For an established operator, the moment funds leave the wallet is not the moment the case is lost. A worldwide freezing order (an injunction freezing a respondent's assets across every jurisdiction in which they are held) is the fastest and most powerful instrument available when digital assets have been misappropriated. Acting without it – or acting too slowly – can make subsequent recovery structurally impossible. The recovery window is measured in hours, not weeks, and courts in leading common-law forums have now confirmed that crypto assets are property amenable to proprietary relief. This page sets out the process, the cross-border architecture, and the decision logic for an established operator deciding whether to move.
What a worldwide freezing order actually does for a digital-asset claimant
A worldwide freezing order directs a respondent not to dissipate any assets, wherever located, up to the value of the claim – and compels third parties (exchanges, custodians, wallet providers) to assist in its enforcement. In the digital-asset context, that reach is decisive. Stolen funds rarely stay in one wallet or on one platform. They move through bridges, mixers, and over-the-counter desks spread across multiple jurisdictions. A domestic injunction targeting only one exchange misses the rest of the chain. A worldwide freezing order – obtained in a forum with strong recognition credentials, typically England and Wales, the DIFC Courts, Singapore or Hong Kong – travels. Allied counsel in the relevant jurisdiction registers or enforces the order locally, extending the freeze before the respondent can move residual funds to the next hop.
England and Wales is the primary origination forum for worldwide freezing orders in crypto matters. The jurisdiction has a developed body of authority confirming that crypto assets are property, that they can be the subject of proprietary injunctions and tracing claims, and that disclosure orders – Norwich Pharmacal and Bankers Trust orders – can be served on exchanges operating from or doing business in the UK. The DIFC Courts have demonstrated equivalent willingness, issuing worldwide freezing orders in support of foreign proceedings and accepting evidence of digital-asset movements as sufficient grounds for relief on an urgent basis.
In our cross-border practice, the choice of origination forum is the single most consequential decision made in the first hours after a theft. It determines which exchanges can be served with disclosure orders, which freezing order form has the widest recognition in the jurisdictions where the funds appear to have moved, and how quickly emergency applications can be heard. For an established operator with a large-balance loss, getting that decision wrong costs days. Days cost funds.
The process above describes the standard path. Your facts – the entity, the user base, the custody structure, the chains involved – change the analysis materially. To map the optimal origination forum and the disclosure strategy for your situation, contact OBOLUS at info@oboluslaw.com.
What is the legal basis for freezing crypto assets cross-border?
The legal basis for a worldwide freezing order over crypto assets rests on three pillars: property status, jurisdiction over the respondent or the assets, and the risk of dissipation. Courts in England and Wales, the DIFC Courts, Singapore and Hong Kong have each affirmed, in decided cases, that crypto assets constitute property capable of being owned, traced and frozen. The English courts reached that position in AA v Persons Unknown [2019] and reinforced it in Osbourne v Persons Unknown [2022], in which NFTs were held to be property. Hong Kong's courts confirmed the same principle in Re Gatecoin [2023] HKCFI 914. Singapore's courts issued a proprietary injunction over crypto in CLM v CLN [2022] SGHC 46.
For an established operator, property status is rarely the contested issue. What matters in practice is satisfying the risk-of-dissipation threshold – demonstrating that the respondent is moving, or is likely to move, assets to defeat a judgment. On-chain evidence is particularly compelling here. Transaction hashes showing rapid movement through multiple wallets, the use of mixers, or conversion from a trackable stablecoin to a privacy coin are the factual bedrock of an urgent application. Courts have accepted that the very mechanics of decentralised finance create a structural dissipation risk that justifies emergency relief without prior notice to the respondent.
The Travel Rule (the obligation, under FATF Recommendation 15 and implemented in most major jurisdictions, to pass originator and beneficiary data with a virtual asset transfer) creates a parallel evidentiary layer. Where an exchange has Travel Rule data on a transfer, a disclosure order can compel production of that data. Combined with on-chain forensic analysis, it often yields a full attribution chain.
