A business wakes to find a significant token balance gone. The wallets show outbound transactions it did not authorize. The question is not whether blockchain forensics can trace the path – they almost always can. The question is whether a court can be reached fast enough to freeze the proceeds before a second transfer renders the effort academic. A worldwide freezing order (a court injunction restraining a defendant's assets in all jurisdictions simultaneously) is now the primary legal instrument that separates a recoverable loss from a permanent one in digital-asset disputes. Enforcement patterns across the leading common-law forums are shifting – and operators who understand those patterns before an incident are materially better placed than those who learn them after.
This analysis maps the current state of worldwide freezing order practice in digital-asset matters, contrasts the positions taken by leading forums, and draws out what the trajectory of recent enforcement means for the businesses that move, hold and issue crypto assets.
Why Worldwide Freezing Orders Matter to Digital-Asset Operators
A worldwide freezing order is the single most powerful pre-judgment remedy available to a fraud victim in a common-law system. It immobilizes a defendant's assets – wherever they are held, across exchanges, custodians and cold wallets – pending the resolution of underlying claims. In the digital-asset context, its value is amplified by one structural feature of blockchain transfers: finality. On-chain transactions settle in seconds. A court order served thirty minutes late can be thirty minutes too late.
The courts that have most actively developed this remedy – England and Wales, the DIFC Courts, Singapore and Hong Kong – have each confirmed that crypto assets are capable of being property for the purposes of proprietary injunctive relief. That foundational step, now well established across these forums, means the legal architecture for freezing is in place. The operational question is whether a victim can move through that architecture quickly enough to catch the funds.
In our cross-border practice, we see two categories of claimant. The first engages counsel within hours, arrives in court with transaction hashes, a preliminary forensic report and a clear account of ownership. The second engages days later, after internal escalations have consumed the window. The outcomes differ sharply. The forensic trail typically remains readable long after the funds have moved – blockchain immutability ensures that. But the assets themselves migrate quickly, and each additional transfer adds a layer of complexity to enforcement.
Operators we advise routinely hold assets in multiple jurisdictions simultaneously: an exchange licence in one hub, banking in a second, a fund structure in a third. That same multi-jurisdiction structure that creates operational flexibility also means that any counterparty dispute or internal misappropriation will require enforcement across borders. A single-forum freezing order is rarely sufficient. The worldwide formulation is, in nearly every serious matter, the necessary instrument.
The Forum Picture: Where Can You Get Relief?
England and Wales remain the pre-eminent forum for worldwide freezing order applications in crypto asset matters, and recent enforcement confirms that the courts are willing to move at the speed the asset class demands. The jurisdiction has an established body of authority confirming digital assets as property, an experienced commercial judiciary comfortable with blockchain evidence, and a procedural regime that allows without-notice applications where delay would defeat the purpose of the relief.
The Norwich Pharmacal order (a disclosure remedy compelling a third party – typically an exchange – to identify the holder of a specific wallet address) sits alongside the worldwide freezing order as a core recovery tool. In practice, the two are sought together: the freezing order restrains movement while the disclosure order surfaces the identity behind the address. England and Wales courts have granted both in digital-asset matters, including against persons unknown, resolving the historical uncertainty about whether a defendant must be identified before relief can issue.
The DIFC Courts in Dubai have developed rapidly as a second forum of substance. The DIFC regime offers a common-law court with English-procedural heritage operating inside a civil-law city-state, with the ability to issue freezing relief in support of foreign proceedings – a critical feature for operators whose assets span the UAE and other jurisdictions. Recent decisions from the DIFC have confirmed the forum's willingness to deploy this tool in complex cross-border matters, and the DIFC's enforcement treaties with courts in the region give the orders practical reach.
Singapore's courts have confirmed the availability of proprietary injunctions over crypto assets. Hong Kong issued what was reported as the first injunction expressed to cover tokenized assets, signaling the SFC-supervised jurisdiction's commitment to applying its commercial law toolkit to the full range of digital instruments. Both forums offer the combination of speed, substantive flexibility and enforcement infrastructure that serious cross-border recovery requires.
The practical implication for an operator assessing its risk position: the forum where a company is incorporated, where it holds its primary bank account, or where its users are based may not be the forum that offers the best or fastest freezing relief. Pre-incident forum analysis – understanding which court could be reached first, with what evidence, and to what effect – is a planning decision, not a reactive one.
For a scoped assessment of your exposure and the forums available to you, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the asset location, the relationship with the counterparty – change the analysis materially.
What Courts Actually Require: The Evidential Threshold
A worldwide freezing order application requires the claimant to satisfy the court on several connected points, and the evidential threshold – while not designed to require a fully proven case at the interim stage – is meaningfully higher than many operators expect when they first arrive at counsel.
