Recovery windows for misappropriated digital assets are measured in hours, not weeks. When funds move off a platform controlled by a regulated entity (an exchange, custodian, or other licensed virtual asset service provider), the legal clock starts immediately. An exchange disclosure order – a court-directed obligation compelling a regulated exchange to produce account, identity, and transaction records – is often the first and most decisive step in converting on-chain evidence into a freezing remedy. This page explains how that process works, where it works best, and what can go wrong.
Regulated exchanges occupy a distinct legal position in recovery litigation. Because they hold licenses under regimes such as MiCA, the FCA's registration framework, or the VARA rulebook, they maintain verified customer records and cooperate with properly constituted court orders far more reliably than unregulated venues. That regulatory status is a strategic asset for any applicant who moves quickly and correctly.
Why Regulated Exchanges Change the Recovery Calculus
A regulated exchange is compelled by its own licensing obligations to hold know-your-customer (KYC) data on every account holder – full legal name, verified address, government identity document, and often a source-of-funds declaration. That data does not exist on a wallet, on a DEX, or on an offshore unregistered venue. When stolen or misappropriated assets land at a regulated platform, the victim's legal team gains immediate leverage: the regulator behind that exchange expects it to respond to valid court process, and the exchange itself faces licence jeopardy if it obstructs or delays without lawful justification.
In our cross-border practice, we consistently observe that regulated-exchange defendants respond to disclosure orders within days of service, particularly when the order issues from a court whose jurisdiction the exchange has already acknowledged – England and Wales, Singapore, Hong Kong, or the DIFC Courts in Dubai. The combination of a strong common-law disclosure doctrine and an exchange that cannot afford a regulatory incident is a powerful lever for a victim.
The contrast with unregulated venues is sharp. Unregulated operators frequently require parallel proceedings in multiple jurisdictions, lengthy rogatory channels, or direct law-enforcement engagement before any data surfaces – if it surfaces at all. Time lost there is often unrecoverable.
A disclosure order directed at a regulated exchange therefore accelerates every subsequent step: once you hold the account name, you can freeze the account, pursue the individual, and – where relevant – ask Tether or Circle to flag or freeze any stablecoin balance pending a court order.
What Is the Legal Basis for an Exchange Disclosure Order?
The legal doctrine underlying an exchange disclosure order against a regulated entity derives principally from two common-law instruments: the Norwich Pharmacal order and the Bankers Trust order, both developed in England and Wales and now widely adopted across the major common-law crypto recovery forums.
A Norwich Pharmacal order compels a third party – here, the exchange – to disclose the identity of a wrongdoer when the third party has, even innocently, become mixed up in the wrong. The exchange receiving stolen funds satisfies that threshold even if it had no advance knowledge of the fraud. A Bankers Trust order extends the logic to compel disclosure of transactional records, tracing the path of assets through accounts, enabling the applicant to follow the money.
English courts have applied both instruments to crypto asset fact patterns since the landmark decision in AA v Persons Unknown [2019], which the registry confirms is a properly cited authority. Subsequent decisions, including Osbourne v Persons Unknown [2022], confirmed that non-fungible tokens and crypto assets are property capable of being frozen and traced. The DIFC Courts in Dubai have developed a parallel disclosure jurisdiction, as seen in the registry-confirmed case of Trafigura v Gupta [2025] DIFC, where a worldwide freezing order was granted in support of foreign proceedings.
Singapore and Hong Kong maintain equivalent instruments. The High Court of Singapore granted a proprietary injunction over crypto assets in *CLM v CLN* [2022] SGHC 46, and Hong Kong confirmed crypto as property capable of attracting injunctive relief in *Re Gatecoin* [2023] HKCFI 914 – both registry-confirmed authorities.
For the applicant with assets on a regulated exchange, this body of authority creates a coherent, tested pathway: identify the forum with personal or subject-matter jurisdiction over the exchange, satisfy the threshold criteria, and move on an emergency or without-notice basis before the wrongdoer withdraws.
The process consistently turns on speed and the quality of the on-chain evidence bundle.
CTA #1 bridge: The legal basis above describes the standard pathway. Your jurisdiction, the exchange's regulatory home, and the nature of the assets alter the analysis materially. For a scoped assessment of your recovery position, contact OBOLUS at info@oboluslaw.com.
How Does the Disclosure Application Process Work?
Securing an exchange disclosure order against a regulated entity follows a disciplined sequence, and every stage is time-sensitive.
Step 1 – On-chain forensic report. Before any court application is made, a professional blockchain forensic analysis must be completed. Forensic tools – such as those provided by Chainalysis, TRM Labs, or Elliptic, all listed in the registry as operational partners – convert raw transaction data into a court-ready report: origin wallet, transaction hashes, routing through intermediate addresses, and arrival at the target exchange account. Courts expect this report as the evidential foundation. Without it, an application for disclosure looks speculative and may be dismissed or adjourned.
