Misappropriated digital assets move fast. Within hours of a theft, funds may pass through multiple exchanges, cross jurisdictions and enter mixers or privacy-coin channels. An exchange disclosure order (a court order compelling a trading platform to identify account holders and produce transaction records) is often the first legal tool that can interrupt that movement before the trail goes cold. Used in combination with a worldwide freezing order (an injunction preventing a defendant from dissipating assets globally), it is the cornerstone of modern digital-asset recovery practice. This analysis maps the legal basis, the cross-border reality and the practical considerations that determine whether an application succeeds.
The central question is not whether courts will act — they will. The question is whether the evidence package, the chosen forum and the timing are good enough to stop assets before they are dissipated. In our cross-border practice, we regularly advise businesses that lost hours to internal escalation and then faced a recovery process that was materially harder as a result. Speed and forum selection are the two variables an operator can actually control.
What is an exchange disclosure order and how does it work in crypto disputes?
An exchange disclosure order requires a centralized exchange or custodian to produce identity records, KYC documentation and transaction histories linked to a specified wallet address or account. The legal mechanism varies by forum, but the leading instrument in common-law jurisdictions is the Norwich Pharmacal order — a principle requiring a third party who has, even innocently, become mixed up in wrongdoing to assist the victim by disclosing what it knows. Courts have applied this doctrine consistently to centralized exchanges, treating them as the functional equivalent of a bank holding evidence of fraud.
The parallel instrument is the Bankers Trust order, which compels production of account documentation in support of tracing claims. In practice, counsel will often seek both in a single without-notice application, supported by a witness statement attaching blockchain forensic evidence and a tracing report from a recognized analytics provider.
England and Wales remains the leading forum for these applications. Its courts have developed a coherent body of case law treating digital assets as property capable of being traced, frozen and recovered. AA v Persons Unknown [2019] confirmed that Bitcoin is personal property under English law — a foundational finding. Osbourne v Persons Unknown [2022] extended that analysis to NFTs. Both decisions are now widely cited outside the United Kingdom as persuasive authority, including in Singapore and Hong Kong.
The DIFC Courts in Dubai have moved in the same direction. Recent decisions — including proceedings against parties operating across the Gulf — have shown willingness to grant disclosure relief and to recognize and enforce foreign freezing orders within the DIFC. For a business with operations or counterparties in the UAE, that creates a parallel route worth assessing at the outset.
CTA #1 — Early engagement
The process above describes the standard path. Your facts — the entity structure, the exchange relationship and the jurisdiction of the relevant assets — change the analysis materially. Map your options before the window closes.
Which forums grant exchange disclosure orders fastest?
Forum selection turns on two variables: the speed of without-notice (ex parte) relief and the practical reach of any order against exchanges incorporated or operating outside the forum. No single court combines both perfectly, and the right answer depends on where the assets are and where the exchange holds its primary regulatory licence.
England and Wales offers the most developed procedural toolkit. Applications can move from instruction to without-notice hearing within days when counsel and a forensics team are already instructed. The court's global reach is practically significant: most major exchanges maintain some presence or user exposure in the United Kingdom, which means English orders carry commercial weight even against platforms incorporated elsewhere. The FCA's regulatory perimeter creates an additional lever — exchanges seeking to retain or obtain FCA registration have a strong incentive to comply with English court process.
Singapore is the second anchor forum for Asian operations. The High Court of Singapore recognized proprietary injunctive relief over crypto in proceedings in 2022, applying common-law property principles to digital assets. Where the exchange involved holds a Digital Payment Token service licence under the Payment Services Act — the MAS licensing regime — it is subject to Singaporean court jurisdiction in a meaningful operational sense. Process timelines are broadly comparable to England when the relevant chambers are fully briefed.
Hong Kong has accelerated. The court's 2024 proceedings in HCA 2417/2024 demonstrated willingness to grant injunctive relief in a tokenized-asset context, building on the 2023 finding in Re Gatecoin that crypto assets constitute property for insolvency purposes. For businesses with Hong Kong entities or with counterparties regulated by the SFC under the VASP licensing regime for virtual-asset trading platforms, the Hong Kong courts provide a credible and commercially meaningful forum.
The DIFC Courts in Dubai are a growing option. The DIFC is a common-law jurisdiction with its own court system operating under English-influenced procedure. VARA, the mainland Dubai regulator, and the FSRA within ADGM operate adjacent to the DIFC but are distinct: counsel must map which entity sits where before committing to a DIFC application. Recent decisions — including proceedings analogous to Techteryx v Aria Commodities DMCC and freezing order applications in support of foreign proceedings — confirm that the DIFC bench will act.
