An early-stage founder whose treasury has been drained by an unauthorized transfer faces a decision that matters more than almost any other in the life of the company: act within hours, or accept that the funds are gone. Exchange disclosure orders – court orders compelling a centralized exchange to identify account holders and provide transaction records – are the primary legal instrument for mapping where misappropriated digital assets went and who controls them. The applicable regimes in England and Wales, the DIFC Courts, Singapore, and Hong Kong each provide a route to compel exchange cooperation before a defendant has time to move funds off-platform.
For a founder navigating this, the critical insight is that disclosure and freezing relief can be pursued simultaneously. A single hearing can produce both an order identifying the counterparty and an injunction preventing further movement. Speed, however, is everything. In our practice, we have seen recovery prospects collapse within twenty-four hours of an incident because the initial steps – transaction preservation, forensic documentation, and the emergency application – were delayed by a misunderstanding of how the process works.
This page maps the legal basis for exchange disclosure orders, explains how a founder obtains one, identifies the mistakes that kill a live recovery, and sets out what a cross-border case looks like in practice.
What is an exchange disclosure order and why does it matter for founders?
An exchange disclosure order is a court order directed at a third party – typically a centralized exchange – requiring it to disclose customer account information, transaction records, and KYC data linked to a specified wallet address or transaction. It is not itself a freezing order, though the two are routinely sought together. The disclosure order answers the identity question; the freezing order answers the movement question.
For early-stage founders, the instrument matters for a structural reason. A startup treasury is often concentrated: a single multisig wallet, a single custodian account, or a small number of on-chain addresses holding the entire operating runway. A single unauthorized transfer can be existential. The exchange disclosure order provides the mechanism to identify who received the funds – and, once identity is established, to proceed against that person in court or to support a law-enforcement referral.
In England and Wales, the jurisdiction with the most developed crypto-recovery case law, disclosure orders against third parties are well established under the Norwich Pharmacal doctrine, which permits a court to compel an innocent third party that has become mixed up in wrongdoing to provide information about the wrongdoer. The same principle, expressed in adapted local procedural rules, operates in the DIFC Courts, Singapore, and Hong Kong. In our cross-border practice, we regularly advise founders on which forum to approach first, based on where the exchange is incorporated, where the assets moved to, and which court can act fastest on the available evidence.
The process requires: a transaction hash, wallet address evidence, a professional forensic trace, and a sworn statement explaining the loss. Without all four, no court will move on an emergency basis.
Exchange disclosure orders operate alongside, not instead of, freezing injunctions. A founder who obtains only disclosure and not a freezing order may identify the counterparty too late to prevent withdrawal.To map the correct forum and application strategy for your situation, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the exchange, the jurisdiction, the size of the loss – change the analysis.
What is the legal basis for compelling exchange disclosure across the leading forums?
Each leading recovery forum provides a distinct doctrinal route to compel a centralized exchange to disclose account and transaction data, and a founder must understand which route applies to which exchange.
In England and Wales, the Norwich Pharmacal jurisdiction allows a victim of wrongdoing to seek a court order against a third party – including a foreign exchange with assets or operations connected to the jurisdiction – requiring disclosure of information identifying the wrongdoer. The Bankers Trust jurisdiction provides an overlapping route for disclosure of financial records where assets are in jeopardy. The decision in AA v Persons Unknown [2019] confirmed that Bitcoin is capable of being the subject of a proprietary injunction; Osbourne v Persons Unknown [2022] extended that to NFTs. These decisions are now the structural foundation for crypto-recovery applications in the English courts.
The DIFC Courts in Dubai apply a common-law procedural framework and have shown willingness to grant worldwide freezing orders in support of foreign proceedings. For a founder whose exchange operates from the UAE or whose counterparty may be located there, the DIFC is a viable and increasingly active forum.
In Singapore, the courts have granted proprietary injunctions over digital assets and have, in practice, compelled disclosure from exchanges. The Monetary Authority of Singapore's Payment Services Act licensing regime means that major exchanges operating in Singapore are regulated entities subject to local court process.
In Hong Kong, the Securities and Futures Commission's VASP licensing regime similarly subjects exchanges to local regulatory oversight, and the courts have shown willingness to recognize digital assets as property capable of being the subject of injunctive relief.
A common early mistake is to approach only one forum. In our practice, we regularly coordinate applications across two jurisdictions where the exchange is registered in one and the assets have moved to another. A disclosure order in the first jurisdiction can support a freezing application in the second within the same business day.
How does a founder actually obtain an exchange disclosure order?
Obtaining an exchange disclosure order follows a defined sequence of steps, each of which has a failure point that a founder who acts alone is likely to miss.
Step one: preserve the on-chain evidence. Before any legal step, the founder must document the incident in a form a court can use: transaction hashes, timestamps, wallet addresses, the sending and receiving addresses, and any exchange account information connected to the transaction. Screenshots are insufficient. A formal chain-of-custody record matters for admissibility.
