Operating an exchange or holding digital assets means facing a hard reality: when funds are misappropriated, the recovery window is measured in hours, not weeks. A business that discovers a theft on Monday morning and waits for a routine legal appointment may find the assets scattered across five chains by Tuesday. In Luxembourg, the legal mechanism that arrests that process is the exchange disclosure order – a court-directed instrument compelling a crypto exchange or custodian to reveal account data, transaction records and beneficial ownership information. This guide walks through each step, from the first forensic assessment to the moment a disclosure order lands on an exchange's compliance desk.
An exchange disclosure order in Luxembourg is obtained through the civil courts, most commonly via an urgent interim procedure, compelling a virtual asset service provider or exchange to disclose account and transaction data tied to a theft or fraud. The governing legal basis sits within Luxembourg's general civil procedure rules and, for regulated entities, intersects with the obligations imposed under the VASP (virtual asset service provider) framework as implemented through Luxembourg's transposition of the EU's anti-money-laundering directives and the broader MiCA (Markets in Crypto-Assets Regulation) regime now in force across the EU. The Commission de Surveillance du Secteur Financier, the CSSF, supervises virtual asset service providers operating from Luxembourg, and its supervisory reach shapes what an exchange must preserve and produce when a court directs it to do so.
Why the Clock Matters in Digital-Asset Recovery
Every hour after a digital-asset theft, the probability of full recovery falls. Assets move through mixers, bridge protocols and offshore exchanges with no KYC gate. A single cross-chain swap can atomize a balance across multiple wallets in minutes. The legal response must match the speed of the underlying technology.
Luxembourg sits at an intersection that makes it strategically important for recovery work. It is the EU's leading fund-domicile jurisdiction and home to regulated crypto custodians, fund administrators and exchange operators subject to CSSF oversight. When misappropriated assets touch a Luxembourg-regulated entity – or when the counterparty exchange holds a European licence that creates a jurisdictional hook – Luxembourg courts have the capacity to intervene quickly. The urgency procedure (référé) allows a court to act within days when a party demonstrates an imminent risk of harm.
In our cross-border practice, we have seen businesses lose recoverable positions entirely because they delayed the first legal step while trying to negotiate directly with the exchange. Exchanges cannot act unilaterally without legal cover; a court order is the instrument that gives them that cover and the obligation to comply.
What Is an Exchange Disclosure Order, and What Does It Compel?
An exchange disclosure order is a court direction requiring a crypto exchange or custodian to produce specified account records, transaction histories, KYC documentation and beneficial ownership data relating to identified wallet addresses or account holders. It is the digital-asset equivalent of a Bankers Trust order in English law – a disclosure mechanism that permits a victim to identify the wrongdoer and trace the asset trail before bringing substantive proceedings.
In Luxembourg, the instrument is rooted in the civil procedure provisions governing interim and urgent relief. A court acting in the référé jurisdiction can grant disclosure orders where the applicant demonstrates an urgent need and a prima facie entitlement. The standard does not require proof of the underlying claim at the same level as a full merits hearing; it requires enough to show the claim is not manifestly ill-founded and that delay would cause disproportionate harm.
The CSSF's supervisory framework for VASPs, aligned to EU AML requirements and now the MiCA regime, means that Luxembourg-registered or Luxembourg-supervised exchanges operate under record-keeping and cooperation obligations that support compliance with such orders. A disclosure order directed at a CSSF-supervised entity therefore lands within a regulatory environment that already mandates the preservation and availability of the data being sought.
The practical scope of disclosure typically covers: account opening documents and KYC files, deposit and withdrawal transaction records with timestamps, IP address and device logs associated with the account, counterparty wallet addresses for outbound transfers, and any internal suspicious-activity flags raised on the account. The more precisely the applicant can define the wallet addresses and transaction hashes in the application, the faster and more complete the exchange's response will be.
Step One: On-chain Tracing and Evidence Preservation
Before any court application is filed, the applicant needs a forensic foundation – and that foundation must be built fast. On-chain tracing begins with the transaction hashes generated at the point of misappropriation. From those hashes, a professional forensic report maps the flow of assets through the blockchain, identifies any exchange deposit addresses and attributes cluster ownership where the data permits.
Forensic partners working in this space use specialist blockchain analytics tools to build that chain of evidence. The output is a traceable path: from the victim's wallet, through any intermediate hops, to the deposit address at a known exchange. That deposit address is the hook on which the disclosure application turns. Without it, the application lacks the specificity a court needs to grant relief against a particular exchange entity.