For assets that have moved into offshore holding structures, the Cayman Islands and BVI each have their own courts and their own VASP legislation. CIMA in the Caymans and the BVI FSC apply distinct regulatory frameworks, but both jurisdictions sit within common-law traditions that treat property principles broadly consistently with England. Ancillary applications in those forums — particularly for entity-level disclosure — are a standard part of a multi-forum recovery strategy.
What evidence does the court require for a disclosure application?
Courts will not grant disclosure orders on assertion alone. The evidence package that supports a successful without-notice application typically has three layers: a clear statement of the underlying wrong, a blockchain forensic trace linking the loss to specific addresses, and a proportionality argument showing that the disclosure sought is the minimum necessary to advance the tracing claim.
The forensic trace is the most operationally demanding element. Leading analytics providers — Chainalysis, TRM Labs, Elliptic and others with recognized methodologies — produce reports that courts have accepted as expert evidence. The report must follow the funds from the victim's wallet address through each on-chain hop to the exchange deposit address at which the trail terminates. Where funds have been mixed, the report needs to address the mixing methodology and, where possible, a probabilistic attribution analysis. In our practice, the quality of the forensic package is the single factor most correlated with obtaining relief quickly.
The identity of the respondent exchange matters too. A large, regulated exchange with AML/KYC obligations under the applicable VASP provisions — MiCA in the EU, the Payment Services Act regime in Singapore, the FCA's MLR registration in the UK — holds the underlying identity data as a compliance requirement. That means the disclosure order, once granted, can be enforced. Against an unregulated platform, the order may be technically obtainable but practically unenforceable.
Courts also look at whether the applicant gave adequate notice or why notice was impractical. The standard without-notice justification is that alerting the defendant would cause dissipation — which in the crypto context is a straightforward argument to make. The risk of a quick on-chain transfer is self-evidently real, and courts in all the leading forums have accepted it.
Cross-border complexity: where does jurisdiction actually lie?
The cross-border dimension is where crypto recovery diverges most sharply from conventional fraud work. A single theft may touch five jurisdictions: the victim is incorporated in one, the exchange is headquartered in a second, the KYC data is stored in a third, the assets have moved to a fourth and the suspected wrongdoer lives in a fifth. Each layer has its own answer.
The forum for the initial disclosure application does not need to be the forum where the exchange is incorporated. Courts regularly grant disclosure against foreign respondents where there is a sufficient connection — the victim is domiciled there, the exchange solicits customers there or the agreement governing the account contains a jurisdiction clause pointing there. A carefully drafted application can assert jurisdiction over a major exchange in England, Singapore or the DIFC on multiple bases simultaneously.
Enforcement is a separate question. An English freezing order does not automatically freeze an account on a Seychelles-incorporated exchange. But it does two things: it creates a contempt risk for any affiliated UK entity that assists in dissipation, and it can be presented to the exchange directly with a request for voluntary cooperation pending formal service. In our experience, major regulated exchanges — particularly those with regulatory ambitions in the UK, EU or Singapore — respond to that combination.
The Travel Rule adds another layer. Under FATF Recommendation 15 and the applicable VASP provisions across leading regimes, exchanges must collect and transmit originator and beneficiary data on transfers above specified thresholds. That data trail, held by a compliant exchange, is recoverable through disclosure. Counsel who knows which exchanges are Travel-Rule compliant — and in which jurisdictions — can build a disclosure strategy that uses regulatory data as well as on-chain forensics.
The stablecoin dimension is distinct. Tether (USDT) and Circle (USDC) each hold contract-level freeze authority over their issued tokens. Both issuers have stated publicly that they act on court order or law-enforcement / OFAC designation. Obtaining an English or Singapore order, or coordinating with a law-enforcement agency, can trigger an issuer freeze that is faster and more complete than waiting for an exchange to comply. We regularly assess both routes in parallel when a theft involves significant stablecoin balances.
Contrasting positions: the tension between disclosure and privacy
The exchange disclosure order regime operates in tension with data-privacy law, and that tension is real and litigated. Exchanges receiving disclosure applications regularly raise privacy objections — typically GDPR in the EU context, or equivalent data-protection regimes elsewhere — as a ground for delay or partial compliance.
Courts in the leading forums have generally resolved this tension in favor of disclosure where the underlying claim is fraud. The reasoning is consistent: the data-protection framework does not create a shield for wrongdoers, and disclosure ordered by a competent court falls within the public-interest exceptions available in most privacy regimes. Under MiCA and the AML obligations that apply to CASPs (crypto-asset service providers), exchanges already hold this data for regulatory purposes. The marginal privacy cost of producing it to a court is lower than it would be for a purely commercial request.