How does on-chain tracing support a freezing application?
On-chain tracing converts blockchain data into a court-ready evidential exhibit that proves the movement of identified assets from the claimant's wallet to the respondent's address – and beyond. The output of a professional forensic analysis is an attribution report that maps each transaction hash, labels counterparty addresses by exchange or entity (using clustering and proprietary datasets), and quantifies the proportion of stolen funds remaining in identified wallets versus those already converted or bridged.
That report serves two functions in a freezing application. First, it establishes the factual basis for the proprietary claim – the claimant can identify the specific coins or their traceable proceeds in identified wallets. Second, it provides the target addresses needed to serve disclosure requests on exchanges: once you can show an exchange that a specific deposit address on its platform received funds traceable to the theft, the exchange's own AML obligations – and any disclosure order the court issues – require it to produce the account data behind that address.
We work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications. The quality of the forensic report is not peripheral to the legal strategy – it is the legal strategy. A report that fails to establish attribution with sufficient certainty, or that uses methodology a court will not recognise, can defeat an otherwise meritorious application. We specify the evidentiary standard required and review the output before it goes before the court.
In a recent recovery matter, an established payments operator traced misappropriated stablecoins through four exchange addresses across two jurisdictions. We obtained a disclosure order in a leading common-law forum within days of the initial instruction, served it on two exchanges, and secured a freeze on the identified balances before the respondent could complete a planned bridge to a privacy protocol. The case settled in the claimant's favour following the freeze. No specific sum is stated, but the exposure was material to the operator's balance sheet.
What does the process look like, step by step?
The process for an established operator pursuing a worldwide freezing order in a crypto matter runs through five stages, each with time pressure that compresses the margin for error.
Stage 1 – Triage and evidence preservation (hours 1–12). The immediate priority is evidence capture: wallet addresses, transaction hashes, platform screenshots, internal communications, and any contractual documentation with the counterparty. If the loss involves a custodian or exchange, contemporaneous account records must be preserved before any notice to the counterparty. We advise on what to preserve and what not to touch – inadvertent contact with the on-chain evidence can complicate tracing.
Stage 2 – Forensic commission and attribution (hours 12–48). A professional forensic report is commissioned on an urgent basis. The instruction specifies the evidentiary standard for court use, the geographic distribution of exchanges that need to be covered, and the output format the court will accept. We brief the forensic team and review the interim report before it is finalised.
Stage 3 – Forum selection and application drafting (concurrent with Stage 2). While forensics are running, we draft the without-notice application. This includes the claim form, the supporting evidence, the draft freezing order, and – critically – the full and frank disclosure statement the court requires from an applicant moving without notice. Errors or omissions in full and frank disclosure are the most common reason freezing orders are set aside after the fact.
Stage 4 – Emergency hearing and order. In England and Wales, emergency applications in crypto matters have been heard within hours of filing in cases of urgent need. The DIFC Courts have demonstrated comparable speed. The order is served on the respondent (if known) and on identified exchanges simultaneously. Exchange service may include a direct communication from OBOLUS and, where required, a translated version of the order for non-English-speaking operators.
Stage 5 – Enforcement and follow-through. A freezing order is not a recovery. It is the precondition for one. Following the freeze, the litigation proceeds toward either a judgment enforceable against the frozen assets, a settlement in which the frozen assets are transferred, or a return hearing if the respondent challenges the order. Allied counsel in each relevant jurisdiction coordinate local enforcement. We manage the cross-border architecture from the origination forum.
How does cross-border structure affect an established operator's recovery strategy?
Established operators typically have a more complex cross-border structure than early-stage businesses: a licensing entity in a regulated hub, a treasury function in a tax-efficient jurisdiction, custody spread across multiple custodians, and a user base across several continents. That complexity is an asset in a recovery context – if it is managed properly.
