On-chain asset tracing in Ireland is governed by a mature common-law property regime that treats digital assets as capable of ownership – and, therefore, as capable of being frozen, disclosed and recovered through the Irish courts. When a business suffers a crypto theft or misappropriation, the question is not whether the law provides a remedy. The question is whether the victim moves fast enough to use it. This guide sets out the step-by-step process: from the first on-chain trace through to freezing relief and enforcement, with the cross-border considerations a general counsel must manage from day one.
Why Ireland Matters for Digital-Asset Recovery
Ireland is a credible forum for on-chain asset recovery because its courts apply established common-law principles – the same property-law logic that underpins English-jurisdiction crypto litigation – and sit inside the EU enforcement architecture. The Irish High Court has jurisdiction to grant Mareva injunctions (interlocutory orders that freeze a respondent's assets pending trial) and Norwich Pharmacal orders (orders compelling third parties, including exchanges, to disclose identity and transaction data). Those tools are precisely what a digital-asset recovery requires.
Ireland's EU membership matters equally. A freezing order made in the Irish courts can, in the right circumstances, be recognized across EU member states. For a crypto-fraud victim whose counterparty holds assets in multiple European jurisdictions, that reach is material. In our cross-border practice, we regularly advise businesses that choose Ireland as the lead forum precisely because of this combination: common-law procedural flexibility and EU enforcement width.
The Irish courts apply common-law property principles to digital assets, treating them as property capable of being the subject of injunctive relief. No bespoke crypto statute is needed for that analysis; the legal basis already exists. What the victim needs is speed, on-chain evidence and legal counsel that can translate forensic data into a court-ready application.
Step 1: Secure the On-chain Evidence Before Anything Else
The first action after a digital-asset misappropriation is not a legal filing – it is evidence preservation, and it must happen within hours. Blockchain transactions are permanent; the record of a theft does not disappear. But the assets move fast, and every hop through a wallet or exchange compresses the recovery window. Securing the on-chain evidence means capturing transaction hashes, wallet addresses, timestamps and any chain-of-custody documentation for the relevant wallets.
In practice, this means engaging a professional forensic partner immediately. We work alongside forensic partners – firms that use tools deployed by market-leading blockchain analytics providers – to convert on-chain data into a timestamped chain-of-custody report. That report becomes the evidential backbone of every subsequent legal step: the application to the court, the request to an exchange, and any law-enforcement referral.
A common mistake at this stage is for in-house teams to attempt their own on-chain analysis using free block explorers, without generating a signed, professionally attributed report. An unsigned analysis has limited weight before a court. A forensic report prepared by a credentialed analytics firm is the foundation of a successful disclosure application in the Irish courts and in any parallel forum.
The cross-border note is critical here: if the stolen assets have already moved through a non-Irish exchange, the forensic report must trace the full path across chains and across custodians. The Irish courts will consider evidence of assets held abroad when granting interlocutory relief; but the evidence must show the connection.
Step 2: Assess the Legal Basis for Irish Court Jurisdiction
The Irish High Court has jurisdiction where the defendant is located in Ireland, where assets subject to the claim are within the jurisdiction, or where there is a sufficient connection between the dispute and Ireland. For crypto disputes, the "assets within the jurisdiction" limb is often satisfied where a wallet or exchange account is accessible in Ireland or where the defendant is Irish-domiciled. EU rules on jurisdiction – the Brussels Ibis Regulation framework – also apply where the defendant is EU-domiciled, which may channel the matter to or from Ireland depending on the facts.
In our practice, the jurisdictional analysis frequently runs in parallel with the forensic trace. We assess three questions simultaneously: where the respondent or the assets can be reached; which forum has the strongest enforcement path; and whether a parallel application in another common-law jurisdiction – England and Wales, Singapore or the DIFC Courts – is warranted alongside or instead of the Irish proceeding.
Operators we advise routinely underestimate the jurisdictional question. The assumption is that the theft "happened online" and therefore no single court has authority. That is wrong. The Brussels Ibis framework and common-law long-arm principles give the Irish courts real reach, provided the facts are properly mapped before the application is filed. A jurisdictional deficiency identified at the hearing stage wastes days that the recovery window cannot afford.
Step 3: Apply for a Mareva Injunction to Freeze Assets
A Mareva injunction – the Irish courts' interlocutory asset-freeze – can be sought on an ex parte basis (without notice to the defendant) where there is a real risk that assets will be dissipated if the respondent is alerted. In digital-asset cases, the dissipation risk is structural: a counterparty with wallet access can move funds in seconds. Ex parte Mareva applications in the Irish High Court are therefore appropriate in most crypto-fraud scenarios, provided the applicant can demonstrate a good arguable case and full and frank disclosure of all material facts.
The application requires an affidavit of urgency, a draft order, and the forensic evidence secured in Step 1. Timing matters: the court must be satisfied that delay would cause irreparable harm. The shorter the gap between misappropriation and application, the stronger that case. Courts are attuned to the velocity of digital-asset movement; we have seen judges acknowledge that hours, not days, define whether relief is still meaningful.
