Recovery windows for misappropriated digital assets are measured in hours. A worldwide freezing order (a court injunction restraining a respondent from dealing with assets wherever they are held in the world) is the primary legal instrument for stopping that clock. In Estonia, courts can grant that relief, and the process is more direct than most operators assume.
Estonian civil procedure permits precautionary measures – including asset freezes – before a substantive claim is resolved. Where the misappropriated assets are crypto, the court's order can bind wallets, exchange accounts and fiat balances simultaneously. The cross-border reach depends on where enforcement is sought, but an Estonian order issued through proper channels carries legal weight in the jurisdictions that recognise it.
This guide walks through each procedural step: from the moment funds move without authorisation to the point at which an exchange is served and assets are frozen. Every step carries the regime basis and the one mistake that derails it.
Who Needs a Worldwide Freezing Order in Estonia?
A business operating in Estonia – or whose counterparty, debtor or fraudster has assets reachable through Estonian courts – is the typical applicant. The question the court asks is whether there is a real risk the respondent will dissipate assets before judgment.
The category is broad in digital-asset matters. Exchange operators licensed under the now-superseded Estonian VASP regime (and those transitioning toward MiCA CASP authorisation under ESMA oversight) hold customer balances here. Fraudsters who routed funds through Estonian-registered entities left asset footprints here. Businesses that were defrauded in a token sale, a DeFi exploit or a custodial theft may have a nexus that puts Estonian courts in reach.
The cross-border reality is unavoidable: the applicant is often not in Estonia, the respondent may be anywhere, and the crypto may have moved through five chains before landing on a centralised exchange. That is exactly the scenario in which a worldwide freezing order – rather than a locally scoped freeze – is the right instrument.
In our cross-border practice, we regularly advise businesses whose first instinct is to pursue the blockchain forensics before taking legal steps. That sequence can work, but the legal steps must run in parallel, not after.
Note for MiCA-obligated operators: if your entity is CASP-registered or in the MiCA licensing queue, any enforcement action against you or by you in Estonia will intersect with your licensing status. Handle both tracks concurrently.If you are facing an asset-dissipation risk right now, the next step is a same-day scoping call. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options.
What Is the Legal Basis for a Freezing Order in Estonia?
Estonian civil procedure provides for precautionary measures – esialgne õiguskaitse – that a court can grant before a final judgment to prevent frustration of enforcement. The applicant must show a plausible substantive claim and a real risk of asset dissipation.
For crypto fraud matters, the plausible claim typically rests on civil liability for unjust enrichment, delict or breach of a contract. The asset-dissipation risk is usually self-evident: digital assets can move globally within minutes. Courts in Estonia have accepted that speed as a structural feature of the asset class, not a speculative concern.
The "worldwide" element – the extension of the freeze beyond Estonian borders – requires either a separate recognition process in each enforcement jurisdiction or, where available, a mechanism under EU law. Within the EU, the European Account Preservation Order (EAPO) provides a parallel route for bank accounts. For crypto held on non-EU exchanges, the Estonian order must be served and recognised independently in each foreign forum. That is where allied counsel in the relevant jurisdiction becomes essential.
Common mistake at this stage: applicants draft the order too narrowly, covering only known wallets. A properly scoped order covers all assets "up to the value of the claim", whether in named accounts or not. The court's willingness to grant that breadth depends on the pleadings.
Step 1 – Preserve Evidence Before Filing
The first step is evidence preservation, not the court application itself – because the application will fail without a coherent chain of proof.
Required before filing: transaction hashes for every relevant on-chain movement, timestamps, wallet addresses, exchange-account identifiers where known, and any contract or communication tying the respondent to the assets. A professional blockchain forensics report is not strictly mandatory at the ex parte stage, but courts treat it as strong corroboration of the dissipation risk.
We have seen applications dismissed at the first hearing not because the fraud was unclear, but because the applicant could not identify which assets the order should cover. The forensics work – run with tools built for that task – converts a narrative of theft into a legally cognisable asset trail.
Common mistake: relying on screenshots of a blockchain explorer rather than a timestamped, signed forensic report. Screenshots are contestable. A signed report from a recognised tool carries weight.
The evidence bundle should also include: proof of the applicant's standing (ownership of the stolen assets), proof of the legal basis (the contract, the transfer records, the breach), and – critically – a cross-undertaking in damages (the applicant's formal commitment to compensate the respondent if the order later proves wrongly granted). Estonian courts require this. Failing to offer it is the fastest route to refusal.
Step 2 – The Ex Parte Application to the Estonian Court
An ex parte application (without notice to the respondent) is the standard route for freezing relief where advance notice would defeat the purpose. The applicant files with the competent Estonian court and presents the full evidence bundle, the draft order and the cross-undertaking.
The competent court is generally the court of the defendant's domicile or the place of business where the dispute arose. For fraud matters with a cross-border element, jurisdiction may also rest on where the harmful event occurred or where the assets are located.
