Recovery windows for misappropriated stablecoins are measured in hours. A founder who discovers that USDT or USDC has left the company wallet without authorization faces a decision that must be made before the funds move again: act now or accept that the trail may go cold. The stablecoin freeze request – a coordinated combination of issuer-level token blacklisting and court-ordered asset preservation – is the primary legal instrument available at this stage. This page explains how the process works, what early-stage founders can realistically expect, and where the analysis gets complicated across borders.
Both Tether (USDT) and Circle (USDC) hold contract-level authority to freeze tokens at the wallet address. Issuers generally act on a law-enforcement request, an OFAC designation, or a court order. That intervention, when it arrives fast enough, stops the asset moving onward while parallel legal proceedings develop. For an early-stage company with a lean in-house function, knowing how to trigger that process – and what courts require before they will assist – is the difference between a live recovery and an academic exercise.
The sections below walk through the regulated basis, the practical steps, the cross-border reality, the most common founder mistakes, and a decision matrix by company profile. One anonymized matter illustrates the process in practice.
Why Stablecoins Are Different From Other Crypto Assets
Unlike Bitcoin or Ether, stablecoins issued by centralized entities carry an administrator with the technical power to act. That distinction is legally significant. The fiat-backed stablecoin sits at the intersection of traditional money-transmission law and on-chain programmability, giving a recovery team two simultaneous levers: the issuer's blacklist function and the courts of a common-law jurisdiction.
Under the FATF Recommendation 15 framework, stablecoin issuers who hold customer balances are treated as obliged entities. Most major issuers operate within a regulatory perimeter – whether the MiCA (Markets in Crypto-Assets Regulation) regime in the EU, the New York BitLicense regime administered by NYDFS, or equivalent structures elsewhere. That regulated status means they have compliance infrastructure and a response process when a legitimate demand arrives.
The practical implication: a well-documented, legally-framed request to Tether or Circle, arriving alongside a court order from a recognized forum, will almost always receive a substantive response. A bare email from a founder alleging theft will not. The form of the demand matters as much as its substance.
In our cross-border practice, we routinely advise founders who underestimate this institutional dimension. The issuer is not acting on good faith alone. It needs legal cover – a court order, a law-enforcement case number, or an OFAC designation – before it will exercise the blacklist function and expose itself to a counterclaim from whoever currently controls the wallet address.
What Is the Legal Basis for a Stablecoin Freeze Request?
A stablecoin freeze request proceeds on two parallel tracks: the issuer channel and the court channel. The court channel produces the legal instrument – typically a worldwide freezing order (an injunction preserving a defendant's assets globally, including digital assets) or a proprietary injunction asserting the claimant's ownership interest in specific tokens – that gives the issuer the cover it requires.
England and Wales remains the leading forum for this work. Courts there have treated digital assets as property, confirmed that proprietary injunctions lie over crypto assets, and developed a body of practice around Norwich Pharmacal and Bankers Trust disclosure orders – orders that compel exchanges and custodians to produce account information about persons unknown. The landmark AA v Persons Unknown decision is the foundational authority; subsequent cases have extended the doctrine to NFTs and to multi-jurisdictional asset trails.
The DIFC Courts in Dubai offer a comparable armoury for operators with a UAE connection, including worldwide freezing orders in support of foreign proceedings. Hong Kong and Singapore both recognize crypto assets as property and have issued proprietary injunctions. For a founder whose company is incorporated in a common-law jurisdiction with a functioning commercial court, the procedural pathway exists. The question is whether the evidence package is sufficient to persuade a judge to act on an urgent, without-notice basis.
That evidence package – the transaction hashes, a professional forensic tracing report, the chain of custody narrative, and the legal basis for ownership – is what separates a successful without-notice application from an adjournment.
To map the right forum and evidence package for your situation, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking relationship, and the jurisdictions through which funds moved – change the analysis materially. Map your options
How Does On-Chain Tracing Feed a Legal Application?
