On-chain asset tracing: The Disputes Angle

When digital assets disappear — through fraud, misappropriation or a counterparty's insolvency — the instinct is to treat the loss as final. That instinct is wrong. On-chain asset tracing converts the blockchain's permanent, public ledger into a litigation weapon: every transfer, every exchange deposit, every bridge transaction leaves an immutable record that a forensic analyst can follow and a court can act on. The question is not whether a trail exists. The question is whether the legal machinery moves fast enough to catch assets before they move again.

The mismatch between recovery windows and legal timelines is the defining risk in crypto asset recovery. Bad actors know it. A misappropriated balance can be layered across five exchanges in under an hour. That is why on-chain tracing — the process of identifying and mapping a digital-asset trail using blockchain analytics tools — must run in parallel with emergency legal applications, not after them. This analysis maps how the two tracks interact: the technical, the legal, and the cross-border reality where most matters actually live.

Why the blockchain trail matters in litigation

The blockchain trail is the foundation of every successful crypto recovery because it does what no bank statement can: it records every transaction in a tamper-evident, publicly verifiable sequence, linking addresses rather than identities, from the original theft to the point of current custody. Courts in leading common-law forums have consistently treated this evidence as probative. In England and Wales, AA v Persons Unknown [2019] established that crypto assets are property capable of being the subject of a proprietary injunction — a holding that turned directly on the traceability of the asset. That principle has since been applied and extended across multiple jurisdictions.

The practical consequence is this: a well-prepared forensic report, mapping the theft event to a cluster of addresses and then to an identified exchange deposit, is the document that opens the courthouse door. It must be prepared by a qualified blockchain analytics firm, be methodologically defensible, and be ready before — or simultaneously with — the first legal application. In our cross-border practice, the matters that succeed are those where the forensic and legal tracks are coordinated from hour one.

Three elements make the trace actionable in court. First, continuity of the asset: the claimant must demonstrate that the crypto now held at the target address is, in traceable terms, the same asset that left the victim's wallet — this is the proprietary claim that founds the freezing relief. Second, identification of a respondent or exchange: anonymous blockchain addresses must be de-anonymised, at least to the point of identifying the venue (an exchange, a custodian) where the assets now sit. Third, urgency: courts granting without-notice emergency orders require evidence that the assets are at risk of dissipation. The blockchain trail, showing multiple rapid hops, provides exactly that evidence.

The legal toolkit: what courts actually order

Courts in the leading common-law forums have a well-developed set of orders available to a crypto recovery claimant, and the toolkit has expanded materially in recent years as forensic practice has matured. The primary instruments are the worldwide freezing order (an injunction preventing a respondent from disposing of or dealing with assets anywhere in the world), the Norwich Pharmacal order (compelling a third party — typically an exchange — to disclose the identity and account details of an account-holder), and the Bankers Trust order (compelling disclosure of transaction information in support of a tracing claim).

Freezing relief and disclosure orders are typically obtained without notice to the respondent, meaning the target receives no warning before the order is served — a feature that is essential where prior notice would allow dissipation. England and Wales remains the pre-eminent forum for these applications. The DIFC Courts in Dubai have developed their own parallel toolkit: the Trafigura v Gupta [2025] DIFC decision demonstrated the court's willingness to grant a worldwide freezing order in support of foreign proceedings, extending the reach of Dubai-seated emergency relief well beyond the UAE.

In Singapore, Hong Kong and the Cayman Islands, analogous mechanisms exist. CLM v CLN [2022] SGHC 46 in Singapore saw the High Court grant a proprietary injunction over cryptocurrency on the basis of a tracing analysis, confirming the court's jurisdiction to treat crypto as property subject to equitable relief. Hong Kong's regime, following Re Gatecoin [2023] and the first tokenised injunction in 2024, is developing with similar velocity. The choice of forum is therefore a strategic decision, not merely a geographic one: it turns on where the exchange is regulated, where the respondent has assets or a presence, and where an order will be most readily enforceable against a third-party custodian.

