Recovery windows for misappropriated digital assets are measured in hours, not weeks. A business that has lost funds to on-chain asset tracing (the discipline of following cryptocurrency movements across public ledgers to establish where stolen assets now sit) must act before those assets are consolidated, bridged or cashed out at an exchange with weaker controls. In Canada, a developed common-law legal environment, courts have the jurisdiction and the willingness to support that process – provided counsel moves quickly and with the right evidence.
On-chain asset tracing in Canada proceeds through three coordinated tracks: a forensic trace on the blockchain, a disclosure order compelling an exchange or platform to identify the account holder, and injunctive or freezing relief to prevent dissipation while proceedings are organized. Canadian courts treat cryptocurrency as property capable of being the subject of proprietary claims and interim remedies, and asset recovery counsel in Canada draws on the same common-law equitable toolkit available in England and Wales, Singapore and Hong Kong. This guide walks through each step in sequence.
Why Speed Determines the Outcome
The first hours after a digital-asset theft determine whether recovery is possible at all. Misappropriated funds move fast: they are typically passed through mixer services, bridged across chains or converted at a spot exchange within a short window. Once funds reach a jurisdiction with no effective AML supervision or a service provider with no obligation to respond to foreign legal process, the practical recovery window narrows sharply.
The forensic layer of on-chain tracing is time-sensitive but also durable. Blockchain transaction data is immutable: the ledger does not forget, and a trace conducted weeks after a theft can still reconstruct the full movement path. The legal layer, however, is not forgiving. Exchanges and custodians that hold or recently held the assets can be compelled to disclose account information and to freeze balances – but only while the funds are still there. A court order that arrives after a withdrawal is too late.
In our cross-border practice, we have seen recovery outcomes diverge sharply between clients who contacted counsel within the first day and those who waited several weeks while pursuing informal routes. The difference is almost always whether the assets were still on a regulated platform when legal process was served.
The Travel Rule (the obligation, under the Financial Transactions and Reports Analysis Centre of Canada – FINTRAC – regime, to pass originator and beneficiary data with a virtual asset transfer) means that compliant Canadian virtual asset service providers (VASPs) already hold identification and transactional data at the point of a transfer. That data can be compelled through court process – and it dramatically improves the quality of evidence available to a tracing team.
CTA #1: If a recovery clock is running on stolen or misappropriated crypto, contact OBOLUS now at info@oboluslaw.com or via t.me/oboluslaw. The process above describes the standard path, but your facts – the chain, the exchange, the counterparty – change the analysis and the urgency.
Step 1: Secure the Evidence Before the Trace
Effective on-chain tracing begins with systematic evidence preservation, not with the blockchain itself. Before a forensic analyst touches a transaction hash, counsel needs to have secured the foundational documentary record: wallet addresses, transaction IDs, timestamps, internal system logs and any communications with the counterparty or platform involved.
This matters for two reasons. First, Canadian courts considering a without-notice application for freezing or disclosure relief will require an affidavit that sets out the factual basis clearly and honestly. A poorly organized evidentiary record delays that application and gives the court reason for caution. Second, the forensic report – the output of the on-chain trace – is more persuasive as evidence when it is anchored to corroborating internal records.
The common mistake at this step is over-relying on exchange transaction history exports that can be altered or are incomplete. Counsel should instruct a qualified blockchain forensics specialist immediately and preserve all raw evidence in a format suitable for court use.
Canada's applicable anti-money laundering regime – administered by FINTRAC under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act – requires registered MSBs (money service businesses) and VASPs to maintain transaction and identity records. Those records can be accessed through legal process and they frequently contain the account identification data that links an on-chain address to a named individual.
Step 2: The On-chain Trace – What It Produces
A professional on-chain forensic trace produces a chain-of-custody report that maps the movement of specific assets – identified by transaction hash and originating address – from the moment of theft through each subsequent hop. The output is not speculative. Public blockchains record every transaction permanently, and analytics platforms can cluster addresses, identify exchange deposit addresses and flag sanctioned wallets with a high degree of accuracy.
The trace report serves a dual function. It is the evidentiary foundation for any court application (the court needs to see that the funds in question are, in fact, identifiably traceable to the original theft). And it identifies the current or last known custodian – typically a centralized exchange or OTC desk – against whom legal process should be directed.
In a recent matter, a technology company discovered that a counterparty had diverted a stablecoin balance through a sequence of self-custodied wallets before depositing at a Canadian-registered exchange. The forensic trace, completed within two business days, identified the deposit address and the approximate time window. That report was the foundation of both the disclosure application and the subsequent freezing motion. The funds were still on the exchange at the time of service.
The common mistake at this step is instructing a general IT consultant rather than a specialist blockchain forensics provider. Courts distinguish between expert reports that apply recognized methodology and informal analyses. The former carry the weight needed to support emergency relief.
Step 3: How Does a Disclosure Order Work Against a Canadian Exchange?
A disclosure order in the Canadian context is typically sought under the court's equitable jurisdiction – modeled on the Norwich Pharmacal principle (an order requiring an innocent third party that is mixed up in wrongdoing to disclose information that identifies the wrongdoer). Canadian superior courts have jurisdiction to grant such relief, and the principle is well established in the case law across provinces.