An operator with a legal presence in England and Wales, the DIFC or Singapore has direct standing to originate proceedings in those forums without constructing a jurisdictional bridge. That shortens the application timeline materially. An operator whose only regulated entity is in a jurisdiction with weaker crypto-asset property jurisprudence may need to establish jurisdiction through the location of the assets or the presence of an exchange with local operations – a workable but slower path.
Banking and treasury structure also affects the post-freeze strategy. If the respondent's identified assets include fiat balances at a correspondent bank operating in a common-law jurisdiction, those balances can be swept into the freeze alongside the on-chain assets. Stablecoin balances present a specific option: Tether (USDT) and Circle (USDC) each hold contract-level blacklisting authority over their issued tokens and generally act on a court order or a law-enforcement designation. A freeze of identified USDT or USDC holdings can be reinforced by a direct engagement with the issuer, in parallel with the court order, to prevent the respondent from redeeming or transferring those specific tokens.
The cross-border architecture must be mapped before the application is filed. Amendments after the fact – adding jurisdictions, seeking additional exchange disclosure, expanding the asset class covered – are possible but costly in time and fees. Operators we advise regularly engage us at the triage stage, before any external communication, so that the strategy is set correctly at the outset.
If a prior application stalled, or if an earlier attempt at recovery was unsuccessful, a second read of the structural facts often surfaces the reason and the route back. To discuss a live matter or a prior unsuccessful attempt, write to us at info@oboluslaw.com.
What mistakes do established operators make in freezing order applications?
Experience across multiple recovery matters surfaces a consistent pattern of avoidable errors. The most consequential is delay: the belief that the matter should be investigated internally before legal counsel is engaged. Internal investigation without legal supervision can alert the respondent, modify the on-chain record (if the operator controls relevant infrastructure), and create privilege issues. Every hour of internal investigation that precedes legal triage is an hour the respondent's funds can move.
The second most common error is filing in the wrong forum. Operators based in a civil-law jurisdiction sometimes file domestically on the assumption that it is faster or cheaper. In most cases, neither is true for crypto recovery. Civil-law courts generally lack the without-notice injunction procedure and the property-over-intangibles jurisprudence that make common-law forums effective. By the time the domestic application fails, the funds have moved beyond the domestic forum's reach.
The third error is incomplete full and frank disclosure. An applicant moving without notice to the respondent has an absolute obligation to place before the court all material facts, including those that might count against the application. Omitting a contractual dispute with the respondent, a prior failed demand, or facts that might suggest the "theft" is contested is the most reliable way to have the order set aside on the return date – at which point the respondent has had warning, the funds have moved, and the claimant has paid for two sets of proceedings.
A fourth category of error is specific to digital-asset cases: serving the disclosure order on the wrong exchange entity. Many exchanges operate through a network of group companies. Service on the wrong legal entity produces a delay while the correct entity is identified – a delay that, in a fast-moving case, can be fatal to the freeze.
Which operator profile should pursue which route?
Not every digital-asset loss warrants an emergency worldwide freezing order. The instrument is powerful but not cost-free, and the decision to move should be calibrated to the facts.
Profile A – Large-balance loss, identified counterparty, on-chain evidence available. This is the core case for an emergency worldwide freezing order. The balance justifies the cost of the application and the cross-border enforcement architecture. The identified counterparty – even if only identified by exchange account or wallet address – is sufficient for without-notice relief in most leading forums. Move immediately: commission forensics and file within 48–72 hours of the loss event.
Profile B – Material loss, counterparty unidentified, funds traced to an exchange. The priority here is disclosure before the freeze. A Norwich Pharmacal or Bankers Trust order directed at the exchange that received the funds produces the identity data needed to name a respondent. Once identified, the freeze follows. This sequence adds time – typically days to a week in a leading forum – but is the correct procedural path where the respondent is not yet named.
