Recovery windows for misappropriated digital assets are measured in hours, not days. A cross-border business that waits for a lawyer's Monday-morning callback while stolen funds move across three exchanges and two blockchains has, in practice, already forfeited most of its options. On-chain asset tracing from a cross-border perspective is the discipline that turns a transaction hash into court-ready evidence – and, when timed correctly, into a freezing order that stops the clock.
The legal question is not simply "where did the funds go?" It is: which forum has jurisdiction, which exchange is compellable, and which issuer can freeze the token before the next withdrawal window. Those three questions each have a different answer depending on where the victim entity sits, where the counterparty exchange is licensed, and which blockchain and stablecoin protocol was used. Getting all three right, simultaneously and at speed, is the work of cross-border crypto asset recovery counsel.
This page sets out the regulated basis for on-chain tracing, the step-by-step process we follow, the cross-border complications that most practitioners underestimate, and the decision matrix operators should apply when a loss is first discovered.
Why on-chain tracing is a legal discipline, not just a forensic exercise
On-chain asset tracing means following the movement of digital assets across one or more public or permissioned ledgers, using blockchain analytics to build a forensic map that a court will accept as evidence. The tracing itself is technical. The cross-border legal layer – establishing that mapped evidence into compellable disclosure, proprietary injunctions and asset freezes – is where the outcome is actually decided.
Courts in the leading common-law forums have confirmed that digital assets are capable of being property. In England and Wales, AA v Persons Unknown [2019] established that crypto assets can be held on trust and subjected to proprietary injunctions. The DIFC Courts, Singapore's High Court and Hong Kong's Court of First Instance have each issued comparable orders. That jurisprudential alignment across multiple forums is significant: it means that a victim with assets scattered across exchanges in four countries is not confined to a single, inconvenient forum. Counsel can select the forum most likely to grant urgent relief and whose orders are most likely to be recognized elsewhere.
The CFAAR (Crypto Fraud and Asset Recovery) network, launched in London in September 2021, formalized the cross-border coordination infrastructure that recovery specialists had been building informally for years. Its existence signals that the leading recovery forums treat digital-asset misappropriation as a mainstream civil-fraud category, not a fringe technical matter.
In our cross-border practice, we treat every tracing instruction as a dual-track matter from the first call: the forensic team maps the chain, and the legal team simultaneously assesses the fastest forum for emergency relief. The two tracks must run in parallel. A forensic report that arrives after funds have been layered across five wallets and converted to privacy coins is informative but rarely actionable.
The regulated basis: disclosure orders and freezing relief
The legal tools available to a digital-asset victim are well-established in the major forums, even where the underlying technology is novel. The two primary instruments are compellable disclosure orders and asset-freezing injunctions – and in cross-border cases, both are typically sought together, on an urgent basis, without notice to the respondent.
A Norwich Pharmacal order (a court order compelling a third party that has been mixed up in wrongdoing to disclose identifying information) is the standard instrument for compelling an exchange to produce KYC records linked to a wallet address. When exchange records are needed quickly, before the account is closed or the operator is tipped off, a without-notice application is the norm. England and Wales, the DIFC Courts and Singapore are the most commonly used forums for exchange-directed Norwich Pharmacal relief. In 2025, the DIFC Courts granted a worldwide freezing order (an injunction freezing assets globally) in support of foreign proceedings in Trafigura v Gupta – confirming that DIFC judges will look past their territorial perimeter when a cross-border case demands it.
A Bankers Trust order – compelling a financial institution to disclose information about a customer's assets and transactions – extends the same logic to crypto custodians and exchanges that hold a fiduciary-type relationship with their users. Both instruments are available in England and Wales and have been adopted, with jurisdictional adaptations, in Singapore and Hong Kong.
For stablecoin cases, the legal layer intersects with the issuer layer. Tether (USDT) and Circle (USDC) each hold contract-level freeze and blacklist authority over their issued tokens. Issuers generally act on a court order, a law-enforcement referral, or an OFAC designation. Coordinating a judicial application with a parallel issuer freeze request – timed so the court order arrives before the issuer requires one – is a sequencing decision that can determine whether any recovery is possible at all.
The tracing process: step by step
Effective cross-border tracing follows a defined sequence. Diverging from it – or allowing the steps to run in the wrong order – is the most common reason recoveries fail.
Step 1 – Immediate preservation of evidence. The victim secures all transaction records: wallet addresses, transaction hashes, timestamps, screenshots of any communications, and any exchange deposit or withdrawal confirmations. This material forms the evidential base for every subsequent step. Loss of metadata at this stage can fatally weaken a later injunction application.