To obtain a Norwich Pharmacal-type order against a Canadian exchange, counsel must demonstrate: a good arguable case that a wrong has been committed; that the respondent exchange is mixed up in that wrong (however innocently, as the recipient of the funds); that the exchange holds the information sought; and that disclosure is necessary to enable the applicant to bring or continue its claim. The application is typically made without notice to the exchange initially, with provision for the exchange to be heard before the order is executed.
FINTRAC registration and Travel Rule compliance mean that regulated Canadian exchanges hold precisely the information a claimant needs: KYC (know-your-customer) records, account balances and transaction histories linked to the deposit address. A disclosure order forces that data into the proceeding.
Cross-border note: where the exchange holding the funds is not Canadian-registered but has Canadian users or operates through a Canadian entity, the jurisdictional analysis becomes more complex. Allied counsel in the relevant jurisdiction – whether Singapore, the British Virgin Islands or the UAE – may need to be engaged in parallel. OBOLUS coordinates that multi-forum process.
Step 4: Freezing Relief – What Can a Canadian Court Actually Order?
Canadian superior courts can grant injunctive relief – including a Mareva-style freezing order (an interim injunction preventing a defendant from dissipating assets pending trial) – over cryptocurrency held by a named defendant or by a third party on their behalf. The test is standard: a strong prima facie case, a real risk of dissipation and a balance of convenience favoring the order.
A key development in common-law jurisdictions relevant to Canadian practitioners is the growing recognition that digital assets constitute property for the purposes of equitable relief. Consistent with the reasoning adopted in England and Wales in AA v Persons Unknown [2019] and in the Hong Kong court in recent decisions, Canadian courts apply the same property analysis. This matters because proprietary claims – not just personal claims – support tracing remedies and may allow recovery against a third party who received the assets.
Freezing relief in Canada can be targeted at both the defendant and at the exchange as a third party. An exchange served with a freezing order is obligated to hold the relevant balance. Breach of a court order carries contempt consequences. This makes exchange-level freezing a practical tool – particularly where the exchange is a regulated Canadian VASP subject to FINTRAC oversight and, accordingly, more likely to comply promptly with court process than an offshore platform with no Canadian nexus.
Where the wrongdoer is unknown – a common scenario in crypto theft – Canadian courts can issue orders against persons unknown, following the model developed in England and Wales. This permits a freezing or disclosure order to be addressed to the exchange or blockchain address without prior identification of the human defendant.
Step 5: Cross-border Enforcement – When the Assets Have Left Canada
Digital assets rarely stay in one jurisdiction. A theft that originates with a Canadian business may have the funds flow through a Cayman-registered exchange, settle temporarily in a UAE wallet and finally be converted at a platform with no meaningful regulatory footprint. Each hop potentially requires separate legal process in a different forum.
The leading common-law forums for crypto asset recovery – England and Wales, Singapore, Hong Kong and the DIFC Courts in Dubai – all have developed bodies of case law and procedural tools for these multi-jurisdictional situations. A worldwide freezing order obtained in England and Wales, for example, operates globally against a defendant subject to the jurisdiction of the English court, even where assets are held offshore. The CFAAR network (the Crypto Fraud and Asset Recovery network, launched in London in September 2021) provides a practitioner framework for coordinating cross-border freezing and recovery actions.
In our cross-border practice, we regularly advise on multi-forum strategies where a primary recovery action in Canada is supported by parallel disclosure or freezing applications in a second or third forum. The sequencing of those applications matters: a freezing order in one forum can strengthen the evidential and practical position in the next.
The common mistake at this step is treating the matter as a single-jurisdiction problem. A defendant who controls funds across multiple blockchains and custodians will move assets the moment they receive notice of proceedings in any one forum. Simultaneous or near-simultaneous applications – coordinated by counsel who can issue instructions in each forum without delay – are the only reliable answer.
CTA #2: If a prior recovery attempt stalled, or an exchange refused to engage, a fresh strategic review can surface the structural reason and the route forward. Write to OBOLUS at info@oboluslaw.com to map the multi-forum options. A second read often identifies the gap the first approach missed.
Step 6: Stablecoin Issuer Freeze Requests – A Parallel Track
Where stolen assets include major stablecoins – particularly USDT (issued by Tether) or USDC (issued by Circle) – a parallel track is available that does not require a court order to initiate: a direct freeze request to the issuer. Both Tether and Circle hold contract-level authority to blacklist addresses on their respective protocols, effectively rendering the frozen balance unspendable by the holder.
Issuers generally act on a law-enforcement request, an OFAC designation or, in practice, a combination of a court order and a credible legal representation from counsel. The process is fast when the conditions are met: an issuer freeze can be implemented in a matter of hours once the legal basis is established. This makes it the highest-priority parallel track where the stolen balance is in USDT or USDC and the address holding the funds is identifiable.
