Recovery windows for misappropriated digital assets are measured in hours, not weeks. When funds leave a controlled wallet through fraud, theft, or unauthorized access, the trace goes cold fast – exchanges process withdrawals in minutes, bridges obscure routing, and mixers can sever the chain of title entirely. The legal mechanism that stops that clock is an exchange disclosure order (a court order compelling a centralized trading platform to identify the account holder behind a deposit address and freeze the associated balance). Obtained under heightened scrutiny standards applied in the leading common-law forums, it is the most direct instrument available to a business that has suffered a digital-asset loss.
This page sets out how the instrument works, which forums apply it, what the scrutiny threshold demands, and where cross-border complexity changes the calculus.
What is an exchange disclosure order and why does "heightened scrutiny" matter?
An exchange disclosure order is a court-directed obligation requiring a cryptocurrency exchange to produce account registration data, know-your-customer records, transaction histories and, where available, linked banking details for a specified wallet address or account. In leading common-law jurisdictions – England and Wales, the DIFC Courts, Singapore, Hong Kong, and comparable forums – courts have accepted that digital assets are property, a finding that grounds the full equitable toolkit: proprietary injunctions, worldwide freezing orders, and compelled disclosure.
The "heightened scrutiny" label reflects the standard courts apply to without-notice (ex parte) applications – applications brought against an exchange without advance warning to the respondent or the suspected wrongdoer. Because these orders are inherently one-sided at the point of grant, the court demands more than bare suspicion. The applicant must demonstrate a good arguable case on the underlying claim, a real risk that the respondent will dissipate or transfer the assets if notice is given, and full and frank disclosure of any fact that might count against granting the relief. The scrutiny is heightened precisely because the order can freeze seven-figure balances on the basis of one party's evidence alone.
In our practice, the cases that fail at this first gate do so for one of two reasons: the applicant comes late, after critical evidence has already dissipated, or the supporting evidence bundle is thin – wallet addresses without forensic attribution, no professional trace report, no legal analysis of the applicable regime. Courts in England and Wales, building on the line established in AA v Persons Unknown [2019], have been willing to act swiftly, but they will not act on assertion alone.
For a scoped assessment of your recovery position, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the exchange, the trace, the jurisdiction of the wrongdoer – change the analysis significantly. Map your options before the trail goes cold.
Which forums apply this regime, and what is the legal basis?
The leading forums for exchange disclosure orders against centralized exchanges are England and Wales, the DIFC Courts in Dubai, Singapore, and Hong Kong – each recognizing digital assets as capable of being the subject of proprietary claims and injunctive relief.
In England and Wales, the equitable jurisdiction to grant Norwich Pharmacal and Bankers Trust disclosure orders against third parties (including exchanges that are not defendants) is well established. A Norwich Pharmacal order compels an innocent third party that has been mixed up in wrongdoing to disclose information needed to identify the wrongdoer. A Bankers Trust order compels disclosure of transaction records where the claimant has an arguable proprietary claim to the underlying asset. Both apply, without modification, to cryptocurrency exchanges. The court's decision in AA v Persons Unknown confirmed that crypto assets satisfy the four criteria for personal property under English law, opening the door to the full range of interim relief.
The DIFC Courts have developed a parallel track. In a series of recent matters, including proceedings related to Trafigura v Gupta [2025] DIFC, the DIFC Courts have demonstrated willingness to grant worldwide freezing orders in support of foreign proceedings and to exercise disclosure jurisdiction over exchanges operating in or accessible from the DIFC. The regime's common-law heritage makes precedent from England and Wales persuasive.
Hong Kong's VASP licensing regime, administered by the Securities and Futures Commission (SFC), imposes record-keeping and compliance obligations on licensed platforms that can be leveraged in civil recovery. In a recent tokenised injunction matter (referenced in HCA 2417/2024), the Hong Kong courts granted proprietary relief over digital assets, reinforcing the jurisdiction's position as a credible recovery forum in the Asia-Pacific region. Singapore courts have followed a similar path under the Payment Services Act framework administered by the Monetary Authority of Singapore (MAS), with CLM v CLN [2022] SGHC 46 confirming the availability of a proprietary injunction over cryptocurrency.
