On-chain Asset Tracing for Regulated Entities

When digital assets leave a regulated entity's control without authorization, the recovery clock starts immediately. Forensic analysis, disclosure orders, and freezing applications do not wait for the next business day. On-chain asset tracing – the systematic mapping of transaction flows across blockchain ledgers to identify, locate, and legally preserve misappropriated funds – is the first, indispensable step. Without it, no court in England and Wales, Singapore, the DIFC, or Hong Kong will grant emergency relief. The sections below set out how the process works, what the applicable legal regimes require, and where operators most often lose recoverable value through inaction or procedural error.

A regulated entity – an exchange, custodian, payment institution, or token issuer – sits in a different legal position from a retail victim. Regulators in the major hubs, including VARA, the FCA, and MAS, increasingly expect documented incident-response and asset-preservation procedures as a condition of ongoing authorization. Getting the trace right is both a recovery tool and a compliance obligation.

Why Regulated Entities Face a Different Standard

A regulated entity cannot treat a misappropriation event as a purely operational matter. Under the applicable VASP and CASP regimes – MiCA in the EU, the VARA rulebooks in Dubai, the FCA's Money Laundering Regulations framework in the UK, and the Payment Services Act regime in Singapore – regulated firms carry explicit obligations around safeguarding, segregation, and incident reporting. An inadequate response can trigger regulatory consequences independent of the criminal investigation.

In our cross-border practice, we have seen exchanges lose time – and, critically, the live trace – while waiting for internal compliance sign-off on external counsel engagement. The misappropriation event and the regulatory response must be managed in parallel. A well-structured on-chain tracing engagement scopes the forensic instruction, preserves privileged legal analysis of the blockchain report, and satisfies any notification obligation to the relevant regulator, all within the same first-response window.

The separation matters because forensic intelligence gathered under legal privilege travels differently in disclosure proceedings than a report commissioned by a compliance team without privilege. We structure the instruction from the outset so the analysis is usable in court without exposing the regulated entity's internal controls to unnecessary disclosure.

What Does On-Chain Tracing Actually Produce?

On-chain tracing produces a documented transaction-flow analysis: a map from the originating wallet, through mixing layers or intermediary addresses, to the current resting point of the funds or their closest equivalent. That output is not self-executing. It becomes legally operative only when combined with the right procedural mechanism in the right forum.

In practical terms, the trace identifies several categories of information. First, it locates exchange deposit addresses where stolen assets have landed. Second, it establishes whether a stablecoin issuer – Tether for USDT or Circle for USDC – can exercise its contract-level freeze authority, which both issuers hold and can act upon in response to a law-enforcement reference or a recognized court order. Third, it surfaces the timing and routing evidence that courts in England and Wales, the DIFC, Singapore, and Hong Kong require before they will grant a worldwide freezing order (an injunction freezing a defendant's assets globally) or a Bankers Trust order (a disclosure order requiring an exchange to reveal account-holder identity and transaction history).

The forensic report must precede any court application. No English, DIFC, or Singapore court has granted emergency relief without an evidenced transaction map. A credible forensic report, combined with legal counsel's evidence of identifiable dissipation risk, is the threshold showing. We prepare both elements and file them together.

The contextual bridge: The process above describes the standard path. Your facts – the entity structure, the user base geography, the exchange custody arrangement – change the urgency and the applicable forum.

Time is the first variable you can control. Contact OBOLUS at info@oboluslaw.com to scope an immediate tracing instruction before the trail cools.

The Legal Toolkit: Cross-Border Freezing and Disclosure

The on-chain trace feeds a layered legal toolkit, and the sequence of tools is not interchangeable. Deploying them in the wrong order – or in the wrong forum – loses time and may alert the counterparty.

In England and Wales, the courts have confirmed that crypto assets are property and are amenable to proprietary injunctions and worldwide freezing orders. The landmark recognition of this principle in AA v Persons Unknown [2019] established that Bitcoin constitutes property capable of being frozen. The CFAAR (Crypto Fraud and Asset Recovery network), launched in London in September 2021, operates as a coordination forum for law enforcement and legal practitioners pursuing cross-border digital-asset recovery.

In the DIFC Courts, the jurisdiction has shown willingness to issue worldwide freezing orders in support of foreign proceedings, making it a powerful secondary forum for matters involving UAE-based exchanges or counterparties. The DIFC's common-law framework and its enforcement network into the wider UAE give it reach that onshore UAE civil courts do not match.

In Hong Kong, the SFC-regulated VATP environment and the courts' recognition of crypto as property – confirmed in Re Gatecoin [2023] HKCFI 914 – make it a viable jurisdiction for exchange-level disclosure orders where the assets have passed through Hong Kong-regulated platforms. Singapore's courts similarly issued a proprietary injunction over crypto assets in the context of CLM v CLN [2022] SGHC 46.

A regulated entity with a cross-border user base will often need to run parallel applications in two forums simultaneously. We coordinate with allied counsel in the relevant jurisdictions to file simultaneously, preventing the defendant from moving assets between the time of the first application and the second.