How does the trace actually work?

Blockchain forensics firms — working from transaction hashes, block explorers and proprietary attribution databases — follow the movement of funds through a sequence of addresses, applying clustering heuristics and known-entity tagging to identify where assets currently sit. The output is a forensic report that a lawyer can exhibit to a court, showing the path from the theft event to the current holding point. This is not theoretical: Tether (USDT) and Circle (USDC), the issuers of the two largest stablecoins, hold contract-level freeze authority over their tokens and will act on a court order, a law-enforcement referral, or an OFAC designation — making stablecoin recovery meaningfully faster than native-coin recovery in the right circumstances.

The trace begins with the transaction hash from the theft event. A qualified forensic analyst maps the outgoing transfers, identifies exchange deposit addresses using the firm's attribution data, and produces a report quantifying confidence levels for each address cluster. That report drives two parallel legal tracks: the freezing application (based on the tracing analysis proving the proprietary claim) and the disclosure application (directed at the exchange or custodian where the funds now appear to sit).

There are limits. Mixers, cross-chain bridges and privacy protocols complicate the chain of evidence — they do not break it entirely, but they raise the evidentiary burden and slow the process. DeFi protocols present a distinct challenge: the absence of a custodial intermediary means there is no exchange to serve with a disclosure order. In those cases, the legal strategy pivots toward on-chain injunctive relief, protocol-level cooperation requests, and — where a developer or DAO governance participant can be identified — personal liability arguments. In our practice, we have seen DeFi-related recovery matters resolved through a combination of forensic evidence and targeted disclosure applications directed at fiat off-ramps downstream of the protocol.

CTA #1: The analysis above describes the standard path from theft event to court order. Your facts — the asset type, the chain, the exchange — change the strategy materially. For a scoped assessment of your situation, contact OBOLUS at info@oboluslaw.com.

The cross-border reality: why forum selection is a decision, not a default

Most crypto recovery matters are inherently multi-jurisdictional: the victim may be in Europe, the exchange regulated in Asia, the assets sitting in a wallet linked to a beneficial owner in the Gulf. The legal question is not just "can a court order this?" but "which court's order will an exchange actually comply with, and how quickly?" That calculus is different for every matter.

England and Wales leads on international enforceability: a freezing order from the English court carries weight with exchanges worldwide, and the CFAAR (Crypto Fraud and Asset Recovery) network — launched in London in September 2021 — has developed practice protocols that accelerate exchange cooperation. The DIFC Courts offer a complementary route for matters touching the Gulf: the court's common-law framework and its treaty relationships with DIFC-regulated entities (including many of the exchanges operating under VARA or ADGM/FSRA licences) make it a natural first application forum where assets touch Dubai or Abu Dhabi.

Singapore's courts are the leading forum in Southeast Asia, and the MAS-regulated exchange environment means that disclosure orders issued by the Singapore High Court carry direct compliance pressure on locally licensed VASPs. Hong Kong's SFC-regulated exchanges operate under a similar dynamic. The practical question for counsel is therefore: where in the forensic chain does the clearest custodial nexus sit, and in which forum can emergency relief be obtained fastest? Those two questions rarely have the same answer, and the correct strategy often involves parallel applications in two or more forums.

Stablecoin cases add a further layer. An issuer freeze by Tether or Circle does not require a court order in the first instance — it requires a law-enforcement case reference or a credible legal demand, ideally backed by forensic evidence — but obtaining that freeze without a parallel court application risks a gap in the asset-restraint chain if the issuer does not act. We advise clients to pursue the issuer track and the court track simultaneously, not sequentially.

What are the contrasting positions on on-chain evidence?

The admissibility and weight of blockchain forensic evidence is not uniformly settled across all forums, and claimants who assume otherwise expose themselves to a challenge they could have anticipated. There are two credible positions in the market, and both deserve honest treatment.

