Recovery windows for misappropriated digital assets are measured in hours, not weeks. A business that loses cryptocurrency to fraud – whether through a compromised exchange account, a social-engineering attack or an insider breach – faces an immediate clock: every block confirmed moves funds further from reach. Switzerland offers a credible, well-developed legal environment for digital-asset recovery, combining FINMA supervision, strong cantonal court procedure and the country's longstanding role as a global financial center. This guide walks through each step of the recovery process, from the first forensic move to the final enforcement action, with the cross-border dimension that most Swiss-focused guides omit.
The Legal Basis for Asset Recovery in Switzerland
Swiss law treats misappropriated crypto as a recoverable asset, and Swiss courts have followed the international trend of recognising digital assets as property subject to civil remedies. Under the Swiss Code of Obligations and the applicable criminal procedure provisions, a defrauded business can pursue both civil and criminal tracks simultaneously – a structural advantage that distinguishes Switzerland from some other jurisdictions.
The civil track allows the aggrieved party to apply for provisional measures – the Swiss equivalent of a freezing order – to immobilise assets before the defendant can dissipate them. The criminal track triggers the public prosecutor's office, which has its own compulsory-measure powers including seizure and account disclosure. Running both tracks in parallel is not just permitted; in our practice it is often the most effective approach when the defendant has assets in Switzerland and abroad.
FINMA, the federal financial-market regulator, supervises exchanges and custodians operating in Switzerland under the applicable banking, securities and anti-money-laundering regimes. A FINMA-supervised entity is subject to regulatory obligations that include cooperating with law-enforcement requests. That supervisory lever matters when an exchange is the gateway through which funds moved.
Switzerland is also a party to international mutual legal assistance treaties and the Lugano Convention framework, which governs recognition and enforcement of civil judgments across participating states. For a cross-border fraud where proceeds landed in a Swiss account or wallet, those treaty relationships are the mechanism for coordinating action from a foreign court order.
Step 1: Preserve the Evidence Before Anything Else
The first step in any Swiss crypto recovery matter is evidence preservation – capturing blockchain data, wallet addresses, transaction hashes and exchange correspondence before the perpetrator can delete records or move funds again.
On-chain data is immutable by nature. A transaction confirmed on a public ledger cannot be altered. But the metadata around it – exchange account records, IP logs, KYC files, counterparty wallet linkages – is not immutable. Exchanges retain data for only as long as their data-retention obligations require, and some offshore platforms have shorter windows than Swiss entities do.
Immediate steps for the business include: securing screenshots and exports of all relevant transactions; preserving wallet addresses in a timestamped record; and retaining every communication channel (email, messaging apps, contract documents) that relates to the fraud. Do not send further transactions to any address associated with the fraudster. Even a small test transaction can complicate the chain-of-custody analysis.
In parallel, engage a professional blockchain forensics provider. The forensic report – mapping the movement of funds across wallets, exchanges and chains – becomes the factual foundation for every subsequent legal step. Without it, courts and prosecutors are working blind. In our cross-border practice, we coordinate forensic engagement at the same time as the first legal assessment, so both workstreams move in parallel from day one.
Step 2: Civil Provisional Measures – the Swiss Freezing Mechanism
Swiss civil procedure allows a claimant to obtain provisional measures – including a freeze on identified assets – on an expedited basis, sometimes within hours of application. The threshold for a freeze is a showing of apparent entitlement and urgency; the standard is deliberately accessible to prevent irreparable harm before a full hearing.
The application is made to the competent cantonal court. The claimant must identify the assets with sufficient precision – ideally a wallet address, an exchange account identifier or a bank account number – and demonstrate that the defendant is likely to dissipate the assets if notice is given. Courts can and do grant measures ex parte (without hearing the defendant first) when the risk of dissipation is credibly shown.
Once a freeze is in place, the next question is whether the exchange or custodian holding the assets will comply. A FINMA-supervised Swiss entity is bound by Swiss court orders. An offshore exchange is not automatically bound by a Swiss order, which is why the cross-border dimension matters so acutely: if funds have moved to a platform in England, Singapore or Hong Kong, parallel or sequential applications in those forums will be necessary.
