Operating a regulated digital-asset business means holding or transmitting assets on behalf of others. When those assets are misappropriated – whether through an external hack, an insider breach or a counterparty fraud – the recovery window is measured in hours, not weeks. A worldwide freezing order (a court injunction prohibiting a respondent from dealing with or dissipating assets anywhere in the world) is the sharpest instrument available in common-law forums to stop the bleed while the underlying dispute is resolved. We move for that relief on an emergency basis, coordinating on-chain tracing, exchange disclosure and multi-jurisdictional enforcement from the moment a matter arrives on our desk.
For regulated entities – exchanges, custodians, payment token issuers and fund managers operating under MiCA, VARA, the MAS Payment Services Act, the SFC VASP regime or equivalent regimes – the stakes carry an additional dimension. A misappropriation event is simultaneously a customer obligation failure, a regulatory notification trigger and a potential licence condition breach. Managing the legal response requires counsel who understands both the litigation mechanics and the regulatory environment. The sections below set out the instrument, the process, the cross-border reality and the mistakes that cost businesses their only window to recover.
What is a worldwide freezing order and when does it apply to digital assets?
A worldwide freezing order – also called a Mareva injunction in several common-law jurisdictions – is a mandatory, asset-specific injunction that prohibits a defendant from moving, dissipating or diminishing assets wherever those assets are held. Courts in England and Wales have been the most active in applying this instrument to digital assets, following the recognition in AA v Persons Unknown [2019] that cryptocurrency constitutes property capable of being subject to proprietary claims and injunctive relief. The DIFC Courts in Dubai have followed, most recently in Trafigura v Gupta [2025] DIFC, granting a worldwide freezing order in support of foreign proceedings – a significant development for businesses whose counterparties are domiciled across the Gulf region.
For a regulated entity, the injunction serves two immediate purposes. First, it freezes the respondent's assets so that any eventual judgment is not rendered valueless by dissipation. Second, it creates the legal foundation for third-party disclosure orders – directing an exchange, a custodian or a stablecoin issuer to produce account records or, in the case of Tether (USDT) and Circle (USDC), to activate their contract-level blacklist authority over specific addresses. Both Tether and Circle hold the technical capacity to freeze tokens at the smart-contract level; they generally act on a court order or a law-enforcement designation, and coordinating that process alongside the injunction application is standard in our practice.
Why does regulatory status change the urgency and the strategy?
A regulated entity facing misappropriation is under obligations that a private claimant is not – and those obligations run in parallel with, and can conflict with, litigation strategy. Under MiCA, a CASP (crypto-asset service provider) authorised by a national competent authority has notification obligations when an incident affecting client assets occurs. Under the VARA regime in Dubai, activity-based licensees are subject to incident-reporting requirements. Under the MAS Payment Services Act in Singapore, similar expectations apply to licensed DPT (digital payment token) service providers.
The tension is direct. Legal privilege, litigation strategy and the duty to preserve evidence all pull in one direction. Regulatory notification obligations, which typically require prompt disclosure to the supervisor, pull in another. We regularly advise clients on sequencing these obligations: what must be disclosed to the regulator, when, and how to protect the integrity of the legal process while complying. Getting that sequencing wrong – notifying too broadly before the injunction is served, for instance – can tip off a respondent and compromise the element of surprise that a without notice application depends on.
There is a further cross-border dimension specific to regulated entities. A business holding a MiCA passport across the EU/EEA may have users in multiple member states. A VARA licensee in Dubai mainland may be serving counterparties whose assets move through Singapore or Hong Kong. The jurisdictional footprint of the regulated activity often determines which forum is optimal for the injunction – not where the theft occurred, but where the respondent holds assets or where enforcement against a third-party exchange is most effective.
To map the injunction strategy against your regulatory obligations before you act, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base, the banking, the regulator – change the analysis in ways that matter from the first hour.
How is a worldwide freezing order application structured in practice?
