Recovery windows for misappropriated digital assets are measured in hours, not weeks. A business that has suffered a crypto theft or fraud in the United Kingdom faces an immediate strategic question: which legal instruments are available, how quickly can they be obtained, and what must be done in parallel to prevent the trail going cold on-chain? Crypto fraud asset recovery in the UK operates through a mature but fast-moving body of law – one that has produced disclosure orders, asset freezes and proprietary injunctions in digital-asset matters at a pace that leads every other common-law forum. This guide walks through the sequential steps, the legal basis at each, and the cross-border complications that affect most business claimants.
Why UK Law Leads on Crypto Asset Recovery
England and Wales is the world's most developed forum for digital-asset litigation, and that matters the moment a business realises funds are gone. The courts have recognised crypto assets as property capable of being frozen, traced and returned – a principle cemented in landmark decisions that now anchor the entire recovery process. AA v Persons Unknown [2019] established that Bitcoin is property under English law; Osbourne v Persons Unknown [2022] extended that to NFTs. Every subsequent order – the freezing injunction, the disclosure order, the proprietary claim – rests on that foundation.
The practical consequence is that a business claimant has genuine, rapidly deployable tools. Courts in England and Wales will grant a worldwide freezing order (an injunction that freezes a defendant's assets anywhere on the planet), a Norwich Pharmacal order (requiring a third party such as an exchange to disclose the identity of a wrongdoer), and a Bankers Trust order (requiring disclosure of information about specific assets). All three can be sought on an urgent, without-notice basis when speed is the difference between recovery and loss.
The Financial Conduct Authority (FCA) sits at the regulatory perimeter here too. Exchanges and custodians operating in the UK must be registered under the Money Laundering Regulations and are subject to the FCA's cryptoasset financial-promotion rules. That registration obligation means regulated entities hold verified KYC data – the same data that a disclosure order can compel them to produce.
For a scoped assessment of your recovery position, contact OBOLUS at info@oboluslaw.com before the trail cools. The process above describes the standard path. Your facts – the entity type, the blockchain, the counterparty exchange – change the analysis entirely. Map your options
Step 1: Secure the On-Chain Evidence
On-chain tracing must begin within hours of a confirmed theft or fraud – the single most time-critical step in the entire recovery sequence. Before any court application is filed, the claimant's legal team needs a forensic transaction map: wallet addresses, transaction hashes, the movement of funds across exchanges or bridge protocols, and any conversion into privacy-enhancing instruments. Without that map, a court order has no identifiable target.
In our cross-border practice we engage forensic partners – specialists in blockchain analytics whose reports carry the evidential weight courts expect – in parallel with the first legal steps. The report serves two functions. First, it identifies where the assets currently sit. Second, it provides the technical annex that supports the without-notice application to court, demonstrating that the assets are traceable and at real risk of dissipation.
A common mistake at this step is waiting for a police report before taking civil action. In the UK, civil and criminal proceedings run independently. A business claimant does not need a prior criminal investigation to seek a civil freezing order or a disclosure order. Waiting for law enforcement to move first can cost days the recovery cannot afford.
The cross-border note is critical. Most crypto thefts involve at least one exchange that is not UK-based. The on-chain evidence must therefore be gathered with an eye on which forums will accept it. A forensic report prepared to the standard required by English courts is generally accepted in Singapore, Hong Kong and the DIFC Courts – the four leading common-law recovery forums – which matters when a parallel application is needed abroad.
Step 2: Obtain a Freezing Order and Exchange Disclosure
A worldwide freezing order from the English courts is the primary tool for immobilising misappropriated digital assets – and it can be obtained on an urgent, without-notice basis, often within a single business day when the evidence is ready. The applicant must demonstrate a good arguable case on the merits, a real risk that the defendant will dissipate or move the assets, and – for a without-notice order – that there is a genuine urgency that justifies proceeding without informing the other side.
In parallel, a Norwich Pharmacal or Bankers Trust order compels an exchange or custodian to disclose the identity and account details of the wallet holder. Where the exchange is UK-registered under the FCA regime, service is straightforward. Where it sits offshore, the English order can be used as the basis for a parallel application in the exchange's home jurisdiction – or, in some cases, served directly where the exchange has a UK footprint.
Stablecoin freezes add a separate instrument. Tether (USDT) and Circle (USDC) hold contract-level blacklist authority over their issued tokens and generally act on a law-enforcement reference or a formal legal request supported by court documentation. Coordinating that request alongside – not after – the court application maximises the window before funds are converted or moved to a non-freezable asset. We move for freezing relief and exchange disclosure while the trail is live; the timing of the stablecoin notification is part of the same tactical sequence.