The process above describes the standard civil path. Your facts – the entity, the asset type, the exchange's domicile – change the analysis significantly. For a scoped assessment of your recovery position in Switzerland, contact OBOLUS at info@oboluslaw.com or map your options here.
Step 3: The Criminal Track and the Prosecutor's Seizure Powers
Filing a criminal complaint in Switzerland opens a second, parallel avenue with enforcement teeth that civil courts do not possess.
The Swiss Code of Criminal Procedure empowers the public prosecutor to seize assets, compel disclosure from financial intermediaries and issue international rogatory letters under mutual legal assistance treaties. For a fraud that involved a Swiss-domiciled exchange, a Swiss bank or a Swiss corporate vehicle, the criminal track can produce disclosure faster than a civil application, because the prosecutor's investigative powers do not require the claimant to identify the precise account in advance – the prosecutor can compel the institution to search its own records.
Criminal complaints for crypto fraud typically allege fraud (Betrug under the applicable criminal code provisions), misappropriation or computer-related offences. The characterisation matters for the prosecutor's priority and for the mutual-legal-assistance request. We regularly advise clients on how to frame the complaint for maximum procedural effect – both to secure a swift seizure and to position the matter for international cooperation.
One important nuance: a criminal seizure benefits the state's prosecution, not automatically the victim's civil restitution. To convert a criminal seizure into civil recovery, the defrauded party must participate as an adhésion claimant or pursue separate civil enforcement. Keeping the two tracks coordinated – so the criminal action supports rather than undercuts the civil restitution – is a material part of the legal strategy.
Step 4: Exchange Disclosure and the Travel Rule Dimension
Identifying who controls a wallet is often the critical step that converts a blockchain trace into an actionable legal claim, and Swiss-supervised exchanges are among the better-placed counterparties to serve with a disclosure request.
Under the Travel Rule (the obligation, arising from FATF Recommendation 15 and implemented across major jurisdictions, to pass originator and beneficiary data with a virtual-asset transfer), compliant virtual asset service providers collect and retain identity data on both sides of a transfer. In Switzerland, FINMA has issued guidance implementing the Travel Rule for supervised entities. That means a Swiss-regulated exchange that received a transfer from your stolen funds very likely holds KYC data on the receiving account.
Obtaining that data requires a court order or prosecutor's request – exchanges cannot voluntarily disclose personal data under Swiss privacy law without legal compulsion. The civil route is a disclosure order akin to the Norwich Pharmacal order available in English courts, framed within Swiss civil procedure as a precautionary measure or an independent evidence-gathering action. The criminal route is faster: the prosecutor can compel production within the investigation.
Where funds moved through multiple exchanges – a common pattern in sophisticated frauds – each hop may involve a different jurisdiction. Our disputes team coordinates disclosure applications across leading common-law forums alongside Swiss proceedings, so the chain of evidence follows the chain of funds without a jurisdictional gap.
Step 5: Stablecoin Issuer Freeze Requests
If stolen assets were converted into stablecoins before or after reaching Switzerland, there is an additional enforcement tool available that most operators do not use quickly enough: a direct freeze request to the stablecoin issuer.
Tether (USDT) and Circle (USDC) hold contract-level freeze and blacklist authority over their issued tokens. Issuers generally act on a law-enforcement case reference, an OFAC designation or a court order from a recognised forum. Speed is everything. We have seen freeze requests succeed when submitted within hours of the misappropriation, with the right documentation – the forensic hash trace, a professional report and a credible law-enforcement or legal reference.
The documentation requirements for an issuer freeze are specific. An informal email is not sufficient. What works is a forensic report mapping the stolen USDT or USDC to the target wallet, a formal legal reference (a filed criminal complaint or a court application), and – ideally – supporting communication from a law-enforcement body. Assembling that package in hours, not days, is where the outcome is determined.
If a prior application stalled or an issuer freeze request was rejected for procedural reasons, a second review can often surface the gap and reconstruct the submission. To discuss that process with our disputes desk, write to info@oboluslaw.com or map your options here.