Step 2 – Forensic blockchain analysis. Specialists using tools such as Chainalysis, TRM Labs or Elliptic map the movement of funds from the victim's wallet through subsequent addresses, identifying clustering patterns, exchange deposit addresses and any conversion events. The output is a professional forensic report – not a self-produced trace. Courts in England and Wales, Singapore and the DIFC expect a report from an accredited or recognized forensic provider, not a party-produced address list.
Step 3 – Forum selection. Counsel assesses which court or courts can grant the fastest and most enforceable relief. Relevant variables include: where the exchange that received stolen funds is incorporated or licensed; which forum's orders the exchange has historically complied with; and whether a coordinating worldwide freezing order is needed to cover multiple custodians. This step requires current knowledge of exchange compliance posture – which changes as firms restructure or relocate their regulated entities.
Step 4 – Without-notice emergency applications. Once the forensic map is ready and the forum is selected, counsel applies, typically without notice to the respondent, for: (a) a proprietary injunction over identified assets; (b) a Norwich Pharmacal or equivalent disclosure order directed to the exchange; and (c) if stablecoins are involved, a coordinated issuer freeze request supported by the court order or a law-enforcement referral. The window between identification and application should be measured in hours, not days. We have seen funds cleared from exchange accounts during the time it took a victim to obtain two counsel opinions instead of acting on the first.
Step 5 – Post-disclosure tracing. Exchange KYC records, once obtained, typically reveal either an identifiable defendant or a further chain of addresses. If the defendant is identifiable, the litigation moves to a substantive recovery claim. If funds were further layered, the tracing process repeats from the new endpoints. Parallel law-enforcement referrals, including to FATF-aligned financial intelligence units, are coordinated at this stage.
Step 6 – Enforcement and recognition of orders. A freezing order obtained in London or Singapore is only as useful as the forum that will enforce it in the jurisdiction where assets currently sit. Cross-border recognition of civil orders is the final, often underestimated, step. Common-law jurisdictions with strong mutual-recognition traditions – the DIFC Courts, BVI, Cayman, Singapore and Hong Kong – are the most reliable enforcement environments. Civil-law jurisdictions require a separate recognition process that adds time and cost.
In a recent recovery matter, a payments business discovered that a seven-figure balance of stablecoins had been transferred without authorization following a credentials compromise. We secured a without-notice disclosure order in a leading common-law forum within the first working day, obtained KYC records that identified the receiving exchange accounts, and coordinated a parallel issuer freeze request. The funds were immobilized before the next business day. The eventual enforcement process played out over several months – but the critical window was closed in hours.
For a scoped assessment of your recovery options, contact OBOLUS now at info@oboluslaw.com. The process above describes the standard path. Your facts – the asset type, the exchange, the forum – change the analysis, and that assessment should happen before another block is confirmed.
The cross-border complications most practitioners underestimate
Cross-border tracing cases fail, or produce partial recoveries, for a predictable set of reasons – nearly all of which stem from treating the case as a domestic civil-fraud matter with a foreign postcode rather than as a multi-forum legal operation from the outset.
The first complication is exchange jurisdiction fragmentation. A major exchange may be incorporated in the Seychelles, licensed in Lithuania under the MiCA transition regime and Dubai under VARA, and hold customer assets through a Cayman-incorporated custodian. A disclosure order directed to the wrong entity – the trading platform rather than the licensed custodian – will be met with a jurisdictional objection that consumes weeks. Identifying the correct legal entity against which to seek relief is a research task that must happen before the application, not during it.
The second complication is the AML/Travel Rule layer. Under the FATF Travel Rule – the obligation to pass originator and beneficiary data with a transfer above applicable thresholds – exchanges in compliant jurisdictions are required to collect and retain counterparty information on transfers. A well-framed disclosure application that invokes the exchange's own AML record-keeping obligations is more likely to produce a prompt response than one that simply demands KYC data under a civil-court order. We regularly frame disclosure requests to align with what the respondent exchange is already required to hold under the applicable regime, whether MiCA/ESMA, MAS, SFC or the FCA's money-laundering regulations.
The third complication is blockchain type. Tracing on Bitcoin or Ethereum mainnet is mature and well-supported by forensic tooling. Cross-chain bridges, privacy coins and layer-2 rollups present distinct forensic challenges. Legal strategy must account for the possibility that tracing will dead-end at a bridge contract or a mixer, and contingency applications – directed to the bridge protocol operator or the receiving-chain exchange – should be prepared in parallel. This is a structural judgment that counsel must make before the first application, not after the trace stalls.
