When misappropriated digital assets move off a victim's wallet, the trail goes live – and begins to cool almost immediately. An exchange disclosure order (a court order compelling a centralized exchange to identify account holders and produce transaction records) is one of the most effective tools available to institutional victims of crypto theft or fraud. Obtained quickly in a competent forum, it reveals the identities behind pseudonymous addresses, preserves evidence and, combined with a worldwide freezing order (an injunction restraining a defendant's assets wherever situated), can stop proceeds before they are dispersed. This page explains how the process works, where it works best and what determines whether a disclosure application succeeds or fails.
Why speed is everything in digital-asset recovery
Recovery windows for misappropriated digital assets are measured in hours, not weeks – and the first hours are when the exchange disclosure order earns its value. Once funds reach a centralized exchange and are converted or withdrawn, the on-chain trail fractures and the practical recovery route narrows sharply. Acting before that conversion event is the difference between a live claim and an evidentiary reconstruction exercise.
Institutional victims – exchanges, custodians, corporate treasury teams and funds – often discover the loss only after a lag: an anomalous withdrawal surfaces in a reconciliation run, a counterparty notifies them, or a forensic alert fires. That lag is costly. We have seen matters where the difference between a successful asset freeze and a failed one came down to twelve hours of delay in instructing counsel. The lesson is structural: the incident-response workflow must include a legal escalation path, not just a technical one.
The second obstacle is cross-border reality. The exchange holding the misappropriated assets may be registered in one jurisdiction, operate servers in another and be subject to regulatory oversight in a third. The forum in which you obtain the disclosure order must be one whose orders the exchange will comply with – either because it operates there, because the order carries recognized extraterritorial reach, or because allied counsel can enforce it locally. Choosing the wrong forum wastes critical days.
The fastest-acting forums for exchange disclosure orders in digital-asset matters are England & Wales, the DIFC Courts in Dubai and, for assets connected to Asia-Pacific, Singapore and Hong Kong. Each has developed a body of practice recognizing crypto assets as property and granting disclosure relief on an expedited basis.
What is the legal basis for compelling exchange disclosure?
An exchange disclosure order derives from two distinct but complementary legal doctrines: the Norwich Pharmacal jurisdiction (a rule compelling a third party who has been mixed up in wrongdoing to disclose information enabling the wrongdoer to be identified and sued) and the Bankers Trust jurisdiction (disclosure in aid of tracing misappropriated assets). Both doctrines have been applied to crypto exchanges in England & Wales and in common-law influenced forums including the DIFC Courts.
The applicant must satisfy the court on three core points: that a wrong has been committed, that the exchange possesses information or documents that are likely to assist in identifying the wrongdoer or tracing the assets, and that disclosure is necessary and proportionate. Courts do not require certainty of wrongdoing – a good arguable case suffices at the disclosure stage.
English courts recognized crypto assets as property subject to injunctive and disclosure relief in AA v Persons Unknown [2019], a decision that has since been cited and applied in DIFC, Singapore and Hong Kong. That recognition is now mainstream in the leading common-law forums. It means the architecture of property law – tracing, freezing, disclosure – travels to digital assets with it.
In the DIFC Courts, a series of recent decisions has confirmed the forum's willingness to grant worldwide freezing orders and disclosure relief in support of foreign proceedings, as well as in standalone Dubai matters. This makes the DIFC a particularly useful forum for businesses with a UAE nexus or for matters where the relevant exchange has a regional presence in the Gulf. Hong Kong's regime – illustrated by the court's first "tokenised" injunction in 2024 – and Singapore's 2022 recognition of proprietary injunctions over crypto assets similarly anchor Asia-Pacific recovery work.
How does the exchange disclosure application process work?
The process moves in stages, and the quality of the evidence assembled before the application is filed determines whether the court grants relief on the first return date or adjourns for further material.
