On-chain asset tracing – the process of following a stolen or misappropriated digital asset across blockchain addresses and through intermediaries – is now a defined legal practice in Gibraltar. The Gibraltar Financial Services Commission (GFSC) regulates distributed ledger technology (DLT) providers under one of the earliest purpose-built crypto regimes in any common-law jurisdiction, giving claimants a coherent regulatory backdrop against which to seek emergency court relief. When funds disappear from a Gibraltar-regulated exchange, or move through one, the clock starts immediately.
This guide sets out each step of a Gibraltar on-chain tracing and recovery matter, from the first forensic capture through to enforcement. It is written for general counsel, CFOs and founders who need to understand the process before they engage local counsel – and to understand why speed is the deciding variable in every case.
Why Gibraltar's Legal Regime Matters for On-chain Recovery
Gibraltar's DLT Provider framework, administered by the Gibraltar Financial Services Commission, was among the first statutory crypto-specific regimes in the common-law world. That early infrastructure matters for recovery: regulated DLT providers in Gibraltar operate under licensing conditions that include record-keeping, AML compliance and cooperation with competent authorities. A claimant pursuing traced funds through a Gibraltar-registered entity has a clear legal basis to compel disclosure. Gibraltar's Supreme Court applies English common-law principles, which means the full canon of English crypto-recovery tools – worldwide freezing orders, Norwich Pharmacal disclosure orders and proprietary injunctions – is available here. That combination of regulatory architecture and common-law courts makes Gibraltar a functional recovery forum when the asset trail passes through it.
The cross-border reality is that most on-chain theft does not stay within a single jurisdiction. A victim's wallet may sit in one country; the exchange that received the stolen funds may hold a Gibraltar DLT licence; the beneficial owner of the destination address may bank elsewhere. Gibraltar's courts have the procedural tools to reach across those layers – but only if the claimant acts while the trace is live and the funds are still traceable to a specific address or intermediary account.
Step 1 – Immediate Forensic Capture of the Transaction Trail
The first legal step in any on-chain tracing matter is locking the blockchain evidence before it can be obscured, mixed or moved through a privacy protocol. Within hours of discovering a theft or misappropriation, a qualified blockchain forensics team should map every hop from the originating address – transaction hashes, timestamps, receiving addresses, estimated exchange deposit addresses and any chain-bridge movements. This record becomes the evidential foundation for every court application that follows.
In our cross-border practice, we engage specialist forensics partners immediately on instruction, generating a professional report that is formatted for court use. That report must identify the theft address, the movement path, and – where possible – a named or attributable intermediary such as a regulated exchange. Without it, a Gibraltar court cannot issue targeted disclosure relief. The more hops the funds have taken, the harder the trace; in our experience, matters where forensics begin within hours of the incident consistently yield better outcomes than those where the victim waits for internal investigation to conclude.
Common mistake at this step: relying on internal IT records rather than an independent blockchain forensics report. Courts expect a professionally produced trace, not a screenshot from an internal dashboard.
Step 2 – Identify the Legal Basis for Relief in Gibraltar
Gibraltar's Supreme Court can grant emergency relief on three principal bases in a crypto-asset recovery matter: a worldwide freezing order (an injunction preventing disposal of assets globally), a Norwich Pharmacal order (compelling a third party who has become innocently mixed up in wrongdoing to disclose information), and a proprietary injunction (asserting a continuing property right over the traced funds). Each instrument has distinct requirements, and choosing the right one – or combining them – is a decision that shapes the entire matter.
A worldwide freezing order requires evidence of a good arguable case, a real risk of dissipation and assets within or connected to the jurisdiction. Gibraltar courts have accepted Bitcoin, Ether and stablecoins as property capable of being the subject of a proprietary claim, consistent with the English common-law position established in leading English decisions. A Norwich Pharmacal order, by contrast, requires only that the respondent – typically a Gibraltar DLT provider or exchange – holds information necessary to identify the wrongdoer or trace the asset. It does not require the respondent to be a defendant.
Where the funds are held in USDT or USDC, a parallel application to Tether or Circle for an issuer-level freeze may be possible. Both issuers hold contract-level blacklist authority over their tokens. They generally act on receipt of a law-enforcement case reference or a court order, which means securing relief from the Gibraltar court first substantially strengthens the freeze application.
Cross-border note: if the destination exchange is not Gibraltar-regulated but holds assets that can be frozen by a Gibraltar order, allied counsel in the relevant jurisdiction must be instructed in parallel. A worldwide freezing order granted by Gibraltar's Supreme Court carries persuasive weight in other common-law forums, including England and Wales.