The first position — and the one supported by the trend of English and common-law jurisprudence — is that blockchain evidence is highly probative: it is contemporaneous, unaltered, and methodologically verifiable by any party with access to the public ledger. Courts in England and Wales, Singapore, Hong Kong and the DIFC have each accepted forensic tracing reports as the basis for granting emergency relief. Where the forensic methodology is explained, the analyst is qualified, and the confidence intervals are properly stated, challenges to admissibility have generally failed.

The second position — and the one defendants' counsel regularly advance — is that probabilistic clustering heuristics are not proof of identity: demonstrating that funds arrived at an exchange deposit address does not prove who controls that address. This is a genuine evidentiary gap, and it is why the disclosure order (compelling the exchange to identify the account-holder) is a necessary companion to the tracing report, not an optional extra. A freezing order obtained on tracing evidence alone restrains an exchange account; the disclosure order converts the anonymous address into a named respondent.

A third, narrower objection concerns mixers and privacy coins: where a portion of the traced funds passed through a mixer, the defendant will argue that the "clean" and "dirty" coins cannot be distinguished on exit. Courts have shown willingness to accept proportionate tracing methodologies — including the lowest intermediate balance rule and pro-rata approaches — but the strength of that argument varies by forum. Instructing a forensic firm that can articulate and defend its methodology under cross-examination is therefore not a luxury. It is the difference between a viable claim and a struck-out one.

Decision matrix: which profile fits which recovery strategy?

Not every misappropriation follows the same fact pattern, and the legal strategy should be calibrated to the profile of the loss. The following profiles cover the most common scenarios we encounter in cross-border digital-asset recovery matters.

Profile A – Exchange hack or internal fraud, large-balance stablecoin loss. The asset is a stablecoin (USDT or USDC) on a major chain. The forensic path leads to one or two identified exchange deposit addresses. The recommended strategy is a parallel application: issuer freeze request (law-enforcement referral plus legal demand to the issuer) combined with a without-notice disclosure and freezing application in the English court or the DIFC Courts. Timeline to first court order: typically a matter of days in urgent cases, subject to court availability. Key risk: the issuer freeze window is short — if the exchange processes a withdrawal before the freeze is confirmed, the stablecoin balance may already be in a new wallet.

Profile B – Counterparty fraud, native-coin loss (Bitcoin or Ether), multiple hops. The assets have been moved through several wallets and may have been partially converted. The forensic trace is longer and the confidence intervals are lower at the terminal address. The recommended strategy centres on a Norwich Pharmacal / disclosure application directed at the exchange where the trail terminates, combined with a proprietary claim and freezing relief. Timeline to first order: longer than Profile A, reflecting the additional forensic preparation required. Key risk: address clustering errors — a misidentified terminal address can result in a freezing order against the wrong account, with reputational and liability consequences for the claimant.

Profile C – DeFi protocol misappropriation, governance-level bad actor. No custodial intermediary sits at the loss point. The strategy pivots to identifying fiat off-ramps, targeting any identifiable DAO participants or developers as respondents, and seeking disclosure from any centralised exchange used downstream. Timeline is typically longer and the outcome is less certain than Profiles A or B. Key risk: the absence of a regulated custodian means no compliance-backed disclosure obligation exists at the point of the loss; the legal strategy depends on what can be found downstream.

Profile D – Insolvency-adjacent asset dissipation. A counterparty in financial difficulty has moved digital assets ahead of collapse. The recovery vehicle shifts toward insolvency law: officeholder powers, transaction avoidance claims, and — where fraud is evident — criminal referral to assist with asset restraint. Key risk: the window for pre-insolvency dissipation claims is jurisdiction-specific and depends on the applicable look-back period under the relevant insolvency regime.

The myth: once funds leave the wallet, nothing can be done

The most damaging assumption a victim makes is that the permanence of a blockchain transaction makes the loss permanent. It does not. The blockchain's immutability is actually the claimant's advantage, not the fraudster's: every movement of the stolen asset is recorded and cannot be altered. The question is speed, not possibility.