Step two: obtain a professional forensic trace. Courts in England and Wales, Singapore, and Hong Kong expect to see a forensic blockchain analysis report, produced by a recognized tool, that traces the movement of funds from the victim wallet through intermediary addresses to the receiving exchange. This report is the evidential backbone of the application. Without it, a judge has no independent basis to conclude that the identified exchange is the right target.
Step three: identify the correct respondent. The order is directed at the exchange, not at the unknown counterparty. Identifying which legal entity within an exchange group holds the relevant account – and in which jurisdiction that entity is incorporated – determines which court has the most direct authority to compel a response. This is a step that requires current knowledge of how the major exchange groups are structured legally.
Step four: prepare the application. A without-notice application (an application made without advance warning to the respondent) requires a sworn statement setting out: the nature of the loss, the forensic evidence linking the funds to the exchange, the legal basis for the order, and – in most jurisdictions – a duty-of-candor undertaking disclosing any matter that could weigh against the application. Without-notice applications carry a higher disclosure burden precisely because the respondent is not present to answer.
Step five: serve and enforce. Once the order is granted, service on the exchange is itself a tactical decision. An exchange served with a disclosure order has a defined period in which to respond. Coordinating that service with any freezing order on the same facts is essential – serving the disclosure order before the freezing order has been granted can alert the account holder and trigger withdrawal.
In a recent recovery matter, a DeFi-adjacent startup approached us after an unauthorized transfer of stablecoin assets from its operating treasury. We coordinated a forensic trace and a without-notice application in a common-law forum within the same business week, obtained a disclosure order identifying the receiving account, and supported a subsequent freezing application before the account holder had the opportunity to move the balance off-platform. The timeline from initial instruction to interim relief was a matter of days.
What cross-border complications arise for early-stage founders?
Cross-border complexity is the default condition for a founder pursuing exchange disclosure, not the exception. Most significant losses involve funds that cross at least two jurisdictions between the moment of theft and the moment a lawyer is instructed.
The first complication is exchange jurisdiction. A founder incorporated in the EU whose funds move to an exchange registered in the Cayman Islands and operating from a Singapore subsidiary faces a threshold question before any application can be drafted: which court has authority to compel this particular exchange entity, and which is fastest? The answer turns on corporate structure, not on where the founder is based.
The second complication is the interaction between the exchange disclosure order and asset-referenced token (ART) or stablecoin freeze authority. Tether and Circle hold contract-level freeze authority over USDT and USDC respectively, and issuers generally act on a court order or a law-enforcement designation. For a founder whose treasury was denominated in stablecoins, a parallel application to the issuer – backed by a court order from a recognized forum – can freeze the asset at the token level while the exchange disclosure process is under way. This dual-track approach is often the most effective recovery architecture.
The third complication is the Travel Rule – the regulatory obligation under FATF Recommendation 15 requiring originator and beneficiary data to accompany transfers above applicable thresholds. Travel Rule data held by a regulated exchange may include the identity of the account holder at the receiving exchange. In a disclosure application, this data can be the most directly useful record the exchange holds. A court order compelling disclosure of Travel Rule records is therefore often worth more than a general account-information order.
For a founder sitting between a European operating entity and assets that have moved to an exchange in the Asia-Pacific region, the practical answer is to start with the forum that can act fastest on a without-notice basis – typically England and Wales or Singapore – and use the resulting order to support enforcement in the second jurisdiction through the allied-counsel network.
What mistakes destroy recovery prospects before legal proceedings begin?
Recovery prospects for digital-asset theft are more fragile at the pre-litigation stage than in almost any other area of commercial dispute. The steps a founder takes – or fails to take – in the first hours after discovery determine whether the case is recoverable at all.
The most common and most damaging mistake is delay. A founder who spends the first twenty-four hours investigating internally, contacting the exchange through customer-support channels, or waiting for a response before instructing counsel is, in most cases, waiting long enough for the counterparty to move the funds off-platform. Recovery windows are measured in hours, not weeks. Emergency legal applications – without-notice freezing orders and disclosure orders – exist precisely because the ordinary adversarial timeline is incompatible with the pace at which digital assets can be moved.
The second mistake is the belief that contacting the exchange directly is equivalent to – or a substitute for – a court order. Exchanges do not, absent extraordinary circumstances, freeze accounts or disclose customer data in response to a victim's request. They require a court order. A founder who spends forty-eight hours in exchange support-ticket correspondence before instructing counsel has likely lost the recovery window on a live matter.
A common assumption is that once funds leave a wallet, nothing further can be done. That is not the legal or practical position. Blockchain transactions are immutable in the ledger, which means they are permanently traceable – the question is whether the assets are still accessible at the point a court order is obtained. The CFAAR network, launched in London in September 2021, and the growing body of crypto-recovery case law in England, Singapore, and Hong Kong demonstrate that recoveries against identified defendants remain possible even where funds have moved through multiple intermediary addresses.
The third mistake is insufficient evidence at the point of instruction. A founder who cannot immediately provide transaction hashes, wallet addresses, and a timeline of the incident forces counsel to spend time reconstructing evidence that the founder could have preserved in the first thirty minutes. Forensic blockchain analysis requires a starting point. Providing that starting point precisely, quickly, and in a documented form is the single most valuable thing a founder can do before the first call with counsel.