Evidence preservation runs in parallel. Screenshots, API logs, exchange communication records and any on-platform correspondence should be secured in native format with timestamps before they are submitted. Courts expect applicants to have done the preliminary work; arriving with a well-organised forensic report alongside the legal pleadings materially reduces the time the court needs to process the application.
We work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications. In our experience, the quality of the forensic report is the single most important variable in the speed of the court's response.
Step Two: Identifying the Right Court and Legal Basis in Luxembourg
Luxembourg's civil court hierarchy routes most commercial urgent applications through the Tribunal d'Arrondissement de et à Luxembourg, the principal district court, sitting in its référé capacity for interim matters. For matters above a value threshold or with a cross-border dimension, the jurisdictional analysis may also involve the question of whether parallel proceedings in another forum – England & Wales, the DIFC Courts, Singapore – should be pursued concurrently or sequentially.
The legal basis for the application draws on Luxembourg's transposition of EU civil procedure principles, the court's inherent jurisdiction to protect against unjust enrichment and the specific obligations of supervised entities to cooperate with judicial process. Where the exchange is a CSSF-supervised VASP, the regulatory overlay reinforces the court's power: the exchange operates under an authorization that carries cooperation duties, and a refusal to comply with a court order carries serious supervisory consequences.
Cross-border complexity arises immediately when the exchange's operational entity is incorporated outside Luxembourg – in Ireland, Malta or a non-EU jurisdiction – but holds a MiCA passported licence or serves Luxembourg-domiciled clients. In those situations, the analysis turns on the MiCA regime's passporting structure and the question of which NCA (national competent authority) holds primary supervisory jurisdiction. We regularly advise on this interface, mapping where the legal anchor is strongest before committing to a jurisdiction for the primary application.
CTA #1: The path from discovery to a filed application is faster when the legal strategy is set on day one. If you are at the beginning of a recovery situation, contact OBOLUS at info@oboluslaw.com for a scoped urgent assessment. Map your options
Step Three: Drafting and Filing the Application
The disclosure application is a pleading document that must simultaneously satisfy two audiences: the court, which needs a clear legal basis and a proportionate scope of relief, and the exchange's compliance team, which needs enough technical specificity to execute the order without ambiguity. Combining those two requirements in a single document is a drafting discipline that general civil litigators rarely encounter.
The pleadings must set out: the identity and capacity of the applicant, the factual basis for the claim (with the forensic report attached), the wallet addresses and transaction hashes at issue, the identity of the exchange entity and its registered presence in or connection to Luxembourg, the legal basis for disclosure, the scope of the information sought and the urgency justification. The urgency section is not boilerplate; it must specifically address why ex parte (without notice to the respondent) relief is necessary or why even a short hearing notice would cause prejudice through asset dissipation.
Where the funds have already moved beyond the exchange deposit address by the time the application is filed, the pleadings should address that too – because the exchange's historical records remain valuable even if the live balance is gone. Historical transaction data identifies the next hop, which becomes the basis for a follow-on order against a second exchange or for a law-enforcement referral.
Language is a practical consideration. Luxembourg's courts operate in French, German and Luxembourgish for official purposes. Commercial proceedings are typically conducted in French. The application and supporting documents, including the forensic report, must be in a language the court accepts or accompanied by a certified translation. Working with allied counsel in Luxembourg ensures the filed documents meet local procedural requirements.
Step Four: Should a Freezing Order Accompany the Disclosure Application?
A disclosure order identifies; a freezing order preserves. Running both in parallel is the standard approach when there is a live balance at a Luxembourg-connected exchange, because disclosure without preservation creates the risk that the wrongdoer, once alerted, moves the funds before the applicant can take further action.
A freezing order (an injunction restraining the respondent from disposing of identified assets) in Luxembourg follows a similar prima facie urgency standard to the disclosure application. The applicant must show a credible claim, a risk of dissipation and proportionality between the relief sought and the potential harm to the respondent. The scope can extend to assets beyond the specific misappropriated tokens where there is a basis to believe the wrongdoer holds related assets on the same platform.
The stablecoin dimension adds a separate track. Tether (USDT) and Circle (USDC) hold contract-level freeze authority over tokens on their respective networks and will act on a law-enforcement request or, in appropriate cases, a court order or OFAC designation. When the misappropriated assets include USDT or USDC, a parallel request to the issuer – supported by a law-enforcement reference and the forensic report – can freeze the balance at the protocol level, independent of what the exchange does. This is among the fastest preservation mechanisms available and should be assessed in the first hours of any recovery operation.