The court will want to see, at minimum: a good arguable case on the merits of the underlying claim; evidence that the defendant holds assets subject to the order; a real risk of dissipation if the order is not granted; and full and frank disclosure of any facts adverse to the application. That last requirement is particularly unforgiving. Operators who present a partial picture – omitting a contractual defence available to the counterparty, or a prior payment that complicates the ownership narrative – risk having the order discharged on a return hearing, with cost consequences.
In digital-asset matters, the dissipation risk element is, in most cases, self-evident. A token in a hot wallet connected to a decentralized exchange can be moved in under a minute. Courts in the leading forums have accepted blockchain-specific evidence of this kind as satisfying the dissipation threshold without requiring the claimant to demonstrate a specific intent to dissipate. The on-chain mechanics themselves do the work.
The forensic report is, in our experience, the document that most often determines whether a without-notice application succeeds at the first hearing. A report that traces the transaction path, confirms the balance at the time of application, and identifies the exchange or custodian holding the relevant addresses gives the court the factual foundation it needs. A bare assertion that funds were taken does not. Engaging a qualified blockchain forensics provider as the first step – before counsel drafts the application – compresses the timeline and improves the evidential position simultaneously.
The Bankers Trust disclosure order (a remedy compelling a financial institution to disclose information about a defendant's accounts or transactions) is the parallel mechanism for reaching exchange-held assets. Where an exchange is based in a jurisdiction that recognizes and enforces English or common-law court orders, the Bankers Trust route is often faster than waiting for a separate domestic order in the exchange's home jurisdiction. Where the exchange is in a jurisdiction that does not, the multi-forum approach – simultaneous applications in the forum of the claimant and the forum of the exchange – becomes necessary.
The Cross-Border Reality: One Order, Many Jurisdictions
A worldwide freezing order binds the defendant everywhere. It does not automatically bind third parties – exchanges, custodians, banks – outside the jurisdiction in which it was granted. This is the operational gap that consumes most of the time in a serious cross-border recovery, and it is the gap that, left unaddressed, allows funds to move before enforcement catches up.
The approach that has emerged in practice is simultaneous multi-forum litigation: a primary application in the most advantageous forum, with parallel or closely sequenced applications in the jurisdictions where the assets are actually held or where the relevant exchanges are licensed. England and Wales, Singapore and Hong Kong each have procedural routes that allow foreign orders to be recognized and enforced domestically. The DIFC Courts have similar provisions. In jurisdictions outside the established common-law network, the position is more variable, and local allied counsel is required to assess enforcement prospects in real time.
The stablecoin ecosystem has added a further enforcement mechanism that runs alongside the court process. Tether (USDT) and Circle (USDC) each hold contractual freeze authority over the tokens they issue, and both have demonstrated willingness to exercise that authority on receipt of a court order or a verified law-enforcement referral. An issuer freeze stops movement at the token level regardless of where the wallet is held or which exchange it interacts with. In a matter involving significant USDT or USDC balances, an issuer freeze request – prepared in parallel with the court application – can be the difference between a frozen asset and a converted one.
This multi-track approach – court order, exchange disclosure, issuer freeze, forensic continuation – requires coordination across legal, forensic and compliance workstreams simultaneously. In our practice, we run these tracks in parallel rather than sequentially, because the window in which all three are effective is the same short window in which the funds have not yet moved beyond the reach of any of them.
Recent Enforcement Patterns: What the Trajectory Shows
Several patterns have become clear across the leading common-law forums over recent periods, and they carry direct implications for how operators should structure their pre-incident planning and their response protocols.
First, courts have become more comfortable granting relief against persons unknown. The practical consequence is that a claimant no longer needs to identify the human being behind a wallet address before obtaining a freezing order. The order can be directed at the address, and the subsequent disclosure process – through exchanges and, where necessary, through allied counsel in each relevant jurisdiction – surfaces the identity. This removes a procedural obstacle that previously allowed sophisticated fraudsters to shelter behind pseudonymity for long enough to convert and move funds.
Second, the courts have accepted a wider range of digital assets as property capable of being the subject of proprietary relief. The trajectory began with Bitcoin and ether and has extended to NFTs and tokenized instruments. The *Osbourne v Persons Unknown* decision in England and Wales confirmed NFTs as property for this purpose. Operators in the NFT and tokenization space now have confirmed authority for the proposition that their assets can be frozen and recovered, not merely traced.