The Cross-Border Dimension: Switzerland and the Leading Recovery Forums
Switzerland is rarely the only jurisdiction in play. Digital-asset frauds are structurally cross-border: the perpetrator may be in one country, the exchange in another, the wallet custody in a third, and the victim's corporate entity in a fourth.
England and Wales remain the leading forum for crypto asset recovery as a matter of practice. The English courts developed the worldwide freezing order (an injunction freezing a defendant's assets globally, enforceable in common-law jurisdictions) and the Norwich Pharmacal order (a disclosure order compelling a third party to identify a wrongdoer) in the context of crypto as early as the landmark AA v Persons Unknown decision. Those tools can be sought by a business with a UK nexus or a contractual English-law clause, and the resulting order can be used to compel disclosure and enforcement in Switzerland through the applicable treaty mechanisms.
The DIFC Courts in Dubai and the Singapore courts have followed England's lead. The CFAAR (the Crypto Fraud and Asset Recovery network, launched in London in September 2021) provides a practitioner-level coordination forum across major common-law jurisdictions. Where assets have passed through multiple hubs, using CFAAR-connected counsel alongside Swiss proceedings is a proven approach to closing jurisdictional gaps.
For a business whose assets moved from Switzerland to offshore exchanges, the practical question is: which forum should anchor the primary application? The answer turns on where the defendant has assets, where the exchange is regulated, and where the contractual governing law sits. We work through that matrix at the outset and engage allied counsel in the relevant jurisdiction where Swiss proceedings need to be complemented by foreign enforcement.
Decision Matrix: Which Recovery Path Fits Your Situation?
Not every crypto fraud in Switzerland calls for the same strategy. The profile of the victim, the size of the loss and the location of assets all shape the right opening move.
Profile A – Large-value fraud, Swiss exchange involved, defendant identity known. The optimal path is simultaneous civil provisional measures and a criminal complaint, with an immediate exchange disclosure request under the criminal track. Timeline from instruction to first provisional measure: typically a matter of days, depending on the cantonal court and the completeness of the forensic package. Key risk: delay in filing the forensic report before the defendant withdraws.
Profile B – Multi-jurisdictional fraud, Swiss account one of several hops, defendant identity unknown. The opening move is forensic tracing across all identified addresses, followed by a coordinated disclosure strategy across the relevant exchanges. The forum for the primary freezing application should be chosen based on where the largest identifiable balance sits and where the court has demonstrated crypto-competence. Switzerland may be one of several parallel venues. Timeline: longer and less predictable, but the CFAAR network can compress coordination time materially.
Profile C – Stablecoin conversion, issuer freeze window still open. The most time-critical scenario. The first 24 hours are consumed by the forensic report and the issuer freeze request package. Civil and criminal filings run in parallel, but the issuer freeze is the immediate containment step. If the window has already closed, the strategy shifts to exchange KYC disclosure and civil enforcement against identifiable counterparties.
Profile D – Fraud discovered after significant delay, funds dispersed across multiple wallets and chains. This is the most challenging profile. Success is not impossible – on-chain traces do not expire – but the strategy depends on finding the asset pool that is still accessible rather than the original stolen amount. Realistic outcomes may include partial recovery and civil judgment against the perpetrator for the balance.
A Note on Tax and Banking Interaction
A question we frequently encounter in Swiss recovery matters: what are the tax consequences of recovering stolen assets?
The answer is jurisdiction-specific and turns on how the original loss was treated, whether the recovery is characterised as a return of capital or a new receipt, and the timing across tax periods. In Switzerland, the cantonal variation in tax treatment adds a further layer. We advise businesses to address the tax structuring of a recovery at the same time as the legal strategy – not after the fact – to avoid an outcome where a successful recovery creates an unexpected tax event. Our practice coordinates with tax counsel from day one on matters where the recovery amount is material.
