Recovery windows for misappropriated digital assets are measured in hours, not weeks. A business that discovers a theft on Monday morning and waits until Friday to brief counsel has almost certainly lost the trail. Georgia sits at a crossroads that matters here: the country has built one of the region's most permissive environments for virtual asset service providers (VASPs – businesses that exchange, transfer or custody digital assets), yet its civil enforcement machinery, when used correctly, connects to the international disclosure and freezing tools that can actually retrieve funds. This guide sets out every step, in sequence, from the moment of discovery through to enforcement.
Georgian courts have general civil-law jurisdiction over fraud matters. The country has not yet enacted a bespoke crypto-asset recovery statute, so practitioners apply general civil-procedure and criminal-procedure instruments to on-chain disputes. Cross-border reach is achieved by combining Georgian proceedings with parallel applications in the forums where stolen assets have come to rest – commonly England and Wales, Singapore, or the jurisdiction of the receiving exchange.
Step 1: Preserve every piece of evidence before the trail cools
The first priority is not filing a claim – it is locking the evidence that makes every subsequent step possible. Within the first two to four hours of discovering a theft, your team should capture full wallet addresses (both origin and destination), transaction hashes, timestamps, any exchange account identifiers or API keys connected to the incident, and every communication that touched the transaction. Screenshots of blockchain explorers are admissible as a starting record, but they are not sufficient alone. A contemporaneous, hash-verified export from the originating platform is far more durable in court. Do not – under any circumstances – attempt to send a "probe" transaction to the receiving wallet: doing so contaminates the forensic record and, in some jurisdictions, raises its own legal questions.
In our cross-border practice, the single most common reason a recovery fails is not that the assets moved too quickly. It is that the victim's own evidence record was incomplete when the first disclosure request landed at an exchange's legal department. Exchanges receiving a bare email complaint will not act. Exchanges receiving a signed letter of claim, a chain of transaction hashes, and a reference to a live court process – or an active law-enforcement case number – will, in many instances, flag the account while they await formal process.
On-chain tracing is the technical backbone of this step. A professional forensic report – prepared by a recognized blockchain analytics firm using tools such as those developed by Chainalysis, TRM Labs, or Elliptic – produces a cluster map showing every address to which the stolen funds have moved, identifying exchange deposit addresses where the funds arrived. This report is not optional: it is the document that drives every subsequent legal application.
Step 2: Open a parallel law-enforcement track in Georgia
Filing a criminal complaint with the Georgian Prosecutor's Office serves two purposes that civil-law practitioners sometimes underestimate. First, a live criminal investigation reference number can accelerate exchange cooperation in jurisdictions where issuers such as Tether or Circle require law-enforcement involvement before honoring a freeze request. Second, it creates an official Georgian state interest in the matter, which can be invoked when requesting mutual legal assistance from foreign jurisdictions where the funds have landed.
The Georgian criminal code covers fraud and computer-related crimes. The relevant agencies are the Prosecutor's Office and, for cyber dimensions, the Cybercrime Division of the Ministry of Internal Affairs. Processing timelines vary, and criminal proceedings in Georgia – as in most civil-law countries – move at a pace that is rarely compatible with an asset-recovery clock measured in hours. This is precisely why the criminal track must run in parallel with, not instead of, civil action. The two reinforce each other: the criminal reference supports the civil application, and the civil disclosure order can surface evidence that the criminal investigation can then use.
Operators we advise routinely file the criminal complaint on day one and the civil freezing application on the same day or the next business day. The two filings share the same forensic report and the same evidence package.
Step 3: How does Georgian civil law address crypto fraud?
Georgian courts apply the general Civil Code and Code of Civil Procedure to claims involving digital assets – there is no dedicated crypto-asset litigation statute. That means the substantive basis for a claim will typically be unjust enrichment, conversion (taking of property), or fraud/deceit, depending on the facts. The question of whether a particular digital asset constitutes "property" for Georgian law purposes is not yet settled by authoritative case law, but courts have generally treated digital assets as an economic interest capable of forming the subject of a civil claim.
A provisional measure under the Georgian Code of Civil Procedure – functionally equivalent to a freezing order (an order that prevents a respondent from dissipating assets pending judgment) – can be sought on an urgent basis. The court requires: a statement of claim, evidence of the defendant's identity or a description sufficient to identify the relevant asset even where the respondent is unknown, a showing of urgency, and a prima facie case. The anonymity of on-chain actors complicates the identity element, but courts in multiple jurisdictions have accepted wallet-address identifiers as a basis for initial process, with identity to be established through disclosure.
The cross-border reality is important here. If the stolen assets have moved off Georgian exchanges and are now sitting on a platform in, say, London or Singapore, a Georgian provisional measure alone will not freeze those assets. You need a parallel application in the forum where the assets now sit. England and Wales remains the leading jurisdiction for worldwide freezing orders and disclosure applications in crypto-recovery matters – the courts there have well-established jurisdiction over assets wherever situated, provided there is a sufficiently strong connection to the English proceedings.