Courts in England and Wales, Singapore, Hong Kong and the DIFC have each confirmed that crypto assets are property, that equitable tracing principles apply to them, and that emergency relief is available without notice in appropriate cases. The forensic tools available to claimants — from major blockchain analytics firms to on-chain explorer data — have improved materially in recent years. Exchange compliance teams, operating under FATF Recommendation 15 and the Travel Rule obligations that apply in most major licensing regimes, are increasingly willing to cooperate with properly structured legal requests.

What does not work is delay. In our cross-border practice, the matters where recovery was impossible were not the ones with complex forensic trails or uncooperative exchanges. They were the ones where the victim waited — for certainty, for a police report, for a second opinion — while the assets moved beyond the reach of any interim order. Recovery windows are measured in hours, not weeks. The first call after a misappropriation event should be to legal counsel, simultaneously with the forensic firm. Not the next morning.

A common assumption is also that law enforcement is the primary recovery vehicle. In practice, for business-to-business digital-asset disputes, civil proceedings move faster and produce more targeted relief. A worldwide freezing order from the English court or the DIFC Courts can be in place within days of the theft event. A criminal investigation operates on a different timeline and a different evidentiary standard. Both tracks can run in parallel — and in serious matters, they should — but civil recovery counsel should be engaged immediately, not after the criminal referral has been filed.

Micro-matter: stablecoin recovery across two exchanges

In a recent matter, a payments company discovered that a substantial balance of stablecoins had been misappropriated by a counterparty through a series of transactions structured to obscure the trail. Working with a forensic analytics firm, we mapped the asset path through two intermediate wallets to deposit addresses at two regulated exchanges, one in a Gulf jurisdiction and one in a European-regulated environment. We applied simultaneously for disclosure orders against both exchanges in the relevant common-law forum and for a worldwide freezing order restraining the account balances. The disclosure order produced account information identifying the beneficial owner of both accounts within a short number of business days. The freezing order was granted without notice. The assets remained frozen while the underlying liability claim was resolved, and the matter concluded with recovery of the principal balance. The case turned on the speed of the forensic preparation and the parallel structure of the legal applications — not on any novel legal argument.

Objection handler: what if the exchange is offshore or uncooperative?

Exchange non-cooperation is a real obstacle — but it is not a terminal one, and understanding its limits is essential to calibrating the litigation strategy. The degree of cooperation a regulated exchange provides in response to a legal order depends on three variables: the jurisdiction in which it is licensed (and the regulatory consequences of non-compliance), the issuing court (and the reputational and legal risk of disregarding its orders), and whether the order is accompanied by an issuer freeze that removes the asset from the exchange's own control.

Exchanges regulated under VARA in Dubai, the SFC in Hong Kong, MAS in Singapore, or MiCA-authorised frameworks in the EU operate under compliance programmes that make engagement with properly served court orders standard practice. Exchanges domiciled in lighter-regulated environments are less predictable, but they retain correspondent-banking and fiat off-ramp relationships with institutions that are regulated — and those relationships create pressure points that a well-structured legal strategy can use. Disclosure applications directed at the exchange's banking partners, or at the on-ramp or off-ramp through which fiat conversion occurs, can produce the same identity information through a different route.

Where an exchange is entirely outside the reach of a major court's process — a genuinely unregulated venue with no banking relationship in a cooperative jurisdiction — the strategy shifts to the asset rather than the custodian: working with the forensic firm to follow the asset when it moves, identifying the next exchange deposit, and applying for relief at the new venue. This is a longer and more expensive path, but it is not futile. We have seen assets recovered through third- and fourth-venue applications where the first exchange was entirely uncooperative.

CTA #2: If a prior recovery attempt stalled — an exchange ignored a demand, an application was refused, or the forensic trail went cold — a second read of the facts can surface the structural reason and the route back. Contact OBOLUS at info@oboluslaw.com or message us via t.me/oboluslaw.

Self-assessment checklist: is your matter recoverable?

