On-chain asset tracing is the process of following the blockchain ledger to identify where misappropriated digital assets have moved, who controls the destination addresses, and which exchanges or custodians hold the funds today. For a business that has suffered a theft, an internal misappropriation, or a counterparty default, this forensic work is the legal foundation for every step that follows – the freezing order, the disclosure application, and the recovery claim. Without a traceable chain of custody, courts cannot grant interim relief, and issuers will not act. Time is the variable that determines whether relief is possible at all.
As regimes across the major hubs tighten their expectations for virtual asset service providers (VASPs – businesses that exchange, transfer or custody digital assets), the legal toolkit for recovery has expanded in parallel. Courts in England and Wales, the DIFC, Singapore, Hong Kong, and the Cayman Islands have each confirmed that crypto assets are property capable of being frozen and traced. The practical question for any business victim is whether counsel can move fast enough to keep the trail live. This page explains how on-chain asset tracing works as a legal matter, what the process looks like, and where it can go wrong.
What exactly does on-chain asset tracing involve?
On-chain asset tracing maps every transaction from the point of misappropriation to the current location of the funds, using the immutable public record of the blockchain. The process begins with raw transaction data – wallet addresses, transaction hashes, timestamps and values – and ends with a professional forensic report that a court or an exchange compliance team can act upon. That report identifies the exchanges, bridges or mixing services through which the funds have passed, and it assigns a probability assessment to each identified destination address.
The legal significance of the report is substantial. Judges in leading common-law courts have accepted blockchain forensic evidence as a basis for worldwide freezing orders (injunctions freezing a defendant's assets globally, regardless of where those assets sit). The same report is ordinarily a precondition to a Norwich Pharmacal order (a disclosure order compelling an exchange to identify the account holder behind a wallet address). Without a credible forensic trail, neither application can succeed. In our cross-border practice, we commission or review the forensic work in parallel with drafting the court application – the two processes run simultaneously, not sequentially.
Forensic capability is only one side of the equation. The legal analysis – which court has jurisdiction, which regime governs the exchange, whether the asset is capable of being frozen under local law, and how to serve a defendant who may be anonymous – sits entirely within the domain of legal counsel. Tracing without legal direction produces a report. Tracing with legal direction produces an application that has a realistic chance of obtaining relief.
The first concrete step after a misappropriation event is to preserve the transaction hash and wallet addresses before taking any other action. Moving funds within your own system, or conducting on-chain activity that touches the traced address, can complicate the evidentiary picture. Counsel should be contacted before any internal remedial steps are taken.
CTA #1 – For operators confronting an asset loss for the first time: The process above describes the standard path. Your facts – the entity, the asset type, the exchange, the jurisdictions involved – change the analysis materially. For a scoped assessment of your situation, contact OBOLUS at Map your options or email info@oboluslaw.com.
What legal regime governs on-chain asset tracing and recovery?
On-chain asset tracing sits at the intersection of private international law, property law, and the regulatory frameworks that govern exchanges and custodians. No single statute governs the field globally; instead, counsel must identify the most favorable forum, the applicable property law, and the regulatory obligations of the exchange or custodian that holds the funds.
In England and Wales, the courts have confirmed crypto assets as property in a series of rulings, including AA v Persons Unknown [2019] and Osbourne v Persons Unknown [2022], which extended that analysis to NFTs. The worldwide freezing order and the Norwich Pharmacal disclosure procedure, both established under English law, remain the most versatile recovery tools available in any common-law system. The DIFC Courts in Dubai have followed the same trajectory, issuing worldwide freezing orders and disclosure orders in digital-asset matters, and recognizing orders from foreign jurisdictions. Singapore and Hong Kong have each confirmed proprietary remedies over crypto assets, and their courts accept forensic blockchain evidence on the same basis as English courts.
The regulatory dimension matters equally. Under the Travel Rule (the obligation to pass originator and beneficiary identification data with a virtual-asset transfer, drawn from FATF Recommendation 15), exchanges that are subject to regulation in the MiCA environment, under VARA, under the MAS Payment Services Act, or under the FCA's anti-money-laundering regime, hold identification data on account holders. A court order directed at a regulated exchange can compel disclosure of that data. Unregulated exchanges are harder to reach through formal legal process, though Tether and Circle hold contract-level freeze authority over USDT and USDC respectively, and both issuers act on law-enforcement requests and court orders.
