Recovery windows for misappropriated digital assets are measured in hours, not weeks. When funds move across a blockchain, the trail is live but perishable – exchanges process withdrawals continuously, and a day's delay can place assets beyond practical reach. An exchange disclosure order (a court order compelling a centralized exchange to identify and disclose the account holder behind a deposit address) is often the first actionable step in a cross-border crypto recovery. This page explains how the process works, when it succeeds, and what an established business operator needs to prepare before approaching counsel.
What is an exchange disclosure order?
An exchange disclosure order is a court direction compelling a virtual asset service provider (VASP – a centralized exchange or custodian) to disclose KYC identity data, account details and transaction history linked to one or more deposit addresses. It is the digital-asset equivalent of a Norwich Pharmacal order (an English common-law disclosure mechanism that compels an innocent third party mixed up in wrongdoing to reveal the identity of a wrongdoer) or a Bankers Trust order (a disclosure tool applied to financial intermediaries holding assets or information). Both frameworks have been applied to crypto exchanges by courts in England and Wales, the DIFC, Singapore and Hong Kong.
The order does not itself freeze assets. It produces the identity and account intelligence that grounds a subsequent worldwide freezing order (an injunction preventing a defendant from dealing with assets globally, also known as a Mareva injunction). In our cross-border practice, the disclosure order and the freezing order are typically sought in parallel or in immediate succession – the disclosure tells you who to freeze, the freezing order locks what remains.
Courts in England and Wales have treated crypto assets as property capable of supporting proprietary remedies since AA v Persons Unknown [2019], and subsequent decisions have confirmed the court's jurisdiction to make both disclosure and freezing orders against unknown defendants identified only by wallet address. That foundation now anchors disclosure applications across the common-law world.
The cross-border dimension is immediate. Most exchanges are incorporated in offshore or non-EU jurisdictions, yet they hold assets deposited by users in dozens of countries. A disclosure order obtained in London, the DIFC Courts or Singapore carries persuasive weight and – through treaty or comity mechanisms – can reach exchanges that are not domiciled in the issuing jurisdiction. We regularly advise on which forum best fits the asset location, the exchange's registered seat and the victim's own base.
For a scoped assessment of your disclosure application and the forum options available, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the exchange, the asset type, the jurisdictions involved – change the analysis materially.
Who qualifies as an "established operator" for this service?
Established business operators – exchanges, custodians, funds, payment companies and corporate treasury holders – occupy a more advantageous procedural position than retail victims in a disclosure application, for several compounding reasons.
First, the evidentiary baseline. An established operator typically holds transactional records, internal blockchain analytics and documented KYC on counterparts. Courts assessing the threshold for disclosure relief (the applicant must show a good arguable case that wrongdoing occurred and that the respondent holds relevant information) are more easily satisfied when the applicant presents transaction logs, timestamped API records and a professional forensic report rather than a screenshot from a personal wallet interface.
Second, the legal standing profile. A corporate applicant with a documented commercial relationship to the stolen assets – custodied funds, a settlement float, a liquidity reserve – can articulate proprietary loss with precision. That precision matters when the court weighs the balance of convenience: the operator's potential loss against the respondent exchange's interest in customer confidentiality.
Third, speed of mobilization. An established operator with in-house counsel or an existing relationship with external disputes counsel can authorize the application, fund the proceedings and execute the forensic engagement within the hours that the recovery window allows. We have seen cases where the decision to seek relief was made and the supporting documents filed within a single business day – a pace that is structurally unavailable to a retail claimant working alone.
The service described on this page is calibrated to that profile: a business that has suffered digital-asset loss at scale, can document the loss chain, and needs specialist cross-border counsel to convert that documentation into a live court application as quickly as the evidence and the forum allow.
Which legal basis applies, and which forum is right?
Forum selection is the first substantive decision, and it determines which legal instruments are available, how quickly they can be obtained, and whether service on an offshore exchange is achievable. The leading options in our practice are as follows.
England and Wales remains the preferred forum for large-scale crypto recovery. The court's proprietary jurisdiction over digital assets is settled. Norwich Pharmacal and Bankers Trust disclosure orders are available as of right where the threshold conditions are met. The court can grant a worldwide freezing order on the same application. Service out of the jurisdiction on a foreign exchange is available under the Civil Procedure Rules where the claim has a proper basis in the jurisdiction. Critically, the CFAAR network (the Crypto Fraud and Asset Recovery network, launched in London in September 2021) provides a practitioner infrastructure for multi-jurisdiction coordination that no other forum currently matches.
