Operating a digital-asset business without a contingency plan for fraud is, today, one of the costliest omissions a founding team can make. Misappropriated tokens move in minutes. By the time an internal audit confirms a shortfall, the on-chain trail may already span three exchanges and two blockchains. The legal question this raises is not philosophical – it is structural: which courts will act, which instruments are available, and how quickly can a competent practitioner deploy them?
Crypto fraud asset recovery at the disputes layer is a specialist discipline that fuses on-chain forensics with injunctive relief in common-law courts, coordinated exchange disclosure, and – where funds have crossed borders – enforcement in multiple forums simultaneously. A freezing order (an interim injunction preventing a defendant from dealing with assets pending judgment) is typically the first instrument a practitioner reaches for. The case for acting fast is not rhetorical: leading courts in England and Wales, the DIFC, Singapore and Hong Kong have each demonstrated a willingness to grant emergency injunctive relief within hours of a well-prepared application. The remainder of this analysis sets out how that process works, where it works best, and what determines the outcome.
Why crypto fraud recovery is a different discipline from traditional asset tracing
Crypto fraud asset recovery is materially different from conventional commercial fraud practice because the asset moves in real time and leaves a public record simultaneously. That paradox – transparent blockchain, anonymous wallet – defines the practitioner's task. In a conventional fraud, assets are often frozen before they can be hidden effectively. In a crypto fraud, the misappropriation and the concealment can happen in the same block confirmation.
The forensic layer is therefore not optional. Courts in England and Wales – the leading forum for this work – expect a professional blockchain tracing report as part of the foundation for a freezing application. That report maps the transaction hashes, identifies the addresses holding the balance, and establishes a live trail to a custodied exchange or a decentralised protocol. Without it, the application lacks the evidentiary anchor that courts require before granting relief against persons who may be unknown at the time of filing.
The cross-border dimension is immediate. A business defrauded in the UAE may find its tokens within hours on an exchange licensed in Hong Kong, a layer-2 protocol with a development team in Europe, and a wallet hosted through a custody provider in the Cayman Islands. Each of those pressure points requires a distinct legal instrument, a distinct regulator, and a distinct procedural route. In our practice, the first call after a confirmed theft is a triage call: which forum acts fastest, which exchange holds the balance, and which instrument – freezing order, Norwich Pharmacal order (compelling a third-party exchange to disclose account-holder identity), or Bankers Trust order (compelling disclosure of transaction records) – should be filed first.
The answer changes with the facts. It changes with the chain. It changes with the exchange. And it changes with the counterparty jurisdiction.
How does on-chain tracing establish the evidentiary foundation for a claim?
On-chain tracing is the process of following stolen digital assets through the public ledger, producing a verifiable forensic chain of custody that courts can act on. Without a documented and auditable trace, a freezing application is an unanchored assertion. With one, it is an evidentiary submission.
Leading forensics providers – including Chainalysis, TRM Labs, Elliptic and Asset Reality – produce reports that courts in England and Wales, Singapore, Hong Kong and the DIFC treat as admissible expert evidence. Those reports do three things. First, they confirm that identified tokens left the victim's wallet under circumstances consistent with misappropriation. Second, they identify the current or last-known wallet address holding the balance. Third, they attribute that address to a custodied platform – typically a VASP (virtual asset service provider) – that is itself subject to a legal regime and therefore reachable by court order.
The chain does not have to be clean to be useful. Mixers and privacy protocols complicate attribution but do not, in the experience of leading practitioners, automatically defeat a claim. Courts have granted disclosure orders in cases where funds passed through intermediary protocols, on the basis that the probabilistic attribution in the forensics report met the civil standard of proof. The relevant question for the practitioner is whether the report achieves sufficient attribution to justify a without-notice application – that is, an application filed without alerting the respondent, which is the standard approach in fraud cases.
In our cross-border practice, we commission forensic analysis at the same time as we begin drafting the application. The two workstreams run in parallel. Every hour saved in that preparation phase is an hour the funds are less likely to move.
England and Wales have established a mature line of authority recognising digital assets as property – a prerequisite for proprietary freezing relief – through decisions including AA v Persons Unknown [2019] and Osbourne v Persons Unknown [2022], the latter extending that recognition to NFTs. That foundation makes English courts a default forum for many cross-border crypto recovery matters, regardless of where the claimant is headquartered.