Step 3: Serve and Enforce the Order Across Borders
Service of an English freezing order on a defendant or exchange located outside the UK raises jurisdictional questions that must be resolved before the order reaches its target. For defendants domiciled within the EU, service follows established international civil procedure channels. For defendants in the UAE, Singapore or Hong Kong, allied counsel in the relevant jurisdiction is instructed to seek recognition or a parallel order in the local forum, using the English order as the anchor document.
In a recent recovery matter, a payments company traced misappropriated stablecoins through two offshore exchanges. We coordinated a Norwich Pharmacal application in England and Wales to identify the wallet controller, then used the resulting disclosure to support a parallel freezing application in a second common-law forum. The assets were frozen before the defendant completed a conversion attempt. The cross-border sequence – timed, not sequential – was the operational difference.
A second common mistake at this stage is treating service as a formality. Courts in some jurisdictions will refuse to recognise a foreign order if the procedural steps for obtaining it do not meet local standards for natural justice. Building the English application to that standard from the outset – rather than correcting it after service fails – saves weeks of remedial work.
The DIFC Courts in Dubai have recently demonstrated a strong willingness to grant worldwide freezing orders in support of foreign proceedings, as illustrated by developing practice in 2025. Singapore's courts are equally receptive where the claimant can establish a proprietary interest in the assets. Identifying the right combination of forums at Step 1 – not at Step 3 – is what determines whether enforcement is surgical or reactive.
If a prior application stalled or an exchange declined to cooperate, a structural review can identify the route back. Write to info@oboluslaw.com or Map your options.
Step 4: Pursue the Proprietary Claim and Restitution
Once assets are frozen and the defendant's identity is known, the claimant must advance the substantive claim before the freeze expires or is discharged. In English law, a business victim of crypto fraud can pursue a proprietary claim – asserting that it retains the beneficial ownership of the misappropriated assets even after they have passed through multiple wallets. This claim survives mixing and conversion in many scenarios, and it is stronger than a purely personal damages claim because it follows the asset rather than the wrongdoer's personal balance sheet.
The practical structure of the claim typically runs: proprietary restitution for the original asset or its traceable proceeds, plus a personal claim against the defendant for unjust enrichment or fraud, plus a potential claim against any exchange or custodian that facilitated the transfer in breach of its own AML obligations. Each head of claim has a different limitation consideration and a different evidential burden.
Cross-border structuring interacts here. If the claimant is a fund or corporate entity domiciled outside the UK, the tax treatment of a recovered sum – is it a capital receipt, a trading receipt, or a return of capital? – must be considered before settlement is reached. The answer varies by the claimant's jurisdiction of incorporation and the nature of the asset lost. Engaging tax counsel early, not after the settlement term sheet arrives, avoids a recoverable situation becoming a tax surprise.
How Does the CFAAR Network Help UK Recovery?
The CFAAR (Crypto Fraud and Asset Recovery) network, launched in London in September 2021, is the specialist practitioner forum for cross-border digital-asset recovery. Its significance for a UK-anchored matter is operational: it provides a structured channel for coordinating across jurisdictions, aligning forensic standards and sharing intelligence about recovery techniques recognised in the leading forums.
In our cross-border practice, CFAAR connectivity means that a matter beginning in England and Wales can be escalated to allied counsel in Singapore, Hong Kong, the BVI or the Cayman Islands without losing evidential continuity. Exchange disclosure obtained in one forum feeds the application in the next. The network functions as an accelerant for the multi-step, multi-forum sequence that most serious recovery matters require.
For an inbound business claimant – a company incorporated in the EU, the MENA region or Asia Pacific that suffered a theft executed through a UK-connected exchange – the CFAAR structure also provides a route to establish English jurisdiction even where the claimant has no UK presence. The connecting factor is often the exchange's FCA registration or the exchange's UK operational footprint, either of which can anchor the application.
What Can Go Wrong in a UK Crypto Recovery?
The most common failure mode in UK crypto fraud recovery is speed: the claimant notifies their internal team, who notify external counsel, who begin a conflict check, by which time the funds have left the exchange. The English courts' ability to grant without-notice relief in hours is only valuable if the legal team is instructed early enough to use it. In our practice, we regularly advise clients to have a recovery protocol in place before an incident occurs – not because incidents are inevitable, but because the first-48-hours window is structurally decisive.
