A fake OTC desk: can the funds be traced and frozen?

On paper, the money is gone. On-chain, it is still moving – and movement leaves a trail.

A fake over-the-counter desk steals funds through a structured confidence scheme: the victim transfers crypto expecting a settlement, and the operator walks away. But the theft does not erase the blockchain record. On-chain tracing, disclosure orders against virtual-asset service providers, and urgent freezing applications have – in the right circumstances – stopped further dissipation and recovered a portion of what was lost. Speed is the defining variable. Every hour of delay is a choke point the fraudster closes.

This analysis examines how fake OTC fraud works, where the trail leads, which legal instruments apply, and where the recovery path genuinely breaks down.

What Is a Fake OTC Desk and Why Does It Work?

A fake over-the-counter desk mimics a legitimate wholesale crypto trading venue to gain trust and extract a large transfer. Understanding the mechanics is the first step in understanding what can be traced.

Legitimate OTC desks offer volume traders a way to settle large crypto positions without moving the visible market. They provide direct settlement, privacy, and speed. The fraudulent version copies every surface feature: a professional-looking portal, responsive account managers, competitive quoted rates, and a credible-seeming settlement process. The victim transfers funds – often a significant block of bitcoin, ether, or a dollar-denominated stablecoin – expecting settlement in a different asset or a corresponding bank transfer. Neither arrives.

What makes the scheme effective is the delay it builds in. Legitimate OTC trades do not settle instantly. Fraudsters use this expectation to buy hours – sometimes days – before the victim realises the counterparty has disappeared. By then, the receiving wallet has already swept the funds to a second or third address.

The victim's instinct, at that point, is that the money is untraceable. That instinct is understandable. It is also, in many cases, wrong.

Public blockchains record every transaction in a permanent, publicly readable ledger. The fraudster controls which wallets receive the funds; they do not control whether those movements are visible. The trail exists from the moment of transfer. What determines recoverability is how quickly it can be followed, and what choke points it passes through.

How Does On-Chain Tracing Work After a Fake OTC Theft?

On-chain tracing reconstructs the movement of funds from the victim's wallet, through intermediary addresses, to the point where the fraudster attempts to convert the proceeds to fiat or to a more liquid asset.

The starting point is the transaction hash of the victim's outbound transfer. From there, blockchain-analytics tools apply wallet clustering and attribution techniques to group addresses controlled by the same actor and to identify whether any of those addresses have been used at a regulated venue. Wallet clustering and attribution can, in well-documented cases, establish a probable link between an anonymous address and a named account at a centralised exchange or VASP within hours of the theft.

In our experience, fake OTC operators follow one of three broad patterns once funds arrive:

• Immediate sweep through a chain of intermediate wallets – sometimes five to fifteen hops – before depositing at an exchange. This is the most common pattern in high-value OTC fraud.
• Conversion to a privacy-enhanced token or coin, which breaks the direct trail and forces the analyst to reconstruct through input clustering and graph-based inference.
• Cross-chain bridge transfer to a different network before cash-out. The bridge transaction is visible on both sides of the transfer, but the time window for intervention narrows sharply.

Each pattern leaves different artefacts. The first is the most amenable to legal process: a deposit at a centralised exchange triggers know-your-customer obligations, and the exchange holds identity data that a disclosure order can compel it to produce. The second and third require more technical reconstruction but do not make tracing impossible.

What tracing does not do is identify the fraudster with certainty on its own. It produces a probability chain: address A controlled by the same actor as address B, address B deposited at exchange C, exchange C holds KYC data for the account that received the deposit. Legal process turns that probability chain into usable evidence.

For a broader grounding in how crypto asset recovery works after a theft, our Crypto Asset Recovery resource hub covers the full range of instruments and methodologies.

Which Legal Instruments Can Freeze or Expose the Funds?

Three categories of legal instrument are relevant to fake OTC fraud: disclosure orders to identify the fraudster and trace the asset, freezing orders to prevent further movement, and enforcement mechanisms to convert a court order into actual recovery.

