A seed-stage token issuer wakes to find its multisig treasury drained. The transaction hashes are on-chain. The counterparty is offshore. The window to freeze is closing. For early-stage founders, a worldwide freezing order (an injunction that prohibits a defendant from dissipating or moving assets anywhere in the world) is often the only instrument fast enough to match the speed of on-chain misappropriation. English courts, the DIFC Courts and other leading common-law forums have all confirmed that digital assets are property capable of being frozen – and they have demonstrated a willingness to grant relief on an emergency basis.
Speed determines outcome. Recovery windows for misappropriated digital assets are measured in hours, not weeks. Every block confirmation that goes uncontested narrows the realistic options. This page maps the instrument, the process, the cross-border complications and the decisions a founder must make before calling counsel.
What Is a Worldwide Freezing Order and Why Does It Matter for Crypto?
A worldwide freezing order (WFO) is a court injunction that restrains a defendant from dealing with or dissipating assets up to a specified value, regardless of where those assets are held. It does not transfer title. It does not compensate the victim. What it does is preserve the asset pool pending a final judgment or settlement, buying time for an investigation to identify who holds what and where.
For crypto businesses and early-stage founders, the WFO is significant for a specific reason: digital assets can be moved instantly, pseudonymously, across jurisdictions that have no mutual enforcement arrangement. A freezing order obtained in England or the DIFC can be served on exchanges, custodians and stablecoin issuers operating in those forums' reach. In AA v Persons Unknown [2019], the English High Court confirmed that cryptocurrency constitutes property capable of being the subject of a proprietary injunction. That precedent opened the door to the full armoury of English commercial litigation relief for crypto victims.
In our cross-border practice, we regularly advise founders who mistakenly believe the pseudonymity of blockchain transfers makes freezing relief impossible. It does not. What it does is require faster action and better forensic preparation than a conventional commercial dispute.
The DIFC Courts have likewise granted worldwide freezing orders and disclosure orders in connection with digital-asset disputes, confirming their position as a leading forum for crypto litigation in the Gulf region. Singapore and Hong Kong have followed parallel reasoning.
Who Needs a WFO? Profiles Most Relevant for Early-Stage Founders
Not every theft or misappropriation calls for a WFO as the first step. The instrument is most appropriate where the value at stake justifies litigation, where there is a real and present risk of dissipation, and where the defendant or their assets are within reach of a forum that can grant and enforce the order.
In our practice, the profiles we encounter most often are these. A token project treasury that has been compromised – whether by an insider, a contractor or an exploited multisig – needs immediate freezing relief if on-chain tracing identifies assets still resting in exchange-held addresses. An exchange or custodian can be served with a freezing order and a separate disclosure order (compelling it to reveal account holder details) in a single urgent hearing. The combination of orders, obtained while the trail is live, is the model that works.
A VC-backed Web3 startup that has been defrauded by a counterparty – a market-making arrangement that was cover for asset stripping, or a vendor that took payment and disappeared – faces a slightly different calculation. Here the question is whether the defendant has identifiable assets in a reachable jurisdiction. A WFO is only useful if those assets can be located and an enforcement mechanism exists.
A DeFi protocol with a stolen operational wallet presents the hardest case. The defendant may be anonymous, the assets may have passed through mixers, and the jurisdictional hook may be thin. Even here, however, stablecoin issuers – Tether and Circle both hold contract-level freeze authority over issued USDT and USDC respectively – can act on the basis of a court order or law-enforcement reference, making early legal action worth initiating regardless of how anonymous the attacker appears.
The process above describes the standard path. Your facts – the entity structure, the user base geography, the exchange relationships, the banking – change the analysis materially. For a scoped assessment of your recovery options, contact OBOLUS at info@oboluslaw.com. We can map the viable forums and the realistic timelines before you commit to a course of action.
What Is the Legal Basis for Crypto Freezing Relief, and Which Forum Should You Choose?
Freezing relief in crypto disputes rests on two pillars: the legal characterisation of digital assets as property and the court's jurisdiction over the defendant or their assets. Get either wrong and the application fails.