The fourth complication is defendant anonymity. Many thefts are carried out by persons who used synthetic or stolen KYC documents at the receiving exchange. A disclosure order that produces a fake identity does not end the case; it redirects the inquiry to the exchange's onboarding procedures and to further on-chain hops. Operators should instruct counsel who have managed cases to this second and third tracing layer, not just to the first exchange disclosure.
Operators we advise routinely underestimate the time it takes to obtain recognition of an English or Singapore freezing order in a civil-law jurisdiction. In jurisdictions without a streamlined recognition procedure, parallel domestic proceedings may need to be filed simultaneously – adding legal entities, local counsel and procedural timelines to an already complex case. Mapping that recognition risk at the outset is part of the forum-selection analysis, not an afterthought.
Decision matrix: which approach fits your situation
Not every on-chain loss calls for the same legal response. The appropriate strategy depends on four variables: the asset type, the identifiable forum connection, the amount at stake relative to the cost of proceedings, and the time elapsed since the loss.
Profile A – Exchange-connected loss, recent (within 48 hours), stablecoin or major token. This is the strongest recovery profile. Funds are likely still on an exchange. The priority is an immediate without-notice disclosure order and a coordinated issuer freeze request. Forum should be selected for speed of emergency relief, not convenience. England and Wales, Singapore and the DIFC are the primary candidates. A professional forensic report must be commissioned in parallel, not sequentially. The key risk is delay caused by internal approvals processes at the victim entity – every hour of internal deliberation is an hour of additional bridging and layering.
Profile B – Loss discovered days or weeks after the event, mixed or bridged assets. The trail may still be followable, but the probability of funds sitting in an identifiable, freezeable account is lower. The priority shifts to a disclosure-first strategy: obtain exchange KYC records to identify defendants, assess the feasibility of a proprietary claim, and consider whether a law-enforcement referral to a FATF-aligned agency is the most cost-effective parallel track. Timeline to recovery, if achievable, is measured in months. The key risk is a cost/benefit miscalculation – instructing full cross-border litigation on a loss that would not cover the cost of proceedings across four forums.
Profile C – Large institutional loss, multiple chains, privacy-coin conversion involved. This is the most complex profile. Forensics must run against multiple chains simultaneously. Legal strategy should include a without-notice application in the strongest available forum, parallel law-enforcement coordination, and contingency applications directed at fiat off-ramps (exchanges, OTC desks) where privacy-coin proceeds are likely to surface. Recovery timelines are long, but partial freezes at identified off-ramp points can be obtained relatively quickly. The key risk is forensic-legal sequencing: if the legal application runs ahead of the forensic map, the evidence presented to the court will be incomplete.
Profile D – Loss by a business through counterparty insolvency or custodian collapse, not theft. This is a different legal category. On-chain tracing plays a secondary role; the primary instrument is an insolvency or restructuring claim in the forum of the custodian's incorporation. The Cayman Islands and BVI are the most common insolvency forums for offshore custodians. The key risk is misclassifying the loss as a theft recovery matter and instructing for the wrong relief.
If your situation maps to Profile A or B and the loss occurred recently, message our disputes desk at t.me/oboluslaw now. If a prior application stalled or disclosure produced a dead end, a second read can surface the structural reason and the route forward.
Common mistakes in cross-border tracing cases
A common assumption is that once funds leave the originating wallet, recovery is impossible. That assumption is wrong as a matter of current law and practice – but the window in which it is wrong is narrow. Most recoveries that fail do so because of mistakes made in the first 24 to 72 hours, not because the legal tools are unavailable.
The most consistent mistake is sequential rather than parallel instruction. Victims instruct a forensic firm, wait for the report, then instruct lawyers, who then assess the forum, then draft the application. Each handoff costs days. An integrated approach – legal and forensic teams working under a single instruction from the first call – compresses the timeline from report to court to a matter of hours. In our practice, the legal analysis begins the moment the transaction hashes and wallet addresses are provided, not when the forensic report is finalized.
The second mistake is forum selection based on familiarity rather than strategy. A victim entity incorporated in Germany that instructs local German counsel for crypto recovery will typically find that German civil procedure, while sound, does not offer the without-notice ex-parte injunctive tools available in England and Wales or the DIFC on the same timeline. The relevant question is not "which court is convenient for us?" but "which court can freeze assets today, and whose orders will the exchange comply with?" Those are different questions with different answers.
