A payments company discovers, on a Monday morning, that a seven-figure stablecoin balance has been moved without authorization. The transaction hashes are on-chain, the counterparty wallets are visible, and the funds are still sitting in USDT (Tether's US-dollar-pegged token) at a known exchange address. The question is not whether the funds can be traced. The question is whether they can be frozen before the counterparty moves them again – and whether the legal machinery to do it can be engaged in time.
A stablecoin freeze request under heightened scrutiny is the coordinated process of obtaining legal authority – through court orders, issuer-level contract freeze mechanisms, or exchange disclosure orders – to immobilize misappropriated stablecoin balances while a recovery claim is pursued. The process is well-developed in leading common-law forums. It is also time-critical: asset recovery windows close in hours, not weeks, once funds reach a withdrawal-capable address. This page sets out how the process works, where it works best, and what determines whether a freeze request survives the scrutiny that courts and issuers now apply.
Why Stablecoins Create a Distinct Recovery Window
Stablecoin balances are recoverable in a way that native blockchain assets often are not, because the issuer retains contract-level authority to freeze individual addresses. Tether (USDT) and Circle (USDC) each hold a smart-contract function that can blacklist a specific wallet, rendering the balance unspendable without reversing the underlying blockchain record. That capability is the pivot on which a well-timed freeze request turns.
The catch is that neither issuer exercises that authority casually. Both have stated publicly that they act on law-enforcement requests, OFAC designations (the US Office of Foreign Assets Control's sanctions list), or court orders from recognized forums. A letter from a private litigant, however urgent, is unlikely to move the needle on its own. What moves the needle is a court order, a law-enforcement referral with a case reference number, or – in documented fraud cases – a combination of a professional forensic report and a credible legal basis delivered to the issuer's compliance team through the proper channel.
The practical implication: a business that discovers a stablecoin theft must engage legal counsel and a forensic provider simultaneously, not sequentially. The on-chain trail is live; the issuer freeze window is open. Both close quickly.
What "Heightened Scrutiny" Means in Practice
Courts and issuers are no longer processing freeze requests at face value. The environment has changed materially over the past several years. Courts in England and Wales, the DIFC, Singapore, and Hong Kong have each granted relief in crypto recovery matters – but they have also refined what they expect from applicants before they will act on an emergency basis.
Heightened scrutiny means, in practice, that a freeze application must demonstrate four things before a court will grant without-notice relief: a proprietary basis for the claim (the applicant owned the assets, not merely had a contractual right to them); a real risk of dissipation if notice is given; a full and frank disclosure of all material facts; and an adequate cross-undertaking in damages.
The last point is often underestimated. A court granting a worldwide freezing order (an injunction freezing a defendant's assets globally) will require the applicant to undertake to compensate the respondent if the order turns out to have been wrongly granted. For a business applicant, that undertaking needs to be backed by evidence of financial capacity. Courts that have seen poorly prepared crypto freeze applications have become stricter on this point.
In our cross-border practice, we regularly advise that the quality of the initial application – the forensic exhibit, the evidence of ownership, the disclosure of any prior dealings with the respondent – determines not just whether the order is granted at the without-notice stage, but whether it survives the return date when the respondent challenges it. A thin application that obtains an order can collapse two weeks later, leaving the applicant worse off and the funds moved.
The Legal Basis for a Stablecoin Freeze Across Forums
The legal foundation for a stablecoin freeze varies by forum, but the common thread is the recognition that digital assets are property capable of being held on trust, traced, and frozen. That recognition is now established in several leading jurisdictions.
In England and Wales, the courts confirmed in AA v Persons Unknown [2019] that a cryptocurrency could be the subject of a proprietary injunction. Osbourne v Persons Unknown [2022] extended that reasoning to NFTs. The result is a well-developed toolkit: Norwich Pharmacal orders (compelling third parties such as exchanges to disclose customer identity), Bankers Trust orders (compelling disclosure of asset movement), and worldwide freezing orders – all available in support of a substantive proprietary claim.