Banking interaction is a related concern. Swiss banks are subject to stringent anti-money-laundering obligations and will scrutinise incoming crypto-derived funds. Preparing a complete transaction and legal narrative for the receiving bank – demonstrating the provenance of recovered assets – is a practical step that many recovery advisers overlook. We have seen recovered funds held by a correspondent bank for extended periods because the documentation package was inadequate at the point of receipt.
Common Assumptions About Crypto Recovery
A common assumption among business owners who have suffered a digital-asset theft is that once funds leave a wallet, nothing can be done. That assumption is incorrect, and it costs victims the narrow window in which intervention is most effective.
The permanent, public nature of blockchain ledgers means that a professional forensic trace can follow funds across dozens of wallet hops and multiple chains. The legal question is not whether the funds can be traced – they almost always can – but whether the legal instruments are deployed quickly enough to intercept them before they are converted to fiat and withdrawn from a regulated exchange. That conversion step is the critical chokepoint, and it is where a coordinated freezing and disclosure strategy is most effective.
A second assumption is that Swiss courts are slow. Cantonal provisional-measure procedures in Switzerland can move quickly when the application is well-prepared. The obstacle in most failed recovery attempts is not the court; it is the time taken to assemble the forensic report, identify the assets precisely and instruct local counsel. The pre-application preparation phase is where the time is lost – and where experienced coordination matters most.
Micro-matter: In a recent recovery matter, a financial-services business based outside Switzerland identified misappropriated stablecoins that had passed through two exchanges, one of which was FINMA-supervised. We coordinated a forensic trace in parallel with an emergency disclosure application and a criminal complaint filing. The FINMA-supervised exchange produced account data under the criminal procedure, and a civil provisional measure was obtained against the identified defendant within days of instruction. The assets were frozen before the defendant completed a withdrawal. The matter remains in enforcement proceedings.
Related at OBOLUS
- Disputes and asset recovery for digital-asset businesses – our full cross-border recovery practice across 25+ forums.
- Crypto fraud asset recovery: practical lessons for boards – strategic guidance on board-level preparation and response.
- Token issuance and offering rules in Malta – EU token-regime context under MiCA and the MFSA.
A prior recovery attempt stalled or an issuer freeze was rejected? Our disputes desk reviews the structural reason and maps the route forward. The analysis takes less time than most operators expect. To get a second read, write to us at info@oboluslaw.com or map your options here.
FAQ
Can stolen crypto actually be recovered?
Recovery is genuinely possible, though the outcome depends on speed, the exchanges involved and whether assets remain in a regulated custodian's hands at the point of legal intervention. Blockchain traces do not expire – funds moved years ago can still be traced on-chain. The limiting factor is finding an asset pool that is still accessible through a compellable counterparty, such as a regulated exchange, before the perpetrator converts proceeds to fiat. A professional forensic report combined with coordinated legal action across the relevant forums gives the best prospect of a meaningful recovery.
How fast must I act after a digital-asset theft?
The recovery window is measured in hours, not weeks. Funds moved to a regulated exchange can be frozen while the KYC trail is live; once they are withdrawn to a private wallet or converted to cash, the legal options narrow significantly. The critical first steps – securing evidence, engaging forensics, and filing provisional-measure and stablecoin-freeze requests – should happen in parallel within the first 24 hours of discovering the loss. Delay is the single most common reason a technically traceable fraud results in no practical recovery.
Can a court freeze assets held on an exchange?
Yes. Swiss courts can issue provisional measures requiring a Swiss-regulated exchange to freeze identified assets. For offshore exchanges, the order must be enforced in the exchange's domicile jurisdiction, which requires a parallel application in that forum – England, Singapore, Hong Kong or elsewhere, depending on where the platform is regulated. FINMA-supervised exchanges in Switzerland are bound by Swiss court orders and by the obligations arising under the applicable anti-money-laundering regime. The precision of the asset identification in the application is the key variable in whether the freeze is granted quickly.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums, including Switzerland, England, Singapore, Hong Kong and the DIFC. We move for freezing relief and exchange disclosure while the trail is live. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialising in cross-border crypto asset recovery, freezing relief strategy and on-chain tracing across common-law and civil-law forums including Switzerland and the DIFC.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.