On property characterisation, the English courts have the deepest body of authority. AA v Persons Unknown [2019] established that cryptocurrency is property. Subsequent decisions – including the NFT-related ruling in Osbourne v Persons Unknown [2022] – have extended that reasoning. Practitioners working in English-law governed projects therefore have a clear doctrinal foundation. The DIFC Courts have moved in the same direction, and the Techteryx and Trafigura matters from 2025 demonstrate the DIFC's willingness to grant WFOs in support of foreign proceedings as well as stand-alone claims.
On jurisdiction, the key question is whether there is a defendant or an asset within the forum's reach. An exchange regulated or incorporated in England, or operating significantly in a jurisdiction that will enforce English orders, is a viable target. Operators we advise routinely underestimate how many of the major exchanges have legal presences in England or Singapore that create an enforcement hook even where the beneficial owner is offshore.
The CFAAR (Crypto Fraud and Asset Recovery network), launched in London in September 2021, has created an informal coordination mechanism among law enforcement and private practitioners across the leading common-law forums. This matters in practice: intelligence shared through CFAAR-adjacent channels can accelerate identification of the defendant and disclosure of exchange account details, shortening the time between the initial application and a productive order.
Forum selection is therefore a tactical decision, not just a legal one. England, the DIFC, Singapore and Hong Kong each offer proprietary injunctions, disclosure orders and – where assets are in scope – ancillary relief that can reach exchange operators. The right forum is the one with the fastest emergency procedure and the strongest enforcement hook over the assets in question. We map these options as the first step in every engagement.
How Does a WFO Application Work in Practice?
The process from first instruction to order on paper has a defined sequence, and the speed at which each step is completed determines whether the assets are still there when the order lands.
Step one is forensic preparation. Before any court application, counsel needs a transaction hash trail, a professional blockchain forensics report confirming the flow of funds, and an identification of the exchange-held addresses where assets are currently resting. Without this, no court will grant emergency relief on a without-notice basis. Forensic partners using tools comparable to those offered by recognised blockchain analytics providers generate the chain-of-custody evidence the court requires.
Step two is the without-notice application. A WFO is almost always applied for without notice to the defendant (ex parte) at the outset, because giving notice gives the defendant time to move assets. The applicant must make full and frank disclosure to the court – disclosing material facts that might count against the application. Any failure here is grounds to discharge the order later. Counsel prepares the evidence in support, the draft order and the cross-undertaking in damages (the applicant's commitment to compensate the defendant if the order turns out to have been wrongly granted).
Step three is service and compliance. Once the order is granted, it must be served on the defendant and on any third parties holding assets – typically the exchange or custodian. A Norwich Pharmacal or Bankers Trust disclosure order, applied for simultaneously, compels the exchange to provide account-holder identity information. The combination of orders is what converts a blockchain address into a named defendant.
Step four is the return date hearing. The defendant has the right to apply to discharge or vary the order. This is where the quality of the original evidence matters most. A well-prepared application, with thorough forensic support, is resistant to discharge.
In our practice, the difference between a successful WFO application and a failed one is almost always preparation speed – how quickly the forensic report is ready and how quickly counsel has enough evidence to satisfy the full-and-frank-disclosure obligation. The legal machinery is available. The question is whether the facts are assembled in time.
How Do Cross-Border Structures Complicate Freezing Relief?
Early-stage founders operate in structures that were designed for speed and flexibility, not for enforcement. A Cayman Islands holding company, a BVI operating entity, a Singapore exchange licence and users in fifteen jurisdictions – this is a common architecture, and it creates genuine complications when enforcement is needed.
The first complication is jurisdictional reach. An English WFO operates worldwide in principle, but enforcement in practice requires either voluntary compliance or a separate recognition and enforcement proceeding in each relevant jurisdiction. An exchange regulated by the MAS (Monetary Authority of Singapore) under the Payment Services Act will comply with a validly served English order in most circumstances, but the process is not automatic. It requires local counsel and, often, a parallel application in the Singapore courts.
The second complication is the defendant's anonymity. Where the attacker is known only by a wallet address, the initial WFO is necessarily against "persons unknown." English courts have accepted this – the AA v Persons Unknown line of authority supports it. But service on an anonymous defendant requires alternative service methods, typically authorised by the court, which adds steps and time.