The third mistake is alerting the exchange or the suspected defendant before an injunction is in place. A victim who contacts an exchange's customer-support line to "report a theft" before a court order is obtained is, in effect, notifying the account holder that a freeze may be coming. Without-notice applications exist precisely to prevent this. All communications with exchanges should be coordinated through counsel from the point of instruction.
The fourth mistake is underestimating the evidential standard. Emergency injunctions are serious court orders. Judges in the leading forums expect a forensic report from a named, recognized provider; a clear proprietary or constructive trust claim; and a realistic case that the balance of convenience favors the freeze. A self-produced address map and a witness statement from the victim's IT team, without a professional forensic report, will typically fail to meet the threshold. Regulators in the leading hubs increasingly expect professional-grade evidence in support of disclosure requests as well as court orders.
The cross-border banking and compliance layer
On-chain tracing does not end at the blockchain. The most common exit route for stolen digital assets is a conversion to fiat at an exchange or OTC desk, followed by a wire transfer through correspondent banking channels. That exit route creates a second layer of disclosure and freezing opportunities – but it also introduces a second regulatory regime: the AML/CFT framework applicable to the receiving bank.
Under the FATF Recommendations, and specifically the Travel Rule obligations now implemented across MiCA/ESMA-regulated exchanges, MAS-licensed operators in Singapore, SFC-regulated platforms in Hong Kong and FCA-registered entities in the UK, exchanges are required to screen transactions, retain counterparty data and report suspicious activity. A well-coordinated case will use those obligations offensively: compelling the receiving bank to freeze the incoming wire under its own AML obligations, supported by a law-enforcement referral and a parallel civil-court order.
In practice, this means that effective cross-border recovery counsel must be familiar with the AML posture of exchanges and banks across multiple jurisdictions simultaneously. An instruction to a firm that handles only the court side, without awareness of the exchange compliance environment, will miss the banking-layer freeze opportunity. We have seen cases where a freezing order was obtained at the exchange level in under two working days, only for fiat proceeds to clear the correspondent bank while the court order was being served on the exchange's registered agent in a different time zone.
Operators we advise routinely build an AML-escalation contact list for their major counterpart exchanges before a loss occurs, as part of incident-response planning. Having a named compliance contact at the exchanges you regularly use is a practical risk-management measure that can reduce the time from loss to freeze by a material margin.
Related at OBOLUS
Related at OBOLUS
- Disputes & Asset Recovery for Digital Asset Businesses – the full scope of our recovery and litigation practice for business clients.
- Worldwide Freezing Orders in Germany under BaFin supervision – cross-border injunctive relief in a major civil-law jurisdiction.
- Cross-chain Bridge Legal Risk in the Czech Republic – jurisdiction-specific analysis of bridge-protocol liability for operators.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses. In every recovery matter we take on, a dedicated legal team moves in parallel with the forensic trace – not after it. To discuss a current loss or to build a pre-incident recovery plan, contact info@oboluslaw.com.
FAQ
Can stolen crypto actually be recovered?
Yes – in a meaningful proportion of cases where action is taken promptly and the assets remain on a regulated exchange or in an identifiable stablecoin. Courts in England and Wales, Singapore, Hong Kong and the DIFC have each issued proprietary injunctions and disclosure orders over digital assets. Recovery depends on speed, the quality of forensic evidence and the forum selected. It is not guaranteed, but the legal tools are well-established and increasingly effective when used correctly.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows are measured in hours, not weeks. Funds can be layered across multiple wallets, converted to privacy coins or withdrawn to fiat within a single business day. The first priority on discovering a loss is to preserve all transaction records and contact recovery counsel before communicating with the exchange or any other party. Every hour of delay narrows the set of available remedies. An integrated legal and forensic response, started within the first few hours, produces the best outcomes.
Can a court freeze assets held on an exchange?
Yes. Courts in the leading common-law forums – England and Wales, Singapore, Hong Kong and the DIFC – regularly grant freezing injunctions over assets held in exchange accounts. A proprietary injunction or worldwide freezing order can be obtained without notice to the respondent where tipping-off is a risk. The exchange is then served with the order and required to freeze the relevant account. Compliance depends on the exchange being subject to the forum's jurisdiction, which is why forum selection is a critical first step in any cross-border tracing case.
By Glen Sorensen, Disputes & Recovery Analyst – specialist in cross-border on-chain asset tracing, multi-forum freezing relief and exchange disclosure strategy for business victims of digital-asset misappropriation.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.