How Do Stablecoin Issuers and Exchanges Cooperate with a Tracing Effort?

Issuer-level freezes and exchange disclosure are separate mechanisms that operate on different timelines and require different legal instruments. Understanding which lever to pull first materially affects the outcome.

Tether and Circle both hold contract-level authority to freeze or blacklist specific USDT and USDC addresses. They generally act on a recognized court order or a law-enforcement designation – including an OFAC designation – rather than on an unconfirmed private report. The practical consequence is that obtaining a court order or a law-enforcement reference is a prerequisite, not an optional step. We have seen situations where a forensic report identified the resting stablecoin address, but the delay in obtaining the order gave the counterparty sufficient time to convert to a non-freezable token.

Exchange cooperation follows a different path. A Norwich Pharmacal order (a court order compelling a third party in possession of information to disclose it) compels a regulated exchange to produce know-your-customer records, transaction histories, and withdrawal records for the relevant addresses. In cross-border matters, the exchange's regulatory home jurisdiction determines whether an English order or a local order is the more efficient route. An exchange regulated under the SFC VATP regime responds to Hong Kong court orders; an exchange authorized under MAS responds to Singapore process.

In a recent matter, we coordinated a stablecoin freeze request and a concurrent disclosure application against an exchange in a leading common-law forum within a single 48-hour window. The parallel approach preserved both the funds and the identity trail. The matter proceeded to a full proprietary claim after the initial freeze held.

Common Mistakes Regulated Entities Make in the First 72 Hours

The first 72 hours after a confirmed misappropriation are where most recoverable value is lost. The mistakes are consistent, and they are all avoidable.

The most common error is waiting for law enforcement before acting civilly. Law enforcement timelines are measured in weeks to months. Civil injunctive relief in England and Wales, Singapore, and the DIFC can be applied for on the same day as the trace is completed, without waiting for a criminal referral. Both processes can and should run concurrently.

The second error is commissioning a forensic report without legal oversight. A report produced without privilege may be subject to compelled disclosure in subsequent proceedings, exposing the regulated entity's security architecture, internal processes, and counterparty relationships. We structure the forensic instruction under legal advice privilege from the first contact.

The third error is a failure to preserve contemporaneous evidence. Blockchain data is immutable, but the wallet access logs, API call records, and internal communications that corroborate the misappropriation are not. Courts in every major forum have granted Norwich Pharmacal and Bankers Trust orders where the applicant demonstrated a clear evidential chain from the loss event to the target address. A gap in internal records weakens that chain.

The fourth error is engaging only in the entity's home jurisdiction when the funds have moved cross-border. We regularly advise operators whose assets traveled through three or four exchange accounts across as many jurisdictions within hours of the event. A domestic-only filing does not reach them.

If your internal incident response has already consumed 24 hours or more, the structure of the application changes but the options do not close immediately. Write to OBOLUS at info@oboluslaw.com to map what remains available.

Decision Matrix: Which Recovery Path Fits Your Profile?

Not every misappropriation event requires the same combination of legal tools. The operator's profile, the asset type, and the exchange routing determine the priority sequence.

Profile A – a regulated exchange or custodian whose internal custody wallet was compromised, with assets moving to deposit addresses at one or two named centralized exchanges. The priority is a concurrent Bankers Trust/Norwich Pharmacal application in the forum where the receiving exchange is regulated, paired with a stablecoin freeze request where USDT or USDC is involved. Timeline to interim relief, where assets are still traceable: a matter of days in the leading common-law forums. Key risk: the receiving exchange's KYC data is stale or the account has been emptied before the order is served.

Profile B – a token issuer or fund whose treasury assets were redirected through a chain of self-custody wallets, using bridging protocols to move across chains before landing on a centralized exchange. The tracing complexity is higher. A multi-chain forensic report takes longer. The first step is an emergency without-notice worldwide freezing order in England and Wales or the DIFC, naming the addresses as property and preventing further dissipation, while the full trace is completed. Timeline to without-notice relief: 24 to 48 hours from a completed evidence package in a leading forum, qualitatively. Key risk: insufficient connection to the chosen forum if the defendant has no UK, UAE, or Singapore nexus.

Profile C – a payments institution regulated under the FCA or MAS whose settlement accounts were manipulated by an authorized internal user. The cross-border angle here is the regulatory notification obligation – the FCA and MAS both require prompt notification of significant operational incidents – and the internal investigation must be structured so it does not contaminate the civil evidence. The recovery mechanism is a proprietary tracing claim combined with an account-freezing order against the individual. Allied counsel in the relevant jurisdiction manages local enforcement. Key risk: the internal investigation disclosing privileged material before the civil claim is protected.

The Cross-Border Reality: Jurisdiction Selection Matters

Jurisdiction selection is not a cosmetic choice. It determines the speed of without-notice relief, the enforceability of the resulting order, and whether the exchange holding the assets will honor a foreign court order at all.