The choice of forum therefore turns on three questions: where can a court be reached quickly, which regime governs the exchange holding the funds, and whether the asset is a stablecoin or a token without a central issuer. Each answer changes the procedural path.
How does the on-chain tracing and recovery process work, step by step?
The process unfolds in distinct phases, and the sequence matters because later steps depend on the quality of what is preserved and done in the first hours.
Phase one – immediate preservation. The moment a misappropriation is identified, the business must record every transaction hash, wallet address, and on-chain event associated with the movement. This is not a technical task; it is a legal one. The purpose is to create a timestamped record that cannot later be challenged as reconstructed. Counsel should be involved at this stage to advise on evidence preservation and to place the forensic work within a legal privilege structure where that is available.
Phase two – forensic tracing. A specialist blockchain analytics firm maps the movement of the funds across the chain. The output is a professional report that identifies each hop – from the originating wallet, through any intermediate addresses or bridges, to the current custodian or exchange address. The report quantifies confidence levels for each identified address and flags any mixing or obfuscation activity. In our cross-border practice, we work with analytics firms whose reports meet the evidentiary standards required in leading common-law courts. We review the report before it is finalized to ensure it answers the specific questions the court application will raise.
Phase three – application for interim relief. With the forensic report in hand, counsel applies to the most appropriate court for a freezing order and, where the defendant's identity is not yet known, for a disclosure order directed at the exchange. The application is typically made without notice to the defendant (on an ex parte basis), because prior notice would permit the defendant to move the funds. The court requires evidence of a good arguable case on the merits, evidence of assets within the jurisdiction or held by a party subject to the court's jurisdiction, and a risk of dissipation – all three of which a strong forensic report can establish.
Phase four – exchange and issuer action. Armed with a court order, counsel presents it to the relevant exchange for account disclosure or account freeze. For stablecoins, the order is simultaneously presented to the issuer. Where the exchange is regulated under VARA, MiCA, the MAS regime, or under FCA oversight, compliance departments are accustomed to responding to court orders from recognized forums, and response times are typically measured in days rather than weeks.
Phase five – substantive proceedings. Once assets are frozen and identities disclosed, the substantive claim – whether in conversion, unjust enrichment, or fraud – proceeds on the ordinary litigation timeline. The freezing order remains in place pending resolution. At this stage, settlement negotiations frequently commence, because a defendant whose assets are frozen and whose identity is known has limited leverage.
How fast must a business act after a digital-asset misappropriation?
The recovery window for misappropriated digital assets is measured in hours, not days – and certainly not weeks. This is not a rhetorical claim; it is an operational reality with a structural cause. Once funds reach an unregulated exchange or are converted through a bridge, the forensic trail does not disappear, but the ability to freeze before withdrawal narrows sharply.
The critical variable is whether the funds are still sitting in an identifiable address at a regulated exchange. If they are, a freezing application supported by a forensic report can be made on an urgent basis to a court that operates an out-of-hours emergency procedure – England and Wales, the DIFC Courts, and the Singapore courts all provide this. The court can grant relief within hours of an application. If the funds have already moved to a non-custodial wallet or to an unregulated exchange, the direct freeze path is blocked, though the forensic and legal work continues with the aim of tracing to a recoverable point later in the chain.
In our practice, we treat every new recovery instruction as time-critical until we have completed the preliminary assessment. We do not ask clients to fill in onboarding forms before we evaluate the facts. The first call is focused on one question: where are the funds right now, and which court can reach them?
A common mistake at this stage is to contact the exchange directly before obtaining legal advice. Some exchanges will act on an informal notice of theft, but many will not freeze an account without a court order, and an unsupported informal request can alert the account holder. The better practice is to proceed through legal channels from the outset, preserving both the evidentiary record and the element of surprise.
Why does the cross-border dimension make tracing harder – and how is it managed?