The first stage is on-chain forensic mapping. Before any court filing, a professional forensic report tracing the misappropriated assets to specific exchange deposit addresses is essential. Courts expect it. Forensic tools used in the industry – including those deployed by firms such as Chainalysis, TRM Labs, Elliptic and Asset Reality – generate blockchain analytics output that forms the evidentiary backbone of the application. The report must identify the transaction hashes, the wallet addresses involved, the exchange or exchanges at which funds arrived, and any intermediate mixing or bridging steps. Without this foundation, the application is weak.
The second stage is forum selection and initial instructions. The applicant's counsel files an urgent without-notice application (or, in some forums, an expedited on-notice application) supported by the forensic report, a witness statement setting out the loss, and a draft order. The without-notice route is appropriate where prior notification would risk dissipation of assets – which is almost always the case in a misappropriation scenario.
The third stage is the exchange's response. Once served, the exchange typically has a defined period to comply. Most regulated exchanges operating in England, the DIFC or Singapore are institutionally familiar with this type of order and will provide the requested records – account KYC data, transaction records, IP logs – within the time prescribed by the court. Non-compliance is contempt of court.
The fourth stage is using the disclosure to build the substantive claim. The identity revealed by the exchange disclosure enables the victim to join a named defendant to the proceedings, seek a worldwide freezing order against that defendant's assets, and – where the wrongdoer holds assets at a stablecoin issuer – engage with issuers such as Tether (USDT) or Circle (USDC), both of which hold contract-level authority to freeze specific token addresses, generally acting on court order or law-enforcement designation.
The CFAAR (Crypto Fraud and Asset Recovery) network, launched in London in September 2021, provides an additional cross-border coordination mechanism for practitioners pursuing recovery across multiple forums simultaneously.
To map your specific forum options and start the forensic intake process, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the exchange, the jurisdiction, the on-chain trail – change the analysis and the urgency calculus.
How does the cross-border dimension affect the strategy?
The structural reality of digital-asset recovery is that assets, wrongdoers and exchanges rarely sit in the same jurisdiction as the victim. A Singapore-incorporated fund, assets misappropriated through a phishing event, funds deposited at an exchange regulated in Seychelles and then bridged to a USDT address – the recovery strategy must span at least three forums before a freeze becomes executable.
Forum selection is the first critical decision. England & Wales produces orders with broad extraterritorial reach and a mature service-of-process regime for overseas defendants. The DIFC Courts are increasingly used for matters with a Gulf nexus, particularly where the exchange or the wrongdoer has UAE connections. Singapore is the preferred forum for Southeast Asian matters; Hong Kong for those involving PRC-connected assets or exchanges.
The choice of forum also turns on whether the relevant exchange will comply voluntarily on receipt of the order, or whether enforcement proceedings will be needed in the exchange's home jurisdiction. We work with allied counsel in the relevant jurisdiction to assess compliance risk before the forum decision is locked. Filing in a forum whose orders an exchange can credibly resist adds weeks and cost to a process where time is the asset.
Stablecoin freeze requests add a parallel track. Where misappropriated assets are held in USDT or USDC, a direct request to the issuer – supported by a court order and, ideally, a law-enforcement case reference – can freeze the specific address before the wrongdoer moves funds on-chain. This track runs concurrently with, not instead of, the disclosure application. It is faster but conditional on the issuer's cooperation and on the assets remaining in the originally identified address.
Tax and banking consequences of recovery also require attention. Institutional victims should consider how a successful recovery – particularly one that results in funds being returned in a different token or jurisdiction from the original loss – interacts with their reporting obligations. We flag these issues early and, where necessary, bring in structuring analysis alongside the recovery work.
What are the most common mistakes institutional victims make?
The first and most consequential mistake is delay. Institutional incident-response processes are designed for technical containment, not legal escalation. By the time the matter reaches legal counsel, a day or more may have elapsed. That day may be the difference between assets sitting at an exchange and assets withdrawn into a privacy protocol or off-ramped to fiat. Every hour without a freeze application is an hour the wrongdoer uses.
The second mistake is filing in the wrong forum without thinking through compliance. An order obtained in a jurisdiction where the exchange has no regulated presence or assets is an order that takes months to enforce – if it is enforceable at all. Forum selection requires a realistic assessment of where the exchange operates, where it has regulated entities and where allied counsel can move quickly.
