Crypto Asset Recovery Lawyer: Tracing, Freezing and Recovery

The decisive question is not simply which address received the tokens. It is who controlled the relevant wallet or custodial account, whether the disputed property can be attributed to the claimant, which legal entity can supply missing records, and which tribunal can make an effective order. A transaction hash is an important starting point, not proof of the wallet holder's identity, dishonesty, liability or entitlement to delivery up.

What does a transaction record establish—and what does it leave open?

A public-chain transaction may establish the recorded network, asset contract, sending and receiving addresses, block reference, transaction identifier and observed transfer amount. It does not ordinarily establish a human identity, the contractual owner of an exchange balance, the purpose of a transfer, or whether an address belongs to the defendant rather than to an innocent customer. Even a highly plausible attribution needs an explanation of the data, assumptions, alternative routes and evidential gaps.

The first review therefore compares the claimant's own acquisition and transfer records with independently verifiable chain data. Retain exchange receipts, transaction histories, signed agreements, wallet screenshots with timestamps, communications with the supposed counterparty and contemporaneous evidence of consent or deception. For token transfers, record the chain and token contract, not merely a ticker: similar ticker symbols on different networks do not prove the same property moved. Record any bridge transaction, wrapper, swap or migration as a separate factual event rather than drawing an unexplained arrow across networks.

The High Court of England and Wales recognised the possibility of proprietary rights in USDT in D'Aloia v Persons Unknown [2024] EWHC 2342 (Ch), yet rejected a claim against Bitkub because the claimant did not prove his assets reached the relevant wallet. The Property (Digital Assets etc) Act 2025, applicable in England and Wales and Northern Ireland, also confirms that a digital thing is not barred from being an object of personal property rights merely because it falls outside the traditional categories of things in possession or in action; it does not decide ownership in an individual dispute. The distinction matters: a judicial finding that a class of cryptoasset can be property does not validate a particular investigator's route through mixing, exchange ledgers or intermediary wallets. Different chains and custody models need their own technical proof.

The evidence-to-relief map: from transaction hash to enforceable order

Use this working matrix before deciding whom to approach or sue. Its purpose is to identify the next missing proof and the person legally able to act, not to promise that any listed remedy will be granted.

Consider two superficially similar outcomes. A traced amount entering an exchange-controlled deposit address may justify seeking narrowly defined customer and transfer records, yet not direct delivery of equivalent coins out of a pooled wallet. Conversely, assets still held in a genuinely identifiable self-custody wallet may support a proprietary claim, but there may be no custodian capable of stopping an on-chain transfer. The evidence-to-relief map changes at the custody fork.

Custodial exchange or self-custody: who can actually preserve value?

At a custodial platform, a customer usually has contractual rights recorded in the platform's internal ledger. The person with practical control of blockchain keys may be an exchange company, while beneficial rights, account balances and liabilities depend on the governing contract and applicable property or insolvency law. In LMN v Bitflyer Holdings [2022] EWHC 2954 (Comm), the Commercial Court described how public tracing stopped at exchange-controlled addresses because customer credits were recorded off-chain. This made a carefully targeted application for information potentially useful, not automatic.

A preservation request to a provider should identify exact transactions, affected accounts if known, dates, relevant chain and a verifiable legal contact. The provider may have its own fraud, compliance or law-enforcement process. Its voluntary decisions depend on applicable law and policy; an advocate cannot command the exchange to freeze property merely by sending a letter. A compulsory injunction or disclosure order must come from a competent court or other authority and be addressed to a properly identified legal person. It may require service, security or undertakings, and can be challenged.

With self-custody, a person controlling private keys can normally authorise on-chain transfers without asking an intermediary. A civil order directed at that person may restrain dealing or require disclosure, but it does not mechanically disable a decentralised network. A wallet software company, validator or analytics vendor is not necessarily the controller of a wallet simply because its product or infrastructure appears in the transaction record. Attempting to obtain a key, hack a wallet or impersonate an authority is not a recovery procedure.

There is a third possibility: the trail reaches a service that is neither the contractual custodian nor the appropriate defendant, such as a routing platform, payment processor or entity in an exchange group. Identify the actual party holding account records and its jurisdiction before issuing a claim. A trade name or website alone is not a reliable description of the legal entity that can obey a court order.

Which civil court can order disclosure or a freeze?