The most immediately powerful tool is a freezing order combined with a disclosure order, applied without notice to the defendant. Courts in common-law jurisdictions with well-developed crypto recovery practice have granted proprietary injunctions against "persons unknown" – including wallet addresses identified only by their on-chain reference. A proprietary injunction of this kind can be applied for without naming an identified defendant, which is critical when the fraudster's identity is not yet established. The order reaches the asset – the funds themselves, treated as property held on constructive trust for the victim – rather than waiting for a named respondent.

Where the funds have reached a centralised exchange or other regulated VASP, two further instruments become available. A Norwich Pharmal order compels the VASP to disclose the identity and account information of the person who deposited the funds. A Bankers Trust order compels disclosure of account history for tracing purposes. Together, they convert the on-chain probability chain into legally admissible identity evidence – and they can be obtained quickly, typically within days of the application.

In stablecoin cases, a further option exists that has no equivalent in traditional finance. Stablecoin issuers can, on appropriate legal process, freeze specific token balances at the contract level – without requiring the co-operation of any exchange or wallet provider. If the stolen funds remain in a major stablecoin at the point of an urgent application, this is often the fastest available intervention.

Chabra relief – a freezing order against a third party who is not the primary wrongdoer but holds assets that are, or may be, the proceeds of the fraud – is relevant where the funds have been moved to an associate's wallet or a complicit intermediary. Courts have extended this relief into the crypto context.

In our experience, the decision about which instrument to prioritise depends on three factors: where the funds are sitting at the moment of application, which forum has jurisdiction over the VASP or exchange that holds the deposit, and how much time has elapsed since the theft.

What Are the Realistic Obstacles to Recovery?

Honest analysis requires examining where the recovery path breaks down. There are four common failure points.

Delay. This is the most preventable obstacle and the most common one. Fake OTC operators move funds quickly and in multiple hops precisely to exploit the window between the victim realising the fraud and a court issuing relief. By the time many victims seek legal advice – sometimes days or even weeks later – the funds have exited every regulated venue and sit in cold storage or have been converted through peer-to-peer or privacy-enhanced routes. There is no legal instrument that overcomes a cold trail.

Jurisdictional complexity. The VASP holding the account may be incorporated in one jurisdiction, regulated (or not) in a second, and operated from a third. Serving an exchange with a disclosure order or a freezing application requires a court in the right forum. If the receiving venue is not subject to the jurisdiction of any court willing to grant rapid relief, the order cannot reach it. We regularly advise clients on how to assess which forum offers the most usable combination of speed, recognition by the VASP, and enforceability.

Privacy-enhanced movement. Where the fraudster has moved the funds through a privacy coin or a mixer before cash-out, the on-chain trail becomes more difficult to follow. Blockchain-analytics tools have made significant progress in these areas, but they do not resolve every case. Partial tracing – sufficient to establish a probable link but not a provable one – may not support the threshold required for interim relief in a particular forum.

Non-cooperative VASPs. Not every exchange responds promptly or in good faith to legal process. Unregulated venues have no compliance obligation. Even regulated exchanges in some jurisdictions move slowly, requiring local proceedings rather than accepting foreign orders. This is where the choice of forum for the primary application matters enormously.

None of these obstacles is a reason not to act. Each is a reason to act faster and with specialist input.

Cross-Border Choke Points: Where Do Fake OTC Funds Usually Flow?

Fake OTC fraud is almost never a single-jurisdiction event. The victim is typically in one country; the fraudster operates from another; the receiving exchange is incorporated in a third; and the funds may pass through a bridge or mixer that is not specifically located anywhere. For a claimant chasing funds across two or more legal systems, the hard part is not the claim – it is timing.

In our experience, fake OTC operators prefer exchange venues that combine high liquidity with inconsistent or slow regulatory co-operation. The deposit may arrive at a centralised exchange that is technically regulated but sits in a jurisdiction with no effective mutual legal assistance treaty with the victim's home country. The victim's domestic lawyer may spend weeks navigating letters of request – a formal mechanism for cross-border judicial co-operation – while the funds move on again.

The most effective approach is to identify the jurisdiction where the exchange holds assets or operates a regulated entity and make the primary application there, using local counsel. This may not be the victim's home country. It may not even be the country where the fraud was marketed. The question is: which forum can issue binding process on the venue fastest?