Most digital-asset misappropriations cross at least one border. The victim business may be incorporated in the Cayman Islands, operate under a VARA licence in Dubai, and find that the funds have moved to an exchange regulated by the MAS in Singapore, through a wallet linked to an account at an FCA-registered custodian in London. Each jurisdiction applies its own procedural law to the application for relief, and no single court can compel action in every forum simultaneously.
The practical answer is to identify the single forum that offers the fastest and widest relief, obtain that order, and then use it as the foundation for parallel applications in the other relevant jurisdictions. English courts and the DIFC Courts are the most commonly chosen primary forums for this reason: both have well-developed worldwide freezing order procedures, both are respected by exchanges globally, and both have strong mutual recognition frameworks. DIFC orders have been enforced in onshore Dubai and across the GCC; English orders are recognized in Singapore, Hong Kong, and the Cayman Islands.
Where funds have moved to an exchange regulated under a jurisdiction whose courts are less immediately accessible – or to an exchange operating outside any regulated perimeter – allied counsel in the relevant jurisdiction can be briefed to make a local application. We coordinate that multi-forum work from a single point of instruction, so the client does not manage five separate counsel relationships under time pressure.
The CFAAR (Crypto Fraud and Asset Recovery network), launched in London in September 2021, provides a coordination mechanism among law firms and forensic specialists in the major recovery hubs. Participation in that network informs our understanding of how different forums respond to specific categories of crypto claims, and how exchange compliance teams across jurisdictions tend to process court orders in practice.
CTA #2 – For operators who have already tried and hit an obstacle: If a prior application stalled, an exchange did not respond to a court order, or a forensic trail went cold, a second read of the structure can surface the reason and the route forward. Email OBOLUS at Map your options or reach the disputes desk at info@oboluslaw.com.
What mistakes do businesses most commonly make in on-chain recovery?
The most consequential mistake is delay. Businesses frequently spend days or weeks attempting internal resolution, engaging the exchange informally, or seeking forensic help without legal direction, before involving counsel. By that point, the funds may have moved beyond a readily freezable position.
The second common mistake is attempting to trace or recover without a legal strategy. Forensic tracing firms produce excellent reports, but a report without a court application is a document. A document does not freeze assets. The forensic and legal workstreams must run together, with counsel directing the scope of the forensic work toward the questions the court will need answered.
Third, businesses frequently underestimate the importance of forum selection. Not every court that could theoretically hear a crypto recovery claim will grant emergency relief on a same-day basis. Courts in some jurisdictions require domestic connections to the defendant that may not exist. Counsel must assess jurisdiction quickly and correctly, because an application to the wrong forum loses days that the defendant can use to move funds.
Fourth, victims sometimes contact the media or post on social media about the theft before obtaining a freezing order. This can eliminate the element of surprise, which is the central tactical advantage in a recovery application made without notice. Any public disclosure about the incident should be deferred until after interim relief is in place, unless there is an overriding legal or regulatory obligation to disclose sooner.
Fifth, inadequate evidence preservation in the first hours creates problems later. Courts will ask how the evidence was collected and when. If the collection was reconstructed after the event, the chain of custody argument is weakened. A contemporaneous, privilege-protected record is significantly more valuable than a retrospective reconstruction.
Which approach fits which business profile?
Not every misappropriation calls for the same response. The right approach depends on the nature of the asset, the size of the loss, the identity of the counterparty, and the jurisdictions involved.
Profile A – Internal misappropriation or employee fraud. The counterparty is identifiable. The primary tools are a without-notice freezing order in the victim's home jurisdiction, a disclosure order to capture any offboarding of funds, and a proprietary claim. Timeline to interim relief: typically a matter of days from instruction. Key risk: delay while internal investigation is completed before counsel is engaged.
Profile B – External hack or exchange compromise. The counterparty is initially anonymous. The primary tools are forensic tracing to a regulated exchange, a Norwich Pharmacal disclosure order against the exchange, and then a freezing order once the identity is established. Timeline to disclosure order: varies by forum and court availability; urgent applications in England and Wales or the DIFC can be heard within hours of filing. Key risk: funds leave the regulated exchange before the order is served.
