Recovery windows for misappropriated digital assets are measured in hours, not weeks. When a Lithuanian-seated business or a foreign operator with counterparty exposure in Lithuania discovers that digital assets have been moved without authorization, the first legal instrument to reach for is a worldwide freezing order (a court order prohibiting a respondent from dealing with assets anywhere in the world). Lithuanian courts have the jurisdiction and the procedural tools to grant interim injunctive relief on an expedited basis, and the cross-border reach of such relief – recognized across the EU under the Brussels I Recast Regulation and respected in major common-law forums through comity – makes Lithuania a credible seat for launching a multi-forum recovery action.
This guide walks through each step of the process: from the first hours after discovery through to enforcement, exchange disclosure, and the interaction with on-chain forensics. It addresses the cross-border dimension at every stage, because digital-asset theft rarely respects a single border.
What is a worldwide freezing order, and does Lithuanian law recognize one?
A worldwide freezing order is an interim court injunction that prohibits a named respondent – or, in appropriate cases, persons unknown – from disposing of, diminishing, or otherwise dealing with assets up to a defined value, regardless of where those assets are held. Lithuanian civil procedure, operating within the EU legal order, empowers courts to grant such interim measures in support of substantive claims. The Civil Procedure Code provides for interim measures (laikinojo apsaugos priemonės), which courts may issue before or after proceedings are commenced, and the Brussels I Recast Regulation gives orders made by a Lithuanian court automatic enforceability across EU member states without a separate exequatur process. For enforcement beyond the EU, Lithuanian judgments and orders travel through bilateral recognition channels and, in common-law jurisdictions, through the principle of comity.
In the digital-asset context, the asset in question need not be held in Lithuania. The connection point is either the respondent's presence or domicile, the location of an intermediary such as an exchange, or the governing law of the underlying contract. Courts across the EU have accepted that crypto-assets constitute property capable of being the subject of proprietary injunctions. The principle is reinforced by the growing body of common-law authority – including AA v Persons Unknown [2019] in England and the recognition of cryptocurrency as property in Hong Kong's Re Gatecoin [2023] HKCFI 914 – and Lithuanian courts look to that developing jurisprudence in the absence of local precedent directly on point.
The critical point: the order freezes the respondent's dealing capacity. It does not, by itself, compel an exchange or custodian to immobilize balances. A parallel application for a disclosure order – compelling the exchange to identify the account holder and freeze the balance pending further order – is typically filed simultaneously.
In our cross-border practice, we regularly advise clients who discover misappropriation in one time zone and need to file for interim relief in Lithuania before the funds move again. The first call should be about the asset trail, not the jurisdiction.
For a scoped assessment of your recovery position, contact OBOLUS at info@oboluslaw.com. The process described above is the standard architecture. Your facts – the entity, the asset type, the exchange, the suspect's location – determine which steps move fastest. Map your options.
Step 1 – Secure evidence and commission on-chain tracing before anything else
Before filing any application, the recovery team must preserve and package the evidentiary foundation, because Lithuanian courts require applicants to demonstrate a good arguable case and the risk of dissipation. In a digital-asset matter, that means assembling three categories of material within the first hours.
First, transaction records: wallet addresses, transaction hashes, block explorer screenshots with timestamps, and any off-chain correspondence that identifies the movement. These records are immutable on-chain, but they need to be captured in a court-ready format before they are presented. Second, a professional forensic report from a recognized blockchain analytics provider tracing the funds through intermediate wallets and, where possible, to an identified exchange deposit address. The report serves two functions: it supports the good-arguable-case threshold for the freezing application, and it gives the exchange a traceable address to match against its own KYC records when a disclosure order arrives. Third, any KYC or counterparty-identification material already in the applicant's possession – onboarding documents, email addresses, IP logs.
The Travel Rule (the obligation, under FATF Recommendation 15 and applicable EU AML rules, to pass originator and beneficiary data with a transfer) means that regulated exchanges in Lithuania and across the EU will hold originator data on incoming transfers above the applicable threshold. A properly framed disclosure application can compel production of that data.