For a scoped assessment of your recovery options, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the chain, the exchange, the counterparty jurisdiction – change the analysis significantly. Map your options.
What does a freezing order actually accomplish in a crypto fraud matter?
A freezing order prevents a respondent – or, in a crypto matter, a custodied exchange holding the respondent's account – from dealing with identified assets pending judgment. It is the primary injunctive instrument in common-law crypto recovery because it preserves value while the merits are litigated.
In practice, a crypto freezing order works at two levels. At the chain level, it may compel a VASP to freeze the identified wallet or sub-account. At the protocol level, for certain stablecoins, it may support a direct request to the issuer. Tether (USDT) and Circle (USDC) each hold contract-level freeze authority over their respective tokens. Both issuers generally act on a valid court order or a law-enforcement designation. This means that for USDT or USDC-denominated fraud, a practitioner can pursue a two-track approach: file for injunctive relief in court, and simultaneously present that order to the issuer to achieve a protocol-level freeze before the funds move off-platform.
The practical limitation is timing. A freezing application filed without notice – the standard approach in fraud matters – requires the applicant to show a good arguable case, a real risk that assets will be dissipated without the order, and full and frank disclosure to the court of all material facts including those adverse to the applicant. That third requirement is demanding and frequently under-prepared. Courts grant without-notice relief only when they are confident that the applicant's counsel has placed the complete picture before them. Incomplete disclosure is the most common reason a good-faith application fails at the return date – when the respondent appears and the order is contested.
Geographic reach matters. The DIFC Courts in Dubai have developed a clear practice of granting worldwide freezing orders (WFOs) in support of proceedings, including in support of foreign proceedings where assets or defendants have a UAE nexus. That makes the DIFC an increasingly important forum for matters with a Gulf or Silk Road dimension. Singapore's courts have similarly granted proprietary injunctions over crypto assets, and Hong Kong entered its first "tokenised" injunction in a matter before the High Court (HCA 2417/2024).
For the operator trying to decide where to file: the answer turns on where the assets are, where the defendant is reachable, and which court can grant and enforce most rapidly. Those three factors rarely align perfectly, which is why multi-forum coordination is the norm rather than the exception in significant crypto fraud matters.
How do exchange disclosure orders unlock the identity of anonymous fraudsters?
Exchange disclosure orders are the mechanism that converts an on-chain address – which is pseudonymous – into an identified person against whom a money judgment can be enforced. They are typically sought under the Norwich Pharmacal and Bankers Trust doctrines in common-law courts: the former compels a third party (the exchange) to disclose the identity of a wrongdoer; the latter compels disclosure of transaction records held by a financial institution.
The logic is straightforward. A VASP licensed in any major jurisdiction – whether under the MAS Payment Services Act regime in Singapore, the SFC VATP licensing regime in Hong Kong, or the FCA Money Laundering Regulations registration in the UK – is required to collect and retain Know Your Customer (KYC) information for its account holders. That information is commercially sensitive. The exchange will not produce it voluntarily. But a court order in the exchange's jurisdiction compels disclosure. The claimant then has a name, an address, and a documented movement of funds.
The cross-border friction is real. An English court can issue a Norwich Pharmacal order against an exchange operating in England. If the exchange is licensed in the Cayman Islands under the Virtual Asset (Service Providers) Act and administered in Singapore, the order must either be recognised in those jurisdictions or separate applications must be filed. In our practice, we have seen matters where KYC information was held across three separate custodians in three separate regulatory regimes, each requiring a parallel application. The CFAAR network (Crypto Fraud and Asset Recovery), launched in London in September 2021, provides a coordination mechanism that shortens the time-to-order in a meaningful number of those cross-border cases.
The window matters enormously here. An exchange subject to regulatory record-retention obligations will hold KYC data. But accounts can be closed, funds withdrawn, and individuals unreachable. Every day between the fraud and the disclosure application increases the probability that the information is stale or the individual has relocated to a non-cooperative jurisdiction.
Which forum should you choose – and how does the cross-border strategy work?
Forum selection in crypto recovery is not an academic exercise. The wrong forum wastes weeks. The right forum, filed correctly, can achieve a freezing order within a business day and a disclosure order within days thereafter. In our cross-border practice, forum selection turns on four variables: where the assets sit, where the defendant has a legal presence, which court has the fastest ex parte track, and which regime governs the custodied exchange holding the funds.