In a recent matter, a fund manager based in a leading European jurisdiction identified a seven-figure USDT outflow from a custody account to a deposit address at a Luxembourg-connected exchange. We filed a combined disclosure and interim freezing application within 48 hours of instruction. The court granted interim relief on an ex parte basis; the issuer freeze on the stablecoin balance was activated within the same window, and the funds were preserved pending substantive proceedings. The forensic trail recovered from the exchange's records subsequently identified the account holder.
Step Five: Serving and Enforcing the Order Against the Exchange
A court order is only as effective as its enforcement. Once granted, the disclosure order must be served on the exchange in a manner that triggers its compliance obligation. For a CSSF-supervised entity, service through the entity's registered agent or compliance officer, with concurrent notification to the CSSF, creates the maximum pressure for timely compliance.
The exchange's response timeline will depend on its internal compliance resources and the specificity of the order. An order that precisely defines the wallet addresses, the account numbers if known, and the date range of transactions sought is processed faster than a broad, open-ended request that requires the exchange to make judgment calls about scope. That precision in drafting – investing the time at the application stage to be exact – pays back in compliance speed.
Where an exchange delays or resists compliance, the applicant has two routes: a contempt application to the court and a supervisory complaint to the CSSF. For a regulated VASP, non-compliance with a court order is also a regulatory event; the CSSF has supervisory tools – including licence conditions and, in extremis, licence revocation – that create strong institutional incentives for prompt compliance.
Cross-border complication arises when the exchange argues that its operational entity is outside Luxembourg and not subject to the court's jurisdiction. Anticipating that objection in the pleadings – by establishing the jurisdictional hook through the MiCA passport, the servicing of Luxembourg clients or the location of the assets – is the better approach than litigating the jurisdictional question after the order is issued.
CTA #2: If a prior recovery attempt stalled – whether because an exchange did not comply or a first application was refused – a second read of the facts can surface the structural reason and the route forward. Write to info@oboluslaw.com or reach us via t.me/oboluslaw. Map your options
The Cross-border Dimension: When Luxembourg Is One Node in a Multi-jurisdiction Trail
Digital-asset theft is almost never a single-jurisdiction event. The victim may be in the United States; the exchange that received the stolen funds may hold a MiCA passport with Luxembourg as its EU anchor; the beneficial owner of the receiving account may be in a third country; and a portion of the funds may already have moved to an exchange in a non-EU jurisdiction. Securing a Luxembourg disclosure order is one step in a coordinated multi-jurisdiction strategy, not a standalone solution.
In our cross-border practice, the standard architecture for a multi-jurisdiction recovery combines a disclosure order at the EU anchor exchange (often Luxembourg or Malta under MiCA), a worldwide freezing order application in England & Wales or the DIFC Courts where those forums have jurisdiction over a defendant or related assets, and a parallel law-enforcement referral in the victim's home jurisdiction. Each of those threads is time-sensitive and the sequencing matters: filing in the wrong forum first can alert the wrongdoer and cause dissipation before the freezing relief is in place.
The CFAAR (Crypto Fraud and Asset Recovery) network, launched in London in September 2021, provides a practitioner forum for coordinating cross-border crypto recovery matters across common-law jurisdictions. Luxembourg, as a civil-law EU jurisdiction, sits alongside rather than within that network, but the principles of evidence-led, forensically-grounded applications translate across legal systems.
Banking interaction is also part of the cross-border picture. When the recovery process identifies fiat off-ramps – proceeds converted to EUR or USD and moved through a Luxembourg bank account – the disclosure order may need to be supplemented with a separate application under Luxembourg banking law, or with a request to the bank's home regulator where the account is held offshore. We regularly advise on this intersection, ensuring that the legal strategy covers both the on-chain trail and the off-chain conversion points.
Common Mistakes That Compromise Recovery Prospects
A common assumption is that once funds leave the original wallet, nothing can be done. That assumption is wrong, and acting on it is one of the most costly mistakes a business can make after a theft. The on-chain trail persists indefinitely; the forensic evidence does not degrade. What degrades is the practical ability to act on that evidence: exchange accounts are closed, KYC data is purged after retention periods, and wrongdoers convert liquid crypto to harder-to-trace assets over time.
