The freeze window is narrower than most counsel assume
Misappropriated stablecoins move faster than most legal teams can file. A stablecoin freeze request – a formal demand to a token issuer such as Tether or Circle to blacklist specific addresses or transaction outputs – is one of the few tools that can halt the dissipation of digital assets in real time. For regulated entities: exchanges, custodians, payment institutions and licensed funds that hold or transmit stablecoins on behalf of clients, the legal regime surrounding that request has become a distinct and urgent area of practice. Regulators in leading hubs increasingly expect these entities to have a documented incident-response process, including the freeze-and-trace sequence, before an incident occurs, not after.
Stablecoin issuers hold a contractual and technical power to freeze specific token balances at the address level. Both Tether (USDT) and Circle (USDC) have confirmed they act on court orders, law-enforcement mandates and OFAC designations. They have also, in documented operational practice, responded to coordinated requests from regulated entities accompanied by professional forensic reports and a law-enforcement case reference. The process is not automatic, and the window between misappropriation and irreversible dissipation is measured in hours. This page maps the legal basis, the practical sequence and the cross-border complications a regulated entity must manage from the first moment.
The sections below cover the regulatory basis for the request, how to build the submission package, where court orders fit into the chain, the cross-border complications, and where this tool fails – so that counsel and compliance officers can calibrate it correctly before the clock runs.
---What gives a stablecoin issuer the power to freeze – and why does it matter to your licence?
Stablecoin issuers derive their freeze authority from the smart-contract architecture of the token itself, combined with contractual terms of issuance and obligations that flow from applicable sanctions regimes. Tether and Circle each maintain a blacklist function in the token contract that allows them to prevent any movement of a designated balance. This is not a judicial power; it is a technical and contractual one. The legal significance for a regulated entity is that accessing this power requires coordinating across two parallel tracks simultaneously: the issuer's internal compliance process and, in most serious matters, a parallel court process.
For an exchange or custodian operating under VARA in Dubai, the FCA's money-laundering registration regime in the United Kingdom, MiCA's CASP authorisation across the EU, or the MAS Payment Services Act regime in Singapore, the obligation to act on suspected fraud is not merely operational. Supervisors expect that licensed entities have both the internal procedures and the external legal relationships to initiate a freeze request promptly. Failure to act – or delay – can itself become a regulatory event, particularly where client assets are at stake.
In our cross-border practice, we regularly advise licensed operators who discover that a freeze request submitted without legal structure either goes unanswered or arrives too late. The issuer's compliance team requires a minimum evidentiary threshold. Meeting that threshold, under time pressure, is the core legal challenge.
The process above describes the standard path. Your facts – the entity, the user base, the banking structure and the jurisdiction of the theft – change the analysis considerably. For a scoped assessment of your incident-response posture, contact OBOLUS at info@oboluslaw.com or map your options here.
---How do you build a freeze submission package that an issuer will act on?
A stablecoin freeze request that succeeds contains five elements, all of which must be assembled under time pressure. The issuer's compliance team is not a court; it does not have subpoena power and it will not investigate on your behalf. You bring the case to them, fully packaged.
First: transaction hash documentation. You must identify the precise on-chain transaction or transactions through which the relevant stablecoin balance moved. This means the originating wallet address, the receiving address or addresses, and the contract address for the token in question. Without this data, no freeze is technically possible, because the blacklist function operates at the address level.
Second: a professional forensic tracing report. This is not an internal spreadsheet. Issuers require a report from a recognised blockchain analytics provider – firms capable of generating court-admissible attribution reports that cluster addresses, identify exchange deposit addresses and map the movement path. The report must be current; stale data from days after the theft may show that the balance has already moved through a mixer or been converted.
Third: a law-enforcement reference. In practice, issuers are more responsive where a formal police or financial-intelligence-unit report number accompanies the submission. The regulated entity's compliance team should file this report immediately after the misappropriation is identified, not after counsel is engaged. Regulatory reporters under the Bank Secrecy Act framework in the United States, the Suspicious Activity Report regime in the United Kingdom, and equivalent mechanisms under MiCA and the applicable AML directives in the EU each generate a reference that can accompany the issuer request.