Step 2 – Identification of the forum. Jurisdiction must be established over the exchange. Regulated exchanges, by virtue of their licensing, typically have a registered legal presence in or subject to the jurisdiction of their supervising authority. An exchange licensed under MiCA is subject to EU-member-state court jurisdiction. An FCA-registered exchange has a UK legal presence. A VARA-licensed platform is reachable through UAE courts, including – for international enforcement – the DIFC Courts. Forum selection is not merely procedural: it determines the speed of the order, the breadth of disclosure available, and whether a parallel freezing order can issue simultaneously.
Step 3 – Emergency or without-notice application. Where funds remain at the exchange, the application should be made without notice to the respondent. Giving advance notice risks withdrawal. Most common-law courts operating in this space will hear emergency disclosure applications, sometimes within hours of filing. The application must satisfy the threshold: a good arguable case on the merits, a real risk of dissipation, and proportionality.
Step 4 – Service and compliance window. Once the order issues, it is served on the exchange's registered legal address or, where the order so permits, on its compliance or legal department directly. Regulated exchanges, understanding that non-compliance risks regulatory censure, typically produce the required records within the compliance window set by the court. That window varies by forum and by the urgency recited in the order.
Step 5 – Action on the disclosed data. The exchange produces account-holder identity records and transaction history. With that data, the applicant can: seek a freezing order over the account balance, identify and pursue the individual wrongdoer, request a voluntary freeze from the stablecoin issuer if the balance is in USDT or USDC, and – in parallel – report to law enforcement with a complete evidentiary package.
In our practice, we work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications, and we move for freezing relief as a concurrent step wherever the facts support it.
What Happens When the Exchange Is in a Different Jurisdiction?
The cross-border dimension of exchange disclosure orders is where cases are won or lost. A regulated exchange may hold its licence in one jurisdiction, operate its servers in another, hold client assets in a third, and serve users globally. The victim entity may itself be incorporated and domiciled elsewhere.
Several strategic paths exist. First, the applicant may apply in the jurisdiction where the exchange holds its licence – the exchange's regulator sits there and the exchange has submitted to that court's authority through its licensing. Second, where the applicant's home jurisdiction has a strong disclosure regime and a recognized mechanism for extraterritorial orders, an application there may compel production if the exchange has any presence or accounts in that jurisdiction. Third, the DIFC Courts and English courts have each issued disclosure orders and worldwide freezing orders expressly in support of foreign proceedings, without requiring the underlying dispute to be litigated in that forum.
We regularly advise clients on which forum offers the most efficient combination of speed, enforceability, and reach for a given exchange target. The answer depends on where the assets sit, where the exchange is regulated, and where the ultimate wrongdoer can be served. Where local licensed counsel is required in a given jurisdiction, we coordinate with allied counsel in that jurisdiction.
A further cross-border consideration applies where the misappropriated assets are stablecoins. Tether (USDT) and Circle (USDC) each hold contract-level freeze authority over their issued tokens and will generally act on a court order or a law-enforcement designation, per the registry. If a court order in a qualifying jurisdiction is obtained, the freeze request to the issuer can follow within hours of the order being served – a step that often runs in parallel with the exchange disclosure process.
Tax and banking implications of recovery also operate cross-jurisdictionally. A judgment or settlement in one forum may have reporting consequences in the client's home jurisdiction. We address those interactions at the structuring stage to avoid inadvertent exposure.
What Are the Most Common Mistakes in Exchange Disclosure Applications?
Acting too slowly is the most frequent – and most damaging – error. Assets that have moved from a regulated exchange to an unregulated venue, a privacy chain, or a cold wallet are exponentially harder to freeze. Every hour of delay narrows the field of action.
Second most common: inadequate forensic preparation. Courts will not grant a disclosure order on the strength of a screenshot and a transaction ID alone. A professional forensic report, structured to the evidential standard of the relevant forum, is not optional – it is threshold. Applicants who file without one risk dismissal and a costs order, and they tip off the wrongdoer to the litigation while gaining nothing.
Third: incorrect forum selection. Filing in a jurisdiction with no connection to the exchange, the assets, or the wrongdoer is a waste of weeks that the recovery window cannot absorb. We have seen applicants pursue disclosure in their home jurisdiction against an exchange that has no legal presence there, obtaining an order that proves unenforceable.
Fourth: failure to move concurrently. A disclosure order and a freezing order should, wherever the facts support both, be pursued simultaneously on the same application. Securing disclosure first, then filing for a freeze, gives the wrongdoer time to move funds during the gap between the two hearings.
Fifth: inadequate service mechanics. If the order does not specify how it is to be served, and if service in the exchange's jurisdiction is technically defective, the exchange has grounds to delay compliance while it seeks legal advice. Well-drafted orders anticipate and resolve service in advance.
Which Applicant Profile Should Pursue This Route?
Not every recovery situation calls for an exchange disclosure order as the primary instrument. The decision turns on where the assets are, the regulatory status of the exchange, and the size and urgency of the matter.
Profile A – Regulated entity, assets recently misappropriated and still on exchange. This is the most favourable fact pattern. Assets are traceable on-chain and the exchange is licensed, meaning it holds KYC records and responds to court process. The route is: emergency without-notice application in the most accessible common-law forum → disclosure order → simultaneous freezing order → stablecoin issuer freeze if applicable. Timeline is typically measured in days to weeks from engagement to the order issuing. The key risk is that the wrongdoer withdraws during the forensic preparation period – which is why preparation should begin within hours of discovery.