The DIFC Courts in Dubai have developed a credible parallel track. Recent decisions – including matters decided in 2025 – confirm the DIFC Courts' willingness to grant worldwide freezing orders in support of foreign proceedings and to require exchanges operating in the UAE to comply with disclosure directions. For operators with a Gulf or Asian footprint, the DIFC forum reduces enforcement friction materially.
Singapore (under the Supreme Court's inherent jurisdiction and the applicable Rules of Court) and Hong Kong (where the High Court granted what is reported as the jurisdiction's first "tokenised" injunction in a 2024 matter, and recognized crypto as property in Re Gatecoin [2023]) provide additional common-law routes. Both jurisdictions have well-developed disclosure and injunction mechanisms, and both sit on the primary Asia-Pacific exchange corridors where many stolen funds flow.
The choice between these forums is not a matter of preference – it is a matter of where enforcement is fastest, where the exchange has a presence or corresponding account, and where the evidence chain originated. In our cross-border practice, the optimal structure frequently involves parallel filings: a disclosure order in the exchange's home jurisdiction, a freezing order in the jurisdiction where the assets sit, and a preservation letter to the exchange's compliance team coordinated with both applications.
How does the application process work, step by step?
A disclosure application against an exchange follows a defined sequence. Each step is time-sensitive and builds directly on the one before it.
Step 1 – Forensic documentation. The first action is instructing a forensic partner to trace the stolen assets from the originating wallet through the intermediate hops to the deposit address on the target exchange. This produces transaction hashes, a hop-by-hop address chain, timing data and – where possible – a contamination percentage showing what proportion of the funds in the destination address can be attributed to the theft event. Courts in all the leading forums expect a professional forensic report at this stage; a self-generated blockchain explorer printout rarely meets the evidentiary threshold. We work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications.
Step 2 – Drafting the application. The application includes a claim form or originating process (forum-dependent), a witness statement from the applicant setting out the theft, the forensic trail and the loss quantum, the forensic report itself, draft orders (disclosure + freezing, if sought in parallel) and a legal memorandum addressing the threshold conditions. The legal standard in most common-law forums requires the applicant to show: (a) a good arguable case that a wrong was committed; (b) that the respondent holds information or assets relevant to that wrong; and (c) that disclosure is necessary to enable the applicant to pursue its claim.
Step 3 – Without-notice hearing. Disclosure and freezing orders in urgent matters are typically sought without notice to the respondent (ex parte). The applicant's counsel makes full and frank disclosure of all material facts – including anything that could be said against the application. The court, if satisfied, grants a without-notice order returnable on a date when the respondent can be heard. Candor at this stage is not optional; courts have set aside without-notice orders in cases where the applicant failed to disclose material adverse facts, and the reputational and costs consequences are severe.
Step 4 – Service and compliance. The order is served on the exchange. Established exchanges with compliance teams in regulated jurisdictions typically respond within the period the court specifies (which may be as short as a matter of days in urgent applications). The response identifies the account holder's KYC data, transaction history and current balance.
Step 5 – Identity and follow-on relief. The identity data received from the exchange is then used to name the defendant, apply for a contradictory freezing order (now on notice), and – where the defendant is traceable to a recoverable jurisdiction – pursue judgment and enforcement. In cases involving Tether (USDT) or Circle (USDC) stablecoins, a parallel application to the issuer using the court order can achieve a contract-level freeze of the specific token balance. Both issuers hold contractual freeze and blacklist authority over their issued tokens and generally act on a court order or law-enforcement designation.
In a recent matter, an institutional payment company traced a seven-figure misappropriation of stablecoins through two exchanges. We secured a disclosure order in a leading common-law forum within days of instruction, named the account holder from the KYC response, and obtained a freezing order before the balance was withdrawn. The matter is ongoing, but the assets remain under the order.
What are the common mistakes that destroy recovery prospects?
Delay is the single largest cause of failed recoveries. The moment a theft is detected, assets begin to move. Every hour of internal deliberation – escalating through a committee, waiting for board authority, engaging the wrong counsel – is an hour in which the attacker is consolidating, swapping and withdrawing. We move for freezing relief and exchange disclosure while the trail is live. Operators who engage us within hours of detection consistently achieve better outcomes than those who engage days later.
