Recovery windows for misappropriated digital assets are measured in hours, not weeks. A business that discovers stablecoin theft at 9 a.m. may find the funds already cycling through a second exchange by noon. The legal instruments that stop that cycle – freezing orders (court orders prohibiting a respondent from disposing of identified assets), disclosure orders (orders compelling exchanges to reveal account-holder data), and direct requests to stablecoin issuers – are available in multiple jurisdictions. But they do not move automatically. They require a coordinated legal strategy that spans the forum where the loss occurred, the exchange where funds landed, and the issuer whose smart contract holds the freeze key.
A stablecoin freeze request – the process of engaging a stablecoin issuer such as Tether (USDT) or Circle (USDC) to blacklist a specific address at the contract level – is one of the fastest instruments available in a digital-asset recovery. It is not a judicial remedy. It sits alongside court orders, not instead of them. Getting the sequencing right across multiple jurisdictions is where most recovery efforts succeed or fail.
This page sets out the regulated basis for stablecoin freeze requests, the process mechanics, the cross-border variables that control outcome, and the common mistakes that cost operators their recovery window.
Why Stablecoin Freeze Requests Work Differently Than Court Orders
Tether (USDT) and Circle (USDC) hold contract-level freeze and blacklist authority over their issued tokens, meaning a designated address can be rendered unable to transfer the issuer's stablecoin at the protocol layer without any court intervention. That capability is technically singular. No other asset class allows a private issuer to immobilize funds at a blockchain address on the basis of a law-enforcement reference or a court order.
The practical consequence is significant. A freezing order from the English High Court, the DIFC Courts or a Singapore court requires judicial process, sworn evidence, and service – all of which take time. An issuer freeze, if granted, operates in minutes. The catch is equally significant: issuers do not act on a complainant's request alone. They generally require a law-enforcement case reference, an OFAC designation, or – in courts where the practice has developed – a court order or a judicial-adjacent referral. The standard varies by issuer and evolves with regulatory expectations.
In our cross-border practice, we position the issuer freeze request as the first parallel track, running simultaneously with – never instead of – the judicial track. The two move at different speeds and address different risks. The issuer freeze stops the funds at the address. The court order binds the human or entity behind it.
What Legal Basis Supports a Freeze Request Across Jurisdictions?
The legal basis for compelling a freeze – whether at the issuer or at an exchange – differs materially across the leading forums, and choosing the wrong forum wastes days a victim cannot afford.
England and Wales is the most developed forum. The courts recognize digital assets as property – the principle established in AA v Persons Unknown [2019] and reinforced in subsequent decisions – which means proprietary injunctions, worldwide freezing orders (injunctions freezing a defendant's assets wherever they are held globally), and Norwich Pharmacal orders (disclosure orders compelling a third party with an innocent role in wrongdoing to disclose information) are all available. The CFAAR (Crypto Fraud and Asset Recovery network, launched in London in September 2021) has embedded practitioner coordination across exchanges, forensics firms and law enforcement within this ecosystem.
The DIFC Courts in Dubai have developed their own crypto-friendly track. Recent decisions – including *Trafigura v Gupta* [2025] DIFC – confirm that worldwide freezing orders can issue in support of foreign proceedings. For a victim whose counterparty is based in the UAE or whose funds passed through a VARA-licensed exchange, the DIFC Courts offer a faster path to a freeze order than many alternative forums.
Singapore's High Court has issued proprietary injunctions over cryptocurrency, and Hong Kong has extended similar relief – including, recently, injunctive orders framed specifically around tokenized assets. Each of these forums applies a common-law property analysis to digital assets, which is the conceptual basis that makes both court orders and issuer freeze requests legally coherent.
For a business operating across these geographies, the choice of forum depends on where the debtor or exchange has enforceable presence, not solely on where the victim is incorporated. In our practice, we map that jurisdictional footprint before filing, because a freezing order against an exchange that has no assets or nexus in the ordering court's territory is a document, not a remedy.
For a scoped assessment of your recovery position, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entities involved, the exchange's home jurisdiction, the stablecoin issuer's cooperation history – change the analysis materially. Map your options
How Does a Stablecoin Freeze Request Actually Work?