A common assumption is that once funds leave the wallet, nothing can be done. That is wrong in most scenarios involving centralised infrastructure. Centralised exchanges hold KYC data. Stablecoin issuers hold freeze authority. Forensic tools can trace funds through multiple hops. The English courts will move quickly when the evidence is ready. The myth of crypto theft as a permanent loss reflects the position before the legal tools existed – not the current state of the law in England and Wales.
Three operational failure points appear regularly in matters we review. First: the claimant reports to police but takes no civil steps, losing days. Second: the forensic report is prepared without legal input and fails to meet the evidential standard the court requires. Third: the freezing order is obtained but the stablecoin issuer is not notified in time, allowing conversion. Each is avoidable with a coordinated legal and forensic response from the outset.
For businesses with significant digital-asset holdings, a pre-incident recovery protocol – mapping the applicable forums, the relevant exchanges, the stablecoin issuers and the internal escalation path – is among the highest-return steps a general counsel can take. It costs a fraction of the legal spend a live recovery requires.
Decision Matrix: Which Business Profile Should Proceed How?
Not every crypto fraud recovery follows the same path. The right instrument and forum depend on the claimant's profile, the nature of the loss and the location of the assets.
A UK-incorporated exchange or custodian that has suffered a theft through a compromised hot wallet should move immediately for a worldwide freezing order in England and Wales, simultaneously notifying any relevant stablecoin issuer and instructing forensic analysts. The FCA registration of the defendant exchange (if UK-based) simplifies the disclosure application. Timeline to first order: typically a matter of hours to days when evidence is prepared in advance.
A fund or institutional investor domiciled outside the UK that suffered a loss through a UK-connected platform has a slightly longer initial step – establishing the English court's jurisdiction over the matter – but the tools available are the same. The cross-border note is that the claimant's home jurisdiction may impose its own notification or reporting obligations on a significant asset loss; those run in parallel with the recovery action and should not be used as a reason to delay the English application.
A business that suffered a rug-pull or insider fraud involving tokens that are now dispersed across DeFi protocols faces the most complex recovery path. On-chain tracing in a DeFi environment is technically harder and the jurisdictional hooks are less obvious. That said, if any part of the value passed through a centralised exchange with a UK presence, or if the promoter has identifiable UK connections, the English court's jurisdiction can often be established. The realistic first step is a detailed forensic assessment, not an immediate court application.
In each profile, the decision to pursue recovery in England alone versus a multi-forum strategy turns on where the assets now sit and where the defendant is likely to be amenable to enforcement. That is a judgment call that requires current forensic intelligence, not a template.
Related at OBOLUS
- Disputes and Asset Recovery for Digital-Asset Businesses – our full cross-border recovery and litigation practice for operators, funds and fraud victims
- How to Respond in the First 48 Hours After a Crypto Theft – a step-by-step protocol for the critical recovery window
- How to Tokenise a Fund Structure – structuring and legal considerations for fund tokenisation across jurisdictions
FAQ
Can stolen crypto actually be recovered?
Yes, in many cases – particularly where funds passed through a centralised exchange holding KYC data, or where stablecoins are involved. English courts will grant worldwide freezing orders and compel exchange disclosure on an urgent basis. Stablecoin issuers such as Tether and Circle hold contract-level freeze authority. The realistic prospects depend on how quickly legal and forensic steps are taken and whether the assets remain in traceable, freezable infrastructure.
How fast must I act after a digital-asset theft?
Speed is the single most important variable. Recovery windows are measured in hours, not days. Once funds are converted to a non-freezable asset, moved to a privacy protocol or withdrawn to self-custody, the practical difficulty of recovery increases sharply. An English court can grant without-notice relief within hours when the evidence package is ready. That means instructing legal counsel and forensic analysts simultaneously – not sequentially.
Can a court freeze assets held on an exchange?
Yes. An English worldwide freezing order binds any exchange served with it, including exchanges with a UK operational footprint or FCA registration. A Norwich Pharmacal order can compel a UK-registered exchange to disclose the identity and account details of a wallet holder. For exchanges domiciled offshore, allied counsel in the relevant forum can seek a parallel order using the English order as the anchor. Compliance timelines and procedural steps vary by jurisdiction.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions, on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance that sit around them. In our recovery practice, we move for freezing relief and exchange disclosure while the trail is live – coordinating forensic, legal and cross-border steps as a single sequence. Digital assets are the whole of our practice. To discuss a recovery situation, contact info@oboluslaw.com or reach us via t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specialising in cross-border digital-asset fraud recovery and injunctive relief in the leading common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.