Step 4: The disclosure order strategy – making the exchange reveal the account holder
Most on-chain theft routes funds through at least one centralized exchange before the attacker attempts to liquidate. That exchange holds KYC data. Obtaining that data is the hinge on which recovery turns. Two instruments are relevant: a Norwich Pharmacal order (a court order requiring a third party who is innocently mixed up in wrongdoing to disclose information about the wrongdoer) and a Bankers Trust order (a disclosure order against a financial institution holding the wrongdoer's account). Both originate in English law but are now applied – or their functional equivalents are applied – across many common-law and common-law-influenced forums including the DIFC Courts and Singapore.
In our practice, the fastest path to exchange disclosure usually runs through England and Wales when the exchange's registered office or principal place of business has a UK nexus. It runs through the DIFC Courts – whose disclosure jurisprudence has developed quickly, with orders in recent cross-border digital-asset matters – when the nexus is the UAE. Singapore courts have similarly issued proprietary injunctions and disclosure orders in crypto-fraud matters. The choice of forum for disclosure is not automatic: it depends on where the exchange holds its assets, where it is incorporated, and where service of process can be effected quickly.
A disclosure application typically requires the forensic report, a sealed letter of claim, and a short witness statement establishing the connection between the theft and the target exchange. Timing from filing to first-return hearing in English proceedings is typically a matter of days to a few weeks, depending on the complexity of the application and the urgency demonstrated. Do not treat this as a comfortable timeline: if the forensic report shows the funds are still static in the account, urgency is real but not yet critical. If the report shows the funds are moving, the application must go in the same day.
For a scoped assessment of your disclosure strategy, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the exchange, the wallet cluster, the jurisdictional nexus – change the analysis entirely.
Step 5: Stablecoin freeze requests – a parallel fast-track
If any portion of the stolen assets was converted to or is currently held as USDT (Tether) or USDC (Circle), a contract-level freeze by the issuer is potentially available without waiting for a full court order. Both Tether and Circle hold technical authority to blacklist specific wallet addresses on their respective blockchains, rendering the funds immovable. Issuers generally act on a law-enforcement request or an OFAC designation – though some have responded to urgent court orders in leading jurisdictions when the request arrives through appropriate legal channels.
This is not a guaranteed outcome. Issuers have their own internal processes. The request must arrive with: the relevant wallet addresses, the transaction hashes demonstrating the fraud, a law-enforcement case reference or court order, and a professional attestation of the forensic analysis. Speed is critical. Once a blacklisted address is identified by the attacker, funds can be bridged or swapped to a non-blacklistable token in minutes. The window for a stablecoin freeze is typically shorter than the window for an exchange disclosure order.
We have seen cases where a well-prepared freeze packet – forensic report, law-enforcement reference, and a draft court order in progress – was sufficient to trigger an issuer's internal review within hours. We have also seen cases where funds were converted and dispersed before the packet reached the right desk. The margin between those outcomes is preparation, not luck.
Step 6: Cross-border enforcement of a Georgian judgment
Assuming proceedings in Georgia result in a judgment – whether a provisional freezing measure or a final award – the next question is enforcement outside the country. Georgia is a party to a number of bilateral and multilateral treaties on judicial cooperation, but enforcement of Georgian civil judgments abroad is not automatic and varies by jurisdiction. For enforcement in EU member states, the standard EU mutual-recognition instruments are not available to Georgia as a non-member. Enforcement through common-law routes in England, Singapore or Hong Kong requires a separate recognition proceeding under those courts' general jurisdiction to enforce foreign money judgments.
This is one reason why practitioners experienced in Georgian crypto-recovery matters often prefer to anchor the freezing and disclosure relief in a foreign forum from the outset – using the Georgian criminal proceedings as supporting evidence – rather than running the primary relief in Tbilisi and then attempting to enforce abroad. The structure depends heavily on where the assets are and where the defendants can be found or served.
Operators we advise in cross-border recovery work have consistently found that a bifurcated structure – Georgian criminal complaint plus English or Singaporean civil relief – moves faster and reaches further than either track alone. Allied counsel in the relevant jurisdiction handle the foreign filings; we coordinate the strategy and the evidence package from the outset.
Step 7: What could go wrong – the mistakes that end recoveries
A common assumption is that once funds leave the wallet, nothing can be done. That is not correct. The on-chain record is permanent. Exchange KYC data does not disappear. What does disappear – fast – is the window during which a freeze is feasible before the attacker moves the funds again. The mistakes that kill recoveries are well-documented from our cross-border practice and fall into a predictable pattern.
