A payments business discovers that a counterparty has exploited a vulnerability in a deployed smart contract, draining a seven-figure balance to an unknown wallet. The funds are moving across chains. The legal question is immediate: what enforcement mechanisms exist in Turkey, and how do they interact with the international tools needed to stop the bleed before the trail goes cold?
Smart-contract dispute resolution in Turkey operates at the intersection of general civil procedure, the Turkish Code of Obligations (the principal statute governing contractual liability), and a developing supervisory regime for crypto asset service providers (CASPs) – entities licensed to hold or transfer digital assets on behalf of customers. Turkish civil courts have jurisdiction over claims arising from on-chain transactions where a party is domiciled or carrying on business in Turkey, and provisional injunctive measures are available under the Civil Procedure Code. The practical challenge is speed: asset recovery and on-chain tracing must begin within hours of a confirmed loss, while the domestic legal process is mapped in parallel.
This guide walks through the process step by step – from the moment of loss to enforcement – and explains where Turkish procedure aligns with, and where it diverges from, the common-law tools available in leading cross-border forums such as England and Wales, the DIFC Courts, or Singapore.
The regulatory setting for digital assets in Turkey
Turkey's primary supervisory instrument for digital assets is the regulation issued under the Capital Markets Law, administered by the Capital Markets Board of Turkey (SPK – Sermaye Piyasası Kurulu). The SPK framework requires domestic CASPs to register and maintain operational standards covering custody, AML compliance and customer asset segregation. Parallel obligations arise under the rules of the Financial Crimes Investigation Board (MASAK), Turkey's financial intelligence unit and the competent authority for AML/CFT supervision of the digital-asset sector.
The SPK CASP regime means that a licensed exchange operating in Turkey is a regulated entity subject to SPK oversight and MASAK reporting obligations. This matters acutely in a dispute context: a licensed CASP can be served with a court order requiring it to disclose account information or freeze a balance, and it has a domestic regulatory obligation to cooperate with Turkish law enforcement and judicial authorities. For an injured party, that creates a domestic enforcement lever that would not exist against an unregistered offshore platform.
Turkey is not an EU member state and is therefore outside the MiCA (Markets in Crypto-Assets Regulation) perimeter, but the SPK framework tracks many of the same principles – activity-based licensing, segregation of client assets, and capital adequacy by category. Businesses operating cross-border into Turkey, or operating from Turkey into EU markets, need to hold the relevant CASP licence in each applicable regime. We regularly advise operators on that two-horizon analysis: the domestic SPK requirement and the MiCA authorisation for the EU side of the business.
When does a smart-contract dispute arise under Turkish law?
A smart-contract dispute in Turkey most commonly arises in one of three ways: an exploit of a deployed contract draining funds; a counterparty refusing to honour an off-chain obligation underpinned by an on-chain settlement mechanism; or a custody or transfer failure by a licensed CASP. Turkish courts treat the smart contract as a species of agreement enforceable under the Code of Obligations, provided the essential elements of consent, consideration and determinable subject matter are present. The fact that execution is automated does not, in our practice, cause a Turkish civil court to treat the agreement as unenforceable. It does, however, complicate the question of which party bears the risk of a code-level defect.
Loss-aversion framing is important here. Recovery windows for misappropriated digital assets are measured in hours, not weeks. Once funds leave an on-chain address and pass through a mixing service or cross into a privacy-coin protocol, tracing becomes materially harder. The decision to engage counsel and initiate provisional measures should happen simultaneously with the internal incident response – not after it.
The MASAK regime imposes AML reporting obligations on licensed CASPs, including suspicious transaction reports. An injured party can request – through counsel – that MASAK open an investigation, which gives law enforcement access to account-level data held by the licensed platform. This route runs faster than civil litigation in many cases and can be pursued in parallel.
For a scoped initial assessment of your position, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the counterparty jurisdiction, the chain – change the analysis materially. Map your options
Step 1 – On-chain tracing and evidence preservation
Effective dispute resolution begins not in a courtroom but on-chain, within minutes of the loss event. The first step is to produce a complete, court-admissible transaction record: the originating wallet address, the exploit transaction hash or hashes, the receiving address or addresses, and every subsequent hop including cross-chain bridges and exchange deposit addresses.