Step 3 – Making the Emergency Court Application
Emergency applications in Gibraltar – for freezing or disclosure relief – are made without notice to the respondent (ex parte) where delay would defeat the purpose. The application bundle typically includes the forensic trace report, a witness statement from the claimant, a draft order and a legal memorandum addressing the legal tests. In our practice, we work with allied counsel in Gibraltar to structure application bundles that address the court's specific requirements under Gibraltar procedural rules and under the analogous English authorities the Supreme Court routinely applies.
Timing is the critical variable here. A court will ask whether the applicant moved promptly. Delay between discovery of the theft and the application weakens the dissipation argument. Where the forensics team has confirmed that assets remain traceable to an address held at an identified exchange, the application can – and should – be made within days of the incident.
An anonymized matter illustrates the sequence. In a recent recovery instruction, a payments company had stablecoins misappropriated through a compromised API key. The funds moved across two blockchains before arriving at an address attributed, via forensics, to a regulated entity operating in a common-law jurisdiction. We structured the disclosure application, coordinated the forensics report format for the court bundle, and the exchange received the order before the funds had cleared a withdrawal queue. The balance was frozen at the intermediary level pending the substantive claim. No specific sum is given – the matter involved a balance material to the client's operations.
To initiate a tracing matter or assess whether your facts support an emergency application, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the chain, the intermediary – change the analysis materially. Map your options.
Step 4 – Disclosure Orders Against Regulated DLT Providers
A Gibraltar-registered DLT provider is subject to the GFSC's supervisory framework, which includes KYC and AML record-keeping obligations. That means it holds information – identity documents, account records and transaction logs – that a claimant needs to connect a blockchain address to a named individual or entity. A Bankers Trust order (an order compelling an institution to disclose information about a customer's account to assist a defrauded claimant) is the instrument most commonly used alongside or following a freezing order.
In practice, once a freezing or Norwich Pharmacal order is served, the regulated DLT provider has a legal obligation to comply and a professional obligation under its GFSC licence conditions to cooperate with competent legal process. The disclosure typically yields the account holder's identity and verification documents, the transaction history, and any withdrawal instructions pending at the time of service. That package enables the claimant to name a defendant and move from an emergency injunction to a substantive proprietary claim.
Common mistake at this step: serving a demand letter rather than a court order. A regulated exchange's compliance team can – and routinely will – decline to disclose customer information on demand, citing data protection. A court order removes that obstacle.
Step 5 – Cross-border Enforcement and Multi-forum Coordination
Crypto-asset theft is structurally multi-jurisdictional. The chain-trace may pass through a Gibraltar entity, but the beneficial owner may sit in a different country, and further asset movements may occur on exchanges in Singapore, the UAE or the British Virgin Islands. A Gibraltar order is not self-executing in those forums. Enforcement requires allied counsel in each relevant seat to mirror or recognize the Gibraltar relief.
England and Wales remains the leading forum for crypto asset recovery globally. A Gibraltar freezing order, if the facts support it, can be mirrored in England under the well-developed English disclosure and freezing jurisdiction, using the CFAAR (Crypto Fraud and Asset Recovery) network – launched in London in September 2021 – as a coordination channel. Singapore and Hong Kong are also active recovery forums with their own proprietary injunction jurisprudence. Where the BVI is in the chain – common in structures involving fund vehicles – a parallel BVI application may run concurrently.
The cross-border cost of coordination is real. In our practice, we structure multi-forum matters so that Gibraltar anchors the trace and issues the initial disclosure order, with allied counsel in secondary forums receiving the order and the forensics package simultaneously. This parallel approach compresses the timeline and prevents asset movement between service of orders in different seats.
Step 6 – From Injunction to Substantive Claim and Recovery
A freezing order and a disclosure order are interim measures, not final recovery. The substantive claim – typically a proprietary claim asserting that the stolen asset or its traceable substitute remains the claimant's property, or a claim in unjust enrichment against the recipient – must follow. In Gibraltar, the limitation and procedure for pursuing such a claim track closely to English common law. The named defendant, identified through the disclosure process, is served with the substantive proceedings while the freezing order remains in place.
Settlement is the most common resolution in crypto recovery matters where the freeze is effective. A defendant whose assets are frozen and whose identity has been disclosed faces significant pressure to negotiate. The claimant's counsel uses the forensic trace and the disclosure package to quantify the claim and demonstrate that the asset is traceable. We have seen matters resolve at this stage – before any trial – once the defendant understands the strength of the evidential position.
Where settlement does not occur, Gibraltar's Supreme Court can grant final judgment and enforcement orders. If the recovered asset is a stablecoin that has been frozen at issuer level, the issuer can redirect the blacklisted balance to a court-designated address on receipt of a court order. For other tokens, enforcement follows the order of the court.
If a prior recovery attempt stalled – or if a freeze application was refused – contact OBOLUS at info@oboluslaw.com. A second read of the facts can surface the structural reason and the route forward. Map your options.