The most common mistakes we see in this practice are: delayed instruction (by the time counsel is engaged, the assets have moved through three hops and the exchange deposit address is cold), incomplete forensic evidence (the applicant files without a professional report, and the court lacks the technical basis to grant specific relief), over-broad pleadings (the application seeks "all data on all accounts" rather than specifying addresses and date ranges, leading to a refusal on proportionality grounds), and failure to address the stablecoin freeze option in the first hours.
A less obvious mistake is conducting informal outreach to the exchange before filing. Some operators instinctively contact the exchange's customer support or compliance team to ask for information voluntarily. That approach alerts the account holder, who may then move the funds before the legal process has had a chance to preserve them. The correct sequence is: forensic report, court application, order served – and only then does the exchange communicate with the account holder as part of its compliance process.
Who Should Pursue an Exchange Disclosure Order in Luxembourg?
Not every recovery situation calls for a Luxembourg-specific disclosure application. The decision depends on whether there is a real jurisdictional anchor – a Luxembourg-supervised exchange, a MiCA-passported entity with Luxembourg as its home NCA, or a Luxembourg-domiciled defendant – and whether the evidence is sufficient to meet the prima facie standard.
Profile A: a business victim who can trace misappropriated assets to a deposit address at a CSSF-supervised VASP. This is the clearest case for a Luxembourg disclosure order. The jurisdictional anchor is strong, the exchange is subject to regulatory cooperation obligations, and the relief can be obtained and enforced within days. The key risk is speed: every day of delay narrows the live-balance window.
Profile B: a business victim who can trace assets to a deposit address at an exchange holding a MiCA passport with Luxembourg as its EU anchor, but whose operational entity is in another member state. The jurisdictional analysis is more complex. The disclosure application may be more effectively anchored in the exchange's home-NCA jurisdiction, or may require a parallel strategy across two forums. The key risk is the jurisdictional challenge from the exchange, which must be anticipated and addressed in the pleadings.
Profile C: a business victim with evidence of a Luxembourg-connected defendant – an individual or entity with Luxembourg domicile or a Luxembourg bank account – but where the misappropriated assets are held at an offshore exchange. A Luxembourg court can, in appropriate circumstances, exercise jurisdiction over a Luxembourg-domiciled defendant even where the custodying exchange is abroad. The key risk is enforcement of the order against an entity outside Luxembourg's direct supervisory reach.
For all three profiles, the starting point is an evidence audit: what do you have, what gap needs to be closed by a forensic exercise, and what is the strongest jurisdictional hook available? That audit should happen on day one.
Related at OBOLUS
- Disputes and Asset Recovery for Digital-Asset Businesses – how OBOLUS structures crypto fraud recovery and litigation strategy
- Crypto Fraud and Asset Recovery: The Disputes Angle – the legal instruments, forums and sequencing behind successful digital-asset recovery
- Founder Relocation and Tax for Established Operators – structuring and tax considerations for digital-asset businesses and their principals across jurisdictions
FAQ
Can stolen crypto actually be recovered?
Yes, in many cases – though recovery is not guaranteed and depends on speed, evidence quality and jurisdictional reach. On-chain tracing can identify the exchange deposit address where stolen assets landed. A court-issued disclosure order then compels the exchange to produce account records, enabling identification of the wrongdoer. Where assets are stablecoins such as USDT or USDC, a protocol-level freeze by the issuer can preserve the balance independently of what the exchange does. The earlier legal action begins after the theft, the higher the probability of a recoverable outcome.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows are measured in hours, not days. Assets move through bridges, mixers and offshore exchanges quickly. The forensic report and the court application should be initiated within the first 24 to 48 hours of discovery. After the first 72 hours, the live-balance probability at the initial deposit address falls sharply, though historical records retained by the exchange remain valuable for identifying the chain of custody and any subsequent holders. Do not contact the exchange informally before filing – that alerts the account holder and risks dissipation.
Can a court freeze assets held on an exchange?
Yes. A Luxembourg court acting in its urgent référé jurisdiction can grant interim freezing relief restraining an exchange from processing withdrawals from identified accounts, where the applicant demonstrates a credible claim, a risk of dissipation and proportionality. For a CSSF-supervised VASP, the regulatory overlay reinforces compliance with such an order. In parallel, where the frozen assets include USDT or USDC, issuers Tether and Circle hold contract-level freeze authority over those tokens and can act on a court order or law-enforcement designation independently of the exchange's internal processes.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We move for freezing relief and exchange disclosure while the trail is live, working alongside forensic partners to convert on-chain evidence into court-ready applications. To discuss your recovery situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialist in cross-border digital-asset recovery, exchange disclosure orders and urgent freezing relief across EU and common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.