A prose decision matrix for the most common operator profiles follows.
Profile A – funds held on a UK-licensed or EU-licensed exchange, defendant identity unknown: File in England and Wales. The High Court's Commercial Court and its Business and Property Courts have the deepest line of authority on crypto as property, the fastest without-notice track, and the strongest network of enforcement treaties for the judgment that follows. A Norwich Pharmacal order against a UK-registered exchange will typically be resolved within days of filing if the application is well-prepared. Timeline to initial relief: typically measured in days, not weeks, with a well-prepared application.
Profile B – funds moved through a Gulf-based exchange or the defendant has UAE connections: The DIFC Courts are the primary forum. DIFC has developed a clear WFO practice, including WFOs in support of foreign proceedings. The FSRA within ADGM and VARA in mainland Dubai each maintain licensed operator registers, which can be accessed to confirm whether the exchange holding funds is a regulated entity subject to disclosure obligations. Timeline: broadly comparable to England and Wales for initial relief.
Profile C – funds on a Singapore-licensed DPT platform, defendant reachable in Asia: Singapore's courts have granted proprietary injunctions over crypto assets, and the MAS regime's licensing requirements mean that Singapore-licensed operators hold KYC records subject to disclosure. Hong Kong is an alternative where the defendant or the exchange has an SFC nexus. Timeline: qualitatively similar to the above, though the procedure differs.
Profile D – stablecoin-denominated fraud (USDT/USDC), balance still on-chain: Consider a two-track approach: injunctive application in the most appropriate forum plus an immediate contact to the issuer's law-enforcement cooperation desk. The issuer freeze, if achieved, buys time while the court application progresses. This track requires a law-enforcement case reference in many instances. It is not available for all fraud types and is not guaranteed in any case.
The common thread: every profile requires a forensic report, a clear identified forum, and a practitioner who has filed in that forum before. A novel or untested application in a new forum takes materially longer than a repeat application before a court that knows the principles.
If a prior application stalled or an account was closed without relief, a second read of the facts can surface the structural reason and the route back. Contact OBOLUS at info@oboluslaw.com or t.me/oboluslaw. Map your options.
What are the most damaging mistakes crypto fraud victims make in the first 48 hours?
The first 48 hours after a confirmed digital-asset theft are the most consequential in the entire recovery arc. Mistakes made in that window compound. The four we see most often are the following.
Notifying the exchange before filing for relief. This is the single most damaging error. An exchange that receives an informal notification – a customer-support ticket, an email to compliance – may act on good faith and alert its account-holder of the complaint. That alert triggers a withdrawal. By the time the practitioner files for a freezing order, the balance has moved. The correct sequence is: forensic triage first, legal application drafted and filed, then the order served on the exchange. The exchange should receive the order, not a pre-order complaint.
Waiting for law enforcement before acting civilly. Criminal and civil processes run in parallel, not in sequence. A police investigation in the victim's jurisdiction does not pause the on-chain movement of assets. Civil practitioners in leading forums can move within hours of instruction. Waiting for a criminal case reference before filing civilly is a reasonable-sounding approach that costs weeks the victim cannot afford.
Underestimating the evidentiary requirements. A freezing application that arrives at court without a professional forensic report, without a full and frank disclosure affidavit, and without a clear identified forum anchor will be refused or adjourned. That adjournment gives the defendant advance notice of the claim. Every element of the application must be complete before it is filed.
Assuming that once funds enter a mixer or privacy protocol, the trail is dead. This is a common assumption we address directly in the next section. It is, in most live matters, wrong – or at least more wrong than the victim has been told.
Does a mixer or privacy protocol end the recovery prospect?
A common assumption in the market – and one that fraudsters actively promote – is that once misappropriated funds pass through a mixer or privacy protocol, recovery becomes impossible. In most real cases, that assumption is wrong, or at least incomplete.
Forensic attribution tools have advanced substantially. The leading providers now apply probabilistic clustering, heuristic analysis and cross-reference to public blockchain data to follow fund flows through known mixing services with a level of confidence that courts have found sufficient for civil purposes. The relevant standard is the civil balance of probabilities, not criminal beyond reasonable doubt. A forensic report that attributes funds to a post-mix wallet with a probability assessment above that threshold has, in practice, supported disclosure and freezing applications in leading common-law forums.