A coordinated stablecoin freeze and recovery process runs on four sequential tracks, managed in parallel from day one.
Track 1 – On-chain forensics. Before any legal instrument can issue, the transaction trail must be documented. That means obtaining full transaction hashes for every hop from the victim's address, mapping the flow to named or pseudonymous addresses at centralized exchanges, and producing a professional forensic report. Without this report, neither a court nor a stablecoin issuer will act. The report is the evidentiary backbone of everything that follows.
Track 2 – Exchange disclosure orders. If funds have moved to a centralized exchange, the exchange holds know-your-customer (KYC) data on the deposit account. A Bankers Trust order (a disclosure order compelling a financial institution to reveal account information related to an identified fraud) compels that disclosure. In England and Wales, these orders are available on an urgent without-notice basis in the right circumstances. In Singapore and Hong Kong, equivalent relief exists. Speed matters: a sophisticated fraudster withdraws funds and closes the account before service of process can occur.
Track 3 – Issuer freeze request. Running concurrently with Track 2, counsel prepares the issuer package. Tether and Circle require a law-enforcement case reference, detailed transaction documentation, and – in most cases – an active court proceeding or law-enforcement investigation reference before they will act. The package should be submitted with both the forensic report and evidence of the judicial proceedings to maximize response time. Operators we advise regularly underestimate this requirement, submitting bare complaints that issuers decline to process.
Track 4 – Freezing order from a competent court. The judicial freezing order is not redundant when an issuer freeze is in place. It binds the respondent personally, catches assets beyond the frozen stablecoin balance, and provides the enforcement mechanism if the respondent attempts to withdraw other assets. A worldwide freezing order from the English High Court or a DIFC Courts WFO in support of foreign proceedings extends that coverage across multiple asset classes and jurisdictions.
In a recent recovery matter, an e-commerce business that had processed a large stablecoin payment to a counterparty that disappeared contacted us shortly after the fraud was discovered. We commissioned a forensic trace, identified the receiving address on a major centralized exchange, and sought disclosure and a freezing order in a leading common-law forum within the first working week. The issuer package followed as the law-enforcement reference was secured. The funds were frozen at the exchange before the counterparty could complete a second withdrawal. That outcome was only available because the four tracks ran in parallel from hour one.
What Cross-Border Variables Decide Whether a Freeze Succeeds?
A stablecoin freeze request in a purely domestic setting is procedurally manageable. The cross-border version – which describes most commercial digital-asset fraud – introduces four variables that require active management.
Exchange jurisdiction. If the exchange where funds landed is incorporated in a jurisdiction with no court order recognition or mutual legal assistance mechanism with the victim's home forum, a disclosure order from that home forum is unenforceable at the exchange. The practical solution is to file in the jurisdiction where the exchange is licensed or incorporated, or to seek an order from a court whose judgments the exchange respects for commercial reasons. The SFC-licensed exchange environment in Hong Kong, the MAS-regulated exchange environment in Singapore, and the VARA-licensed environment in Dubai all respond to orders from their local regulators and courts. An English order may need a local recognition step.
Stablecoin issuer responsiveness. Tether and Circle are both incorporated outside most victim jurisdictions. Neither is subject to a single court's authority. Their cooperation is contractual and policy-driven, not compelled by any single regulatory mandate. A law-enforcement case reference from a recognized national authority carries more weight with issuers than a civil court order alone, though the two together are optimal. Victims operating under the FCA regime, under MAS, or under the SFC regime should engage their regulator's law-enforcement liaison early.
Time zones and business hours. A USDT freeze request submitted outside Tether's operational hours loses critical hours. Coordinating a without-notice hearing in London, a disclosure request to an exchange in Singapore, and an issuer submission requires a team that can move in multiple time zones simultaneously. We have seen well-structured cases lose their recovery window because the cross-border coordination was sequential rather than parallel.
Conflicting insolvency proceedings. If the fraudster's entity enters insolvency in its home jurisdiction while the freeze request is pending, the automatic stay that applies in most insolvency regimes may delay enforcement of the freezing order. The interaction between a proprietary claim over identified digital assets and an insolvency moratorium is an unsettled area in many jurisdictions. Planning the claim as a proprietary action – asserting ownership of specific identifiable assets, not just a debt claim – is the structural step that preserves priority.