The application must set out the claim value clearly. The freeze is limited to assets up to that value – courts do not grant open-ended freezes. Over-claiming the value of the claim is a common error that triggers judicial scrutiny and can result in a scaled-back order or a costs penalty.
Timeline for the ex parte decision varies. In urgent fraud matters, Estonian courts can act quickly – but applicants should plan for a realistic window of days rather than hours. Emergency applications filed with full supporting documentation stand the best chance of prompt determination.
One practical note on the cross-border dimension: if the order needs to reach an exchange operating outside Estonia, the application should already specify the foreign jurisdictions involved. That allows the order to be drafted in a form that maximises its enforceability abroad. We work through allied counsel in each relevant jurisdiction to achieve simultaneous service where the facts support it.
Step 3 – Serving Exchanges and Securing the Freeze
Once the order is granted, speed of service determines whether the freeze actually catches the assets. This is the step where most recovery efforts stall.
For assets on a centralised exchange: the order must be served on the exchange's legal department (or its registered service agent) and must be in a form the exchange can act on without further court involvement. Many exchanges have a compliance desk for exactly this purpose, but they require: a certified copy of the order, a clear identification of the account or wallet to be frozen, and – for foreign-exchange enforcement – either an apostille or a recognition decision from the court in the exchange's home jurisdiction.
For Tether (USDT) and Circle (USDC) balances specifically, the issuers hold contract-level freeze authority on their respective tokens. They generally act on a court order combined with a law-enforcement case reference. Securing that freeze through the issuer directly – alongside the exchange – is the fastest route to immobilisation. We coordinate both tracks simultaneously in active recovery matters.
Common mistake: serving the exchange but not the issuer, or vice versa. Both tracks must run in parallel. Funds bridged off the exchange remain unfrozen if only the exchange account is covered.
For on-chain assets in self-custodied wallets, the freeze order alone cannot technically stop movement. The legal mechanism here is a Norwich Pharmacal-style disclosure order (compelling the exchange where the wallet's owner has an account to disclose identity) combined with a follow-on freezing application in the jurisdiction where the owner is identifiable. Estonian courts can issue disclosure orders; enforcement of the resulting identification information may require recognition in a second forum.
Step 4 – Exchange Disclosure Orders and Identity Tracing
A disclosure order runs alongside or immediately after the freezing application. Its purpose is to compel a third party – typically an exchange – to disclose the identity and account details of the person holding the relevant assets.
Under the principles originating in English case law (influential in common-law forums including those in the CFAAR network, which was launched in London in September 2021), a disclosure order requires: a real prospect of a cause of action against the account holder, the third party's involvement (innocent or otherwise) in the wrong, and necessity – the information is not otherwise obtainable.
Estonian courts apply analogous principles under civil procedure. The practical result is that an exchange served with a valid Estonian court order must produce the KYC records, account history and withdrawal logs associated with the flagged wallet. That output feeds the identity determination that allows the case to move from "persons unknown" to a named respondent.
We advise clients to run forensics and the disclosure application in parallel. Waiting for forensics to complete before filing the disclosure application adds days. Days matter when a withdrawal is pending.
In a recent recovery matter, a digital-asset business identified suspicious outflows from a custodial account late in the quarter. We filed for a precautionary freeze and a simultaneous disclosure application within forty-eight hours. The exchange produced account records, the respondent was identified, and a follow-on freezing application was made in the relevant forum before the assets were moved to a second wallet. The funds were immobilised before the respondent's attempted withdrawal cleared.
Step 5 – Cross-border Enforcement Outside Estonia
An Estonian worldwide freezing order is only as effective as the enforcement network behind it. For assets outside Estonia, the order must be recognised in each target jurisdiction before it has operational force.
Within the EU, mutual recognition mechanisms simplify this for bank accounts. For crypto exchanges located in non-EU jurisdictions – Singapore, Hong Kong, the United Kingdom, the Cayman Islands, the BVI, the United States – recognition requires a separate application in each forum. The DIFC Courts, English courts and Singapore courts are among the forums most experienced in recognising and enforcing foreign freezing relief in crypto matters. Applicants with assets across multiple platforms routinely need to file in two or three forums simultaneously.
Timing is the governing constraint. Staggered applications create gaps. An exchange in Singapore may act on a recognised order within hours; the same exchange will not act on an unrecognised Estonian order until local proceedings conclude. Multi-jurisdictional coordination, with allied counsel briefed and on standby in each forum, is the only reliable architecture for a worldwide freeze that actually works.
Common mistake at this stage: filing in Estonia first and treating the cross-border step as secondary. For cases where the bulk of the assets are outside Estonia, the primary filing jurisdiction should be the most efficient forum for recognition and service in the target country. Estonia may be the right choice for domicile reasons; it may not be the fastest route to the assets.
If your recovery involves assets on exchanges in multiple jurisdictions, the structure of your filing strategy will determine the outcome. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. Map your options.