Third, enforcement cooperation between the leading forums – England, Singapore, Hong Kong, the DIFC – has deepened. Mutual recognition of orders, coordination on disclosure and the willingness of courts to issue orders in support of proceedings in sister jurisdictions has made the multi-forum approach progressively more efficient. A claimant who moves quickly and coordinates correctly can now create a legal net across multiple jurisdictions in a compressed timeframe that would have been impossible a few years earlier.
Fourth, the costs of delay have become more explicit. In several matters tracked by the CFAAR network – the Crypto Fraud and Asset Recovery network, launched in London in September 2021 – the single most consequential variable was the time between discovery of the misappropriation and the first court application. Matters where that gap was measured in hours produced materially better outcomes than those where it was measured in days. This is not a function of legal complexity; it is a function of asset mobility.
The Operator Decision Matrix: Which Profile Should Do What
Not every digital-asset operator faces the same recovery profile. The appropriate pre-incident strategy and the optimal response protocol depend on the operator's structure, asset mix and geographic footprint. The following analysis maps the primary profiles against the relevant instruments and risks.
Profile A – Centralized exchange holding client funds: The primary risk is both inbound (a hacker extracting client balances) and internal (a rogue insider). The exchange holds substantial assets in a small number of wallets, which means the loss event is high-value and highly visible on-chain. The best pre-incident preparation is a documented incident-response protocol that specifies the forensic partner, the counsel engagement trigger and the jurisdictional priority order for court applications. The response window is measured in hours; the protocol needs to be executable by operations staff without waiting for a board decision. Without-notice applications to the leading common-law courts and simultaneous stablecoin issuer freeze requests are the primary instruments.
Profile B – Custodian or prime broker holding institutional assets: The institutional client base means that a loss event triggers not only a recovery obligation but also reporting requirements to regulators in the relevant licensing jurisdiction – VARA, FSRA, the SFC or the applicable regime – and potential notification to the clients themselves. Recovery counsel and regulatory counsel need to be engaged simultaneously, because statements made in one context will be seen in the other. The multi-forum approach applies, with particular attention to the forum where the institutional clients are domiciled and where their assets are contractually held.
Profile C – Token issuer with treasury assets: Treasury misappropriation may involve a smaller number of wallets but can be highly sensitive to public disclosure – a treasury drain that becomes public before a freezing order issues typically causes secondary damage in the token's market. The confidentiality provisions available in without-notice applications in England and Wales, the DIFC and Singapore are a significant practical advantage for this profile. Acting before public disclosure is feasible; waiting until after disclosure of the loss has usually closed the optimal recovery window.
Profile D – Fund or family office with digital-asset exposure: The fund structure introduces a layer of complexity around who has standing to bring the claim – the fund, the general partner, or the individual investor. Counsel needs to resolve standing quickly and correctly, because an application by the wrong party can be challenged on return and cost the claimant the freezing order. The applicable regime in the fund's domicile – Cayman, BVI, ADGM, or an EU member state under MiCA – will affect the regulatory reporting dimension of the response.
If a prior attempt to recover stalled or an application was declined, a second read of the structure often surfaces the procedural or evidential gap. To discuss, write to info@oboluslaw.com. If a recovery clock is running, reach our disputes desk now.
A Common Assumption Corrected: "Once the Funds Move, Nothing Can Be Done"
The most operationally damaging belief in digital-asset recovery is the assumption that a completed on-chain transfer is the end of the matter. It is not. The blockchain's immutability – the property that makes funds appear irretrievably gone to a non-technical observer – is also the property that makes the forensic trail permanent. Every hop, every intermediate address, every exchange deposit is recorded and readable.
The courts have consistently accepted this forensic record as evidence sufficient to ground both the merits of the claim and the dissipation risk. An exchange that receives misappropriated funds is not a safe harbor; it is an identifiable endpoint that is subject to a disclosure order and, in most of the leading licensing jurisdictions, to obligations under the applicable AML/CFT regime to report suspicious transactions and cooperate with legal process.
The Travel Rule – the obligation under FATF Recommendation 15 for virtual asset service providers to pass originator and beneficiary information with transfers above the applicable threshold – means that regulated exchanges increasingly hold verified identity data on their depositors. A forensic trace to an exchange deposit, combined with a disclosure order, produces an identified defendant in the large majority of cases that reach this point. The pseudonymity of the blockchain is a feature of the public ledger, not of the regulated exchange on which most funds are eventually liquidated.
What changes after funds move is not the legal possibility of recovery – it is the cost and complexity of the process. Each additional transfer adds another potential jurisdictional issue, another exchange whose cooperation must be sought, another layer of forensic analysis. The case for moving in the first hours is not that recovery is impossible later; it is that it is materially cheaper, faster and more reliable when the fund trail is short.