A second tension is between the applicant's need for speed and the respondent exchange's operational capacity. Large exchanges receive many court orders. Compliance teams vary in size and in familiarity with specific jurisdictions' court processes. Applicants who present a clean, well-drafted order — with a clear specification of the data sought, a reasonable production timeline and a point of contact — get faster results than those who serve a broadly worded order and wait. This is a drafting and process point, but it has material practical consequences.
A common assumption in the market is that decentralized exchanges (DEXs) are outside this regime entirely, on the basis that there is no corporate entity to serve. That assumption is increasingly challenged. Regulators in the UK, EU and US have each taken positions that the operators of DEX protocols — developers, governance-token holders with operational control, front-end operators — may be subject to the applicable VASP provisions. Courts have shown willingness to look through the protocol to the person or entity in control. The disclosure regime is not yet settled for DeFi, but treating a DEX as a disclosure-free zone is a risk that is growing, not shrinking.
CTA #2 — For the reader who already tried and hit a wall
If a prior application stalled — because the forum was wrong, the evidence package was underprepared or the exchange refused compliance — a second read of the facts can surface the structural reason and the route forward. Map your options with our disputes desk.
Decision matrix: which operator profile should take which approach?
The right combination of forum, instrument and sequencing depends on the specific facts of each matter. The following profiles describe the patterns we most commonly see.
Profile A — Exchange theft, victim a corporate entity, funds in stablecoins, exchange regulated in EU or UK. This is the highest-probability recovery scenario. The exchange holds verified KYC data under MiCA or FCA MLR requirements. England and Wales or an appropriate EU forum can grant disclosure quickly. A parallel stablecoin freeze request to the issuer should accompany the court application. The window is tight — hours — but the probability of identifying the account holder and freezing the balance before withdrawal is meaningfully higher than in less structured scenarios. Timeline to without-notice hearing: typically days with a fully briefed team.
Profile B — SIM-swap or account-compromise theft, victim an individual corporate officer, funds mixed through multiple exchanges across Asia-Pacific. This is the multi-forum problem. The forensics work is more extensive; the mixing path must be traced before a disclosure target can be identified. Singapore is often the primary forum for the first application, with Hong Kong as a parallel option where the SFC-regulated exchange is involved. The timeline is longer — weeks rather than days for the first order — but not hopeless. Allied counsel in the relevant jurisdictions coordinates service and enforcement simultaneously.
Profile C — Investment fraud, funds held on an offshore or lightly regulated exchange, no obvious EU/UK/SG connection. This is the hardest category. The forum must be identified from first principles: domicile of the victim entity, any contractual jurisdiction clause, any regulatory presence of the exchange in a reachable jurisdiction. The BVI and Cayman courts are relevant where entities are incorporated there. CFAAR — the Crypto Fraud and Asset Recovery network, launched in London in September 2021 — provides a practical coordination mechanism among counsel in multiple jurisdictions. The key variable is whether the exchange has any regulated entity that can be reached.
Profile D — Internal misappropriation by a director or employee, assets now held at a private wallet or custody provider. The disclosure target here is the custody provider rather than a trading exchange. The same Norwich Pharmacal / Bankers Trust toolkit applies. The additional tool is a proprietary injunction preventing the employee from dealing with assets they hold on the company's behalf. This route is often faster than in external-theft scenarios because the identity of the wrongdoer may already be known; the objective is to freeze before assets are moved off the custody platform.
Micro-matter: tracing through two exchanges under live conditions
In a recent matter, a payments company discovered that a substantial balance of stablecoins had been misappropriated overnight, apparently through a compromised API credential. On-chain forensics — commissioned within hours of discovery — traced the funds through two intermediate wallets to deposit addresses at two exchanges, one regulated in the UK under the FCA's MLR registration and one operating under the MAS regime in Singapore. We moved simultaneously for without-notice disclosure in England and, through allied counsel in Singapore, for a parallel application in the High Court there. Both exchanges received the orders within days of the theft. The FCA-registered exchange produced KYC records promptly. The Singapore-regulated exchange complied following confirmation of the Singapore order. The account holder's identity was established and a worldwide freezing order was obtained in England before the balance was moved. The stablecoin issuer was separately notified and froze the remaining balance at the contract level. The matter illustrates the compounding effect of simultaneous multi-forum action when the forensics are prepared immediately and counsel is already instructed.