If a prior application stalled or a recovery attempt hit a jurisdictional obstacle, a second read of the structure may surface the route forward. Write to OBOLUS at info@oboluslaw.com. Map your options
Decision Matrix: Which Recovery Profile Needs Which Instrument?
The right mix of instruments depends on the operator's profile, the fraud type, and the forum available. Three common profiles illustrate the decision logic.
Profile A – Centralized exchange victim, large USDT balance, counterparty identified. The forensic trace is straightforward. The appropriate instruments are an urgent disclosure order at the deposit exchange, a parallel issuer freeze request with a law-enforcement reference, and a proprietary injunction from a court with jurisdiction over the exchange. Timeline for initial relief is typically measured in days – not hours – because of the court filing and without-notice hearing requirements. The key risk is exchange delay in honoring the disclosure order; having local counsel in the exchange's jurisdiction accelerates compliance.
Profile B – DeFi bridge or DEX-routed fraud, no centralized exchange in the chain. The issuer freeze remains available if the funds land on-chain in a Tether or USDC address that has not yet moved to a non-freezable asset. The exchange disclosure track is unavailable because there is no custodial exchange holding KYC data. The primary instrument is the issuer freeze request, supported by law-enforcement engagement and a court order naming the on-chain address as the subject of the freezing relief. Timeline is shorter if the funds have not yet been bridged to a chain where the issuer has no freeze capability. The key risk is bridge outflow before the issuer can act.
Profile C – Multi-jurisdiction fraud, funds split across multiple exchanges in different countries. This is the highest-complexity scenario. It requires simultaneous filings in multiple forums, coordination with allied counsel in each relevant jurisdiction, and a consolidated issuer package covering all identified addresses. A worldwide freezing order from the English High Court, used as the anchor order and then recognized or enforced locally, is the standard structure in our practice. Timeline for comprehensive relief is longer; the priority is to freeze the largest identifiable balance first and pursue the remainder through the recognition track. The key risk is that partial freezing accelerates the movement of the unfrozen portion.
What Common Mistakes Close the Recovery Window?
The most costly mistake is delay. Operators we advise routinely lose their window not because legal relief was unavailable but because they spent the first 24 to 48 hours attempting to resolve the matter commercially – emailing the counterparty, disputing the transaction through the exchange's own support system, or waiting for law enforcement to act before engaging counsel. Commercial resolution attempts are not wrong in principle, but they should not come at the cost of the legal track. The two should run simultaneously from hour one.
The second most common mistake is incomplete forensic documentation. A court or an issuer will not act on a complaint that says "funds went to this address." The package must include transaction hashes at every hop, wallet attribution where available, and a professional forensic report from a recognized blockchain analytics firm. Operators who submit their own blockchain explorer screenshots as evidence lose credibility and time.
A third mistake is single-jurisdiction thinking. Filing only in the victim's home court works when the exchange and the counterparty are also in that jurisdiction. In cross-border fraud, the victim's home court may have no practical reach over the exchange, the issuer, or the counterparty. Identifying the enforcement forum early – the jurisdiction where the assets actually sit or where the exchange is licensed – is a threshold step, not an afterthought.
Finally, the proprietary claim framing matters. A contractual or debt claim against a fraudster gives the victim a creditor position. A proprietary claim over specifically identified digital assets gives the victim ownership priority. In jurisdictions that recognize digital assets as property – England and Wales, Hong Kong, Singapore, and the DIFC Courts among them – the proprietary framing is available and should be pleaded from the outset. Amending a claim from debt to proprietary after the respondent files a defense loses time and may lose priority.
A Common Assumption: Once Funds Leave the Wallet, Nothing Can Be Done
A common assumption among business operators discovering a digital-asset loss is that on-chain finality makes recovery impossible. This assumption is factually wrong in a significant proportion of cases. On-chain transactions are irreversible at the protocol layer – that is correct. But the assets, once identified, remain traceable. And in many cases they remain in a form – USDT or USDC on a chain where the issuer holds freeze capability – where the issuer can immobilize them without reversing any transaction.