If a recovery clock is already running, reach our disputes desk immediately at info@oboluslaw.com or via t.me/oboluslaw. If a prior application stalled or an exchange failed to respond, a second read can surface the structural reason and the route forward.
Which approach fits which founder profile?
Not every founder's situation calls for the same entry point into the disclosure and recovery process. The correct approach depends on the size of the loss, the nature of the asset, the jurisdiction of the exchange, and the speed at which the matter is moving.
Profile A – recent loss, stablecoin asset, exchange identified. This is the highest-probability recovery scenario. The founder can pursue a without-notice application in a common-law forum for simultaneous disclosure and freezing relief, and a parallel request to the stablecoin issuer backed by the court order. The timeline from instruction to interim relief is typically a matter of days in the leading forums. The key risk is delay between discovery and instruction.
Profile B – recent loss, native token (BTC, ETH, or similar), exchange identified. Disclosure and freezing applications follow the same route, but there is no issuer freeze authority available at the token level. The freezing order against the exchange account is therefore the only mechanism for preventing withdrawal. Speed is even more critical. The key risk is that the receiving exchange is incorporated in a jurisdiction with slower court process or without a developed crypto-property framework – in which case allied counsel in the relevant jurisdiction must be engaged in parallel.
Profile C – loss discovered after a delay, trail partially cold. Forensic blockchain analysis can often reconstruct the path of funds even where they have passed through several intermediate addresses. However, the probability of interim freezing relief decreases as time passes and the number of hops increases. In this profile, the priority shifts from freezing to identification – obtaining a disclosure order that identifies the ultimate recipient, with a view to civil proceedings against an identified defendant rather than emergency asset-preservation.
Profile D – cross-border loss, multiple exchanges involved. This is the most complex profile. The founder needs to identify, with the help of forensic analysis, which exchange holds the most significant balance and which court can most efficiently compel that exchange to respond. A coordinated multi-forum strategy – typically combining an English or Singapore first-mover application with parallel enforcement actions in one or two additional jurisdictions through allied counsel – is the standard approach in our cross-border practice.
Self-assessment: are you ready to apply?
Before instructing counsel on an emergency basis, a founder should be able to answer yes to each of the following. If any answer is no, the first step is to address the gap – not to proceed with an incomplete application.
Do you have the transaction hashes for every transfer involved in the incident, in documented form? Do you have the wallet addresses of the sending and receiving wallets, independently verified? Do you have a timeline of events – when the transfer was authorized, when it was discovered, and what steps have been taken since? Have you avoided contacting the exchange directly in a way that could alert the account holder? And do you have a clear record of the asset type, quantity, and approximate value at the time of the incident?
If the answer to each is yes, you are in a position to instruct on an emergency basis and to expect counsel to move within hours. If any is no, the priority is to recover that information as quickly as possible – preferably within the same business day as the incident is discovered.
In our practice, we regularly work through the evidence-gathering process with founders in parallel with preparing the legal application. The two are not sequential – they run simultaneously in a live recovery matter.
Related at OBOLUS
- Disputes and asset recovery for digital-asset businesses – the full scope of our recovery and litigation practice across 25+ forums
- Smart contract dispute resolution – what recent enforcement tells operators about on-chain risk and legal exposure
- Exchange disclosure orders for institutional clients – how the same instrument applies at institutional scale, with different risk and forum considerations
FAQ
Can stolen crypto actually be recovered?
Recovery is possible but not guaranteed, and the probability depends heavily on speed and the forum. Where the receiving exchange is a regulated entity subject to a competent court's jurisdiction – particularly in England and Wales, Singapore, or Hong Kong – disclosure and freezing orders can preserve assets before withdrawal. Forensic blockchain analysis can trace funds even through multiple intermediate addresses. However, the recovery window is short, and delay is the single most common reason recoveries fail.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows are measured in hours, not days. The first priority is to document the incident – transaction hashes, wallet addresses, timeline – and to instruct counsel on an emergency basis. Without-notice applications for freezing and disclosure relief can be made in the leading common-law forums within a matter of hours of instruction, provided the evidence is in order. Every hour that passes before a court order is in place is an hour in which the counterparty can move the funds off-platform.
Can a court freeze assets held on an exchange?
Yes. Courts in England and Wales, Singapore, Hong Kong, and the DIFC have all granted injunctive relief over digital assets held in exchange accounts. The order is directed at the exchange as a third party, prohibiting it from releasing the relevant balance pending further order of the court. The legal basis for treating digital assets as property subject to injunctive relief is now well established in each of these jurisdictions, building on decisions including AA v Persons Unknown [2019] in England and Wales.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and founders on disputes and on-chain asset recovery across more than twenty-five forums, and on the licensing, tax and compliance that sit around them. Digital assets are the entirety of our practice. We move for freezing relief and exchange disclosure while the trail is live. To discuss a recovery matter or to pressure-test your incident response posture before a loss occurs, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specialist in exchange disclosure applications, on-chain asset tracing and multi-forum freezing relief for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.