A Mareva order covering digital assets will typically identify the specific wallet addresses, exchange accounts or custodians holding the subject assets. It will restrain the defendant from dealing with those assets up to the value of the claim. If the defendant or custodian breaches the order, that is a contempt of court – a serious consequence in any EU common-law jurisdiction.
Mid-page note for counsel meeting this situation for the first time: the process above describes the standard path. Your facts – the entity structure, the exchange involved, the chain the assets sit on – change the analysis materially. Map your options with the OBOLUS disputes desk before filing.
Step 4: Obtain a Norwich Pharmacal Order Against the Exchange
A Norwich Pharmacal order (NPO) compels a third party – including a crypto exchange – to disclose information that enables the applicant to identify a wrongdoer or trace assets. The exchange itself need not be the wrongdoer; the legal basis is that the exchange, by facilitating the transaction, has become innocently mixed up in the wrongdoing and is therefore obliged to assist the victim. Irish courts recognize and apply the Norwich Pharmacal jurisdiction inherited from English common law.
In a crypto-fraud context, an NPO directed at an exchange yields KYC (Know Your Customer) records, account identifiers, deposit and withdrawal histories, and any linked banking details. That information converts the on-chain pseudonymous trail into an identified natural person or corporate entity – the prerequisite for a civil claim or a law-enforcement referral. In our cross-border practice, we regularly work through allied counsel in the relevant jurisdiction when the exchange is domiciled outside Ireland, filing parallel disclosure applications to reach custodians in multiple jurisdictions simultaneously.
The grounds for an NPO: the applicant must show that the exchange has information necessary to enable the applicant to take action, that there is a real possibility that the information will establish the applicant's case, and that it is just and convenient to make the order. In a well-evidenced crypto case, with a professional forensic report and documented transaction trail, those grounds are usually met. Exchanges operating under VASP (virtual asset service provider) registration obligations – including those subject to the EU's Anti-Money Laundering directives – maintain the KYC records that an NPO unlocks.
Step 5: Engage the Issuer Freeze Mechanism Where Applicable
For stablecoin assets – particularly USDT (issued by Tether) and USDC (issued by Circle) – a parallel avenue exists that operates at the smart-contract level. Tether and Circle hold contract-level freeze authority over their issued tokens; they generally exercise that authority in response to a court order, a law-enforcement case reference, or an OFAC designation. Where the stolen assets are in USDT or USDC, an issuer freeze request is often the fastest route to preventing dissipation while the court process moves forward.
Engaging the issuer freeze requires specific documentation: the transaction hashes identifying the subject tokens, a professional forensic report, and – for an issuer acting without a court order – typically a law-enforcement case reference. The sequencing therefore matters: in many cases, a law-enforcement report is filed simultaneously with the court application, so that the issuer freeze request can be made as soon as the police reference number is available.
The cross-border dimension here is significant. Tether and Circle are not Irish entities. An Irish court order directed at them operates through recognition and through commercial cooperation, not through direct domestic enforcement. In our experience, coordinating the Irish court application with a request to allied counsel in the issuer's operative jurisdiction accelerates the issuer's response materially.
Step 6: Coordinate Law Enforcement and Parallel Civil Proceedings
Civil asset recovery and criminal investigation are not mutually exclusive. Filing a complaint with An Garda Síochána (Ireland's national police service) and with the Garda National Cyber Crime Bureau (GNCCB) serves two purposes: it establishes a formal record that supports the issuer freeze request, and it opens a channel for mutual legal assistance (MLA) requests if the assets or the wrongdoer are located abroad.
Operators we advise often ask whether the criminal route is faster than the civil. It is not. Law-enforcement timelines are measured in months; civil injunctive relief can be obtained in days. The two tracks run in parallel. The criminal report feeds the civil case by generating an official reference and, eventually, evidence obtained through police powers that the victim could not access independently. The civil case feeds the criminal investigation by producing court-ordered disclosure that identifies the wrongdoer.
The cross-border parallel-proceedings strategy is where the work becomes genuinely multi-jurisdictional. If the exchange holding the assets is in Singapore, a civil disclosure application before the Singapore courts may proceed alongside the Irish Mareva. The CFAAR network (Crypto Fraud and Asset Recovery network, launched in London in September 2021) provides a structure for coordinating across common-law forums. We map this multi-forum strategy at the outset, not as an afterthought once the Irish proceedings stall.
Step 7: Convert the Freeze Into Enforceable Recovery
A Mareva injunction preserves the position; it does not itself transfer assets back to the victim. Converting the freeze into actual recovery requires either a judgment on the underlying claim – obtained after proceedings on the merits – or a negotiated settlement reached while the freeze is in place. In practice, many crypto-fraud defendants settle once assets are frozen and their identity is disclosed: the cost-benefit of litigation shifts sharply once anonymity is lost.