The choice of forum is not academic. A business victim based in the UAE may need disclosure from a Seychelles-registered exchange while the wrongdoer is in Eastern Europe. That map – entity, exchange domicile, wrongdoer location, and asset location – determines which court can grant relief that is practically enforceable.
What does the heightened scrutiny threshold require in practice?
Meeting the heightened scrutiny threshold is a matter of evidence quality, speed, and candor before the court. Courts applying this standard require, at minimum: a good arguable case on the substantive claim (proprietary or contractual); a serious risk of dissipation if notice is given; full and frank disclosure of all material facts including those adverse to the applicant; and a cross-undertaking in damages, meaning the applicant commits to compensating the exchange or the respondent if the order later proves to have been wrongly granted.
On the evidence side, courts increasingly expect a professional blockchain forensic report. Exchanges in particular are familiar with the standard forensic tools – Chainalysis, TRM Labs, Elliptic – and will scrutinize a trace that does not meet that bar. The report must attribute the deposit address to the exchange with confidence, show the flow of funds from the victim's wallet to the identified address, and flag any bridge or mixer steps with reasoned analysis of why the trace survives them. An address printed from a public block explorer is not a forensic report.
On the candor side, applicants routinely underestimate the duty of full and frank disclosure. If there is a competing explanation for the transaction – a failed trade, a disputed contractual arrangement, a prior relationship between the parties – it must be placed before the court. Suppressing it does not strengthen the application; it gives the respondent grounds to set aside the order entirely at a later stage, potentially with adverse costs consequences.
The cross-undertaking in damages is a real liability. In a matter where a business secures a freezing order over a seven-figure exchange balance and the order is later discharged for want of a good arguable case, the applicant is on the hook for the exchange's losses from the freeze period. We counsel clients to model that exposure before applying.
How does the application process run from incident to order?
The process moves in four stages, and the first stage is the most time-critical.
Stage one – secure the evidence. The moment a loss is identified, preserve everything: wallet addresses (victim and recipient), transaction hashes, timestamps, the exchange interface screenshot, any communication with the wrongdoer, and any prior KYC or account data you hold. Engage a forensic provider to run an initial trace. The trace need not be complete at this stage, but it must be sufficient to identify the receiving exchange and attribute the deposit address to an account on that platform with reasonable confidence.
If the receiving asset is a USDT or USDC stablecoin, contact OBOLUS immediately about a parallel freeze request to Tether or Circle. Tether and Circle hold contract-level freeze authority over their issued tokens and generally act on a law-enforcement case reference or a court order. The issuer-freeze path is faster than the court path in some cases and can preserve the balance while litigation is prepared. It is not a substitute for the court order, but in the right fact pattern it buys the hours needed to file properly.
Stage two – prepare the application. The core documents are: a witness statement from the victim setting out the facts and the loss; the forensic report exhibiting the trace; a legal argument on the basis of the applicable regime (Norwich Pharmacal, Bankers Trust, or the equivalent in the chosen forum); draft orders for the court to consider; and the cross-undertaking. In England and Wales, this bundle can be prepared and filed in a matter of days where the facts are clear. Courts are alive to the urgency and typically list disclosure applications promptly.
Stage three – the without-notice hearing. The court reviews the bundle, hears counsel, and decides whether the heightened scrutiny threshold is met. If it is satisfied, the order issues directing the exchange to provide the specified information within a defined time window – typically a matter of days. The order is served on the exchange directly, often by email to the legal or compliance department.
Stage four – enforcement and the freezing application. Once the exchange returns the data and the wrongdoer is identified, the applicant files for a worldwide freezing order against that identified person or entity, using the exchange data as the evidentiary foundation. In parallel, an application for a proprietary injunction over the balance on the exchange can be made, typically on the same evidence package.