On-chain tracing is the evidentiary foundation of every stablecoin recovery action: without it, a court application is narrative without proof, and an issuer request is noise. The tracing process follows the asset from the point of loss through each wallet address and exchange deposit, producing a timestamped chain-of-custody record that a court can read and an issuer can rely on.
In our practice, we work alongside specialist forensic partners – firms equipped with the tools and methodologies that courts in England and Wales, the DIFC, and Singapore regularly accept – to convert raw on-chain data into a professional report. That report addresses three questions the court will ask: where did the asset go, who controls the destination address, and is there an identifiable defendant (or "persons unknown" whose address is known) against whom relief can be directed?
For founders, the practical points are these. First, preserve everything immediately: wallet logs, access logs, any correspondence that preceded the loss, and any two-factor or key-management records. Second, do not move assets in or out of the affected wallets before the forensic team has captured the state of the blockchain. Third, understand that the quality of the tracing report directly determines the urgency tier at which the court will hear the application. A report from a recognized forensic provider, referencing established methodology, carries significantly more weight than an in-house reconstruction.
The CFAAR (Crypto Fraud and Asset Recovery network, launched in London in September 2021) operates as a coordination layer across the major common-law recovery forums, connecting practitioners who manage cross-border disclosure chains. We engage that network where assets have moved through multiple jurisdictions and where simultaneous orders from more than one court are required to lock the position before withdrawal.
How Does the Issuer Request Process Actually Work?
Tether and Circle both maintain formal processes for law-enforcement and legal-counsel engagement. The request must arrive through the correct channel, in the correct form, with the correct documentary support. A founder who sends an informal email will not trigger the blacklist function. A lawyer who submits a properly scoped demand – ideally backed by a court order, or in parallel with one being sought – will receive a structured response.
The core documentary requirements at the issuer stage are: a clear identification of the wallet address to be frozen, the transaction hash or hashes evidencing the unauthorized transfer, the legal basis for the claimant's ownership interest, and – wherever a court order exists – a certified copy of that order. Where a law-enforcement case reference exists, including it significantly accelerates the issuer's internal compliance review.
The timeline at the issuer level, once the correct package arrives, is short – typically hours to a small number of business days for a substantive response. That urgency is why the legal and forensic preparation must begin before the formal demand is sent, not after. In our cross-border practice, we stage the preparation so that the forensic report, the court application, and the issuer demand arrive in close sequence, minimising the window during which the counterparty can move funds to a non-blacklistable asset or off-ramp to fiat.
One operational constraint bears emphasis: the issuer freeze is a temporary measure. Blacklisted funds remain on-chain but inaccessible to the controlling wallet address. Permanent recovery requires either a negotiated return (uncommon in adversarial situations) or a court order directing the issuer to transfer the frozen balance to a specified address. The legal process does not end with the freeze.
What Happens When Funds Cross Borders?
Stablecoins move faster than any jurisdictional boundary. A founder in Dublin, a counterparty using an exchange registered in Singapore, funds currently sitting in a wallet associated with a UAE address – that three-way geography is not unusual, and each element adds procedural complexity. The cross-border reality of a stablecoin freeze request is that no single court controls the entire chain, and coordination between forums is the rule rather than the exception.
England and Wales courts regularly grant worldwide freezing orders with extra-territorial reach, and DIFC Courts have issued freezing orders in support of proceedings seated in foreign jurisdictions. Singapore and Hong Kong have established regimes for recognizing and enforcing foreign court orders. But each step in the chain requires that the relevant forum is satisfied on its own procedural requirements – jurisdiction, service, and the merits of the underlying claim.
For a founder whose company is incorporated in one jurisdiction, banking in a second, and whose counterparty is operating through a third, the practical question is: which forum anchors the primary application? The answer turns on where assets are most accessible, where the defendant has a recognizable presence, and where a court is most likely to act on an urgent, without-notice basis with a well-evidenced application. In our practice, we regularly advise on this sequencing decision before the application is filed, because the wrong starting forum can delay the entire action by days – long enough for funds to move again.