Common mistake at this step: applicants wait for internal sign-off before commissioning forensics. Every hour of delay allows the respondent to move funds to a further wallet, convert to a privacy coin, or withdraw through a peer-to-peer channel. The forensic commission and the legal instruction should run in parallel from the moment of discovery.
Step 2 – Identify the correct Lithuanian court and ground jurisdiction
The competent court for interim measures in Lithuania is determined by the location of the claim's substantive connection: the respondent's domicile, the place of performance of the breached obligation, or the location of the relevant assets or intermediary. For most digital-asset recovery matters with a Lithuanian dimension, this will be the Regional Court (Apygardos teismas) in Vilnius, which handles civil and commercial matters above the threshold amount and has the broadest familiarity with cross-border interim relief.
Where the respondent's identity is not yet known – a common scenario when funds have been moved by a pseudonymous actor – the applicant may seek relief against persons unknown, a procedural device recognized in EU practice and directly adopted from the English-law model developed in cases such as AA v Persons Unknown. The application names the wallet address or the exchange account as the identifier and seeks both the freezing order and a disclosure order compelling the exchange to identify the account holder.
Jurisdiction can also be grounded in the Brussels I Recast Regulation where the matter has a cross-border EU dimension – for example, where the applicant is seated in one member state and the exchange or respondent is in another. Lithuania, as an EU member state, applies the Regulation directly, and a Lithuanian court order granted under the Regulation benefits from automatic recognition across the EU without re-litigation of the merits.
For matters involving a respondent or exchange outside the EU, jurisdiction must be established under Lithuanian private international law and the domestic Civil Procedure Code. In our practice, we assess that question on the specific facts before filing, because a jurisdictionally defective application wastes the most valuable commodity: time.
Step 3 – Prepare and file the without-notice (ex parte) application
A worldwide freezing order in a digital-asset matter is almost always sought without notice to the respondent. Advance notice would defeat the purpose: a respondent aware of an impending freeze can, within minutes, move assets to a fresh wallet or withdraw through an unregulated channel. Lithuanian procedural law permits without-notice interim applications where the applicant demonstrates urgency and the risk that prior notice would prejudice the relief sought.
The application package requires: a formal petition to the court setting out the legal basis and the factual matrix; a sworn statement from the applicant or an authorized officer establishing the good-arguable-case threshold and the risk of dissipation; the forensic tracing report; supporting transaction evidence; and, in most cases, security for the respondent's costs in the event the order is later discharged or the claim fails. The security requirement is set by the court and varies with the scale of the claim – it is not fixed by statute and is assessed on a case-by-case basis.
Common mistake at this step: applicants underestimate the risk-of-dissipation element. Courts are reluctant to grant without-notice relief unless the applicant can point to specific conduct – rapid multi-hop transfers, conversion to privacy assets, movement toward an unregulated exchange – that evidences the risk. The forensic report must speak directly to this point.
Once filed, the court may hear the application the same day or within a matter of days for urgent matters. The timeline from filing to an initial hearing is typically short in the Lithuanian commercial court system for properly framed urgent applications, though this depends on the court's docket and the completeness of the application package. We do not state a specific number of days here because the timeline varies with the court's capacity and the complexity of the facts.
Step 4 – Serve the order and notify exchanges and custodians
Once the order is granted, the priority is execution: the order must reach the exchanges and custodians holding the identified funds before the respondent can move them. This step operates on two tracks simultaneously.
On the exchange track: most centralized exchanges (CEXs) operating in Lithuania or across the EU are registered or licensed VASPs subject to the Bank of Lithuania's supervision or, from MiCA's full application, to CASP authorization requirements. These entities are legally obligated to comply with a valid court order. The order is served on the exchange's legal or compliance team with a cover letter identifying the specific wallet address, account identifier, or transaction hash at issue. Many exchanges have established compliance intake channels for law enforcement and court orders. Tether (USDT) and Circle (USDC), as stablecoin issuers, also hold contract-level freeze authority over their issued tokens and generally act on a court order or law-enforcement designation – a parallel notice to the issuer's compliance desk, citing the court order, can result in a token-level freeze of identified USDT or USDC balances.