In a recent matter handled by our disputes team, a payments company identified unauthorized outbound transfers from a treasury wallet in the early hours. We engaged a forensic partner and had preliminary on-chain tracing completed before the business day began in the relevant time zone. A without-notice application to a leading common-law forum followed within the same day, and a disclosure order against the receiving exchange issued shortly thereafter. The funds were frozen before a further transfer could be executed. The matter was resolved without protracted litigation. This is not the typical outcome of every recovery – but it is the outcome that the first-hours response is designed to make possible.
Pre-Incident Planning: What Counsel Can Do Before Anything Goes Wrong
The operators we advise who manage digital-asset recovery well have one thing in common: they did not wait for an incident to understand the process. Pre-incident planning in this area is not a theoretical exercise. It produces specific, executable outputs that compress the response time when an incident occurs.
The first output is a jurisdictional priority map: a clear analysis of which forum is most advantageous for a without-notice freezing application given the operator's specific asset location, entity structure and likely defendant profile. This analysis is done once and updated as the business grows into new jurisdictions. It is not a long document; it is a decision tree that operations and legal staff can consult at 3 a.m. without waiting for a partner briefing.
The second output is a forensic retainer. The lead time between engagement and the production of a court-ready forensic report is the single largest variable in the application timeline. Operators with a standing retainer with a qualified blockchain forensics provider can have that report in hours. Those who engage for the first time at the moment of incident routinely lose a day or more to onboarding, data access agreements and scoping discussions.
The third output is a template evidence pack: the categories of document that will be needed for a without-notice application, assembled in advance so that the operator's operations team can produce them from internal systems quickly. Transaction records, wallet ownership evidence, governance records and the relevant contractual relationship with the counterparty all need to be located and presented. Having a template means that the search is directed and fast, not open-ended and slow.
The fourth output is a relationship with allied counsel in the key jurisdictions where the operator holds assets or interacts with exchanges. When a multi-forum application is needed, the ability to instruct allied counsel in Singapore, Hong Kong or the DIFC within hours of the primary application filing – rather than spending that time identifying and engaging them – materially changes the enforcement timeline.
None of these outputs requires a long engagement. In our practice, a pre-incident planning mandate typically runs to a few weeks of focused work and produces a protocol that the operator's team can maintain and update. The cost is a small fraction of the economic exposure of a single significant recovery failure.
Related at OBOLUS
Related at OBOLUS
- Disputes & Asset Recovery for Digital-Asset Businesses – how we approach cross-border recovery mandates end to end
- How to Build a Recovery Strategy for Misappropriated Tokens – a step-by-step guide for operators facing an active loss event
- Client Funds Safeguarding in South Korea – jurisdictional analysis of safeguarding obligations and enforcement tools
FAQ
Can stolen crypto actually be recovered?
Recovery is achievable in a meaningful proportion of cases where action is taken quickly. The blockchain's immutability means the forensic trail is permanent: every transaction is recorded. Courts in England and Wales, Singapore, Hong Kong and the DIFC have each confirmed crypto assets as property capable of being frozen and returned. The limiting factor is not legal possibility but speed – the recovery window narrows with each onward transfer. Engaging forensic and legal counsel within hours of discovery is the single most consequential decision a victim can make.
How fast must I act after a digital-asset theft?
The recovery window is measured in hours, not days. On-chain assets can be moved in seconds, converted across decentralized exchanges and distributed to multiple wallets in under an hour. Without-notice freezing applications can be made on the same day in the leading common-law forums if the evidential pack – transaction hashes, a preliminary forensic trace and a clear ownership narrative – is ready. Pre-incident preparation, including a standing forensic retainer and a jurisdictional priority map, is what makes a same-day application executable.
Can a court freeze assets held on an exchange?
Yes. Courts in England and Wales, Singapore, Hong Kong and the DIFC can issue disclosure orders – including Norwich Pharmacal and Bankers Trust orders – that compel exchanges to identify wallet holders and freeze relevant balances. Where the exchange is licensed in a jurisdiction that recognizes common-law court orders, service and compliance are typically achievable within days. For exchanges in jurisdictions outside that network, allied counsel in the exchange's home forum is needed to secure the equivalent domestic relief in parallel.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. In our cross-border practice, we move for freezing relief and exchange disclosure while the forensic trail is live – running court, forensic and issuer-freeze tracks simultaneously. We structure these mandates as one coordinated workstream, not a series of disconnected engagements. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Lydia Brennan, Tax & Structuring Analyst – specialist in cross-border asset structuring and the intersection of tax, recovery and multi-jurisdiction enforcement in digital-asset disputes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.