The DIFC Courts in Dubai have similarly developed their approach to crypto asset recovery. Worldwide freezing orders in support of foreign proceedings are available under the DIFC regime, making the DIFC a useful secondary forum for applicants whose funds have moved through UAE-registered exchanges or custodians.
In Singapore, the courts have granted proprietary injunctions over misappropriated crypto balances. Hong Kong's courts have followed an analogous path, including injunctive relief timed to exchange-level freezes. In each forum, the common requirement is a credible proprietary basis and evidence that the relevant assets are identifiable on-chain.
What this means for a business applicant is that forum selection is a strategic decision, not merely a geographic one. The choice of where to file turns on where the respondent has assets or a presence, where the relevant exchange or issuer is most likely to respond to compelled disclosure, and where the applicant can sustain the litigation to judgment.
For a scoped assessment of your recovery options, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your specific facts – the entity structure, the exchange involved, the issuer of the stablecoin, the jurisdictions in play – change the analysis materially.
What Does the Freeze Request Process Actually Look Like?
A well-run stablecoin freeze request moves through four overlapping phases: on-chain forensic triage, legal preparation, court application, and issuer or exchange engagement. None of these phases is fully sequential – the clock compresses them.
The forensic triage phase begins the moment the theft is identified. A blockchain forensics professional (working in parallel with legal counsel) traces the misappropriated funds from the originating address through any intermediate hops to their current resting point. The output is a forensic report that maps each transaction hash, names the exchange or custodian that controls the destination address, and attributes the funds to a known wallet cluster where possible. Tools used by the leading forensic providers in this field – including those known for blockchain analytics and compliance intelligence – can often attribute wallets to named exchanges within hours.
The legal preparation phase overlaps with the forensic work. Counsel drafts the application: the claim form, the without-notice application, the affidavit evidence, the proprietary claim analysis, and the cross-undertaking documentation. The quality of the proprietary claim analysis is the hinge point. Courts under heightened-scrutiny conditions want to see not just that funds were taken, but that they were the applicant's funds held in a way that grounds a proprietary right in equity or common law.
The court application phase is typically without notice to the respondent. A judge reviews the application, the evidence, and the undertaking. If satisfied, the court grants the freezing order, often with a return date – typically within days – at which the respondent can challenge the continuation of the order. The applicant must serve the order correctly, file the necessary undertakings, and prepare for the return date immediately.
The issuer or exchange engagement phase runs concurrently. Armed with the court order, counsel contacts the stablecoin issuer's compliance team (for Tether or Circle, through their stated legal/law-enforcement intake process) and the relevant exchange (through its legal or compliance department). Both are asked to freeze the identified addresses. Issuers generally require a combination of: the court order, a law-enforcement case reference or OFAC designation, the specific wallet addresses, and the transaction hashes. Exchanges facing a court-compelled disclosure or freezing order are similarly required to act.
In our practice, we have seen cases where the window between theft identification and successful freeze is under 48 hours. We have also seen cases where a delay of even a few hours – waiting for internal approvals, for instance – allowed the respondent to move funds to a non-custodial wallet beyond the issuer's freeze capability. The process rewards speed and preparation.
The Cross-Border Reality: Multiple Regimes, One Recovery
Most stablecoin thefts involve assets that cross at least two jurisdictions before coming to rest. The originating business may be incorporated in one country; the exchange that received the funds may be licensed in another; the stablecoin issuer may be domiciled in a third; and the respondent may be identifiable only through a KYC record held in a fourth. That multi-jurisdictional reality is not an obstacle – but it requires a coordinated approach rather than a single-forum strategy.
The cross-border dimension affects three specific decisions. First, forum selection: the applicant must choose the court most likely to grant rapid without-notice relief and most capable of compelling the relevant exchange to comply. England and Wales retains a strong institutional position here. The DIFC Courts are increasingly useful for matters involving UAE-registered entities. Singapore is the preferred forum for matters touching Southeast Asian exchanges.
Second, exchange cooperation: exchanges licensed under the VARA regime in Dubai, under MAS in Singapore, or under the SFC's VASP regime in Hong Kong are subject to regulatory expectations around cooperation with legal process. A well-structured application that engages the exchange's compliance function – rather than simply serving legal process on its registered address – often produces faster results.