There is no single international crypto recovery court. A proposed claim needs a jurisdiction-by-jurisdiction analysis of the defendant's connection, the events and loss, governing law, place of custody, service rules and enforceability. England and Wales offers an illustrative route only where the High Court has jurisdiction; its remedies are not available worldwide simply because a wallet is public.

CPR Part 25 allows interim remedies, in appropriate cases before a claim begins, but requires evidence and normally safeguards such as undertakings as to damages and prompt service. It does not imply that every report of fraud qualifies. The Bankers Trust disclosure criteria discussed in Wilden v Person Unknown [2026] EWHC 1355 (KB) include good grounds that assets belonged to the claimant, a real prospect the information will locate or preserve them, narrow scope, a balance of interests and protective undertakings. The High Court granted relief in that case on its evidence; it did not create a disclosure entitlement for every cryptocurrency complainant.

LMN shows why overseas exchange operators can sometimes be brought before an English court for narrowly defined information applications, and why the court may require notice to an innocent exchange instead of deciding the substance entirely without notice. Practice Direction 6B paragraph 3.1(25) expressly addresses overseas service of information-order claims or applications against non-parties. Establishing the gateway is only part of the analysis: forum, merits, service and the terms of the order still need attention.

What did the later crypto cases change about tracing and third-party rights?

The distinction between interim relief and proof at trial is particularly important. In D’Aloia v Persons Unknown [2024] EWHC 2342 (Ch), the High Court held that USDT can attract property rights under English law, but the claimant failed to prove that his USDT reached Bitkub’s wallet. The judgment also exposed serious defects in the expert tracing evidence: the methodology was described inconsistently and did not reliably explain the allocation of funds through mixed wallets. It does not validate a generic software-generated path or establish one universal formula for tracing mixed cryptoassets. General evidence of suspicious flows cannot replace proof that this claimant’s property reached the defendant’s wallet.

Property status does not make every remedy available. In Ping Fai Yuen v Fun Yung Li [2026] EWHC 532 (KB) (10 March 2026), the High Court struck out a conversion claim concerning Bitcoin, applying the binding House of Lords decision in OBG Ltd v Allan [2007] UKHL 21 that conversion remains limited to tangible property. The court did not strike out the pleaded declaration of ownership or proprietary injunctive relief at that stage, and left open whether a distinct cause of action could be developed by analogy. This first-instance decision is a material limit on the English example: a claimant must identify a viable cause of action and cannot assume that recognition of cryptoassets as property makes conversion available. Check for later authority before filing.

In June 2026, Wilden continued an interim proprietary/worldwide freezing order against an alleged fraudster and disclosure order against an exchange on evidence the judge considered sufficient, including an explained chain of transactions. That is a first-instance, fact-specific decision, not an appellate ruling that mixing never matters. The question remains whether the claimant can establish the relevant legal and technical connection using an intelligible methodology.

A more recent, binding appellate warning is Jones v Persons Unknown [2026] EWCA Civ 1212, decided by the Court of Appeal on 28 September 2026. A Bitcoin delivery order based on mistaken attribution resulted in a third party’s exchange account being debited. The Court of Appeal held that the third party was directly affected within CPR 40.9, allowed its appeal and set aside relevant parts of the earlier order. It did not order an immediate transfer to Kyrrex; the parties’ underlying claims to the Bitcoin remained unresolved. Before asking for a transfer, a claimant must therefore verify wallet attribution, assess the risk to innocent third-party accounts and provide the required procedural safeguards. A deposit address at a custodian does not prove that every token recorded there belongs to the fraudster.

For an English High Court dispute, a Court of Appeal decision on that procedural rule binds lower English courts; D'Aloia and Wilden are High Court decisions whose reasoning may be relevant but whose facts and procedural posture differ. None of them decides the competence of a court in the EU, Asia or the Americas. Before relying on a particular court order, counsel should check subsequent appeals, amendments and local contrary authority in the jurisdiction actually hearing the case.

Can an EU exchange be required to release customer information?

EU Regulation 2023/1114 (MiCA), including Articles 70 and 75, imposes safeguarding, position-register and custody duties on in-scope crypto-asset service providers. These records may help establish who had contractual rights or control, but MiCA is not a universal private subpoena or a power for a foreign lawyer to freeze an account. The provider’s authorisation status, governing contract, data-protection duties and national civil or criminal procedure still matter. As of 28 October 2026, the general transitional allowance in MiCA Article 143(3) for providers already operating under national law before 30 December 2024 expired no later than 1 July 2026, or earlier when authorisation was granted or refused. Member States could also disapply or shorten that transition, so the relevant national measure and the provider’s current authorisation status must be checked; do not assume grandfathering continues. Whether a request goes to a civil court, competent national regulator or investigating authority depends on the specific legal basis; those procedures are not interchangeable.