Professional forensic tools – the category includes platforms such as Chainalysis, TRM Labs and Elliptic – generate attribution reports that courts in Turkey and in common-law forums have accepted as expert evidence. The report serves three functions: it identifies the exchange or CASP at which the funds currently sit; it establishes the chain of traceability required for a proprietary claim; and it provides the evidentiary foundation for both a court freezing application and a direct request to the relevant CASP to freeze the account pending legal process.
The common mistake at this step is delay. Operators we advise routinely attempt internal investigation before engaging outside counsel. In our cross-border practice, every hour of delay after a confirmed loss reduces the probability of a successful freeze. The forensic report and the legal application for provisional measures should be prepared simultaneously. Turkish civil courts accept applications for precautionary attachment – ihtiyati haciz – on an ex parte basis where urgency is demonstrated, and that urgency argument is strongest when filed within the first hours of the event.
Step 2 – How do provisional measures work in Turkish civil courts?
Turkish civil procedure provides two primary provisional instruments relevant to digital-asset disputes: ihtiyati haciz (precautionary attachment) and ihtiyati tedbir (preliminary injunction). Both are available before the main claim is filed, provided the applicant demonstrates a prima facie right and an urgency that makes it impossible or substantially harder to enforce a final judgment without immediate relief.
For smart-contract disputes, the preliminary injunction route is generally more appropriate. The applicant seeks an order directing a named respondent – most commonly a licensed CASP – to freeze a specified balance or wallet address pending the outcome of the substantive proceedings. The court may require the applicant to post security (a bond or guarantee) to protect the respondent against wrongful freezing. The quantum of that security varies by court and by the size of the claim; it is not a fixed statutory figure.
Turkish courts have jurisdiction on a territorial basis. If the CASP or the respondent is domiciled outside Turkey, service of process under the Hague Service Convention or bilateral treaties is required, which adds timeline. The more efficient route in cross-border cases is usually to pursue the Turkish injunction against any Turkish-domiciled entity or asset simultaneously with a common-law freezing order in England and Wales, the DIFC Courts, or Singapore – whichever has the strongest nexus to the funds or the parties.
A critical practical note: stablecoins such as USDT and USDC are subject to contract-level freeze authority held by their issuers, Tether and Circle respectively. Those issuers generally act on a law-enforcement case reference or a court order. Obtaining that order – or the law-enforcement referral – in the fastest available forum is often more valuable in the first 24 hours than pursuing a Turkish court application alone. We structure that parallel-track approach from day one.
Step 3 – Compelling disclosure from exchanges and custodians
Once provisional measures are in place – or are pending – the next step is to compel disclosure of account-holder identity from the exchange at which the stolen funds currently sit. In Turkey, this request proceeds through a court order directing the CASP to identify the account holder and provide full transaction records. A licensed SPK-registered CASP has a domestic obligation to comply; an unlicensed offshore platform does not, and a separate strategy is required for that scenario.
In our cross-border practice, the most effective tool for compelling disclosure from an offshore exchange remains the Norwich Pharmacal order – a form of disclosure order developed in England and Wales that requires a third party who has, innocently or otherwise, become mixed up in wrongdoing to identify the wrongdoer. England and Wales remain the leading forum for this instrument, and its availability does not depend on the primary dispute being governed by English law. A Turkish business whose funds are held on a Cayman-incorporated exchange can apply to the English Commercial Court for a Norwich Pharmacal order against that exchange. We have structured exactly that approach in recent matters.
Similarly, the DIFC Courts in Dubai have developed a strong practice in crypto asset disclosure and freezing orders, as seen in matters such as Techteryx v Aria Commodities DMCC and Trafigura v Gupta – decisions that confirmed the DIFC Courts' willingness to grant worldwide freezing orders in support of foreign proceedings. For a Turkish operator with contractual or operational connections to the UAE, that is a meaningful additional forum.
