On-chain asset tracing gives established operators a structured legal and forensic process to follow misappropriated digital assets across blockchain networks, identify custodians holding those assets, and secure interim relief before the trail goes cold. When funds are taken – whether through an internal breach, a protocol exploit or a counterparty default – the first priority is not litigation. It is preservation. The steps taken in the first hours determine whether recovery is possible at all.
This page sets out the legal basis for tracing, the process OBOLUS applies for established operators, the cross-border complications that typically arise, and the decision logic for choosing the right forum and instrument. If a clock is already running, contact us before reading further.
Why Speed Defines the Outcome in Digital-Asset Recovery
The single most important variable in a digital-asset recovery is elapsed time. Blockchain networks settle transactions in minutes. A malicious actor who controls private keys can bridge assets across chains, swap into privacy coins, or fragment balances across dozens of wallets before a traditional injunction is even drafted. The recovery window – the period during which assets remain traceable, segregated and legally reachable – is often measured in hours rather than days. Established operators understand this from their own risk frameworks. What they frequently underestimate is how quickly the legal window closes alongside the forensic one.
Courts in leading common-law forums have shown a willingness to move at the pace the technology demands. England and Wales is the pre-eminent recovery jurisdiction, with a developed body of authority recognising crypto-assets as property and supporting emergency applications for freezing and disclosure orders on an ex parte basis – meaning without prior notice to the respondent. Singapore, Hong Kong and the DIFC Courts in Dubai have each demonstrated similar agility. An operator that waits for a formal board resolution before engaging counsel has, in most cases, already narrowed its options materially.
In our cross-border practice, we have seen cases where a six-hour delay between discovery and legal engagement made the difference between a successful freeze and an asset that had moved through three intermediary exchanges and been partially converted. Speed is not a preference. It is the operative variable.
What Is the Legal Basis for Tracing and Interim Relief?
On-chain asset tracing rests on three interlocking legal foundations: the classification of digital assets as property, the availability of proprietary remedies, and the court's jurisdiction to grant emergency orders against both known and unknown defendants. Each matters. Without all three, a tracing claim stalls at the threshold.
Property status is no longer contested in the major forums. Courts in England and Wales, Hong Kong, Singapore and the DIFC have each confirmed that crypto-assets constitute property capable of being owned, traced and frozen. The DIFC Courts have addressed this in recent proceedings, and Hong Kong's Court of First Instance addressed the point directly in proceedings concerning a failed exchange. Once property status is established, a claimant can assert a proprietary claim – a right not merely to damages but to the specific asset itself, or its traceable substitute. This distinction is commercially vital: a proprietary claim survives the insolvency of an intermediary, whereas a personal claim against an insolvent exchange is worth very little.
Interim relief takes two principal forms. A worldwide freezing order (an injunction that freezes a respondent's assets globally, up to the value of the claim) prevents dissipation while the substantive case proceeds. A disclosure order – under the Norwich Pharmacal or Bankers Trust principles in English law – compels a third party that has become innocently mixed up in wrongdoing to disclose information identifying the wrongdoer. Applied to exchanges, this means compelling the platform to disclose KYC records, transaction logs and wallet addresses linked to the suspect account. The DIFC Courts have granted equivalent relief in support of foreign proceedings, extending the practical reach of this toolkit well beyond any single jurisdiction.
How Does the On-Chain Tracing Process Work?
The tracing process has five discrete phases, each with a legal and a forensic component running in parallel. Compressing these phases – or running them sequentially rather than concurrently – is the single most common structural mistake operators make.
Phase 1 – Incident triage. Within the first hour, the operator should isolate affected wallets, capture all available on-chain data (transaction hashes, block heights, timestamps, originating and destination addresses) and preserve internal logs before they are overwritten or deleted. This is not merely good practice; in some forums, destruction of evidence after a dispute is reasonably foreseeable can constitute a contempt or give rise to adverse inferences.
Phase 2 – Forensic blockchain analysis. Professional-grade forensic tooling maps the movement of assets across the chain. The goal at this stage is not attribution – it is chain-of-custody documentation. A clean, court-ready forensic report is a prerequisite for most disclosure and freezing applications. Courts expect to see a report that traces specific transaction hashes through identifiable intermediary addresses to a custodian – typically a centralised exchange – that can be served with a disclosure order. Qualitative assertions without transaction-level evidence are routinely insufficient.