In a recent matter, a payments company identified a seven-figure misappropriation of stablecoins by a counterparty in a separate jurisdiction. We secured a Norwich Pharmacal disclosure order in a common-law forum within days of instruction, identified the account holder through the returned data, and obtained a proprietary injunction over the exchange balance before the wrongdoer could initiate a further withdrawal. The matter proceeded to a consent order resolving the underlying dispute. No specific outcome is guaranteed, but the speed of the legal response was the decisive factor in that case.
How does cross-border structure affect the strategy?
Almost every digital-asset recovery matter is cross-border by nature. The victim is in one jurisdiction, the exchange is incorporated in another, the wrongdoer operates from a third, and the assets may have moved through a DeFi bridge with no single legal domicile. That structure creates three distinct legal problems: jurisdiction (which court has authority to order the exchange to disclose?), service (how is the order served on an entity with no registered agent in the forum?), and recognition (if the exchange is in a non-common-law jurisdiction, will a judgment be recognized?).
On jurisdiction, the leading common-law courts have shown willingness to grant extraterritorial disclosure orders against foreign-registered exchanges where those exchanges have some connection to the forum – a domestic user base, a local marketing presence, or assets flowing through regulated counterparties in the forum state. England and Wales in particular has used the Bankers Trust doctrine to reach exchanges domiciled in offshore centers. The DIFC Courts have taken a similarly expansive view in cross-border matters.
On service, many exchanges publish a legal process address or have established law firms that accept service on their behalf in major jurisdictions. Where they do not, courts can authorize alternative service – by email to a publicly listed compliance address, by courier to a registered agent address in a third country, or, in exceptional cases, by service through the court's own process. We work with allied counsel in the relevant jurisdiction to manage service in parallel with the substantive application.
On recognition, the analysis turns on whether the jurisdiction where the exchange is domiciled or where the assets sit is a common-law forum with an established framework for recognizing foreign injunctions. Where it is not – for instance, where assets have moved to an exchange in a jurisdiction with limited treaty relationships – the strategy shifts toward an issuer-level freeze (for stablecoins) or a secondary tracing application in the local forum with the assistance of local counsel. The CFAAR (Crypto Fraud and Asset Recovery) network, launched in London in September 2021, provides a practitioner framework for coordinating exactly these multi-forum matters.
Tax and regulatory posture in the victim's home jurisdiction also interact with the recovery strategy. A business that is itself a regulated entity – a VASP (virtual asset service provider) licensed under MiCA, the VARA regime, or the Singapore Payment Services Act – may have reporting obligations triggered by a significant loss event. Those obligations run on their own clock, independent of the recovery clock, and failing to meet them can create a secondary regulatory exposure. We routinely map both timelines from the outset of a recovery instruction.
If a recovery clock is running, reach our disputes desk now at info@oboluslaw.com. If a prior application stalled or an exchange refused to comply, a second read can surface the structural reason and the route back. Map your options with our team.
What mistakes most often derail a disclosure application?
The most costly mistake is delay. Courts are sympathetic to urgency, but the factual predicate for the application must exist – you cannot ask for a freezing order over assets that have already been withdrawn and dispersed. Businesses that wait days after identifying a theft before engaging counsel, hoping the situation will resolve itself or waiting to exhaust internal escalation paths, routinely arrive at the point of instruction with a cold trace and significantly reduced prospects.
The second mistake is inadequate forensic evidence. A wallet address alone is not an application. The court needs attribution: evidence that the address is controlled by an account on the named exchange, evidence that the funds flowing into it trace from the victim's wallet, and expert analysis of any intervening steps. Engaging a forensic provider the day of instruction, rather than several days later, is the single most impactful operational decision a business victim can make in the hours after a loss.
The third mistake is forum selection driven by convenience rather than enforceability. A disclosure order granted by a court in a jurisdiction where the exchange has no assets and no legal presence is a paper order. The work of selecting the right forum – the one where the exchange has a presence, where service is achievable, and where the order will be respected by the exchange's compliance function – is legal strategy, not administrative detail.
A common assumption is that once funds leave a wallet, nothing can be done. That is wrong. The blockchain's immutable record creates a permanent audit trail; forensic analysis regularly traces assets through multiple hops, bridges, and partial withdrawals. Courts have granted disclosure orders in matters where the funds passed through four or five distinct addresses before reaching the exchange. The assumption that complexity defeats recovery is itself a reason attackers use complex routing – but it is not a legal defense, and courts treat it as a factor in the risk of dissipation, which can strengthen the case for without-notice relief.