Step 6 – Post-freeze Strategy and the Substantive Claim
A freezing order is interim relief – it preserves the status quo while the substantive claim proceeds. The applicant must pursue the underlying case or the freeze lapses.
In Estonia, the court that granted the precautionary measure will set a deadline by which the substantive claim must be filed. Missing that deadline dissolves the freeze and exposes the applicant to a damages claim under the cross-undertaking. Managing that timeline is as important as winning the initial application.
The substantive claim options for digital-asset fraud in Estonia include claims in unjust enrichment, civil fraud (delict), breach of contract and, where the wrong involves a regulated entity, claims under applicable VASP or MiCA CASP provisions. The MiCA regime, enforced by ESMA and national competent authorities, creates substantive obligations on CASPs that can underpin a claim against a regulated entity that facilitated the loss.
Post-freeze, the frozen assets can serve as security for judgment. Where the respondent is willing to negotiate, the freeze often accelerates settlement. Where the respondent contests the order, the inter partes hearing is the applicant's opportunity to convert an ex parte grant into a confirmed order on notice.
The decision matrix at this stage:
Profile A – clear identified respondent, assets frozen in Estonia: pursue the substantive claim in Estonian courts; resolution typically within the courts' standard civil timeline; key risk is procedural delay if the claim is complex.
Profile B – respondent identified but assets distributed across multiple jurisdictions: coordinate parallel proceedings in each forum with assets; key risk is fragmentation and inconsistent interim rulings; coordinated multi-forum counsel is the mitigation.
Profile C – respondent still unidentified ("persons unknown"): maintain the freeze while the disclosure orders produce identification; file the substantive claim on identification; key risk is the identification timeline exceeding the court's permitted window for interim relief.
Addressing a Common Assumption: Once Funds Move, Nothing Can Be Done
A common assumption among businesses facing digital-asset theft is that once funds leave the wallet, the situation is irretrievable. That is incorrect, and acting on that assumption causes the very outcome it fears.
On-chain transactions are permanent but they are not untraceable. The blockchain is a public ledger. Every movement – through mixers, bridges, DEXs or centralised exchanges – leaves a record. Professional forensics tools reconstruct that trail to a degree of specificity that courts accept as evidence. The question is not whether the trail exists; it is whether the applicant moves fast enough to freeze the assets before they are liquidated or layered into a jurisdiction where enforcement is impractical.
The disclosure-and-freeze combination exists precisely for this scenario. Exchange accounts at the end of a traced chain can be frozen before withdrawal. Stablecoin issuers can blacklist specific token balances. Courts in leading common-law forums – including through the CFAAR network – have issued relief in matters where the theft was recent and the trail was still hot.
What changes the outcome is speed and the quality of the legal-forensics coordination. Recovery is not guaranteed. But the probability of recovery falls sharply with each day of inaction.
In our practice, we move for freezing relief and exchange disclosure while the trail is live. That combination – legal action and forensics running simultaneously, not sequentially – is the architecture that preserves recovery options.
Related at OBOLUS
- Disputes & Asset Recovery for Digital-Asset Businesses – full-scope recovery counsel from tracing to enforcement across leading forums
- How to Respond in the First 48 Hours After a Crypto Theft – a step-by-step emergency guide for businesses facing active misappropriation
- VASP Licence Application for Early-stage Founders – licensing and registration strategy for crypto businesses entering regulated markets
FAQ
Can stolen crypto actually be recovered?
Recovery is possible but not guaranteed. The determinants are speed, the quality of forensic tracing and the availability of legal relief in the jurisdictions where the assets land. Courts in leading common-law forums have granted freezing orders and disclosure orders that resulted in recovery. The earlier the legal process starts after the theft, the greater the probability of a useful outcome. Acting on the assumption that nothing can be done is the most common reason recoverable funds are not recovered.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows are measured in hours, not weeks. Assets that move through a centralised exchange can be frozen at the exchange level if the legal and forensic response reaches the exchange before a withdrawal clears. Stablecoin issuers can blacklist specific token balances quickly when presented with a court order and, generally, a law-enforcement case reference. Waiting for certainty before filing costs the window. An application on strong but incomplete facts is better than a perfect application filed too late.
Can a court freeze assets held on an exchange?
Yes. An exchange holding assets on behalf of a customer is a third party holding property that is the subject of the claim. Courts with jurisdiction – including Estonian courts for assets within their reach, and courts in leading forums such as England and Wales, Singapore and the DIFC for international enforcement – can order an exchange to freeze an account and to produce disclosure. Most major exchanges have compliance desks that act on court orders. The order must be properly served and, for non-domestic enforcement, recognised in the relevant jurisdiction.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums, moving simultaneously on the legal and forensics track to preserve recovery options while the asset trail is live. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialises in cross-border digital-asset recovery, worldwide freezing orders and exchange disclosure applications across common-law and civil-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.