The more limiting variable is often not the technical one. It is the jurisdictional one. If post-mix funds land in a wallet hosted by an exchange in a jurisdiction without strong disclosure obligations or without a functioning court system willing to assist, the trail stalls legally even if it is technically visible. That is why the cross-border legal architecture matters as much as the forensic layer. The forensic tool surfaces the address. The legal tool converts that address into an actionable defendant. Both are required.
In a recent recovery matter, a payments business discovered that a seven-figure sum in stablecoins had been misappropriated by a counterparty who had passed the funds through two intermediary exchanges before consolidating them in a custody account in a common-law forum. We commissioned a forensic report in parallel with drafting the disclosure application, filed without notice, and secured an exchange disclosure order before the account-holder had been notified of the claim. The KYC records produced under that order identified an individual in a jurisdiction with which the primary forum had a mutual recognition arrangement. Enforcement followed.
The lesson: the mixer is a delay, not a wall. The legal architecture, prepared in advance and executed quickly, can follow it.
When should a business engage specialist disputes counsel in a crypto fraud matter?
The answer is: before the first notification to the exchange, before any public statement, and ideally within hours of confirming the misappropriation. That instruction – "engage counsel before you notify anyone" – runs counter to the instinct of most operations teams, who want to call the exchange's compliance desk immediately. The instinct is understandable. It is also, in the context of asset recovery, frequently counterproductive for the reasons set out above.
Specialist counsel in this context means a practitioner with three specific capabilities: prior experience filing without-notice injunctive applications in the relevant forum, a working relationship with forensic providers so that the report and the application can be produced in parallel, and a cross-border network allowing simultaneous filings in multiple jurisdictions where the facts require it.
For a business that has not yet experienced a fraud – and is reading this as a planning document rather than a crisis response – the most valuable step is a pre-incident protocol: a documented process that identifies the practitioner, the forensic provider, and the initial forum before the event occurs. The protocol costs very little to set up. The absence of one, in a live matter, costs hours the victim will never recover.
Operators we advise in this area regularly ask how the civil track intersects with regulatory obligations. In most major jurisdictions, a VASP subject to AML supervision has notification obligations when it identifies a fraud. Those obligations run to the regulator, not to the counterparty. A well-structured protocol sequences the civil application, the regulatory notification and any public communication in an order that protects both the recovery prospect and the operator's compliance standing.
Related at OBOLUS
- Disputes and asset recovery for digital-asset businesses – our practice overview for crypto fraud, freezing orders and enforcement
- Worldwide freezing orders in Canada – jurisdiction-specific guidance on WFO practice and procedure in Canadian courts
- Smart contract legal review in Abu Dhabi Global Market (ADGM) – FSRA framework and contract-level analysis for Gulf-based operators
FAQ
Can stolen crypto actually be recovered?
Yes – subject to timing and forum. Digital assets have been recognised as property by courts in England and Wales, Singapore, Hong Kong and the DIFC. That recognition supports proprietary freezing relief and disclosure orders against exchanges holding the balance. Recovery is not guaranteed in any case, but the legal tools exist and have produced results. The critical variable is how quickly a forensically supported application is filed. Every hour after misappropriation reduces the probability of recovery.
How fast must I act after a digital-asset theft?
The recovery window is measured in hours, not days or weeks. On-chain assets move in real time. A freezing application filed on the same day as a confirmed theft, supported by a professional forensic report, can result in an exchange freeze within 24 to 48 hours in a well-prepared matter before an experienced court. Delays – whether from internal approvals, waiting for a criminal case reference, or an informal exchange notification made before filing – directly reduce the probability of success.
Can a court freeze assets held on an exchange?
Yes. Common-law courts in England and Wales, the DIFC, Singapore and Hong Kong have each granted freezing orders and disclosure orders directed at exchanges as third parties. An exchange licensed in the relevant jurisdiction is a legal person subject to court orders served within that regime. Where the exchange is in a different jurisdiction, a parallel application or a mutual recognition procedure may be required. Whether a specific exchange in a specific jurisdiction can be reached depends on the applicable regulatory and enforcement framework there.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. In disputes and recovery work, we move for freezing relief and exchange disclosure while the trail is live – coordinating forensic, legal and regulatory workstreams as a single mandate rather than three disconnected processes. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialises in cross-border regulatory and recovery frameworks for digital-asset operators, including VASP supervision and multi-forum dispute coordination.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.