The first mistake is delay. Businesses that route a crypto-fraud report through their standard incident-response process – IT ticket, internal escalation, CFO approval, outside counsel engagement – lose two to five business days. That is often the entire recovery window. The engagement protocol for a digital-asset theft must be pre-set: the moment a suspicious outbound transaction is detected, the recovery clock starts and outside counsel is notified in parallel with internal response.
The second mistake is DIY chain analysis. An internal trace using a free block explorer is not a forensic report. Courts will not act on it. Exchanges will not act on it. Stablecoin issuers will not act on it. A professional forensic report, produced by a recognized analytics provider, is mandatory. It is also not expensive relative to the asset values typically at stake.
The third mistake is notifying the attacker. Sending a demand to the wallet address, posting about the theft on social media, or contacting the exchange through a customer-service channel (which the attacker may monitor) alerts the thief and triggers movement of the funds. Communications should be controlled and directed exclusively through legal channels until a freeze is in place.
In a recent recovery matter, a trading company discovered an unauthorized withdrawal of a seven-figure stablecoin balance late on a Thursday evening. The forensic report was commissioned by Friday morning, a criminal complaint was filed in the relevant jurisdiction by Friday afternoon, and a disclosure application was before a court in a leading common-law forum by the following Monday. The funds were frozen before the attacker's withdrawal request reached settlement on the destination exchange. The outcome was not certain at any stage, but preparation made each step possible.
The decision point: when do you need cross-border counsel?
Not every digital-asset dispute requires a multi-jurisdictional recovery structure. The decision turns on a clear set of factors. If the theft is small, the costs of a forensic report plus a multi-forum court application may not be proportionate. A rough proportionality analysis should happen in the first conversation with counsel, not after weeks of preliminary work.
If the amount is material, the profile of likely recovery is as follows. Where the funds remain on a Georgian or regionally-registered exchange – and the exchange is cooperative – a Georgian court provisional measure and a compliance-channel demand may be sufficient. Where the funds have moved to a major international exchange, a parallel foreign disclosure application is almost certainly necessary. Where the funds have been converted to stablecoins and are sitting in a hot wallet, a stablecoin freeze request is the first call. Where the funds have been layered through multiple wallets and bridges, the forensic trace is the critical first step and the forum strategy follows from where the funds have come to rest.
Profile A: Funds on a Georgian exchange, identifiable attacker, amount above a sensible litigation threshold – Georgian provisional measure plus compliance demand; timeline measured in days to two weeks.
Profile B: Funds on an international exchange, attacker unknown, disclosure needed – Georgian criminal complaint plus foreign disclosure application; timeline measured in weeks to a small number of months from filing to first result.
Profile C: Stablecoin balance in a wallet the attacker controls – freeze-packet preparation and issuer engagement as the first priority, running alongside court proceedings; timeline measured in hours to days for the freeze attempt.
If a recovery clock is running, reach our disputes desk now at info@oboluslaw.com. If a prior application stalled or an account was closed without explanation, a second read of the structure can surface the reason and the route forward.
Related at OBOLUS
- Disputes and asset recovery for digital-asset businesses – the full practice overview: forums, instruments and the recovery process end to end.
- Smart contract dispute resolution in Liechtenstein – how Liechtenstein's token act shapes on-chain dispute outcomes.
- Regulator AML audit defence for institutional clients – preparing for supervisory scrutiny on AML and Travel Rule compliance.
FAQ
Can stolen crypto actually be recovered?
Yes, in a meaningful proportion of cases where action is taken quickly. The on-chain record is permanent: stolen funds leave a traceable path. Where those funds reach a centralized exchange, forensic analysis combined with a disclosure order can identify the account holder. Where funds are held as a major stablecoin, a contract-level freeze by the issuer may be available. Recovery is not guaranteed, but the probability rises sharply with preparation and speed of response.
How fast must I act after a digital-asset theft?
The first two to four hours are the most critical. The attacker's ability to move funds, swap tokens, or withdraw from an exchange is technically possible at any moment. A forensic report should be commissioned within hours. A criminal complaint and exchange notification should follow within the first business day. A court application for a freezing or disclosure order should be prepared in parallel. Every day of delay reduces the probability of a successful freeze.
Can a court freeze assets held on an exchange?
Yes. Courts in England and Wales, Singapore, Hong Kong and the DIFC have all issued freezing orders and disclosure orders in respect of assets held on centralized exchanges. The exchange holds the assets as a custodian; the court can order it not to release them and to disclose the account holder's identity. The application requires a forensic report, evidence of the theft, and a showing of urgency. Georgian courts can issue provisional measures domestically; foreign relief is pursued in the relevant forum.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance structures that sit around them. Digital assets are the whole of our practice. In our recovery work, we move for freezing relief and exchange disclosure while the forensic trail is live – not after the window has closed. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialist in cross-border digital-asset recovery, freezing orders and multi-forum disclosure strategy.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.