Step 4 – Bringing the substantive claim and enforcing judgment
The substantive claim in a Turkish smart-contract dispute will typically be framed in one or more of three ways: a contractual damages claim under the Code of Obligations; a tortious claim for wrongful interference with property; or, where the CASP itself is at fault, a claim under the SPK regulatory framework for breach of its custody or segregation obligations.
Turkish courts recognize a restitutionary logic in unjust enrichment cases, which is directly applicable where funds have been wrongfully diverted. The proprietary claim – asserting that the claimant retains a beneficial interest in the specific digital assets, even after transfer – is the stronger foundation for enforcement, because it attaches to the asset itself rather than converting the claim to a monetary debt against a potentially insolvent defendant.
Enforcement of a Turkish judgment against assets held in a foreign jurisdiction requires recognition proceedings in that jurisdiction. Conversely, a judgment obtained in England and Wales, the DIFC Courts, or Singapore can be enforced in Turkey through the Turkish recognition procedure, provided the foreign court had proper jurisdiction and the judgment does not contravene Turkish public policy. We map the optimal enforcement sequence from the outset of a matter – choosing the primary litigation forum based on where enforcement is most likely to succeed, not simply where the wrong occurred.
If a prior application has stalled or you have hit a procedural barrier, a second-look review can identify the structural gap and the viable route forward. Write to us at info@oboluslaw.com or map your options with our disputes desk.
How do tax and banking interact with a Turkish dispute?
A freezing order that successfully preserves assets creates an immediate secondary question: what happens to tax treatment and banking access during the freeze? In Turkey, the tax characterization of digital-asset gains – including restitution payments – is a developing area. The revenue authority has issued guidance treating certain digital-asset disposals as taxable events, but the treatment of recovered stolen assets and court-ordered restitution requires case-specific analysis. We do not treat this as a standalone issue: the tax and banking implications are assessed at the start of the mandate, not at the end.
Banking is a material practical concern. A Turkish business that has suffered a digital-asset loss and is pursuing recovery will typically need to maintain operational banking while the dispute proceeds. Financial institutions in Turkey are subject to MASAK oversight and will monitor accounts connected to a reported crypto incident. Having structured legal counsel on record – and having engaged proactively with the bank's compliance function – significantly reduces the risk of an account restriction compounding the original loss.
For operators domiciled outside Turkey but with Turkish counterparties, the cross-border banking picture is more complex. The entity's home-jurisdiction banking relationship and the Turkish enforcement proceedings must be managed as a single narrative, not two separate workstreams. Regulators in the leading hubs increasingly expect to see evidence of that integrated approach when they review a licensed operator's incident response.
Decision point – which forum should anchor the dispute?
The forum decision in a Turkish smart-contract dispute is the single most consequential choice in the early days of a matter. It turns on four factors: where the respondent's assets are held or accessible; which forum can grant provisional relief fastest; where any relevant CASP is domiciled or regulated; and which enforcement regime gives the best prospect of converting a judgment into actual recovery.
Profile A – Turkish-domiciled respondent, funds on a licensed SPK CASP. Pursue the Turkish civil court ihtiyati tedbir application as the primary measure. File simultaneously with MASAK for a suspicious transaction investigation. Timeline for ex parte provisional relief: typically measured in days in an urgent matter before a commercial court, though this varies by court and by the completeness of the application.
Profile B – Foreign-domiciled respondent, funds on an offshore exchange. Anchor the disclosure application in England and Wales or the DIFC Courts. Seek the Norwich Pharmacal or equivalent disclosure order. Pursue the Turkish claim in parallel if there are Turkish-domiciled assets or a Turkish-registered entity involved. The English Commercial Court and the DIFC Courts are generally faster on interim measures in the first 72 hours than most civil law forums.
Profile C – Stablecoin balance, issuer freeze available. Prioritize the law-enforcement referral and the issuer freeze request. This requires a verified transaction hash, a professional forensic report, and – in practice – a court order or credible law-enforcement case reference. Pursue the court application in the fastest available forum to generate that reference. Turkish law enforcement and the SPK can issue a referral; so can law enforcement in the jurisdiction where the issuer is regulated.