Enforcement of an Irish judgment against assets held abroad depends on the jurisdiction. Within the EU, the Brussels Ibis framework enables relatively direct enforcement of Irish court judgments. Outside the EU – in the BVI, the Cayman Islands, Singapore or the UK – enforcement requires separate recognition proceedings, which allied counsel manages in the local forum. Timing this correctly – keeping the Mareva in force long enough to complete recognition – is a critical operational step.
The micro-matter below illustrates how this chain of steps works in practice.
In a recent cross-border recovery matter, a European-based payments business discovered that a substantial stablecoin balance had been misappropriated through a compromised key management process. We coordinated with allied counsel to secure an ex parte freezing order in the lead common-law forum while a parallel forensic report was filed with the relevant stablecoin issuer. The issuer froze the on-chain balance within days. The subsequent Norwich Pharmacal order against the exchange yielded full KYC records; the identified counterparty settled before trial, returning the majority of the balance. The entire process from incident to settlement took several months – fast by litigation standards, and only achievable because the forensic evidence was secured within the first 24 hours.
If a recovery clock is running, the OBOLUS disputes desk moves immediately. The bridge between a live forensic trail and a filed application is measured in hours. Reach the disputes desk now before the trail goes cold.
The Cross-border Stack: Tax, Banking and Regulatory Interaction
A recovery proceeding does not exist in isolation. Three ancillary areas routinely affect the strategy and the outcome.
Tax. Where recovered assets are returned to a corporate victim, the tax treatment of the receipt varies by jurisdiction. In Ireland, the interaction between corporation tax and the capital gains treatment of digital-asset recoveries is unsettled in certain edge cases. We engage tax counsel at the outset to ensure the recovery structure does not generate an unexpected liability on the returned funds.
Banking. Exchange accounts and custodian wallets involved in a recovery are often subject to account freezes or restrictions by the financial institution once a fraud report is filed. Coordinating with the victim's banking relationships to prevent collateral account restrictions – while maintaining the forensic chain of custody – is operational work that is easy to overlook under the pressure of a live incident.
Regulatory. If the victim is a regulated entity – a VASP, a payment institution or an e-money issuer – it may have regulatory notification obligations triggered by a material loss event. Under applicable AML/CFT provisions, suspicious transaction reports may also be required. Failure to notify promptly creates regulatory exposure alongside the loss. In our practice, we assess the regulatory notification question in the first hours alongside the forensic and legal steps.
Related at OBOLUS
- Disputes & Asset Recovery for Digital Asset Businesses – our full cross-forum recovery practice and the tools we deploy across 25+ jurisdictions.
- On-chain asset tracing in Gibraltar – the step-by-step guide for recovery proceedings anchored in Gibraltar's common-law courts.
- Crypto fund formation in France (AMF/PSAN) – structuring digital-asset funds under the French AMF regime for EU market access.
A Common Assumption Worth Correcting
A common assumption among businesses that have suffered a digital-asset theft is that once funds leave a wallet, nothing can be done – that the pseudonymous nature of blockchain makes recovery structurally impossible. That is wrong, and it costs victims the recovery window while they accept the loss as permanent.
The on-chain record is immutable. Every transaction is traceable. The challenge is not the evidence; it is the speed of the legal response. Courts in Ireland and in other leading common-law forums have consistently demonstrated willingness to grant urgent interlocutory relief in well-evidenced crypto-fraud cases. What fails is not the legal system. What fails is the gap between the discovery of the loss and the first call to counsel.
In our practice, businesses that act within the first 24 hours have materially better recovery outcomes than those that wait. The forensic trail is live. The assets are traceable. The issuer freeze window is open. Every hour that passes without a legal response is an hour the counterparty uses to obscure the trail.
FAQ
Can stolen crypto actually be recovered?
Yes – recovery is possible in well-documented cases where action is taken quickly. On-chain forensics can trace digital assets across wallets and exchanges. Irish courts can issue freezing orders and Norwich Pharmacal disclosure orders. Stablecoin issuers such as Tether and Circle hold contract-level freeze authority. Outcomes depend on speed, evidence quality and the jurisdiction where assets come to rest; no outcome can be guaranteed, but the legal tools exist and courts use them.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows for misappropriated digital assets are measured in hours, not weeks. The forensic report must be initiated within the first day. An ex parte Mareva application can be filed within days of instruction where the evidence is ready. Stablecoin issuer freeze requests can be processed in days once the supporting documentation – transaction hashes, a forensic report, and where required a law-enforcement reference – is assembled and submitted.
Can a court freeze assets held on an exchange?
Yes. An Irish court Mareva injunction can extend to assets held in an identified exchange account. A Norwich Pharmacal order can compel the exchange to disclose account-holder information and transaction records. Where the exchange is domiciled outside Ireland, parallel proceedings through allied counsel in the exchange's jurisdiction are typically required. The exchange's own VASP registration obligations – requiring it to maintain KYC records – underpin the disclosure that makes identification possible.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We move for freezing relief and exchange disclosure while the trail is live – working alongside forensic partners to convert on-chain evidence into court-ready disclosure applications. To discuss a live matter or a recovery strategy, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialising in cross-forum on-chain asset tracing, freezing relief and coordinated civil and regulatory recovery for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.