For example, Article 75 requires custody agreements and records of client positions and movements. It does not say that a person who knows a deposit address may demand all customer identity records. Nor can a regulator's supervisory power be treated as a civil claimant's personal disclosure order. If funds appear to be held in an EU custodial business, establish which entity provides the service, which state supervises it and what procedural assistance a competent local lawyer may seek. If the company is not within MiCA's scope, the relevant national framework must be checked instead.

How does a cross-border judgment become an actual recovery?

Three questions must be separated: which court may decide the underlying dispute; which court may make an interim order against the relevant person; and where the resulting order can be served and enforced. These answers can point to different countries. A worldwide freezing injunction is a restraint addressed to a defendant; it does not become a globally executable seizure instruction to all exchanges. An overseas provider may need formal service or a domestic recognition or assistance route. A locally available disclosure order may reveal an account holder without itself transferring any property.

The choice between a proprietary claim to specific assets and a personal money claim changes both the proof and enforcement plan. An account may hold a contractual balance rather than separately identified coins. A defendant may be insolvent, a custodian may have transferred value onwards, or an order against one company may not bind another group entity. Interim measures can preserve an opportunity for litigation without resolving ownership or guaranteeing enough accessible assets at judgment.

For an extensive general discussion of identifying assets outside crypto, use asset tracing. Recognition and execution across countries belong to cross-border asset recovery; bank-specific restraints belong to bank account freeze procedure. Here the question is narrower: which link in the digital evidence chain supports which legally enforceable request?

What should a client supply, and what should a legal assessment deliver?

A useful initial dossier contains (1) the claimant's lawful acquisition records; (2) the precise network, asset and transaction identifiers; (3) time-stamped account statements and withdrawal notices; (4) complete relevant communications, including purported recovery-agent contacts; (5) an existing tracing report with methodology and data provenance; (6) exchange support correspondence and any police reference; and (7) known defendant, exchange or custody jurisdictions. Do not send seed phrases, passwords, private keys or remote wallet access to a purported adviser.

The first legal work product should be an evidence-gap schedule: established facts, inferences, disputed identity, available preservation targets and who needs to supply missing information. Next should come a jurisdiction and service note naming the proposed court or authority, respondent legal entity, candidate claim, evidence required, urgency, possible undertakings, expected enforcement obstacle and material cost exposure. A reasoned recommendation may be to pursue targeted disclosure, seek an injunction through appropriately qualified local counsel, report to law enforcement, negotiate with an identifiable operator, or stop because the available evidence or assets do not justify litigation.

Engagement scope needs to be explicit. Document review, strategy, coordination with experts and referrals are not the same as a right to appear in a foreign court. Any local advocate's participation and authority must be confirmed before representing that proceedings can be filed. Costs, adverse-costs exposure and the risk of financing proceedings that cannot yield enforceable recovery should be considered before urgent litigation starts.

What should happen immediately, and which promises are warning signs?

As a practical priority—not a statutory countdown—secure remaining wallets and accounts using trusted channels, preserve original evidence, notify the relevant platform through its verified fraud route and make a report to the competent law-enforcement body. In England, Wales and Northern Ireland, Report Fraud accepts fraud and cybercrime reports; in Scotland the police route differs. Reporting does not automatically open a civil claim, result in a freeze or put the victim first in any compensation process. If a court application is contemplated, preserve evidence in a form capable of independent verification and avoid alerting an alleged wrongdoer where that could undermine a lawful application; the decision about notice belongs to the court.

Be suspicious of anyone who promises guaranteed recovery, asks for an advance “unlocking tax”, claims privileged access to a blockchain reversal function or requests wallet credentials. A purported screen showing an account balance does not establish recoverable assets. Demand a clear description of what is known, who actually controls the property, which competent authority could act and what would make the proposed route fail. A careful negative assessment can save further loss.

For a confidential assessment of existing transaction evidence, the relevant custodians and possible jurisdictions, submit a concise chronology through the legal consultation request. This page is general information, not advice on a particular case or an assurance of representation or recovery.