Objection handler: the common assumptions that cost victims time
A common assumption is that once funds leave a victim's wallet, recovery is legally impossible because there is no central counterparty to sue. This is incorrect, and acting on it causes the very outcome it predicts. Centralized exchanges, stablecoin issuers and custody providers are identifiable legal entities subject to court process. On-chain tracing can follow funds across multiple hops with a level of precision unavailable in conventional banking fraud. Courts in England, Singapore, Hong Kong and the DIFC have each confirmed that digital assets are property capable of being traced, frozen and recovered through established legal process.
A second assumption is that privacy law or the exchange's terms of service blocks disclosure. As noted above, courts in leading forums have consistently held that a judicially supervised disclosure order operates within, not outside, applicable data-protection frameworks. An exchange's terms of service bind its customers — they do not bind a court.
A third assumption — one we see among businesses that have suffered a smaller initial loss and delayed action — is that the cost of legal process exceeds the likely recovery. This can be true at very small scale. But the economic calculus changes sharply when a matter involves a balance that a forensic team and two counsel teams can address across standard fixed-scope packages, and when the alternative is writing off the entire loss. In our practice, the businesses that fare worst are those that spent the first seventy-two hours internally debating whether to engage counsel, rather than preserving evidence and initiating process.
Self-assessment: what a business operator should have ready before instructing counsel
The speed of a without-notice application depends heavily on what the victim can produce in the first conversation with counsel. The following items accelerate the engagement materially.
First: wallet addresses. Every sending address, every receiving address and every intermediate hop that in-house technical staff can identify from logs or the blockchain explorer. Even a partial set is useful; a forensics team will extend the trace from there.
Second: transaction hashes. The on-chain identifiers for each relevant transfer. These anchor the forensic report and allow the court to follow the chain independently.
Third: exchange identifiers. Any information about the exchange or platform through which the theft occurred — account numbers, email addresses used, IP logs from API access if available. If the attacker used an exchange account to withdraw, that account identifier is the primary disclosure target.
Fourth: the timeline. A factual narrative of when the misappropriation occurred, when it was discovered and what steps the business took between discovery and instructing counsel. Courts care about prompt action; a clean narrative supports the without-notice justification.
Fifth: corporate authority. The person giving instructions needs to confirm they have authority to instruct litigation counsel and to authorize the cost of the forensics engagement. Internal authorization delays are a common and avoidable source of lost time.
A business that has this package ready can support a counsel team moving to a without-notice hearing within days. A business that spends days assembling it after instruction materially narrows its own options.
Related at OBOLUS
- Disputes & Asset Recovery for Digital Asset Businesses – our full practice overview covering freezing orders, tracing and multi-forum recovery strategy
- Exchange Disclosure Orders in Germany under BaFin – jurisdiction-specific analysis for EU operators facing disclosure applications under the MiCA and AML regime in Germany
- CASP Authorisation under MiCA in the Cayman Islands – how Cayman-incorporated entities interact with the MiCA authorisation regime and what that means for disclosure exposure
FAQ
Can stolen crypto actually be recovered?
Yes — when action is immediate and the funds have passed through a regulated, centralized exchange. Courts in England, Singapore, Hong Kong and the DIFC have all granted freezing and disclosure relief in digital-asset theft cases. On-chain tracing can follow funds with precision unavailable in conventional banking fraud. Recovery probability is highest when the forensic trace is prepared within hours and counsel moves for without-notice relief before the wrongdoer withdraws to a private wallet or mixes the funds.
How fast must I act after a digital-asset theft?
The window is measured in hours, not days. Funds moved to a private wallet or through a mixing service become materially harder to trace and freeze. The practical priority on discovery is: preserve every log and transaction identifier, commission a blockchain forensics trace immediately and instruct litigation counsel that same day. Courts understand the urgency and will accommodate an expedited without-notice application where the justification — risk of dissipation — is clearly evidenced. Delay is the primary reason recovery applications fail.
Can a court freeze assets held on an exchange?
Yes. A worldwide freezing order granted by a court of competent jurisdiction — England and Wales, Singapore, Hong Kong and the DIFC are the leading forums — operates as an injunction preventing the defendant from dealing with assets wherever held, including within exchange accounts. The order is served directly on the exchange. Regulated exchanges operating under MiCA, the FCA regime, the MAS Payment Services Act or equivalent VASP regimes have strong compliance incentives to honor the order promptly. Contempt risk for non-compliance is a meaningful enforcement lever.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We move for freezing relief and exchange disclosure while the trail is live. In our cross-border practice, we regularly advise on multi-forum recovery strategies that run England, Singapore and the DIFC in parallel. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst — specialising in cross-border digital-asset regulatory analysis and exchange disclosure strategy across common-law and civil-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.