The third mistake is underinvesting in the forensic report. Courts are sophisticated about blockchain analytics. A superficial report that traces funds one hop without addressing intermediate steps, bridging transactions or chain-switching will not satisfy the evidential threshold for a without-notice disclosure order. The forensic report is not a commodity – it is the case.
The fourth mistake is treating disclosure and freezing as sequential rather than parallel. In practice, the without-notice application for a worldwide freezing order and for the exchange disclosure order should be sought simultaneously where the evidence supports it. Waiting for disclosure before seeking the freeze loses the window in which the freeze matters most.
A fifth mistake – specific to corporate victims with in-house legal teams – is attempting to manage the matter without external counsel experienced in the forum. The procedural requirements for a without-notice application vary materially by jurisdiction, and errors in the initial filing – missing undertakings, inadequate evidence of full and frank disclosure – can result in the order being set aside at the return date, handing the wrongdoer time to move assets.
A recovery matter: tracing stablecoins across two exchanges
In a recent matter, a payments company discovered that a series of withdrawals, executed over a weekend, had moved a seven-figure USDC balance from its custodial account through two intermediary exchanges before reaching a third-party wallet. We were instructed within hours of the discovery being made. Working alongside a forensic partner, we mapped the transaction chain to specific deposit addresses at the second exchange – a regulated platform with a presence in a leading common-law jurisdiction. We filed a without-notice application for a Norwich Pharmacal disclosure order and a concurrent worldwide freezing order. The court granted interim relief the same day. The exchange provided KYC records and transaction logs within the compliance window, identifying a named individual and a corporate vehicle. A freezing order against those defendants' assets was granted at the return date. The stablecoin issuer was simultaneously notified and placed a contract-level hold on the destination address. The matter is ongoing, but the assets remain frozen.
Self-assessment: are you positioned to move quickly?
Institutional victims who are positioned to move quickly on an exchange disclosure application share a set of structural readiness indicators. The following checklist identifies the gaps that slow recovery.
- Transaction records and wallet logs are accessible to legal and forensic teams within hours of an incident, not subject to an internal approval queue.
- A forensic provider relationship is pre-established, or OBOLUS's intake process is understood in advance so that forensic scope can be activated immediately.
- In-house counsel have a clear escalation path to external disputes counsel for digital-asset incidents – separate from the technical incident response procedure.
- The business has identified, in advance, which forums are most likely to be relevant based on its exchange relationships and counterparty jurisdictions.
- Key evidence – private keys, contract addresses, signed transaction records, relevant communications – is preserved under legal hold from the moment the incident is identified.
- The business understands that a without-notice application requires full and frank disclosure of all material facts, including any that do not favour the applicant.
If any of these indicators are absent, the business is exposed to the delay that turns a recoverable loss into an irrecoverable one. We regularly advise institutional clients on building this readiness posture before an incident occurs, not only after.
If a recovery clock is running, reach our disputes desk now at info@oboluslaw.com. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back.
Decision matrix: which profile should pursue which route?
Not every loss scenario calls for the same primary instrument. The right entry point depends on the size and nature of the loss, the forums available and the on-chain evidence in hand.
Profile A – Large institutional loss, assets traceable to a regulated exchange with a presence in England & Wales, DIFC or Singapore. This is the strongest position. A without-notice application combining a Norwich Pharmacal/Bankers Trust disclosure order with a concurrent worldwide freezing order is the primary route. Timeline to interim relief: measured in days, not weeks, where evidence is in order. Key risk: the exchange's compliance window and whether the wrongdoer has already withdrawn.
Profile B – Mid-size loss, assets at an exchange with limited regulated presence in major common-law forums. Forum selection becomes the primary challenge. Options include obtaining an order in England or Singapore and relying on the exchange's voluntary compliance, or engaging allied counsel in the exchange's home jurisdiction to seek parallel relief. Timeline: longer, and cost-benefit analysis is critical. Key risk: enforcement friction and asset movement during the additional time required.