Fourth: a legal demand letter. This sets out the factual basis, the amounts, the wallet addresses, the time sequence and the legal authority under which the freeze is sought. For regulated entities, this letter carries weight beyond a private individual's complaint. It signals that a licensed, supervised operator is making the request and that the matter has institutional standing.
Fifth: parallel court or court-adjacent action. In the most consequential matters, the freeze request is not a standalone tool. It runs alongside an application for a freezing order – a court injunction preventing the dissipation of assets – or a disclosure order requiring an exchange to identify the account holder behind a receiving address. England and Wales, the DIFC Courts in Dubai, Singapore's High Court and Hong Kong's courts have each issued such orders in digital-asset matters. In our cross-border practice, we coordinate the submission to the issuer with the parallel court filing so that both move on the same timeline.
---When is a court order necessary alongside the issuer request?
A court order is necessary whenever the misappropriated stablecoin balance has already moved beyond the initial receiving address, whenever the counterparty is unidentified, or whenever the value at stake makes the informal route legally insufficient. The issuer's freeze function stops movement in the blacklisted address; it does not recover funds, identify the wrongdoer or compel an exchange to disclose account information. Those outcomes require court process.
In England and Wales, a worldwide freezing order – an injunction that freezes a defendant's assets globally, including digital assets – can be obtained on an urgent without-notice basis where there is a real risk of dissipation. The landmark decision AA v Persons Unknown [2019] established that crypto-assets are property capable of being the subject of such an order. Subsequent decisions in English courts have consistently affirmed that position, and the courts have shown a willingness to grant disclosure orders against exchanges – known as Norwich Pharmacal orders – to identify the person behind a wallet.
The DIFC Courts in Dubai have developed a parallel body of practice. Their ability to issue worldwide freezing orders in support of foreign proceedings makes them valuable for operators whose counterparties sit across the Gulf or whose assets transit exchanges in the region. The DIFC Courts have issued disclosure and freezing relief in digital-asset matters in recent terms.
Singapore's High Court and Hong Kong's courts have each made proprietary injunctions in crypto matters. Hong Kong's first tokenised injunction in HCA 2417/2024 is a recent example of the region's courts adapting standard injunctive relief to on-chain assets. The CFAAR network – the Crypto Fraud and Asset Recovery network launched in London in September 2021 – provides a coordinating structure for cross-border practitioners working across these forums simultaneously.
Operators we advise routinely underestimate how quickly English or DIFC courts can move on an urgent without-notice application. The institutional perception is that litigation takes months. In asset-recovery matters, the first hearing can occur within days. That speed only works if the legal team is already assembled and the evidence package is ready.
---What cross-border complications arise when the stablecoin moves across jurisdictions?
A cross-border stablecoin theft creates a coordination problem across at least three axes simultaneously: the jurisdiction where the regulated entity is licensed, the jurisdiction where the exchange receiving the stolen funds is registered, and the jurisdiction whose courts are asked to grant relief.
These three axes rarely align. A CASP authorised under MiCA and based in Lithuania may hold client assets in USDC; the funds may move to an exchange registered under the Cayman Islands' CIMA regime; and the most practical forum for injunctive relief may be England and Wales because of its developed crypto-property jurisprudence. Managing that triangle requires a coordinated instruction across allied counsel in each relevant jurisdiction, with a single lead strategy that keeps the freeze request, the court application and the law-enforcement filing synchronised.
The applicable AML regime adds a further layer. The Travel Rule – the obligation under FATF Recommendation 15 to pass originator and beneficiary information with a virtual asset transfer – means that some of the data needed for the freeze request may already exist in the receiving exchange's compliance files. A properly structured disclosure application can compel that data before the wrongdoer has time to withdraw. The threshold at which the Travel Rule applies, and the technical standards for compliance, vary by jurisdiction – but the data, once generated, is there.