Common Assumptions That Cost Claimants Recovery
A common assumption among business victims of crypto fraud is that once funds leave the wallet, nothing can be done. That assumption is incorrect – and in our practice, it is the most expensive mistake a victim can make, because acting on it causes the delay that makes the assumption self-fulfilling.
Blockchain transactions are irreversible at the protocol level. But the legal ability to recover does not depend on reversing the transaction. It depends on (a) tracing the asset to an identifiable intermediary or address, (b) securing a court order before the asset is moved further or withdrawn, and (c) obtaining disclosure that names the defendant. All three are achievable – but each becomes harder with every hour that passes. Operators we advise routinely underestimate how quickly assets move through exchange deposit addresses; withdrawal queues, compliance holds and block confirmation windows are the recovery window, and they are measured in hours.
A second common assumption is that the DLT provider's regulatory status is irrelevant to recovery. In fact, Gibraltar's GFSC licensing regime is a direct asset to the claimant: it means the exchange holds verified KYC data, operates under record-keeping obligations and has a professional incentive to comply with legal process promptly. The regulatory infrastructure is the claimant's ally.
Decision Point: When Does a Gibraltar Tracing Matter Make Sense?
Not every on-chain misappropriation is best anchored in Gibraltar. The decision turns on where the funds have moved and where the regulated intermediary sits.
Profile A: Funds have moved to an address attributed to a Gibraltar-registered DLT provider or exchange. This is the clearest case for a Gibraltar-primary matter. The GFSC regime gives the court a direct line to the intermediary; the Supreme Court can grant disclosure and freezing relief on an emergency basis; and the common-law forum is well-suited to the subsequent substantive claim. Timeline from instruction to service of a freezing order is typically a matter of days, not weeks, where the forensics package is ready.
Profile B: Funds have passed through a Gibraltar entity but have moved on to another jurisdiction before instruction. Here, Gibraltar may still be the right forum for the initial disclosure order – particularly if the Gibraltar entity holds the KYC record that names the next-step recipient. A Gibraltar order, paired with a parallel application in the secondary forum, gives the claimant the best chance of intercepting the asset before further movement.
Profile C: No Gibraltar nexus, but the asset trail runs through an English common-law forum, the BVI or another comparable jurisdiction. In this profile, Gibraltar is not the primary forum. England and Wales, Singapore or Hong Kong may be more efficient anchors. We assess the forum question as the first step on every instruction – before any application is drafted.
Regulators in the leading hubs increasingly expect DLT providers to maintain robust cooperation protocols for legal process. That posture is visible in the GFSC's supervisory approach and strengthens the claimant's hand when a court order is served.
Related at OBOLUS
- Disputes & Asset Recovery for Digital Asset Businesses – our full cross-border recovery practice, from freezing orders to enforcement
- Stablecoin Freeze Requests in the British Virgin Islands – how to pursue issuer-level and court-ordered stablecoin freezes through the BVI
- Payment Institution Licensing in Turkey – structuring licensed payment and crypto activity for the Turkish market
FAQ
Can stolen crypto actually be recovered?
Recovery is legally possible when the asset trail can be traced to an identifiable intermediary and court relief is obtained before the funds move further. Blockchain transactions are irreversible at the protocol level, but a court can compel disclosure of the recipient's identity, freeze assets held at a regulated exchange and order the return of the traceable equivalent. Success depends heavily on how quickly the claimant acts after the theft is discovered.
How fast must I act after a digital-asset theft?
Speed is the decisive variable. Withdrawal queues, compliance holds and block confirmation windows create a short window – often hours to a day – in which a freezing or disclosure application can intercept assets before they are moved further. In our practice, we treat the first twenty-four hours as the critical period: forensics should begin within hours, and an application should be filed as soon as a regulated intermediary is identified on the trace. Delay weakens the dissipation argument before the court and reduces the probability of an effective freeze.
Can a court freeze assets held on an exchange?
Yes. Gibraltar's Supreme Court can grant a worldwide freezing order and a disclosure order against a regulated DLT provider or exchange where the legal tests are met: a good arguable case, a real risk of dissipation, and evidence connecting the exchange to the misappropriated funds. A Gibraltar-registered DLT provider operates under GFSC licensing conditions that include cooperation with legal process, which supports prompt compliance once a court order is served. Stablecoin balances may also be frozen at issuer level on receipt of a court order or law-enforcement designation.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. Operators we advise rely on our cross-border disputes team to move for freezing relief and exchange disclosure while the forensic trail is live. To discuss a recovery matter, contact info@oboluslaw.com or reach us at t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specialising in on-chain asset tracing, cross-border freezing orders and multi-forum crypto recovery for business claimants.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.