Profile C – Assets held in stablecoins (USDT or USDC) and the destination address is identified. A parallel stablecoin freeze request to the issuer – supported by a court order and a law-enforcement reference – is the fastest supplementary tool. This does not replace the disclosure application but can freeze the specific address while proceedings develop. Key risk: the wrongdoer moves funds on-chain before the issuer acts.
Profile D – Loss is older, on-chain trail is fragmented, and immediate recovery is uncertain. The focus shifts to evidence preservation, identification of the wrongdoer through disclosure, and building a substantive damages claim. Recovery is still possible but requires a longer-horizon strategy. We are direct with clients about the realistic scope when this profile applies.
A common assumption: once funds leave the wallet, nothing can be done
A common assumption among institutional victims – particularly those who have been told by internal teams that the blockchain is immutable – is that misappropriated digital assets are simply gone. This is incorrect, and acting on that assumption leads to the one error that cannot be reversed: not acting at all.
The blockchain's immutability is precisely what makes on-chain tracing effective. Every movement of assets is recorded on a public, permanent ledger. The challenge is not the absence of evidence – it is the pseudonymity of the addresses involved. Lifting that pseudonymity through an exchange disclosure order converts a traceable-but-anonymous trail into a named defendant and a live claim.
Courts in England, the DIFC, Singapore and Hong Kong have repeatedly confirmed that digital assets are property, that they can be traced using established common-law tracing principles, and that disclosure relief is available against exchanges that are mixed up in the movement of misappropriated assets. The toolset is mature. The window is short. The combination of those two facts is the argument for acting immediately.
In our cross-border practice, we move for freezing relief and exchange disclosure while the trail is live. Operators who come to us at the forensic mapping stage consistently achieve better outcomes than those who arrive after a failed internal remediation attempt.
Related at OBOLUS
- Disputes & Asset Recovery for Digital Asset Businesses – the full scope of our recovery and litigation practice across 25+ forums
- Smart Contract Dispute Resolution in Estonia – how Estonian law and EU frameworks apply to on-chain contract disputes
- Oracle and Data Feed Liability in Seychelles – liability exposure for data-feed failures in a Seychelles-domiciled structure
FAQ
Can stolen crypto actually be recovered?
Recovery is possible and has been achieved in cases involving centralized exchanges, where on-chain forensics identify specific deposit addresses and a court order compels the exchange to disclose account holder identity. The conditions that favor recovery are: assets held at a regulated exchange with a presence in a common-law forum, a clear on-chain trail generated quickly after the loss event, and immediate instruction of counsel to pursue disclosure and freezing relief concurrently. Recovery is not guaranteed, but the tools exist and have worked.
How fast must I act after a digital-asset theft?
The recovery window is measured in hours. Once misappropriated assets are converted or withdrawn from an exchange, the practical route to freezing narrows sharply. An institutional victim should instruct disputes counsel and a forensic provider simultaneously, within hours of identifying the loss. Every hour without a without-notice application for freezing and disclosure relief is time the wrongdoer uses to move assets further from reach. Pre-establishing an escalation path before an incident occurs is the most effective risk-management step available.
Can a court freeze assets held on an exchange?
Yes. Courts in England & Wales, the DIFC, Singapore and Hong Kong routinely grant worldwide freezing orders covering assets held at exchanges, provided the applicant can demonstrate a good arguable case, a real risk of dissipation and an undertaking in damages. The exchange disclosure order and the worldwide freezing order are typically sought together in a single without-notice application. Once granted, the exchange is obligated to hold the relevant assets and provide the information required by the order, subject to contempt liability for non-compliance.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on disputes and on-chain asset recovery across more than 25 forums, on licensing across more than 70 jurisdictions, and on the tax, banking and compliance structures that sit around them. Digital assets are the whole of our practice. In our disputes work, we move for freezing relief and exchange disclosure while the trail is live – a posture that has made a material difference in the recovery matters we have handled. To discuss a live situation or to build pre-incident readiness, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specialising in cross-border digital-asset recovery, exchange disclosure applications and on-chain forensic strategy across common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.