A successful worldwide freezing order application in a leading common-law forum requires three elements: a good arguable case on the merits of the underlying claim; a real risk of dissipation; and a balance of convenience that favours granting relief. For digital-asset matters, the dissipation risk element is almost always acute – the entire premise of a blockchain transfer is irreversibility, and assets moved across chains or converted to privacy-preserving instruments become materially harder to trace. Courts are familiar with this dynamic, and we have found that a well-prepared forensic report presented alongside the application significantly strengthens the dissipation risk argument.
The procedural steps in England and Wales – the forum where the instrument is most developed for crypto matters – typically run as follows. First, a professional forensic trace is commissioned and completed, producing a report that documents the transaction path from the point of theft to the current address or exchange. Second, a without-notice application is issued, supported by a witness statement setting out the claim, the tracing evidence and the risk of dissipation if notice is given. Third, the order is granted by a judge sitting in the interim applications list, usually on the same day. Fourth, the order is served on any third-party exchanges or custodians identified in the tracing report, with a concurrent Norwich Pharmacal or Bankers Trust disclosure order requiring those third parties to produce account and identification records. Fifth, the respondent is served, and a return date is set for the full inter partes hearing.
Timing across this sequence is tight. Courts in England and Wales can move from application to grant within a day on an emergency basis. Exchange compliance teams at major platforms typically respond to court orders within a matter of days, though response time varies by the exchange's domicile and the forum of the order. Stablecoin issuers – specifically Tether and Circle – generally require a law-enforcement case reference alongside the court order before they will activate a freeze. Coordinating all three – the court, the exchange and the issuer – simultaneously is not a routine task, and we structure the application package to anticipate each recipient's requirements from the outset.
How does multi-jurisdictional enforcement work for a regulated entity?
Multi-jurisdictional enforcement is the practical test of a freezing order. An order granted in England and Wales freezes assets worldwide in theory; enforcing it against assets held at an exchange domiciled in Singapore, or against a respondent in the UAE, requires parallel steps in each relevant forum. In our cross-border practice, the most effective structure is to obtain the primary order in the forum with the strongest claim nexus or the most developed crypto-property jurisprudence, and then to use that order as the foundation for recognition and ancillary relief elsewhere.
The DIFC Courts have demonstrated a clear willingness to recognise and enforce foreign judgments and to grant their own worldwide freezing orders in support of foreign arbitral and court proceedings. Singapore courts, following CLM v CLN [2022] SGHC, have confirmed that cryptocurrency is property capable of being subject to proprietary injunctions, making Singapore an effective secondary enforcement forum for assets moving through Southeast Asia. Hong Kong – following the first "tokenised" injunction issued in HCA 2417/2024 and the recognition in Re Gatecoin [2023] HKCFI that crypto constitutes property – is increasingly relied upon for enforcement against exchanges with a Hong Kong nexus.
The practical cross-border workflow, as we structure it, begins with allied counsel in each relevant jurisdiction being briefed simultaneously. A DIFC-registered exchange requires a DIFC-compliant service process and, for compliance purposes, a DIFC-issued or recognised order. A Singapore-domiciled exchange requires a Singapore order or an application to the Singapore court for recognition. That coordination – legal, not just administrative – is what determines whether assets are frozen before they move again.
For regulated entities with a multi-hub presence, there is an additional lever: a regulator in the entity's home jurisdiction can be an effective informal pressure point on regulated counterparties. A custodian that is itself regulated under MiCA or MAS has its own compliance obligations, and those obligations create a parallel channel for securing voluntary co-operation alongside the court process.
What role does on-chain tracing play in a freezing order application?
On-chain tracing is the evidential foundation of a viable crypto recovery claim, not an optional enhancement. A court will not grant a worldwide freezing order on the basis of an assertion that funds were stolen; it requires evidence of a proprietary claim – that specific identifiable assets or their traceable proceeds are held by or under the control of the respondent. On the blockchain, that evidence is inherently available: every transaction is recorded. The challenge is converting that raw data into a forensic report that meets the evidentiary standard a court will accept.