Phase 3 – Forum selection and emergency application. Once a custodian exchange or jurisdictional anchor is identified, counsel selects the most advantageous forum and files on an urgent basis. The application bundle typically includes the forensic report, a supporting affidavit, a claim form and a draft order. In England and Wales, applications at this stage can move within a matter of hours. DIFC Courts have demonstrated comparable responsiveness. Hong Kong and Singapore each have procedures designed to accommodate urgent crypto-asset relief. The choice of forum turns on where the relevant exchange is regulated, where the respondent may have assets and where an order can be enforced effectively.
Phase 4 – Disclosure execution and follow-on tracing. Once a disclosure order is served, the exchange typically responds within a regulated timeframe. The information received then feeds back into the forensic picture, often revealing further hops, additional exchanges and potentially identifying a respondent who can be personally served. Each round of disclosure can open a new tracing thread. In multi-jurisdictional cases, we coordinate this phase through allied counsel in the relevant jurisdictions so that parallel applications run concurrently rather than sequentially.
Phase 5 – Permanent injunction and enforcement. If interim relief is maintained and assets are identified and frozen, the case moves toward a permanent order and, ultimately, recovery. The mechanisms – consent order, summary judgment, default judgment against a non-responding respondent – vary by forum and by whether the respondent is identifiable. In cases involving a Persons Unknown respondent (a procedural device allowing an English court to grant relief against unidentified wrongdoers), the later identification of the wrongdoer allows the claimant to amend and proceed to judgment.
For a scoped assessment of your incident and to determine whether emergency relief is available in the right forum, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the asset type, the exchange where funds are held, the jurisdiction of the bad actor – change the analysis materially.
Stablecoins, Issuer Freezes and Protocol-Level Controls
For losses denominated in major stablecoins, a parallel route is available that operates independently of the court system – though it works best alongside it. Both Tether (USDT) and Circle (USDC) hold contract-level freeze and blacklist authority over tokens on their respective networks. Each issuer can freeze a specific address, rendering the tokens in that address permanently non-transferable until unfrozen. Issuers generally act on a law-enforcement reference, an OFAC designation, or a court order from a recognised jurisdiction.
In practice, this means that in a case involving a stablecoin theft, two parallel tracks should run from the outset: the court-based freezing and disclosure track described above, and a direct engagement with the relevant issuer's legal team, supported by the forensic report and any law-enforcement case reference obtained. The issuer freeze operates at the protocol level and is not geographic – it applies regardless of which exchange currently holds the assets. This gives it a speed advantage over court-based relief, but it requires a threshold of evidence that the issuer regards as sufficient. A request unsupported by professional forensic evidence and a credible legal framework rarely moves quickly.
We have worked through both tracks concurrently. The interaction between them – and the sequencing of court filings relative to issuer engagement – is an area where experienced counsel adds material value over a self-managed approach.
What Cross-Border Complications Arise for Established Operators?
Established operators – exchanges, custodians, institutional funds, tokenised-asset platforms – face a specific variant of the cross-border problem. The operator is typically regulated in one or more jurisdictions. The bad actor exploited infrastructure spanning several chains. The assets moved through exchanges domiciled in a third set of jurisdictions. The entity that needs to pursue relief may have ongoing regulatory relationships it does not want to compromise. And the operator's banking partners in yet another jurisdiction may be exposed if the loss is material enough to affect solvency ratios.
Each of these dimensions requires a co-ordinated response. A freezing order obtained in England does not automatically bind an exchange regulated by the MAS in Singapore or the SFC in Hong Kong. A separate application – or recognition proceedings – is required in each material forum. For operators regulated under VARA in Dubai or ADGM/FSRA in Abu Dhabi, the domestic framework and the DIFC Courts each play a different role in the recovery architecture. An operator that concentrates its legal effort in one jurisdiction while the assets migrate to another has, in practice, secured a piece of paper.
In our cross-border practice, we regularly advise operators running parallel applications across three or more forums simultaneously. The coordination logic – which application to file first, how to sequence service to avoid tipping off the respondent, when to engage law enforcement across jurisdictions – is not a matter of legal boilerplate. It is tactical case management that requires real-time decisions made under time pressure.