The operational prerequisites are demanding. The freeze request requires the transaction hashes, the specific addresses holding the balance and, typically, a law-enforcement case reference or a court order supporting the request. A blockchain forensics report that traces the provenance of the funds from the theft event to the current address is essential. Acting without that documentation risks a declined request and potential alert to the bad actor.
Cross-border note: Tether and Circle operate under US regulatory frameworks (Tether under its BVI structure; Circle under the US money-transmitter regime). The enforcement and compliance teams engage with requests framed in terms they recognize. Canadian counsel coordinating a freeze request benefits from understanding the US regulatory posture – which OBOLUS manages through its cross-border practice.
Decision Matrix: Which Track Fits Your Situation?
Not every tracing matter calls for the same sequence of steps. The right approach depends on the asset type, the custodian, the speed of movement and the available evidence.
Profile A – Funds on a Canadian-registered VASP, assets identifiable: Priority is a concurrent disclosure application (to confirm the account holder) and a freezing order against the exchange. The FINTRAC registration of the exchange means KYC data exists. Timeline from instruction to application is typically a matter of days. Key risk: exchange may not be holding the full balance if withdrawals began before service.
Profile B – Funds already moved offshore, exchange jurisdiction unknown: Priority is the forensic trace to identify the receiving exchange's deposit address. Multi-forum strategy follows: primary proceedings in Canada, parallel applications in the receiving exchange's home forum. Timeline extends materially. Key risk: the receiving jurisdiction may have limited or no effective legal process for crypto recovery.
Profile C – Stolen assets are USDT or USDC, address identified: Immediate parallel track is the stablecoin issuer freeze request alongside the court application. This is the fastest available tool where the asset type and address are confirmed. Key risk: if the bad actor bridges to a non-stablecoin asset before the freeze is executed, this track fails.
Profile D – Assets scattered across self-custodied wallets, no exchange involved yet: The forensic trace is the immediate priority to monitor for the moment of exchange deposit. Legal preparation runs in parallel so that a disclosure and freezing application can be filed within hours of the deposit being identified. Key risk: the monitoring period may be lengthy, and exchange deposit is not guaranteed.
We regularly advise clients across all four profiles. The analysis at the outset – choosing the primary forum, sequencing the applications, deciding whether to engage the stablecoin issuer in parallel – determines whether the matter is recoverable.
A Common Assumption Worth Correcting
A common assumption among business operators who have suffered a digital-asset theft is that once funds leave the wallet, nothing can be done. This assumption is wrong on both the technical and legal levels.
On the technical level, public blockchains are permanent records. Every transaction is visible, traceable and attributable to an address. The challenge is not finding the funds on the ledger – it is converting that ledger data into actionable legal evidence quickly enough to precede withdrawal from a regulated custodian.
On the legal level, the Canadian common-law courts have jurisdiction to grant disclosure and freezing relief on an urgent basis. The equitable toolkit – Norwich Pharmacal orders, Mareva injunctions, proprietary tracing remedies – is available and has been applied in analogous common-law jurisdictions to digital assets with increasing regularity. Canadian courts look to those decisions and apply the same principles.
The accurate statement is narrower: once funds reach a jurisdiction with no effective legal process or a service provider who cannot be compelled to cooperate, the practical recovery path becomes very difficult. The answer is speed, not fatalism – and the decisive factor is how quickly professional tracing and legal counsel are engaged.
Related at OBOLUS
- Disputes & Asset Recovery for Digital Asset Businesses – our full cross-border recovery practice for operators and institutions
- Exchange Disclosure Orders: Turning On-chain Data Into Evidence – how Norwich Pharmacal-style orders are applied to crypto exchanges
- Travel Rule Compliance in Canada – FINTRAC obligations and how they interact with on-chain tracing evidence
FAQ
Can stolen crypto actually be recovered?
Yes, in a meaningful proportion of cases – particularly where the stolen assets land on a regulated exchange with KYC obligations and the tracing action is initiated quickly. Recovery is not guaranteed and depends heavily on where the assets move, the custodian's jurisdiction and the speed of the legal response. A forensic trace followed by coordinated court applications in the right forum gives the best outcome probability. We move for freezing relief and exchange disclosure while the trail is live.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows for misappropriated digital assets are measured in hours, not weeks. The critical window is the period while stolen funds remain on a regulated platform that can be served with a court order or an issuer freeze request. Assets that are withdrawn, bridged or converted before legal process is served become materially harder to recover. Counsel who can file on an emergency basis – including without-notice applications where necessary – should be instructed within the first day.
Can a court freeze assets held on an exchange?
Yes. Canadian superior courts can grant freezing injunctions – Mareva-style orders – over cryptocurrency held by an exchange on behalf of a defendant. The exchange, once served, is obligated to hold the relevant balance pending further order. Where the account holder is not yet identified, courts in Canada and other common-law forums have issued orders against persons unknown, addressed to the exchange by reference to the relevant account or address. Contempt consequences apply to exchanges that do not comply.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums, engaging allied counsel in the relevant jurisdiction where multi-forum proceedings are required. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specializing in on-chain asset tracing, cross-border freezing relief and exchange disclosure strategy across common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.