England and Wales is the deepest common-law forum for crypto asset recovery. Its courts have confirmed digital assets as property across a range of cases, its freezing order template is recognized in the greatest number of offshore financial centers, and its Norwich Pharmacal jurisdiction compels exchange disclosure with a well-developed procedural history. For matters involving EU-based exchanges, an English worldwide freezing order, recognized and enforced through the applicable bilateral framework, remains a primary option even post-Brexit, though the analysis is jurisdiction-specific.

The DIFC Courts are the preferred forum for matters with a UAE nexus – an exchange authorized under VARA or ADGM, a counterparty domiciled in Dubai or Abu Dhabi, or assets routed through UAE payment infrastructure. The DIFC's enforcement network into the GCC and its willingness to issue worldwide relief, demonstrated in recent matters including proceedings comparable to the Trafigura v Gupta line, make it an effective primary or parallel forum.

Singapore and Hong Kong serve matters with an Asia-Pacific routing. Both jurisdictions have confirmed crypto property rights, both operate active VASP/VATP regulatory regimes – MAS under the Payment Services Act and the SFC under the VATP licensing regime – and both have courts with established crypto-injunction practice. Where assets move between these two hubs, parallel applications are frequently the correct answer. We coordinate with allied counsel in both jurisdictions to manage simultaneous filing without tip-off risk.

Self-Assessment Checklist for Regulated Entities

Before engaging external counsel, a regulated entity should be in a position to answer the following questions. Each gap represents a point where recovery probability decreases.

• Have you confirmed, with wallet-level data, that the loss event occurred and identified the originating address?
• Do you hold transaction hash records for every outbound transfer from the point of compromise?
• Have you preserved access logs, API keys, and internal communication records from the incident window without alteration?
• Do you know the regulatory home jurisdiction of each exchange where the assets may have landed?
• Have you identified whether USDT or USDC is involved, such that a stablecoin freeze is potentially available?
• Has your compliance team assessed whether a regulatory notification obligation has been triggered in any licensing jurisdiction?
• Have you avoided making any public statement or on-chain communication that could alert the counterparty before an injunction is in place?

Operators we advise routinely work through this checklist in the first hour of a confirmed event. The answers do not slow the engagement – they make the evidence package substantially stronger.

Related at OBOLUS

• Disputes and Asset Recovery for Digital-Asset Businesses – the full scope of our cross-border recovery practice, from tracing to enforcement.
• Crypto Fraud and Asset Recovery: Where the Legal Lines Are Drawn – an analysis of the frameworks courts apply when classifying digital assets as property.
• Fiat On/Off-Ramp Banking Legal Counsel for Digital-Asset Firms – managing the banking and payments layer that surrounds a regulated entity's operations.

FAQ

Can stolen crypto actually be recovered?

Yes, in a meaningful proportion of cases – provided the trace is initiated promptly and the correct legal tools are applied in the right forum. Courts in England and Wales, Singapore, Hong Kong, and the DIFC have all confirmed that crypto assets constitute property subject to freezing orders, proprietary injunctions, and disclosure orders. Recovery is not guaranteed, but the legal infrastructure to pursue it is well-developed. The single most important variable is speed: a live trace combined with a same-day or next-day court application preserves options that a delayed response does not.

How fast must I act after a digital-asset theft?

Recovery windows for misappropriated digital assets are measured in hours, not weeks. Assets can move across multiple wallets and exchanges within minutes, and once converted or bridged to a non-freezable form, the trace becomes substantially harder. In our practice, we treat any confirmed misappropriation event as requiring an immediate forensic instruction and a same-business-day legal strategy call. The without-notice application to a court, supported by a completed forensic report, can be filed within 24 to 48 hours in the leading common-law forums where the evidence package is ready. Do not wait for law enforcement before acting civilly.

Can a court freeze assets held on an exchange?

Yes. A worldwide freezing order, granted on a without-notice basis in England and Wales, the DIFC, Singapore, or Hong Kong, covers assets wherever they are held, including in exchange accounts. A concurrent Bankers Trust or Norwich Pharmacal order compels the exchange to disclose account-holder identity and transaction records. Both orders can be served on the exchange's legal department directly. The exchange's cooperation depends partly on its regulatory home jurisdiction: an exchange regulated under VARA, the FCA's MLR regime, MAS, or the SFC VATP framework carries compliance obligations that make non-compliance with a valid court order a regulatory risk for the exchange itself.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking, and compliance obligations that surround them. Digital assets are the entirety of our practice. In our cross-border disputes work, we move for freezing relief and exchange disclosure while the forensic trail is live – because the recovery window does not reopen. To discuss your situation, contact info@oboluslaw.com or reach us on Telegram at t.me/oboluslaw.

By Glen Sorensen, Disputes & Recovery Analyst – on-chain asset tracing, cross-border freezing orders, and exchange disclosure across the leading common-law forums.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.