The cross-border angle also affects the operator's own obligations. An exchange or custodian that has suffered a material security incident may have mandatory breach notification obligations to its primary regulator – whether that is VARA, the FCA, the SFC, MAS or another competent authority. Managing the timing and content of that notification alongside active litigation – and ensuring the two are not inconsistent – is a governance challenge that falls squarely within the scope of work we manage for operator clients.
What Are the Most Common Mistakes Established Operators Make?
The five structural mistakes we see most often are not failures of intent. They are failures of process, made under time pressure by competent teams that were not set up for this specific contingency.
Mistake 1 – Treating it as an IT incident, not a legal one. The first hour is typically consumed by internal technical response: rotating credentials, patching the vector, notifying the board. None of this is wrong. But legal and forensic preservation should run in parallel from minute one. Evidence gathered by an internal team for technical purposes may not be court-ready. A clean, independently maintained chain of custody for the forensic record matters.
Mistake 2 – Contacting the receiving exchange directly before filing. Operators frequently reach out to the exchange where stolen funds have arrived, asking for a voluntary freeze. The exchange, absent a court order, has limited authority to act and significant liability concerns. More importantly, an unstructured contact may alert the account holder, who then moves funds before relief is secured. The court order comes first; exchange engagement follows under cover of the order.
Mistake 3 – Filing in the wrong forum. The instinct is to file in the operator's home jurisdiction. That may not be where the respondent's assets are, where the relevant exchange is regulated, or where an order can be enforced. Forum analysis is a substantive decision, not an administrative one.
Mistake 4 – Underestimating the forensic threshold. Courts and exchanges both require a forensic report that traces assets at the transaction level. A narrative summary of what happened is not sufficient. The report must identify specific hashes, specific addresses and the specific custodian currently holding the assets.
Mistake 5 – Waiting for law enforcement to lead. Law enforcement involvement is valuable and, in some cases, essential for stablecoin issuer engagement. But law enforcement timelines are long and the operator's recovery interest is not always the primary objective. Civil litigation runs on a different track and should not wait for a criminal referral to produce results.
Which Profile Calls for Which Recovery Instrument?
Not every incident calls for the same response. The right instrument depends on the asset type, the traceability of funds, the forum options available and the scale of the loss relative to the cost of litigation.
Profile A – Exchange or custodian with a defined internal breach. Assets are in a stablecoin or major token. The forensic trail is clear within the first two hours. Funds have moved to one or two centralised exchanges. The priority instrument is a combined freezing and disclosure order, filed urgently in England and Wales or the DIFC Courts, paired with a parallel stablecoin issuer engagement. Timeline to first relief: typically a matter of days in a well-supported application, though specific timelines vary by forum and case complexity. Key risk: delay past the point at which assets bridge to a privacy-chain-adjacent protocol.
Profile B – Institutional fund with a counterparty default or misappropriation. The bad actor is identifiable. Assets are fragmented across multiple venues. The fund has investors whose interests must be protected in the recovery architecture. The priority instrument is a worldwide freezing order combined with a proprietary claim. Forum selection requires analysis of where the respondent holds other assets and where enforcement against those assets is practical. Key risk: a respondent in a jurisdiction where recognition of foreign judgments is limited.
Profile C – Token issuer with a protocol-level exploit. Attribution is technically complex. Assets have been converted or bridged. Law enforcement has been notified. The practical instrument set is narrower: the focus is on exchange disclosure to identify any fiat off-ramp, alongside a law-enforcement co-operation strategy that may open the stablecoin issuer track for any converted portion. Key risk: the exploit recipient is pseudonymous throughout and no exchange-held balance is identified, leaving only subrogation or insurance avenues.
Profile D – Operator with a smaller incident below the litigation economic threshold. Full emergency litigation may not be economical. The right response is a scoped forensic trace, a structured law-enforcement referral and exchange outreach through the appropriate legal channels. A documented record of all steps is maintained against the possibility that the economic calculus changes – for instance, if the same actor is later identified in a larger matter where claimants can pool resources.