Profile C – Counterparty default (exchange insolvency or rug-pull). The counterparty may be known but the assets may be controlled by an insolvent entity or spread across multiple wallets. The primary tools are insolvency proceedings, a freezing order over identifiable wallets, and potential claims against directors. Timeline: longer than an emergency freeze; measured in weeks for the insolvency route. Key risk: dissipation of remaining assets during the period before the insolvency appointment.
Profile D – Stablecoin misappropriation (USDT or USDC). The issuer freeze capability is directly relevant. A law-enforcement referral combined with a court order can engage the issuer's blacklist function directly. Timeline: issuer response to a court order or law-enforcement request is typically faster than an exchange freeze for non-stablecoin assets. Key risk: the window between misappropriation and when the issuer can act is narrow; the request must reach the issuer before the funds are converted.
A common assumption worth examining
A common assumption among businesses that have suffered a digital-asset loss is that once the funds have left the original wallet, nothing can be done. This is not accurate, and operating on that assumption causes businesses to miss recovery windows that were still open.
The blockchain's immutability, which makes theft difficult to reverse immediately, also makes it impossible for a thief to erase the trail. Every hop leaves a record. The question is not whether the trail exists – it almost always does – but whether the funds can be reached at a legally accessible point in the chain before they are converted to a form that is harder to freeze. Courts in every major common-law jurisdiction have now confirmed that crypto assets are property. That confirmation means the standard property remedies – freezing, disclosure, proprietary injunction – are available. The legal infrastructure exists. What determines the outcome is whether it is engaged quickly enough and directed by counsel who understands both the forensic and the procedural dimensions.
In our practice, we have seen matters where the victim believed recovery was impossible and had already written off the loss. In several of those matters, a forensic review revealed that the funds were still sitting in an identifiable account at a regulated exchange, and a court application was still viable. Delay had not closed the window entirely – but it had narrowed it considerably, and the urgency premium on the court application was correspondingly higher.
Related at OBOLUS
- Disputes & Asset Recovery for Digital-Asset Businesses – full practice overview covering disputes, freezing orders and cross-border recovery for exchanges, funds and issuers.
- On-chain Asset Recovery: How the First Hours Decide the Outcome – analysis of the time-critical decisions in the first hours after a misappropriation event.
- Redemption and Liquidity Terms in Cayman Islands – how Cayman Islands fund terms interact with digital-asset recovery and enforcement proceedings.
FAQ
Can stolen crypto actually be recovered?
Yes, in many cases – though the outcome depends heavily on speed and forum. Courts in England and Wales, the DIFC, Singapore, Hong Kong, and the Cayman Islands have each confirmed that digital assets are property subject to freezing orders and proprietary claims. Where funds remain at a regulated exchange, a court order can freeze them and compel disclosure of the account holder's identity. For stablecoins, issuers hold a direct freeze capability. The earlier counsel is engaged, the wider the options remain.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows for misappropriated digital assets close in hours, not days. The critical question is whether the funds are still sitting in an identifiable address at a regulated exchange – if they are, an urgent court application for a freezing order can be made on the same day. Waiting even forty-eight hours to engage counsel can mean the difference between funds that are frozen and funds that have been converted and moved beyond immediate reach. Preserve transaction hashes before taking any other step.
Can a court freeze assets held on an exchange?
Yes. Courts in England and Wales, the DIFC Courts, Singapore, and Hong Kong have each granted freezing orders and disclosure orders directed at exchanges and custodians. A regulated exchange operating under MiCA, VARA, the MAS Payment Services Act, or FCA oversight will typically comply with a court order from a recognized forum. The order is directed at the exchange as a third party, requiring it to freeze the identified account and disclose account-holder information. The strength of the forensic tracing report underpinning the application determines how quickly relief can be obtained.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. In our disputes work, we move for freezing relief and exchange disclosure while the forensic trail is still live – because that is the window that matters. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
CTA #3 – To engage the OBOLUS disputes desk: If a recovery clock is running, reach our disputes desk now at Map your options or at info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialises in on-chain asset tracing, cross-border freezing orders and emergency recovery applications across common-law forums including England and Wales, the DIFC Courts, and Singapore.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.