The second mistake is contacting the exchange directly before the order is obtained. An informal inquiry to an exchange's support team alerts the account holder. If the account holder has any visibility into the exchange's communication with the "victim" – through a linked email, a support ticket acknowledgment, or a system-generated alert – they will withdraw immediately. The correct sequence is: forensics first, court order second, then service on the exchange.
A third common error is insufficient forensic preparation. Courts do not grant disclosure orders on assertion alone. An applicant who presents a chain of events without transaction-level documentation, address clustering evidence and a contamination analysis will face adjournment at best and refusal at worst. Adjournment in a disclosure matter is functionally equivalent to refusal – by the time the court reconvenes, the funds have moved.
Finally, forum error is recoverable but costly. An operator who initiates proceedings in a forum with no leverage over the exchange – because the exchange has no assets, no correspondent bank and no regulator in that jurisdiction – will spend weeks on an application that cannot be enforced. Forum analysis must be done at the outset, not after a first filing fails.
If a prior application stalled or an exchange refused to engage, the structural reason is usually recoverable. A second-opinion assessment can identify the correct forum and the correct instrument. Write to info@oboluslaw.com to request a rapid review.
Cross-border execution: how do exchange compliance teams actually respond?
The legal mechanism and the operational reality are different things. Understanding how exchange compliance teams process disclosure orders is essential for setting realistic expectations and structuring the application to maximize response speed.
Exchanges in major regulated jurisdictions – those holding licences under MiCA in the EU, under the VASP licensing regime operated by the SFC in Hong Kong, under MAS's Payment Services Act in Singapore, or registered with the FCA in the UK – typically have legal and compliance functions staffed to process court orders. Response times in those jurisdictions, in our experience, are measured in days to low single-digit weeks when the order is clearly drafted and properly served.
Exchanges in less regulated environments are more variable. An exchange incorporated in a jurisdiction with minimal VASP supervision may technically comply with a disclosure order while providing data of limited utility – incomplete KYC records, outdated email addresses, or a correspondent corporate rather than a beneficial individual. Building the application to anticipate incomplete compliance – including a request for the full document set held by the exchange, not merely what the exchange volunteers – materially improves the output.
The Travel Rule (the obligation, under FATF Recommendation 15 and the applicable VASP provisions in each jurisdiction, to pass originator and beneficiary data with a virtual asset transfer) creates a parallel source of identity data. Where the theft involved a transfer between two regulated exchanges, both exchanges will have received and should hold Travel Rule data. A disclosure order directed at both ends of the transfer – the sending exchange and the receiving exchange – can produce overlapping identity confirmation that is difficult to fabricate.
Stablecoin issuers occupy a separate track. Tether and Circle hold contractual freeze and blacklist authority over USDT and USDC respectively. In practice, both issuers act on court order, a law-enforcement request, or an OFAC designation. A disclosure application that simultaneously produces an issuer freeze – achievable where the asset is a stablecoin and the court order is obtained quickly enough – is the most effective combination we deploy in large-value recovery matters.
Decision matrix: which operator profile uses which recovery approach?
Profile A – Exchange or custodian with a misappropriated client balance. The operator holds documented internal records (transaction logs, API data, internal wallet addresses) and can demonstrate proprietary loss through its own books. The preferred approach is an emergency disclosure application in England and Wales or the DIFC Courts, combined with a without-notice worldwide freezing order. Parallel notification to a stablecoin issuer is appropriate where the stolen assets are USDC or USDT. The indicative window from instruction to a live court order, on well-prepared facts, is a matter of days. Key risk: incomplete forensic documentation at instruction, which delays the without-notice hearing.
Profile B – Fund or treasury holder with an external-theft event. The loss event involves a third-party attacker (phishing, private-key compromise, smart-contract exploit) rather than an internal breach. The operator must establish standing to bring the claim in the chosen forum and demonstrate that the assets at the destination exchange are traceable to its specific loss event (contamination analysis). The preferred forum is typically the jurisdiction with the most favorable proprietary remedy precedent relative to the exchange's compliance profile. Timeline is similar to Profile A where the forensic work is initiated immediately; it extends materially where forensic engagement is delayed. Key risk: forum-selection error based on corporate convenience rather than enforcement leverage.