The third complication is the cross-border AML and Travel Rule regime. When law enforcement is involved – and for a significant misappropriation, they should be – the exchange's compliance obligations under the FATF Travel Rule (the obligation to pass originator and beneficiary data with a transfer) mean that the exchange may already have information about the counterparty that is accessible through a disclosure order. Coordinating the legal application with a law-enforcement referral can accelerate both tracks simultaneously.
We have seen cases where the cross-border complexity – multiple entities, multiple exchanges, multiple jurisdictions – appeared to make recovery impossible. With coordinated multi-forum action through allied counsel in the relevant jurisdiction, assets have been frozen within days of the initial instruction. The complexity is manageable. What is not manageable is delay.
What Are the Most Common Mistakes Early-Stage Founders Make When Pursuing a WFO?
In our experience advising on crypto asset recovery, the errors that destroy a case appear early – often in the first twelve hours after a founder discovers the misappropriation.
The most damaging mistake is waiting. A founder who spends two days trying to resolve the matter directly with the exchange, or three days convening an internal post-mortem before contacting counsel, may find that assets have been moved, converted or withdrawn. Recovery windows are measured in hours. The first call should be to counsel with a blockchain forensics capability, not to the exchange's customer-support desk.
The second common mistake is conducting on-chain activity that could be characterised as tampering with evidence – sending funds to a flagged address to "test" it, or publicly announcing the exploit on a Telegram channel before a without-notice application has been filed. Both actions can give the defendant notice and time to react. Social-media announcements, however understandable, should wait until after the without-notice order is in place.
The third mistake is underestimating the cross-undertaking in damages. When a founder applies for emergency freezing relief, the court requires an undertaking that if the order turns out to have been wrongly granted, the applicant will compensate the defendant. For an asset-light startup with thin capitalisation, this undertaking can become a significant liability. The financial capacity to support it should be assessed before the application is filed.
The fourth mistake is pursuing the wrong forum. An application in a jurisdiction with no enforcement hook over the defendant or the assets wastes time and money. The forensic and intelligence work needed to identify the right forum is not optional – it is the foundation of the strategy.
If a prior recovery attempt stalled, or if a first application was discharged, a second review can identify the structural cause and map the viable route forward. Contact OBOLUS at info@oboluslaw.com or message us via t.me/oboluslaw to assess whether an alternative approach is available.
Decision Matrix: Which Recovery Path Fits Your Profile?
Not every misappropriation case follows the same path. The right instrument depends on the asset type, the defendant's identifiability, the value at stake and the available enforcement hook. The following profiles describe the most common situations we encounter and the typical approach for each.
Profile A – Identified exchange-held assets, named or partially identified defendant. This is the highest-probability recovery scenario. A WFO combined with a disclosure order, filed urgently in England, the DIFC or Singapore, is the primary tool. Timeline from instruction to initial order is typically a matter of days if the forensic report is ready at the time of instruction. The key risk is the defendant moving assets between instruction and service, which is why the without-notice application is filed as fast as forensic preparation allows.
Profile B – On-chain assets traced to stablecoin addresses (USDT or USDC). A WFO is still relevant, but a parallel issuer freeze request – directed at Tether or Circle on the basis of a court order or a law-enforcement case reference – is the faster route to immobilisation. The legal and the operational track run simultaneously. Timeline depends heavily on whether a law-enforcement referral can be made credibly and quickly.
Profile C – Assets passed through a mixer or privacy protocol; defendant fully anonymous. This is the hardest case. A without-notice WFO against persons unknown is possible in England and potentially other forums, but the practical prospects depend on whether a downstream exchange-held address can be identified. Blockchain forensics are indispensable. If no identifiable address can be found within a realistic window, the strategy shifts toward law-enforcement engagement and long-game monitoring for when the assets surface. Legal action remains worth initiating to preserve limitation periods and to create a formal record.
Profile D – Insider misappropriation; defendant is a known person in a reachable jurisdiction. The full armoury of English commercial litigation relief is available: WFO, search order, disclosure order, contempt proceedings for non-compliance. Timeline from instruction to order can be shorter than in anonymous cases because service and identification are not the obstacles. The cross-border element here is typically the location of the defendant's personal assets, which requires allied counsel in the relevant jurisdiction to assess local enforcement.