In our cross-border practice, most live recovery matters involve elements of all three profiles simultaneously. We sequence the applications to maximize the probability of a freeze before the funds move further, while preserving the substantive claim for full recovery.
Objection handler – "nothing can be done once funds leave the wallet"
A common assumption among operators who have suffered a digital-asset loss is that the pseudonymous and immutable nature of blockchain transactions makes recovery legally impossible. That assumption is wrong. It is also expensive: businesses that accept it as true forgo the short window in which provisional measures can actually stop the movement of funds.
The reality is more measured. Recovery is not guaranteed – and OBOLUS never represents that it is. But the legal tools exist: on-chain tracing, CASP disclosure orders, provisional attachment, stablecoin issuer freezes, and ultimately proprietary claims in forums with well-developed crypto jurisprudence. The CFAAR network (Crypto Fraud and Asset Recovery network, launched in London in September 2021) demonstrates the depth of the practitioner infrastructure now dedicated to exactly this category of claim. Courts in England and Wales, the DIFC, Hong Kong and Singapore have each confirmed that digital assets are capable of being the subject of a proprietary claim and a freezing order.
We move for freezing relief and exchange disclosure while the trail is live. That is a process and a timing decision, not a guarantee of outcome. The difference between a successful freeze and a failed one is frequently the speed and quality of the application in the first 24 to 48 hours.
In a recent recovery matter, a technology operator tracing a smart-contract exploit moved to engage our disputes desk within hours of the confirmed loss. We coordinated on-chain tracing, prepared the forensic report, and filed for provisional measures in a leading common-law forum while simultaneously engaging the relevant CASP's compliance team. The balance was frozen before the funds were withdrawn to a privacy-coin bridge. No specific dollar figure is attributed to that matter; scale is described only as material to the business involved.
Related at OBOLUS
- Disputes & Asset Recovery for Digital Asset Businesses – how OBOLUS structures cross-border recovery mandates from day one
- Stablecoin Freeze Requests in the Seychelles – issuer freeze mechanics and the legal process across offshore jurisdictions
- Corporate Bank Account Opening: A Cross-border Perspective – banking strategy for digital-asset businesses managing multi-jurisdiction exposure
FAQ
Can stolen crypto actually be recovered?
Recovery is possible but not guaranteed, and the probability depends heavily on speed. The legal toolkit includes on-chain tracing, provisional freezing orders in civil courts, disclosure orders against exchanges, direct stablecoin issuer freeze requests, and law-enforcement referrals through bodies such as MASAK in Turkey. Courts in England and Wales, the DIFC, Hong Kong and Singapore have all confirmed that digital assets can be the subject of proprietary claims and freezing relief. The window to act is short – often 24 to 48 hours from the loss event.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows for misappropriated digital assets are measured in hours. Once funds pass through a mixing service, a cross-chain bridge or a privacy-coin protocol, tracing becomes materially harder and provisional measures lose their force. The forensic report, the court application and the CASP disclosure request should be prepared simultaneously, not sequentially. Engaging counsel at the point of confirmed loss – not after an internal investigation concludes – is the single most important procedural decision a business can make.
Can a court freeze assets held on an exchange?
Yes. Turkish civil courts can order a licensed SPK-registered CASP to freeze a specified balance pending the outcome of substantive proceedings. In cross-border cases, the English Commercial Court, the DIFC Courts, and courts in Singapore and Hong Kong each have well-established jurisdiction to grant freezing orders over assets held on exchanges, including exchanges incorporated in their jurisdiction or subject to their regulatory supervision. The stablecoin issuers Tether and Circle also hold contract-level freeze authority, which can be triggered by a court order or law-enforcement referral.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around those mandates. Digital assets are the whole of our practice. In disputes and recovery work, we move for provisional measures while the forensic trail is live – not after the window has closed. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialist in cross-border digital-asset recovery, provisional measures strategy and on-chain evidence preparation in multi-forum matters.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.