The Travel Rule (the obligation under FATF Recommendation 15 to pass originator and beneficiary data with a transfer) also operates as an intelligence layer in cross-border recovery. Where an exchange is a regulated VASP (virtual asset service provider) and subject to the Travel Rule, it holds KYC and counterparty data that a disclosure order can unlock. That data can bridge the gap between an on-chain address and an identifiable individual or entity.
If your matter involves assets in multiple jurisdictions, reach our disputes desk now at info@oboluslaw.com. A second read on the sequencing question costs nothing and can determine whether the cross-border chain is manageable. If a prior application stalled or an account was closed, that structural reason is usually identifiable and the route back exists. Map your options
What Are the Most Common Mistakes Early-Stage Founders Make?
The most common mistake is delay. Founders frequently spend the first twelve to twenty-four hours trying to resolve the situation informally – messaging the counterparty, contacting the exchange directly, or waiting to see whether the transfer reverses. None of those steps trigger the legal process, and each one consumes time that the recovery window does not have.
The second mistake is contact with the exchange without legal advice. Most exchanges will not act on a founder's direct request; some will alert the account-holder, which may accelerate a withdrawal attempt. The correct channel is a formal legal demand or a court-ordered disclosure request directed to the exchange's compliance function, not a customer-service inquiry.
The third mistake is moving funds before forensics are complete. Founders who attempt to "secure" remaining assets by transferring them to a new wallet can inadvertently contaminate the on-chain evidence trail, create questions about the chain of custody, and, in some jurisdictions, raise procedural issues around dissipation of assets.
The fourth – and arguably most consequential – mistake is treating the matter as a technology problem rather than a legal one. On-chain tracing identifies where funds went. Only legal process compels disclosure of who controls the destination address and secures preservation of the asset. A forensic tool alone does not freeze a wallet.
In our cross-border practice, we have seen founders lose the recovery window entirely because their initial steps – however well-intentioned – signalled the investigation to the counterparty before legal process was in place. The sequence matters: secure the evidence, instruct counsel, file for relief, then communicate.
Decision Matrix: Which Recovery Path Fits Your Profile?
Not every stablecoin loss warrants the same response. The appropriate pathway depends on the size of the claim, the jurisdiction of the relevant parties, the quality of the available evidence, and whether a specific counterparty can be identified.
Profile A – Identified counterparty, assets still on-chain, claim in the six figures or above: this is the core case for a combined court application and issuer freeze request. The evidence package is built, the primary forum is selected (typically England and Wales, Singapore, Hong Kong, or DIFC depending on the nexus), a without-notice freezing order and disclosure application are filed simultaneously with the issuer demand. The timeline from instruction to filed application is typically a matter of days with a prepared evidence package.
Profile B – Unknown counterparty, address-only identification, assets moving through multiple exchanges: the primary instrument is a "persons unknown" freezing order combined with Norwich Pharmacal-style disclosure orders against the exchanges holding the identified addresses. This path works best in England and Wales, which has the most developed practice on Persons Unknown defendants. The disclosure chain may need to run through two or three exchanges before an identifiable entity emerges.
Profile C – Assets already converted to fiat or to a non-blacklistable asset, withdrawal suspected: the legal options narrow but do not close. The focus shifts to tracing the proceeds through bank accounts (where banking disclosure orders are available), to identifying the beneficial owner of the relevant exchange account, and to whether criminal referral accelerates the recovery. The timeline extends materially, and the cost-benefit analysis at smaller claim sizes shifts against proceeding.
Profile D – Cross-border claim, multiple jurisdictions, significant scale: coordinated multi-forum strategy, engaging allied counsel in each relevant jurisdiction alongside the primary application team. The CFAAR network is activated where the cross-border chain requires simultaneous disclosure in more than one forum. This profile requires the most preparation and the clearest sequencing decision at the outset.