We work with specialist forensic partners whose reporting has been accepted in leading common-law forums. The report needs to trace the specific tokens from the point of misappropriation through each subsequent transaction, address and exchange deposit, identifying the balance currently held and the exchange or custodian holding it. Where assets have been moved through mixers or converted into different tokens, the report needs to address the tracing methodology and explain why the proceeds remain legally identifiable. Courts have accepted sophisticated tracing arguments in multi-step conversions; the key is early instruction of the forensic team so that the trail is followed while it is live.
In a recent recovery matter, a payments company operating under a regulated licence traced misappropriated stablecoins through two successive exchange deposits across different jurisdictions. We coordinated the forensic report, the without-notice application and parallel disclosure requests to both exchanges. The funds were frozen before the respondent could initiate a withdrawal. The matter settled at a return date, with the frozen assets returned in full. No dollar figure is attributed here; the outcome turned on speed and preparation, not scale.
What are the most common mistakes regulated entities make after a theft?
The single most costly mistake is delay. A regulated entity that spends the first 48 hours after a misappropriation on internal investigation, insurance notifications and board briefings before instructing litigation counsel has typically lost the live trail. By the time a forensic report is commissioned, the assets have moved through multiple wallets and often across chains. The court can still grant relief – but the prospects of locating and freezing specific assets diminish with every on-chain step.
The second mistake is over-notification. Regulated entities have compliance instincts that can work against litigation strategy. Notifying the regulator, the insurer and internal stakeholders before counsel has had a chance to assess privilege and litigation risk can produce a paper trail that constrains strategy and, in the worst case, tips off a respondent who has an insider relationship with the business. We advise on the minimum disclosure required at each stage and the sequence that keeps the litigation option open.
The third mistake is forum selection based on convenience rather than analysis. A regulated entity incorporated in the EU, with assets misappropriated by a counterparty who holds those assets at a Singapore-domiciled exchange, should not default to a home-jurisdiction court if it does not offer an effective service mechanism for Singapore entities. The optimal forum is the one where the respondent or the third-party exchange is most susceptible to enforceable process. That analysis takes an hour; not doing it takes months.
A fourth, frequently overlooked mistake is failing to preserve the private key and transaction evidence in a forensically sound manner before internal teams begin moving assets or rolling back systems. Evidence of the original breach – wallet addresses, transaction hashes, API access logs – must be preserved in a chain-of-custody compliant format before any remediation begins. We routinely issue evidence-preservation instructions as the first step in a new recovery matter, before the court application is drafted.
If a recovery clock is running, reach our disputes desk now at info@oboluslaw.com. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back.
Which forum, instrument and timeline fit your operator profile?
The right forum and instrument depend on where the assets are, where the respondent operates and where your regulated entity is domiciled. The following profiles capture the most common configurations we encounter.
Profile A – EU-licensed CASP (MiCA), assets at an exchange with a UK or EU nexus. Primary forum: England and Wales or the home-member-state court, depending on the exchange's domicile and the respondent's location. Instrument: worldwide freezing order with concurrent Norwich Pharmacal disclosure. Timeline: order obtainable on the same day on an emergency application; exchange response typically within days. Key risk: regulatory notification obligations under MiCA may conflict with the without-notice strategy; sequencing is critical.
Profile B – VARA licensee (Dubai mainland), assets at a DIFC-registered or Gulf-based exchange. Primary forum: DIFC Courts. Instrument: worldwide freezing order; the DIFC Courts have demonstrated willingness to grant this relief in support of both domestic and foreign proceedings. Timeline: comparable to England and Wales on emergency applications. Key risk: enforcement against exchanges outside the DIFC free zone may require parallel applications in the UAE courts or recognition proceedings.