A Recent Recovery Matter: How the Sequence Works in Practice
In a recent engagement, a DeFi infrastructure company discovered that a contractor had misappropriated a substantial stablecoin balance from the project's operational wallet. Forensic analysis confirmed the funds had moved to addresses held at two regulated exchanges. We instructed allied counsel in the relevant common-law forum and prepared the without-notice application within twenty-four hours of the initial instruction. The court granted both a WFO and a Bankers Trust disclosure order in an emergency hearing. The exchanges complied with the disclosure order within the period specified. The named account holders were identified, and assets were frozen before withdrawal was possible. The matter proceeded to contested proceedings on the basis of the disclosure obtained.
That outcome was possible because the forensic chain was clean, the facts were assembled quickly, and the application was made before the defendant had opportunity to act. Every delay would have narrowed the realistic options.
Related at OBOLUS
- Disputes and Asset Recovery for Digital-Asset Businesses – the full practice overview covering forums, instruments and enforcement strategy
- Crypto Fraud Asset Recovery: A Cross-Border Perspective – multi-jurisdiction analysis of recovery paths and forum selection
- How to Structure an Airdrop Legally – regulatory and structural guidance for token distribution events
A Common Assumption: "Once the Funds Leave the Wallet, Nothing Can Be Done"
This is the single most damaging belief in the digital-asset recovery space. It is wrong, and acting on it is the mechanism by which the assumption becomes self-fulfilling.
Digital assets leave forensic traces that conventional assets do not. Every transfer is timestamped, hash-verified and permanently recorded on a public ledger. Blockchain analytics tools can follow funds through multiple hops, identify exchange-held addresses and – when combined with the legal machinery of a disclosure order – convert a pseudonymous address into a named account holder. The pseudonymity of blockchain does not protect a thief from a court that has jurisdiction over the exchange holding the funds.
What gives the myth its persistence is that recovery is time-sensitive in a way that conventional fraud is not. A victim who waits three weeks to take action in a crypto case may genuinely find that nothing can be done – not because the legal tools do not exist, but because the assets have moved beyond reach. The conclusion that "nothing can be done" is therefore accurate only for those who waited too long. For those who act within the relevant window, the legal and operational tools are well developed and increasingly well tested in the leading courts.
We move for freezing relief and exchange disclosure while the trail is live. If funds have moved in the last hours or days and you have the transaction data, the window is likely still open. Contact OBOLUS now at info@oboluslaw.com or via t.me/oboluslaw.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums, moving quickly while the forensic trail is live. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – specialising in cross-border crypto asset recovery, worldwide freezing orders and on-chain tracing across common-law forums.
FAQ
Can stolen crypto actually be recovered?
Yes, in a meaningful proportion of cases – provided action is taken quickly. Blockchain forensics can trace funds through multiple hops to exchange-held addresses. A court-granted disclosure order then compels the exchange to reveal the account holder's identity. A worldwide freezing order immobilises the assets pending litigation. The critical variable is time: assets that rest at an exchange for long enough to be identified and frozen can be preserved. Assets that have been withdrawn to self-custody or converted through a mixer become significantly harder to reach. Early legal action determines whether recovery is realistic.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows for misappropriated digital assets are measured in hours, not weeks. An attacker who moves funds from an exchange-held address to self-custody before a freezing order is served places those assets beyond the reach of the most effective legal tools. The practical sequence – transaction hash identification, forensic report, without-notice court application, service on the exchange – can be completed within days if counsel is instructed at once. Every hour of delay increases the probability that assets have moved beyond the most accessible enforcement mechanisms.
Can a court freeze assets held on an exchange?
Yes. A worldwide freezing order served on an exchange that is regulated or incorporated within the relevant forum's jurisdiction obliges that exchange to freeze the identified accounts pending further court order. A simultaneous disclosure order requires the exchange to provide the account holder's identity and transaction records. Leading exchanges operating in England, Singapore, Hong Kong and the DIFC have legal presences that create enforcement hooks for orders granted in those forums. The exchange's own AML and compliance obligations under the applicable VASP regime reinforce its incentive to comply promptly.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.