Profile C – Loss involving a regulated counterparty (exchange, custodian, fund). Where the counterparty is itself regulated, the litigation strategy involves parallel tracks: the injunctive relief and, separately, engagement with the counterparty's regulator. Regulatory pressure does not substitute for court process, but it can accelerate settlement discussions in cases where the regulated entity is a knowing or negligent participant rather than a purely innocent third party.
Profile D – Loss that has aged beyond the immediate recovery window. If weeks or months have passed since the loss event, the emergency without-notice route is no longer appropriate. The analysis shifts to: can the funds be traced to a static address or an identified exchange account? Are the limitation periods still open? Is the loss sufficiently large to justify full civil litigation through to judgment? These cases are recoverable, but the strategy is different and the timeline is longer.
A common assumption: if funds have left the wallet, nothing can be done
A common assumption among operators who contact us after a delay is that the funds are gone. That assumption is usually wrong, and it is wrong in specific, addressable ways. Blockchain assets leave a permanent, immutable record. Unlike cash, crypto does not disappear – it moves to another address, and that address is traceable. Most thieves make attribution errors: they consolidate funds at an exchange before cashing out, they use infrastructure that has been cluster-identified by forensic tools, or they attempt to convert stablecoins in ways that trigger issuer-level controls.
The window for emergency relief is short. But the window for recovery – the full arc of tracing, disclosure, litigation and enforcement – is considerably longer. Courts in England and Wales, the DIFC, Singapore and Hong Kong have each demonstrated willingness to grant disclosure orders against exchanges months after a loss event, provided the on-chain evidence remains traceable and limitation is not exhausted. What changes with delay is the cost and complexity of the proceeding, not the legal right to bring it.
Operators we advise who believed recovery was impossible have, on a second structural read, identified viable paths: funds sitting in KYC-verified exchange accounts awaiting withdrawal, stablecoin balances frozen by issuer action before the operator engaged counsel, or counterparty assets in a jurisdiction where enforcement is straightforward once a judgment is in hand.
Related at OBOLUS
- Disputes & Asset Recovery practice overview – the full scope of OBOLUS's cross-border disputes and recovery capability
- Crypto fraud and asset recovery counsel for digital-asset firms – end-to-end legal strategy from fraud identification to enforcement
- Worldwide freezing order for early-stage founders – the same instrument adapted for the constraints of an early-stage business
FAQ
Can stolen crypto actually be recovered?
Yes, in many cases. Recovery depends on the speed of response, the quality of on-chain tracing, and the forum. Courts in England and Wales, the DIFC, Singapore and Hong Kong have each confirmed that crypto assets are property subject to proprietary claims, freezing orders and disclosure relief. Stablecoin issuers hold independent freeze authority over issued tokens. The most common barrier to recovery is delay, not law. Acting within hours of the loss event materially improves the odds.
How fast must I act after a digital-asset theft?
Immediately. The recovery window is measured in hours. Funds moved to an exchange can be withdrawn or bridged onward within hours of deposit. An emergency without-notice freezing application, supported by a forensic attribution report, can be before a court in a leading common-law forum within 24–48 hours of instruction. Every hour of delay narrows the window. Preserve all evidence, do not contact the counterparty, and engage specialist counsel at once.
Can a court freeze assets held on an exchange?
Yes. A worldwide freezing order binds the respondent personally – meaning they cannot instruct the exchange to withdraw or transfer the funds. In parallel, a Bankers Trust or Norwich Pharmacal disclosure order can compel the exchange to produce account data and, in many cases, to hold the relevant balance pending the court's further direction. Courts in the leading common-law forums have granted both forms of relief against major exchanges operating in or accessible from their jurisdictions.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. In disputes and recovery matters, we move at the speed the case demands – forensic commission, application drafting and exchange service can run in parallel within a single coordinated instruction. We work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications. To discuss a live matter or a recovery strategy, contact info@oboluslaw.com or reach us via t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specialist in cross-border digital-asset freezing orders, on-chain tracing strategy and enforcement across common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.