited hearing, now that a named defendant exists. If the assets have moved, the forensic team must run a second trace from the point of disclosure forward, identifying the next destination.
If the disclosed information identifies a corporate entity, the additional step of piercing through to the beneficial owner may be required before a freezing order can be obtained. This is where the company-registry records of the exchange's home jurisdiction, combined with the KYC data produced, become the next layer of investigation.
A common mistake at this step is treating disclosure as a milestone to be celebrated rather than a trigger for immediate action. The recipient of a disclosure order has a defined period to comply; that period is typically measured in days. The day the exchange produces its file, the recovery team should be ready to move on the next step. Delays at this stage allow defendants to liquidate or move remaining assets once they become aware – as they will – that proceedings have been commenced.
The cross-border note at this stage is straightforward: if the disclosed defendant is in a jurisdiction outside the original forum, enforcement of a resulting judgment or freezing order will require recognition proceedings in that jurisdiction. Identifying that jurisdiction early – at the same time as the disclosure application is being prepared – allows allied counsel to be briefed in parallel rather than after the fact.
Related at OBOLUS
- Disputes & Asset Recovery for Digital Asset Businesses – full-service recovery and litigation support for operators and victims of crypto fraud
- Persons Unknown Proceedings: A Legal Guide for Digital Asset Businesses – how to pursue claims against unidentified defendants in digital-asset disputes
- PSP and Acquiring Agreements in Canada – cross-border payment structuring considerations for digital-asset businesses active in North America
FAQ
Can stolen crypto actually be recovered?
Recovery is possible, and courts in England and Wales, the DIFC, Singapore, Hong Kong, and the Cayman Islands have each granted relief that resulted in frozen or returned assets. Success depends on how quickly forensic tracing is initiated, whether assets have moved off identifiable exchanges, and whether an exchange disclosure order can be obtained before funds are further dispersed. There is no guaranteed outcome, but early action materially increases the prospects.
How fast must I act after a digital-asset theft?
Recovery windows are measured in hours, not weeks. Assets can move through multiple wallets and exchanges within minutes of misappropriation. The priority on day one is to instruct both forensic blockchain analysts and specialist legal counsel simultaneously – not sequentially. The forensic report, which the court will require as evidence, takes time to produce. Every hour of delay before that instruction is made is a permanent reduction in the recovery window.
Can a court freeze assets held on an exchange?
Yes. Courts in the leading common-law forums – England and Wales, the DIFC Courts, Singapore, and Hong Kong – have each issued freezing orders directed at exchanges, preventing the release of assets pending proceedings. The order is typically obtained on an emergency basis without notice to the defendant. The exchange is notified of the order and placed under an obligation not to release the relevant assets. In parallel, stablecoin issuers such as Tether and Circle can freeze tokens at the contract level on a verified court order or law-enforcement request.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums, moving for preservation while the trail is live. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialising in cross-border on-chain asset recovery, exchange disclosure applications, and emergency freezing relief across common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.