Third, Travel Rule data: under the Travel Rule (the obligation to pass originator and beneficiary data with a transfer, derived from FATF Recommendation 15), exchanges that processed the transfer may hold identifying data about the counterparty wallet. Compelling disclosure of that data through a Norwich Pharmacal order or its local equivalent can convert an anonymous wallet into an identified person. That identification step often unlocks the remainder of the recovery strategy.
Allied counsel in the relevant jurisdictions are engaged where the recovery requires parallel proceedings or local court filings. OBOLUS coordinates those relationships, maintaining the strategic coherence of the recovery across forums.
If a recovery clock is running, reach our disputes desk immediately at info@oboluslaw.com. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route forward.
What Kills a Freeze Request Before It Starts
A common assumption is that once funds leave the wallet, nothing can be done. That assumption is wrong – but it leads to the single most damaging mistake in crypto recovery: delay. Businesses that spend the first 24 to 48 hours escalating internally, briefing non-specialist counsel, or waiting for a forensic provider to be retained lose the window in which an issuer freeze is realistic. By the time a freeze request reaches the issuer's compliance team, the funds may already have been bridged to a non-custodial address or converted to a privacy-enhanced asset where the freeze mechanism does not exist.
The second most common error is an inadequate proprietary basis. A business that held stablecoins under a custodial arrangement with a third party, rather than directly in its own wallet, may face arguments that its claim is contractual rather than proprietary. Courts applying heightened scrutiny to freeze applications will examine the custody arrangement carefully. If the claim is contractual, a freezing order in support of a money claim is still available – but the analysis and the threshold are different, and the urgency framing changes.
The third error is inadequate full and frank disclosure. A without-notice application carries an absolute duty to disclose all material facts – including facts that might weigh against the grant of the order. Courts in England and Wales and in the DIFC have discharged freeze orders at the return date on the basis of non-disclosure, even where the underlying claim was meritorious. The quality and completeness of the first affidavit is not a detail; it is the foundation of the entire proceeding.
We have seen applicants present clean forensic evidence and a strong proprietary claim, only to have their order challenged and reduced because the affidavit omitted a prior commercial dispute with the respondent. Getting the disclosure right at the outset is not just good practice – it is the difference between an order that holds and one that collapses.
Which Profile Should Pursue Which Route?
Not every stablecoin misappropriation follows the same legal path. The right instrument depends on the operator profile, the current location of the funds, and the jurisdictional footprint of the parties.
Profile A – Exchange-facing business victim. Funds were misappropriated by a counterparty whose identity is known or KYC-attributed to an exchange account. The funds remain in USDT or USDC at a custodial address. The preferred route is a simultaneous court application for a freezing order and a Norwich Pharmacal/disclosure order against the exchange, combined with a parallel request to the issuer's compliance team. Timeline to a without-notice order, in a well-prepared application, is typically measured in days. The key risk is delay – every hour reduces the probability that the funds remain in a freeze-capable address.
Profile B – Counterparty dispute with a mixed asset base. A commercial dispute has resulted in a party misapplying funds that included stablecoins. The respondent's identity is known. The proprietary claim may be contested. The preferred route is a freezing order in support of a substantive commercial claim, with the cross-undertaking in damages carefully sized to the applicant's balance sheet. The timeline is similar, but the return-date challenge is more likely to be contested. The key risk is that the cross-undertaking is challenged as inadequate or that the proprietary basis does not survive the return date.
Profile C – Unknown respondent, funds at a non-custodial address. The misappropriation was by an unknown person or an entity using non-custodial infrastructure. The forensic trail leads to an exchange that may hold KYC data but the funds themselves have been bridged beyond the issuer's freeze capability. The preferred route is a disclosure-first strategy: obtain a Norwich Pharmacal order against the exchange to identify the respondent, then consider whether a proprietary claim against identified individuals or a tracing claim through conversion is viable. Timeline is longer; outcome is more uncertain. The key risk is that the respondent's real-world identity is not recoverable from the exchange's KYC records, which is increasingly common for self-custody arrangements.