The following questions are not legal advice. They are the first-pass triage that our disputes desk applies to every new inquiry. A "yes" to most of these does not guarantee recovery — no one in this practice can. But a "no" to several signals that the strategy will need to account for a harder evidential or procedural path.

• Do you have the transaction hash or hashes from the theft event? Without this, the trace cannot begin.
• Has it been fewer than 48 hours since the misappropriation? If yes, the stablecoin freeze window may still be open.
• Is the stolen asset a stablecoin with a known issuer (USDT or USDC)? If yes, an issuer freeze is a viable parallel track.
• Can you identify the exchange or custodian where the trail currently terminates, even tentatively? If yes, a disclosure application has a target.
• Is the loss commercially material — large enough to justify the cost and time of a cross-border legal application? This is an honest question that counsel should help you answer before proceedings are commenced.
• Do you have documentation of the underlying transaction or relationship that generated the entitlement — a contract, a transfer confirmation, a signed term sheet? This is the foundation of the substantive claim that the freezing order protects.
• Is the misappropriation civil or criminal in character, or both? If fraud is present, a parallel criminal referral may accelerate exchange cooperation.

The answers to these questions shape the opening strategy. They also determine which forum is the right starting point — a matter where the trail leads to a VARA-regulated exchange in Dubai calls for a different first step than one where the terminal address is on an exchange in a Southeast Asian jurisdiction.

Related at OBOLUS

• Disputes & asset recovery for digital-asset businesses – full practice overview: freezing orders, disclosure applications, cross-border recovery strategy.
• Crypto fraud and asset recovery in Luxembourg – EU-forum recovery strategy for digital-asset disputes under Luxembourg law.
• DeFi protocol legal structuring in Kazakhstan AIFC – structuring considerations for DeFi protocols under the AIFC/AFSA common-law framework.

FAQ

Can stolen crypto actually be recovered?

Yes — in a meaningful number of cases, provided the response is fast and the forensic and legal tracks run in parallel. Courts in England and Wales, Singapore, Hong Kong and the DIFC have each confirmed that crypto assets are property and that proprietary freezing and disclosure relief is available. The realistic recovery rate depends on the asset type, the speed of response, and whether the assets can be traced to a regulated custodian before they are moved again. Stablecoins, which carry issuer-level freeze authority, are more recoverable than native coins in many scenarios. No outcome is guaranteed, but the position is far from hopeless in well-prepared matters.

How fast must I act after a digital-asset theft?

Immediately. Recovery windows for misappropriated digital assets are measured in hours, not days. The stablecoin issuer freeze window — the period during which Tether or Circle can act on a credible legal demand before the asset is moved again — is particularly short. Exchange disclosure applications require the assets to still be present in the target account. Every hour of delay narrows the available options. The first call after a misappropriation event should be to legal counsel and a forensic analytics firm simultaneously, not after internal escalation or a police report has been filed.

Can a court freeze assets held on an exchange?

Yes. Courts in leading common-law forums routinely grant without-notice worldwide freezing orders that bind third parties, including crypto exchanges. A freezing order served on an exchange requires it to refrain from processing withdrawals from the affected account pending further order of the court. Exchanges regulated under MiCA, VARA, MAS, the SFC regime or the FCA's rules are subject to compliance obligations that make adherence to a properly served court order standard practice. Unregulated exchanges present additional challenges, but parallel strategies — directed at downstream fiat off-ramps or the assets themselves as they move — remain available.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We move for freezing relief and exchange disclosure while the trail is live, working alongside forensic partners to convert on-chain evidence into court-ready disclosure applications. To discuss your situation, contact info@oboluslaw.com.

CTA #3: To map a recovery strategy before the window closes, write to info@oboluslaw.com or reach our disputes desk directly at t.me/oboluslaw.

By Lydia Brennan, Tax & Structuring Analyst — specialist in the cross-border tax and structuring dimensions of digital-asset disputes and recovery transactions, including the treatment of recovered assets and the structural choices that affect enforcement exposure.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.