In our cross-border practice, we have seen matters where the regulated entity's most powerful move was not a court filing in its own jurisdiction but a disclosure application in the jurisdiction where the receiving exchange was licensed – because that exchange's regulator had leverage the home regulator lacked. Identifying the strongest forum quickly is often worth more than filing in the obvious one.
If a prior application stalled or a recovery track has gone cold, a second read of the forum analysis and the issuer submission can often surface the structural reason and the route forward. Write to OBOLUS at info@oboluslaw.com or map your options here.
---Where does the stablecoin freeze request fail – and what does that mean for strategy?
The freeze request fails in four predictable situations. Understanding them in advance lets a regulated entity recalibrate its strategy rather than waste critical hours on a path that will not work.
Conversion before the request arrives. If the counterparty has already swapped the USDT or USDC into a non-blacklistable asset – bitcoin, ether, a privacy coin – the issuer's freeze function is irrelevant. The forensic trail continues, but the stablecoin-specific tool is exhausted. The strategy shifts to exchange-level freezes (where the exchange itself holds the converted asset), proprietary claims and civil recovery through the courts.
Insufficient evidence at the time of submission. Issuers decline requests that do not meet the evidentiary threshold. A demand letter unsupported by a forensic report, or a forensic report that does not cluster the relevant addresses to a specific theft event, will be declined or deferred. In a matter where hours matter, deferral is effectively a refusal. The submission must be complete at the moment it is sent.
No law-enforcement footprint. In regulated-entity matters, the absence of a suspicious activity report or police report weakens the submission significantly. Some issuers treat a law-enforcement reference as a quasi-jurisdictional requirement. Filing that report is the first administrative step, and it should happen before the freeze request goes out – not after.
The balance has already been withdrawn into fiat. Once the stablecoin is redeemed and the proceeds are in a bank account, the on-chain recovery tools are exhausted. The remaining options are civil judgment enforcement in the relevant banking jurisdiction and, where applicable, international cooperation mechanisms under applicable mutual legal assistance frameworks. These are slower and less predictable. Prevention – catching the balance before redemption – is the only reliable answer, which returns to the core premise: speed is the variable that matters most.
---Which recovery path fits your situation?
The right combination of tools depends on the profile of the loss, the structure of the regulated entity and the jurisdictions in play. The following analysis maps the most common profiles to the instruments most likely to produce a result.
Profile A – Exchange or custodian; large balance; stablecoin still in the receiving address. This is the strongest recovery scenario. The issuer freeze request, submitted with a complete evidence package, has the best chance of success. Run the court application in parallel – a without-notice freezing order from England and Wales or the DIFC Courts is achievable on an urgent basis. The forensic report and the law-enforcement reference are prerequisites. Timeline from instruction to first court hearing: typically days in an urgent without-notice application, not weeks.
Profile B – Payment institution or fund; mid-size balance; funds converted to BTC or ETH at a second exchange. The issuer freeze route is closed. The operative tool is a disclosure order against the second exchange, followed by a freezing order once the account holder is identified. The CFAAR network and allied counsel in the exchange's registration jurisdiction are relevant from the outset. Timeline is longer and outcome is less certain, but the forensic trail can still be live if the matter is escalated within hours.
Profile C – Any regulated entity; balance already partially withdrawn to fiat; counterparty partially identified. The on-chain tools are limited. The strategy is civil proceedings in the jurisdiction where the fiat was received, supported by the forensic trace as evidence, combined with a judgment-enforcement strategy if the wrongdoer is identifiable. This path is measured in months, not days. The regulated entity should also assess its regulatory notification obligations – supervisors under VARA, MiCA, and the MAS Payment Services Act expect timely disclosure of material operational incidents.
A common assumption among operators facing a stablecoin theft is that the matter is beyond recovery once the initial hours have passed. That assumption is often wrong. Forensic trails on public blockchains do not age the way physical evidence does. Exchange compliance files – accessed through disclosure orders – remain available for months. The question is not whether the trail exists but whether the legal strategy is structured to access it in the right order.