Which recovery instrument fits which fact pattern?
The right instrument turns on the specifics of the loss, the exchange involved, and the time elapsed. The following profiles illustrate the typical decision logic.
Profile A – recent theft, stablecoin balance, identified exchange: The asset is USDT or USDC and sits identifiably on a named exchange that is accessible in a common-law forum. Priority action is a parallel issuer-freeze request and a without-notice court application for a Bankers Trust disclosure order and a proprietary injunction. Timeline is days, not weeks. Key risk: the issuer freeze requires a law-enforcement case reference or court order; where neither is immediately available, the court route must lead.
Profile B – theft several days old, mixed routing, identified exchange domicile unclear: Forensic analysis is the first task before any court application. Once the terminal exchange is identified, the forum selection turns on where that exchange has legal presence. If no common-law nexus exists, the strategy pivots to allied counsel in the jurisdiction of the exchange's incorporation or a secondary tracing application through any regulated counterparty the exchange uses. Timeline extends to weeks, and the outcome is less certain.
Profile C – loss from a DeFi exploit, no centralized exchange in the trace: The disclosure order route applies only if funds eventually bridge to a centralized platform. In the interim, on-chain tracing and OFAC screening of linked addresses can establish a public record of the theft, which supports a law-enforcement referral and may prompt voluntary action by centralized exchanges downstream when the funds move. This profile has the longest recovery horizon and the most variable outcome.
Profile D – business victim is itself a regulated VASP: All of the above apply, with the additional complexity that the victim's own regulatory reporting obligations – under MiCA, VARA, the FCA's regime, or the applicable VASP provisions in the entity's licensing jurisdiction – must be managed in parallel. We structure these matters to run the legal recovery and the compliance response on synchronized timelines from day one.
Related at OBOLUS
- Disputes and Asset Recovery for Digital-Asset Businesses – full scope of on-chain recovery, freezing relief, and cross-border enforcement for business victims.
- Worldwide Freezing Order in Estonia – jurisdiction-specific analysis of freezing relief available through the Estonian courts.
- Licence Renewal and Variation: the Compliance Burden in Practice – how regulatory reporting obligations interact with incident response for licensed VASPs.
FAQ
Can stolen crypto actually be recovered?
Yes, in the right fact pattern. The blockchain's immutable record means stolen assets leave a permanent trace. Courts in England and Wales, the DIFC, Singapore, and Hong Kong have repeatedly granted disclosure orders, proprietary injunctions, and worldwide freezing orders over cryptocurrency balances. Recovery depends on speed, evidence quality, and forum selection – but the legal toolkit exists and has been applied successfully in numerous documented matters. No outcome is guaranteed, but the instrument works when the conditions are met.
How fast must I act after a digital-asset theft?
The recovery window is measured in hours to days, not weeks. Funds on a centralized exchange can be withdrawn before a court order is served if too much time passes. The priority tasks in the first hours are: preserve all transaction evidence, engage a forensic provider to begin tracing, and instruct counsel. Where the asset is a stablecoin, a parallel issuer-freeze request to Tether or Circle can be initiated immediately. Courts in leading forums are receptive to urgent without-notice applications when the evidence supports them.
Can a court freeze assets held on an exchange?
Yes. Courts in England and Wales, the DIFC Courts, Hong Kong, and Singapore have granted proprietary injunctions and worldwide freezing orders over balances held on centralized exchanges. The exchange is served with the order and required to prevent the account holder from withdrawing the specified balance. Compliance is enforced through contempt jurisdiction. Where the exchange is domiciled outside the forum, enforceability depends on the exchange's legal presence in or connections to the forum state.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. Operators we advise include businesses across the full lifecycle – from licensing to incident response. We move for freezing relief and exchange disclosure while the trail is live. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialist in on-chain asset tracing, exchange disclosure orders, and multi-forum freezing relief for business victims of digital-asset fraud.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.