If a recovery clock is running, reach our disputes desk now at info@oboluslaw.com. If a prior attempt stalled or an account was closed before relief was secured, a second structural read can surface the reason and the route back.
A Recent Cross-Border Recovery Matter
In a recent matter, an established custodian identified a misappropriation of a seven-figure stablecoin balance late on a business day. The assets had moved through two intermediate addresses to a deposit address at a regulated exchange in a major common-law jurisdiction. We engaged within hours, prepared a court-ready forensic bundle, and filed an ex parte application the following morning. The court granted a combined freezing and disclosure order within the day. The exchange's compliance team responded to service, the suspect account was frozen, and a parallel stablecoin issuer notification was submitted with the court order as supporting documentation. The issuer placed a protocol-level freeze on the relevant addresses within a short window. The matter proceeded to a contested hearing at which the freezing order was maintained pending the substantive claim. The operator's regulatory notification – which had to be timed carefully relative to the litigation steps – was managed alongside the proceedings without inconsistency.
The outcome in that matter turned on two things: the forensic report was transaction-level from the outset, and legal engagement ran in parallel with the internal incident response from hour one.
A Common Assumption About Post-Theft Recovery
A common assumption among operators who have not been through a recovery is that once funds leave the wallet, nothing can be done. This assumption is wrong in most material cases, and costly when it prevents timely action.
Blockchain transactions are permanent, but they are also permanently visible. The immutability of the ledger that makes reversal impossible is the same property that makes tracing possible. Assets do not disappear; they move to addressable locations. The legal system has developed a toolkit – freezing orders, disclosure orders, proprietary claims, stablecoin issuer engagement – that is specifically designed to reach assets at those locations. The condition precedent is not the absence of pseudonymity or the simplicity of the transaction graph. It is speed. Recovery is not guaranteed in any case. But the absence of effort in the early window is, in our experience, the most reliable predictor of a failed recovery.
The second false premise is that recovery requires identifying the bad actor before filing. It does not. Proceedings can be brought against Persons Unknown in England and Wales, and equivalent procedural routes exist in Singapore, Hong Kong and the DIFC. The identity of the respondent can be the product of the litigation, not the precondition for starting it.
Related at OBOLUS
- Disputes and Asset Recovery for Digital-Asset Businesses – an overview of the full disputes and recovery practice across 25+ forums
- Smart Contract Dispute Resolution: What Recent Enforcement Tells Operators – enforcement trends and structural lessons for operators using smart contracts
- On-Chain Asset Tracing for Regulated Entities – the tracing and recovery service for exchange-licensed and regulated-entity clients
FAQ
Can stolen crypto actually be recovered?
Recovery is achievable in many cases, but it depends on speed and the forensic trail. Courts in England and Wales, Singapore, Hong Kong and the DIFC Courts have each granted emergency freezing and disclosure orders over crypto-assets, treating them as property subject to proprietary claims. The critical variable is how quickly a court-ready forensic report is assembled and an application filed. Later-stage recoveries are possible but progressively harder as assets are moved, converted or fragmented across jurisdictions.
How fast must I act after a digital-asset theft?
The recovery window begins closing immediately. Assets can bridge chains, be swapped into illiquid tokens, or be deposited at exchanges in jurisdictions without strong co-operation frameworks within hours of a theft. Legal engagement should run in parallel with the internal incident response from the first hour – not after the internal review is complete. Forum selection, forensic report preparation and the emergency application can all proceed simultaneously. Waiting for law enforcement to act is not a substitute for parallel civil proceedings.
Can a court freeze assets held on an exchange?
Yes. Courts in leading common-law forums routinely grant freezing orders that bind exchanges as third parties and compel them to freeze accounts and disclose KYC and transaction data under disclosure order principles. The exchange is not the defendant – it is typically an innocent third party that has become mixed up in the wrongdoing. Major stablecoin issuers including Tether and Circle also hold protocol-level freeze authority, which operates independently of the court system and can complement a court-based freezing order in cases involving USDT or USDC.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance structures that sit around them. Digital assets are the whole of our practice. Operators we advise include established platforms that have embedded our recovery process into their incident-response protocols – because preparation, not reaction, is the first stage of recovery. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialising in on-chain asset tracing, emergency freezing relief and cross-border recovery proceedings for digital-asset operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.