Profile C – Payment company or fintech with a fraudulent-counterpart event. The loss arises from a counterpart who received payment under a fraudulent commercial arrangement and on-forwarded the proceeds to an exchange. The legal theory is restitutionary rather than purely proprietary; the applicant must trace from the commercial payment through the bank correspondent chain to the exchange deposit. Norwich Pharmacal jurisdiction is available where the exchange is an innocent third party mixed up in the fraud. Singapore and Hong Kong offer attractive options where the counterpart and the exchange have Asian connections. Key risk: the bank-to-exchange chain may involve multiple correspondent hops, each requiring separate disclosure; early forensic engagement on the full chain (not just the exchange leg) is essential.
A common assumption is that once funds leave the wallet, nothing can be done
This is the most damaging misconception we encounter at initial consultation. It leads operators to delay, to report to a regulator rather than a court, and to treat the loss as written off. The misconception has a surface logic: blockchains are pseudonymous, assets move fast, and the attacker may be in an uncooperative jurisdiction. None of those facts forecloses recovery. They change the difficulty of recovery, which is a different thing.
The legal and operational position is this. Digital assets are property. Courts in the leading common-law forums have confirmed that property characterization repeatedly. Property can be frozen. Freeze requests directed at exchange accounts and stablecoin issuers work – when made quickly, on a properly documented application, in the right forum. Forensic tracing converts a pseudonymous address into an identity with a practical hit rate that increases with the quality of the forensic engagement and the speed of the disclosure order.
The cases that end in write-offs are predominantly cases where the victim waited. Waited to consult a lawyer. Waited for the forensic report before calling a lawyer. Waited for internal approval. In those cases, the assets were moved to a non-custodial wallet, fragmented across dozens of addresses, or bridged to a chain with lower forensic coverage. The loss is not caused by the law's inability to act – it is caused by the time between the theft and the instruction.
The cases that result in frozen assets are cases where the operator engaged a disputes team within hours, the forensic work ran in parallel with the court application, and the exchange received a properly constituted disclosure order before it processed a withdrawal request from the attacker's account. That sequence is achievable. It is what this service is designed to deliver.
Related at OBOLUS
- Disputes and asset recovery for digital-asset businesses – the full scope of our recovery and litigation practice for operators
- Worldwide freezing order: a cross-jurisdiction comparison – how freezing relief works across England, DIFC, Singapore and Hong Kong
- Cross-chain bridge legal risk in South Africa – bridge-related loss events and the applicable legal regime in an emerging recovery forum
FAQ
Can stolen crypto actually be recovered?
Yes – when action is taken quickly and the right instruments are deployed. Courts in England and Wales, the DIFC, Singapore and Hong Kong treat digital assets as property and will grant disclosure and freezing orders against exchanges holding stolen funds. The legal infrastructure exists. Recovery depends on the speed of instruction, the quality of on-chain forensic documentation, and the choice of forum relative to where the assets and the exchange actually sit. A well-executed disclosure application can freeze a balance before it is withdrawn.
How fast must I act after a digital-asset theft?
Immediately. The recovery window is measured in hours: exchanges process withdrawals continuously, and a delayed application reaches an empty account. The first actions – engaging disputes counsel and initiating forensic tracing – should happen simultaneously, within the first few hours of detection. A without-notice disclosure application can be filed and heard within a single business day on well-prepared facts. Every hour of internal deliberation before instruction narrows the window further.
Can a court freeze assets held on an exchange?
Yes. A court with jurisdiction over the matter can grant a worldwide freezing order that covers assets held in exchange accounts, and can simultaneously order the exchange to preserve those assets and disclose the account holder's identity. Centralized exchanges in regulated jurisdictions – those operating under MiCA, the SFC regime, MAS's Payment Services Act or FCA registration – generally comply with properly served court orders. Where the stolen assets are stablecoins such as USDT or USDC, a parallel freeze request to the issuer can lock the balance at the contract level.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We move for freezing relief and exchange disclosure while the trail is live, working alongside forensic partners to convert on-chain evidence into court-ready applications. To discuss a recovery matter, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specialist in cross-border digital-asset recovery, exchange disclosure applications and freezing relief across common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.