A Common Assumption Worth Addressing
A common assumption among founders who have suffered a stablecoin loss is that once the funds leave the wallet, recovery is impossible. The blockchain is permanent, the counterparty is anonymous, and the law has not caught up with crypto. This assumption is incorrect, and acting on it is the reason many recoveries fail – not the law, but the inaction the myth produces.
Courts in England and Wales, Singapore, Hong Kong, and the DIFC have all confirmed that digital assets are property, that proprietary claims lie over specific tokens, and that freezing and disclosure relief is available against both identified and unknown defendants. Stablecoin issuers have the technical means and the compliance infrastructure to act on a properly documented legal demand. On-chain forensics can follow assets through dozens of wallet hops with the same precision a bank statement provides for fiat.
The accurate statement of the position is this: recovery becomes materially harder with each hour of delay, and it requires legal process – not technology alone. The window is short, the process is real, and the law supports it. Acting on the myth produces the outcome the myth predicts.
In Practice: A Recovery Matter in a Leading Common-Law Forum
In a recent matter, an early-stage payments company discovered late on a weekday evening that a seven-figure USDC balance had been transferred from the company's operational wallet to an address it did not recognize. Within hours, we had engaged a forensic partner, traced the balance through three intermediate wallet addresses to a deposit address at a regulated exchange, and prepared a without-notice application for a proprietary injunction and a Bankers Trust-style disclosure order against the exchange. The application was filed in a leading common-law forum by the following morning. The exchange froze the relevant account pending the disclosure order, and we submitted the issuer demand to Circle contemporaneously. The funds were preserved before any further withdrawal was attempted. The matter subsequently moved to a substantive hearing on ownership, but the critical preservation step was secured in the first working day.
The lesson we draw from that matter – and from others in our practice – is that speed is determined by preparation, not by urgency. A team that knows the evidence standard, the procedural route, and the issuer channel before the loss occurs will always move faster than one assembling the picture from scratch under pressure.
Related at OBOLUS
- Disputes & Asset Recovery for Digital-Asset Businesses – the full scope of our cross-border recovery and litigation practice
- Smart Contract Dispute Resolution – Cross-Border Perspective – how we manage on-chain contractual disputes across jurisdictions
- Client Funds Safeguarding in Ireland – regulatory obligations for digital-asset businesses holding client balances under Irish and EU law
FAQ
Can stolen crypto actually be recovered?
Yes, in many circumstances – but the outcome depends heavily on speed and preparation. Courts in England and Wales, Singapore, Hong Kong, and the DIFC have confirmed that digital assets are property and that proprietary injunctions and freezing orders are available. Stablecoin issuers hold technical freeze authority. On-chain forensics can trace asset movements through multiple wallets. The realistic window for preserving assets is short; the legal tools exist but require prompt, correctly-structured action.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows for misappropriated stablecoins are measured in hours, not days. Each subsequent transaction makes tracing harder and may move the asset outside the reach of a particular court's jurisdiction or the issuer's freeze mechanism. The evidence-preservation and legal-instruction steps should begin within the first hour of discovery. Delay is the single most common reason a technically recoverable matter becomes irrecoverable.
Can a court freeze assets held on an exchange?
Yes. Courts in leading common-law forums – including England and Wales, Singapore, Hong Kong, and the DIFC – regularly grant freezing orders that bind assets held on centralized exchanges. Disclosure orders under the Norwich Pharmacal or Bankers Trust principles can also compel an exchange to produce account-holder identity and transaction records. The exchange must hold assets in the relevant jurisdiction, or be subject to the court's in personam jurisdiction, for the order to be effective without further enforcement steps.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We move for freezing relief and exchange disclosure while the trail is live, and we work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications. To discuss a recovery matter, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialist in on-chain asset tracing, multi-forum freezing applications, and stablecoin issuer engagement for business claimants.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.