Profile C – MAS-licensed DPT provider (Singapore), assets distributed across Southeast Asian exchanges. Primary forum: Singapore High Court. Instrument: proprietary injunction with disclosure order. Timeline: injunctions obtainable on an urgent basis, though timelines vary with court scheduling. Key risk: Singapore's Travel Rule implementation means the exchange may hold originator/beneficiary data that significantly accelerates the tracing process – but accessing that data requires the disclosure order to be drafted to capture it specifically.
Profile D – SFC-licensed VATP (Hong Kong), assets moved cross-chain into privacy instruments. Primary forum: Hong Kong Court of First Instance. Instrument: injunction with tracing order; Hong Kong courts have accepted sophisticated cross-chain tracing arguments following the first tokenised injunction in 2024. Timeline: urgent applications proceed quickly, though the forensic complexity of cross-chain tracing extends the overall process. Key risk: privacy instrument conversions require advanced forensic methodology; early instruction of specialists is essential.
Self-assessment: are you positioned to move quickly?
Regulated entities that can answer affirmatively to the following questions are in a materially better position to secure effective freezing relief quickly.
- Do you hold a complete record of the transaction hashes associated with the misappropriated assets, including the original wallet address and the first destination address?
- Have you identified the exchange or custodian currently holding the assets, or the last known address before the trail went cold?
- Is your evidence – private keys, access logs, API records, smart-contract event logs – preserved in a forensically sound format and not yet overwritten by system remediation?
- Do you know your regulatory notification obligation and the window in which it must be satisfied, so that it can be sequenced around the litigation strategy?
- Have you identified the jurisdiction of the relevant exchange for service-of-process purposes, and confirmed that your chosen litigation forum can serve process there effectively?
- Is allied counsel in each relevant enforcement jurisdiction on notice and capable of being instructed within hours?
A gap in any of these areas does not end the recovery option – but it extends the time between the instruction and the order. We have seen matters where a single missing transaction hash delayed a forensic report by several days and allowed a respondent to move assets to an unidentified wallet. Prevention is architectural.
Related at OBOLUS
- Disputes & Asset Recovery for Digital-Asset Businesses – the full practice overview for crypto disputes and on-chain recovery across 25+ forums
- Smart Contract Dispute Resolution in Estonia – how Estonian law and EU frameworks interact on smart-contract enforceability and breach
- CASP Authorisation under MiCA in Ireland – practical guide to obtaining a MiCA CASP authorisation through the Central Bank of Ireland
FAQ
Can stolen crypto actually be recovered?
Yes – recovery is possible, and the prospects depend heavily on speed and the exchange or custodian holding the assets. Courts in England and Wales, the DIFC, Singapore and Hong Kong have each confirmed that digital assets constitute property capable of being frozen and subject to proprietary claims. Where assets are held at a regulated exchange or in USDT/USDC, a court order can compel disclosure and freeze the balance. The later the instruction, the narrower the window – but the trail is rarely entirely cold.
How fast must I act after a digital-asset theft?
Speed is decisive. Assets can move through multiple wallets and across chains within hours. The practical priority, in the first hours, is preserving the transaction evidence – hashes, wallet addresses and access logs – and instructing forensic tracers before the trail cools. An emergency without-notice freezing application in England and Wales or the DIFC Courts can be placed before a judge the same day. Instructing litigation counsel on the day of discovery, rather than after internal investigation is complete, consistently produces better outcomes.
Can a court freeze assets held on an exchange?
Yes. A worldwide freezing order binds the respondent personally, and a concurrent disclosure order – a Norwich Pharmacal or Bankers Trust order in England and Wales – requires the exchange to produce account records and, where relevant, freeze the balance pending the litigation. Both Tether and Circle have contract-level freeze authority over USDT and USDC respectively and generally act on court orders or law-enforcement designations. The exchange's domicile determines which forum's order it is most likely to comply with promptly.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around those activities. Digital assets are the whole of our practice. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums, moving for injunctive relief on an emergency basis while the trail is live. To discuss your situation, contact info@oboluslaw.com or message us via t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specialising in on-chain asset tracing, worldwide freezing order applications and multi-jurisdictional enforcement for regulated digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.