Self-Assessment: Is Your Business Ready to Move?
Businesses that have thought through the recovery process in advance recover faster. The following are the questions counsel will ask in the first hour of an engagement – having the answers ready compresses the timeline substantially.
- Can you produce the originating transaction hashes and wallet addresses within minutes of discovery?
- Is your entity the direct wallet holder, or do you hold through a custodian? Do you have the custody agreement available?
- Do you have a current relationship with a blockchain forensics provider capable of producing an overnight report?
- Do you know which stablecoin is involved – specifically whether it is Tether (USDT), Circle (USDC), or a different issuer – and are you aware of that issuer's stated freeze process?
- Can your legal team (internal or external) produce a without-notice court application on an emergency basis, including a full and frank disclosure affidavit, within 24 hours?
- Is your cross-undertaking in damages supportable by evidence of financial capacity that you can place before a court on short notice?
- Have you identified the forum most likely to produce rapid relief given where the exchange and the respondent are located?
A "no" to any of these questions is a preparation gap. Addressing these gaps before a loss event occurs is materially cheaper than addressing them on the morning of discovery. In our practice, we advise operators at risk of stablecoin misappropriation to develop a recovery-readiness protocol as part of their broader operational risk posture – not as a litigation contingency plan, but as a live document.
In a recent matter, a financial technology company identified an unauthorized stablecoin transfer late in a trading session. Having retained forensic capability in advance, they produced transaction hash evidence within the hour. We secured a without-notice freezing order in a leading common-law forum by the following morning, served the order on the relevant exchange the same day, and the balance was frozen before the respondent's next scheduled withdrawal. The speed of outcome depended entirely on the preparation that existed before the loss event.
Related at OBOLUS
- Disputes & Asset Recovery for Digital-Asset Businesses – full practice overview, forums, and recovery instruments across 25+ jurisdictions
- Crypto Fraud & Asset Recovery for Established Operators – structured approach to multi-vector fraud recovery for licensed and institutional operators
- Compliance, AML & Travel Rule for Digital-Asset Businesses – how your AML and Travel Rule posture intersects with recovery readiness
FAQ
Can stolen crypto actually be recovered?
Yes – though recovery is not guaranteed and depends heavily on speed and the current location of the funds. Stablecoins issued by Tether or Circle are recoverable if the balance remains at a custodial address and the issuer receives a legally adequate freeze request, typically supported by a court order or law-enforcement referral. Proprietary claims, freezing orders, and exchange disclosure orders have all produced successful recoveries in leading common-law forums including England and Wales, Singapore, and Hong Kong. The critical variable is how quickly the legal process is engaged after the loss event.
How fast must I act after a digital-asset theft?
The recovery window is measured in hours, not days. Once stablecoin funds reach a withdrawal-capable custodial address, the respondent can move them to a non-custodial or privacy-enhanced asset where issuer-level freeze mechanisms no longer apply. Legal counsel and a forensic provider should be engaged simultaneously, within the first hour of discovery if possible. Courts in the leading forums are capable of granting without-notice freezing relief the same day or the next business day on a well-prepared application. Delay is the single most common reason recovery fails.
Can a court freeze assets held on an exchange?
Yes. Courts in England and Wales, the DIFC, Singapore, and Hong Kong have each granted freezing orders that apply to assets held in exchange accounts. A worldwide freezing order will bind the respondent personally, wherever their assets are held. In parallel, a Norwich Pharmacal or equivalent disclosure order can compel the exchange to identify the account holder and freeze the relevant balance. Exchanges licensed under regulated regimes – including MAS, the SFC's VASP framework, and VARA – are subject to regulatory expectations around cooperation with legal process, which generally supports timely compliance.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We move for freezing relief and exchange disclosure while the trail is live – and we structure the legal, forensic and cross-border coordination as a single mandate rather than disconnected workstreams. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialist in on-chain asset tracing, stablecoin freeze requests, and cross-border freezing order strategy across leading common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.