---A coordinated freeze and disclosure in a recent cross-border matter
In a recent recovery matter during the latter part of last year, a regulated payments entity in an EU member state contacted us after a significant USDC balance was misappropriated through a compromised hot-wallet key. The balance had moved to two receiving addresses on exchanges registered in different jurisdictions – one in Asia, one in the Gulf region. Within hours of instruction, we assembled the evidence package with a forensic analytics provider, filed the issuer freeze request with Circle's compliance team under cover of a legal demand letter and a co-filed law-enforcement report, and initiated a without-notice disclosure application in a leading common-law forum. The issuer froze one of the two addresses before the balance was moved. The court disclosure order, made within days, identified the account holder behind the second address. Recovery proceedings continued in the Gulf forum using the disclosure as the evidential foundation. The outcome was a partial recovery of a seven-figure balance within weeks of the initial misappropriation.
---Self-assessment: is your entity ready to act if a stablecoin theft occurs today?
Regulated entities that can answer yes to the following questions are in a position to initiate a freeze request without delay. Those that cannot should treat this as a compliance gap worth closing before the incident occurs.
- Do you have a documented incident-response procedure that includes a stablecoin freeze request as a named step, with responsible officers identified?
- Do you have a standing relationship with a professional blockchain forensics provider capable of generating a court-admissible report within hours of instruction?
- Do you know which law-enforcement or financial-intelligence-unit channel to use for your jurisdiction's suspicious activity report, and can you file it within the first hour of confirming misappropriation?
- Do you have external legal counsel, with access to the relevant courts, on notice that they may be called for an urgent without-notice application at short notice?
- Have you assessed which forum – England and Wales, DIFC Courts, Singapore, Hong Kong or another – is the most practical for your entity's profile, before an incident occurs?
- Are your stablecoin holdings documented at the address level, with full transaction records, so that hash identification can be completed in minutes?
If any of these gaps exist, the practical consequence is that the first hours of a real incident are consumed by setup rather than by action. In a recovery window measured in hours, that cost is structural.
---Related at OBOLUS
- Disputes & Asset Recovery for Digital-Asset Businesses – Our full disputes and recovery practice for exchanges, custodians and funds.
- On-Chain Asset Tracing – Legal Counsel for Digital-Asset Firms – The forensic and legal process for tracing misappropriated digital assets across chains and exchanges.
- Economic Substance for Licensed VASPs in the Isle of Man – Structural requirements for licensed entities holding digital assets in an offshore jurisdiction.
FAQ
Can stolen crypto actually be recovered?
Yes – in a meaningful number of cases, particularly where the misappropriated balance is a stablecoin that remains in an identifiable address at the time of the request. Stablecoin issuers hold technical authority to freeze balances at the address level. Courts in England and Wales, the DIFC, Singapore and Hong Kong have issued proprietary injunctions and disclosure orders over digital assets. Recovery is not guaranteed, but it is a realistic outcome where the legal response is fast, structured and cross-border in scope.
How fast must I act after a digital-asset theft?
The recovery window after a stablecoin misappropriation is measured in hours. A balance that sits in a receiving address for six to twelve hours is at risk of conversion into a non-blacklistable asset or withdrawal into fiat. The practical sequence – forensic report, law-enforcement filing, issuer freeze request and court application – must begin within hours of confirming the loss, not the following business day. Entities that have not prepared their incident-response infrastructure before an event will lose critical time to setup rather than action.
Can a court freeze assets held on an exchange?
Yes. Courts in England and Wales, the DIFC, Singapore and Hong Kong have each made freezing orders covering digital assets held on exchanges, including where the account holder's identity is initially unknown. A disclosure order – known in English proceedings as a Norwich Pharmacal order – can compel the exchange to identify the account behind a wallet address. The exchange's registration jurisdiction determines which court has the most direct leverage. In our practice, we regularly coordinate multi-forum applications to match the forum to the exchange's legal exposure.
---OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around every structure. Digital assets are the entirety of our practice. In stablecoin recovery matters, we move for freezing relief and exchange disclosure while the forensic trail is live – because the recovery window does not wait. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialising in cross-border stablecoin recovery, freezing orders and exchange disclosure applications for regulated digital-asset entities.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.