Beyond the issuer freeze, court orders in England and Wales, Hong Kong, Singapore and the DIFC Courts operate against the person or entity controlling the address, not against the protocol. A freezing order does not reverse the blockchain; it forbids the respondent from moving the assets and can be backed by contempt sanctions against an identified person. Where the person is identified, the combination of a proprietary injunction and a disclosure order to the exchange has resulted in the return of frozen assets through settlement in a material number of cases we have seen reach resolution.
The practical qualifier is time. The more hops a fraudster can execute – across exchanges, across chains, across asset types – the more expensive and uncertain the recovery becomes. Acting within the first 12 to 24 hours gives counsel and forensic teams a meaningful chance. Waiting until the third day after the loss removes a substantial part of that chance.
Regulators in the leading hubs increasingly expect exchanges they license to cooperate with properly documented recovery requests. The SFC in Hong Kong, MAS in Singapore, and VARA in Dubai have each signaled expectations around exchange cooperation with law-enforcement and court-directed disclosure. That regulatory pressure strengthens the practical enforceability of disclosure orders at licensed exchanges in those hubs.
Self-Assessment: Is Your Business Ready to Act in the First Hour?
The following checklist is not legal advice. It reflects the preparation steps that, in our experience, distinguish businesses that recover assets from those that do not.
- Do you have a documented incident-response protocol that triggers legal counsel engagement within the first hour of discovering a suspected misappropriation – not after internal escalation is complete?
- Do you hold full transaction records, including wallet addresses, transaction hashes and timestamps, for every significant stablecoin transfer in and out of your treasury?
- Have you identified in advance which forensic analytics provider you would engage, and do you have a relationship that allows urgent commissioning?
- Does your business have or can it quickly obtain a law-enforcement case reference in a jurisdiction whose referrals the major stablecoin issuers recognize?
- Do you know which court has jurisdiction over the exchange where your counterparties typically hold accounts, and do you have access to counsel in that forum?
- Is your legal counsel capable of filing on a without-notice basis in at least two of the leading common-law forums – England and Wales, Singapore, Hong Kong or the DIFC Courts – simultaneously?
If any of these answers is uncertain, the recovery process will be slower than it needs to be. The time to address the gaps is before a loss occurs.
Related at OBOLUS
- Disputes and Asset Recovery for Digital-Asset Businesses – our full practice overview across 25+ forums for exchange operators, custodians and institutional holders
- Stablecoin Freeze Request in Nigeria – jurisdiction-specific process and forum guidance for Nigerian-nexus recovery matters
- Token Sale Agreement Drafting in the Cayman Islands – structuring and documentation for token issuances in one of the leading offshore domiciles
FAQ
Can stolen crypto actually be recovered?
Recovery is possible but not guaranteed. It depends on the speed of response, whether funds remain in a freezable stablecoin, the cooperation of the exchange or issuer, and the forum available. In jurisdictions that recognize digital assets as property – including England and Wales, Singapore, Hong Kong and the DIFC Courts – proprietary injunctions, disclosure orders and issuer freeze requests have, in documented cases, resulted in funds being frozen and returned. Acting within the first 24 hours substantially improves the probability of success.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows for misappropriated digital assets are measured in hours. Every additional transaction the fraudster executes – from one exchange to another, or from a freezable stablecoin to a non-freezable asset – reduces the practical reach of available legal instruments. Legal counsel should be engaged within the first hour of discovery. Forensic commissioning and the initial issuer and court contacts should follow within the same working day. Delay in starting the process does not just slow it; in many cases it ends it.
Can a court freeze assets held on an exchange?
Yes. Courts in England and Wales, Singapore, Hong Kong and the DIFC Courts have issued freezing orders and disclosure orders directed at centralized exchanges in digital-asset fraud matters. The exchange must have either a presence in the relevant jurisdiction or assets or operations subject to that court's jurisdiction. For exchanges licensed by the SFC, MAS, the FCA or VARA, regulatory obligations around court-directed disclosure reinforce the practical enforceability of such orders. A disclosure order will typically compel the exchange to reveal the account-holder's identity, enabling a proprietary claim against an identified respondent.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums – moving for injunctive relief and issuer freeze requests while the forensic trail is live. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialist in cross-border digital-asset recovery, on-chain tracing, and urgent freezing relief across common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.