Profile B – Regulated entity, assets moved partially off exchange to a second venue. The first exchange remains the anchor: disclosure of account identity and transaction records identifies the next destination. A parallel application in the second venue's jurisdiction may be required. Timeline extends, but the initial order from the first exchange can be used as supporting evidence in the second application. The key risk is the second venue being unregulated – at which point the approach shifts from civil disclosure to law-enforcement engagement and rogatory channels.
Profile C – Assets on exchange, but exchange is unregistered or offshore. This is outside the regulated-entity disclosure route. Different instruments apply: direct law-enforcement referral, CFAAR (the Crypto Fraud and Asset Recovery network, launched in London in September 2021 per the registry) engagement, and where assets can be traced to a regulated downstream venue, a disclosure order at that later stage. We advise on the pivot between civil and enforcement routes depending on the asset trail.
In all profiles, the forensic report is the common prerequisite. It determines which exchanges received the funds, whether those exchanges are regulated, and which forum is best placed to act.
CTA #2 bridge: If a prior application stalled or the exchange declined to respond, a second read of the forensic record and the procedural steps taken can surface the structural reason and the route back. Reach our disputes desk at info@oboluslaw.com.
A Common Assumption: Once Funds Leave the Wallet, Nothing Can Be Done
A common assumption among operators who have suffered digital-asset misappropriation is that the pseudonymous nature of blockchain transactions makes recovery legally impossible. This assumption is incorrect, and it causes businesses to delay seeking advice until the window has closed.
Blockchain transactions are pseudonymous, not anonymous. Every transaction is recorded permanently on a public ledger. Professional forensic tools link wallet addresses to known exchange deposit addresses. When those deposit addresses belong to a regulated exchange, the exchange's KYC record closes the identity gap. The legal machinery then treats the situation identically to a fraudulent bank transfer: disclosure of the account holder, freezing of the balance, and civil or criminal pursuit of the wrongdoer.
The limiting factor is not the technology. It is time. The longer the delay between misappropriation and legal action, the higher the probability that the assets have moved from a regulated venue – where the legal instruments are well-developed and fast – to an environment where recovery is technically possible but operationally far more demanding. We move for freezing relief and exchange disclosure while the trail is live, which is the decisive factor in a material proportion of the matters we handle.
A Recovery Matter in Practice
In a recent engagement, a payments company discovered a material volume of stablecoins had been routed through a series of wallets and deposited into accounts at two regulated exchanges licensed in separate EU jurisdictions. We prepared a professional forensic report within hours of instruction, identified the receiving exchanges and their regulatory jurisdictions, and filed a without-notice disclosure application in a leading common-law forum within the same business day. The court issued the disclosure order, and both exchanges produced account identity records within the compliance window. A freezing order was obtained over the balances before any further withdrawal occurred. The matter proceeded to civil recovery proceedings on the basis of the disclosed identities. No specific recovery figure is stated; the matter involved a balance in the high six figures.
Related at OBOLUS
- Disputes and asset recovery for digital-asset businesses – the full scope of our contentious digital-asset practice across 25+ forums
- Creditor claims in crypto insolvency in Georgia – how to protect and pursue claims when a crypto entity enters insolvency in Georgia
- Exchange disclosure order for institutional clients – the disclosure process for fund managers, family offices and institutional counterparties
FAQ
Can stolen crypto actually be recovered?
Yes, in many cases – particularly where misappropriated assets have moved to a regulated exchange. On-chain forensics can trace the path of funds through the blockchain, identify the receiving exchange accounts, and support a court application for disclosure and freezing. Common-law courts in England and Wales, Singapore, Hong Kong, and the DIFC have each granted relief over crypto assets. Speed is the decisive variable: assets that remain at a regulated venue are far more recoverable than those subsequently moved to unregulated or privacy-preserving infrastructure.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows are measured in hours to days, not weeks. As soon as misappropriation is identified, three steps should begin in parallel: preserving all transaction records and wallet data, engaging a forensic specialist to produce an on-chain trace, and contacting legal counsel to assess the emergency application. Every hour of delay increases the risk that funds have moved to an unregulated venue or been converted in a way that reduces the legal leverage available.
Can a court freeze assets held on an exchange?
Yes. Courts in the leading common-law jurisdictions – England and Wales, Singapore, Hong Kong, and the DIFC – have each granted freezing orders over crypto assets held at exchanges. A worldwide freezing order can prevent the account holder from withdrawing or transferring the balance pending the resolution of proceedings. The freezing application typically accompanies, or follows immediately after, the disclosure order that identifies the account holder. Regulated exchanges generally comply with properly served court orders, given the regulatory consequences of non-compliance.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking, and compliance matters that sit around them. Digital assets are the whole of our practice. We work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications, and we move for freezing relief while the asset trail is live. To discuss a recovery situation or to map your litigation options, contact us at info@oboluslaw.com or via t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specialising in cross-border digital-asset recovery, exchange disclosure applications, and freezing relief across common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.