On the EU enforcement track: the Brussels I Recast Regulation means the order can be served on parties in other EU member states without a separate recognition procedure. An exchange or custodian seated in, say, Germany or Estonia that receives a copy of a Lithuanian court order and the relevant EU certificate must treat it as enforceable. For exchanges outside the EU, enforcement is through private international law channels and, in common-law jurisdictions, through local counsel applying to have the order recognized and enforced domestically.
In our cross-border practice, we coordinate with allied counsel in the relevant jurisdiction to execute the enforcement step in parallel with the primary Lithuanian proceedings. A freeze that arrives at one exchange while the respondent's balance is already moving through a second exchange in a different country is only a partial success.
If a prior application stalled or an exchange declined to act on an order, a second read can surface the structural reason and the route back. Write to info@oboluslaw.com or t.me/oboluslaw. Map your options.
Step 5 – Obtain a disclosure order and identify the respondent
A freezing order immobilizes assets. A disclosure order compels the exchange or custodian to produce KYC documentation, account records, and transaction history identifying the account holder behind the wallet address. Together, these two instruments are the foundation of a successful recovery.
In Lithuania, the procedural basis for compelling third-party disclosure is established in the Civil Procedure Code's provisions on evidence and, in appropriate cases, through the court's general powers to make orders necessary to give effect to its interim relief. The equivalent instrument in English law – the Norwich Pharmacal order (a disclosure order against an innocent third party that has become mixed up in wrongdoing) – provides a model that is persuasive in EU courts grappling with the same fact pattern.
The exchange, once served with a disclosure order, must produce the relevant records within the time fixed by the court. In practice, exchanges that operate KYC programs compliant with the Bank of Lithuania's requirements or MiCA's CASP obligations will hold: government-issued identification, proof of address, IP address logs, and, in many cases, connected payment account details. This information allows the applicant to identify and serve the respondent, grounding the substantive claim in a named defendant rather than a pseudonymous wallet address.
Where the exchange is non-EU-seated and resists compliance, the disclosure application may need to be mirrored in the exchange's home jurisdiction. This is the step where allied counsel in the relevant jurisdiction becomes essential.
In a recent recovery matter, a digital-asset trading business discovered a series of unauthorized withdrawals during a weekend settlement window. We secured a without-notice freezing order from a competent civil court and, simultaneously, a disclosure order against the exchange where the funds had been deposited. The exchange produced KYC records within the period fixed by the court, identifying the account holder. The funds – a seven-figure USDT balance – remained frozen while substantive proceedings advanced. The matter resolved before trial.
Step 6 – Cross-border interaction: tax, banking, and AML considerations
A freezing and recovery action in Lithuania does not operate in isolation from the business's tax and banking position. Three interactions require attention early in the process.
On the banking side: Lithuanian banks and payment institutions are required under AML rules to file suspicious transaction reports (STRs) for activity that matches patterns of fraud or misappropriation. If the applicant's own accounts at a Lithuanian bank are scrutinized because incoming or outgoing transactions are associated with a flagged address, the bank may restrict access pending a review. Proactive engagement with the bank – providing the court order and a summary of the legal action – typically resolves this, but it requires early coordination. Separately, recovery proceeds, when they arrive, may trigger enhanced due-diligence requirements at the receiving bank.
On the tax side: the tax treatment of recovered funds in Lithuania and in the applicant's home jurisdiction is fact-specific and depends on the nature of the original loss (capital asset, trading inventory, receivable) and the nature of the recovery (damages, settlement, restitution). This is not a question that should be addressed post-recovery; the structure of any settlement should be reviewed before it is agreed, to avoid an unexpected tax charge on a recovery that was less than the original loss when costs are included.
On the AML compliance side: a VASP or CASP applicant that is itself regulated – under the Bank of Lithuania's supervision or under MiCA – must consider whether the facts of the misappropriation trigger its own internal AML reporting obligations. The duty to report suspicion to the Financial Intelligence Unit (FIU) of Lithuania may run in parallel with the civil recovery action, and the civil and regulatory tracks must be managed so that one does not prejudice the other.
Decision matrix: which operator profile should pursue Lithuanian relief?
Not every digital-asset recovery matter has Lithuania as the optimal seat for the freezing application. The analysis turns on several decision axes.
Profile A – Lithuanian-domiciled operator. A business incorporated or operating in Lithuania whose assets or counterparty is also in Lithuania. This is the clearest case: Lithuanian courts have primary jurisdiction, the Brussels I Recast route for EU-wide enforcement is available, and the Bank of Lithuania's VASP supervision regime means exchanges in scope are identifiable and reachable. The recommended instrument is a without-notice freezing order with simultaneous disclosure application to the relevant exchange. Timeline to initial order: typically days from filing a properly packaged application, though this varies with court capacity.
Profile B – EU-seated operator, Lithuanian exchange or custodian involved. A business domiciled in another EU member state whose funds are held at a Lithuanian-regulated exchange. Under the Brussels I Recast Regulation, the applicant may found jurisdiction in Lithuania on the basis of the asset location or the exchange's seat. A Lithuanian order travels directly to other EU member states. The recommended approach mirrors Profile A, with the addition of parallel notifications to the home-jurisdiction regulator if the applicant is itself regulated.
Profile C – Non-EU operator, Lithuanian connection point. A business outside the EU whose exposure arises because funds were deposited at a Lithuanian-regulated exchange or because the respondent has assets in Lithuania. Jurisdiction can be grounded in Lithuania on the asset-location basis, but enforcement of the resulting order outside the EU requires the bilateral-recognition or comity route. In our practice, this profile benefits most from a parallel action in a common-law forum – England and Wales, Singapore, or Hong Kong – where worldwide freezing order jurisprudence is more developed and enforcement networks are broader. The Lithuanian action and the common-law action run concurrently, each reinforcing the other.
Profile D – DeFi or cross-chain exposure, no identified exchange. Where funds have moved through decentralized protocols with no identifiable centralized exchange holding a balance, the immediate freezing instrument has limited reach. The forensic tracing step becomes the entire focus: the goal is to identify a point where the funds touched a regulated exchange or a smart contract with an identifiable operator. Until that identification is made, the legal instruments are latent. We advise clients in this profile to commission forensics immediately and to preserve all on-chain evidence, because the legal action follows the trace.
Related at OBOLUS
- Disputes & Asset Recovery for Digital-Asset Businesses – our full cross-border recovery practice for operators and fraud victims
- Smart Contract Dispute Resolution for Established Operators – on-chain dispute resolution strategy for DeFi and structured protocols
- Staking and Rewards Taxation in Bermuda – cross-border tax structuring for digital-asset income streams
FAQ
Can stolen crypto actually be recovered?
Yes – but the probability of recovery is directly proportional to the speed of the legal response. Digital assets held at a regulated, centralized exchange can be frozen by court order and, on disclosure of KYC records, traced to an identified respondent. Stablecoin issuers such as Tether and Circle hold freeze authority over identified USDT and USDC balances and generally act on a valid court order or law-enforcement designation. Funds that have moved to a non-custodial wallet or through a decentralized protocol are harder to freeze but remain traceable on-chain. Acting within hours of discovery materially improves outcomes.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows are measured in hours, not days. The longer the delay, the higher the probability that funds move through a second or third exchange, are converted to a privacy coin, or are withdrawn into a non-custodial wallet beyond the reach of any custodial freeze order. The forensic commission and the legal instruction should run in parallel from the moment of discovery. Courts in Lithuania and across the EU will hear urgent without-notice applications on an expedited basis for properly packaged matters, but the application cannot be filed without the evidentiary foundation – which takes time to build.
Can a court freeze assets held on an exchange?
Yes. A regulated exchange operating under the Bank of Lithuania's VASP supervision or under MiCA's CASP regime is legally obligated to comply with a valid court order. A freezing order served on the exchange's compliance function, paired with a disclosure order compelling production of account-holder KYC records, is the standard instrument in a Lithuanian digital-asset recovery action. For exchanges outside Lithuania, the order must be served through the enforcement route applicable to the exchange's home jurisdiction – either directly under the Brussels I Recast Regulation for EU-seated exchanges, or through allied counsel in the relevant forum for non-EU exchanges.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses. We move for freezing relief and exchange disclosure while the trail is live. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specializing in cross-border digital-asset freezing orders, exchange disclosure applications, and on-chain forensic recovery strategy.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.