Where the funds have crossed into a blockchain network that is favoured for obfuscation – or where the destination VASP is genuinely unregulated – the on-chain trail may still lead to a secondary exchange where the fraudster eventually converts to fiat. Fraudsters need to exit crypto at some point. That exit is almost always a choke point.

Anti-suit injunctions are available in some forums to restrain a defendant from pursuing proceedings in a parallel jurisdiction that would interfere with the recovery – for example, where the fraudster attempts to challenge a disclosure order in a friendly venue. These are less common in crypto matters, but the option exists where the defendant is identified and has assets worth protecting.

For clients who have lost funds through a cross-chain or peer-to-peer mechanism, our analysis of how to recover stolen TRON illustrates how chain-specific choke points can still be reached with the right combination of on-chain tracing and targeted legal process.

The steps above cover the most common recovery patterns. Your matter turns on specific facts – where the funds went, how fast they moved, and which forums can act before the trail goes cold. A confidential case review tells you whether it is worth pursuing.

To assess the viability of tracing funds lost to a fake OTC desk, contact info@axiomtracel.com.

How Should the Recovery Be Structured: Two Positions in Tension

Practitioners in cross-border recovery do not always agree on the optimal sequencing of legal and forensic steps after a fake OTC fraud. There are two positions, each with legitimate grounding.

Position A: trace first, litigate second. This view holds that applying for relief before the on-chain trail is fully reconstructed risks exposing the strategy to the defendant, triggering further movement, and wasting court time on an insufficient record. The better course, on this view, is to complete a full tracing analysis – including exchange attribution and cross-chain reconstruction – before any application is made. The result is a cleaner application with a higher probability of success.

Position B: litigate and trace simultaneously, with speed as the priority. This is the position we more commonly adopt in practice. Fake OTC operators are experienced at moving funds quickly. Waiting for a complete tracing report before making any application may mean the funds have already exited every regulated venue. The wiser approach is to make a without-notice application for a proprietary injunction and a disclosure order on the strength of the initial on-chain evidence – which may only require the transaction hash, the destination address, and an expert statement on the probability of exchange attribution – while tracing continues in parallel. The disclosure order from the exchange then confirms or redirects the attribution.

The right answer depends on the facts. Where the funds are moving rapidly and the exchange attribution is already clear from the initial tracing, Position B is correct. Where the trail is already partly cold and the fraudster is likely to have exited regulated venues, a more deliberate Position A approach – focused on building a complete evidential picture before applying – may produce a stronger result in enforcement.

A third consideration is budget. Tracing and litigation are not free. The ratio of likely recovery value to recoverable costs is a legitimate and important part of case assessment. We have traced matters in the Gulf, in autumn 2024, involving funds in the high six figures where the cost-to-value ratio supported full litigation; we have also advised clients, honestly, that the expected recovery – given the state of the trail – did not justify the cost. That is not a failure of the process. It is the process working correctly.

The decision matrix in practice looks like this:

• Funds still in a stablecoin at a regulated exchange → without-notice proprietary injunction and stablecoin issuer freeze simultaneously; this is the fastest and most powerful combination.
• Funds converted to a major liquid asset and sitting at a centralised exchange → without-notice injunction plus Norwich Pharmal order to the exchange; parallel tracing to confirm attribution.
• Funds moved through a bridge or privacy mechanism but with probable exit at a second-order exchange → tracing analysis to establish the secondary deposit; application to the forum with jurisdiction over the secondary exchange.
• Funds in cold storage with no evident path to a regulated venue → enforcement depends on identifying the defendant through other means (corporate records, IP logs, communication metadata) before any legal process can reach the asset.

Micro-Cases: What Recovery Looks Like in Practice

The following are anonymised illustrations. They are not specific cases and contain no identifying information.

A matter in Southeast Asia, spring 2024, involving funds in the mid-seven figures. A corporate treasury transferred bitcoin to an OTC desk for a purported settlement. The settlement did not arrive. On-chain tracing, begun within hours, showed the funds moving through eleven intermediate addresses before depositing at a centralised exchange. An urgent without-notice application produced a proprietary injunction and a disclosure order within three days. The exchange froze the account. The identity disclosed led to a named defendant in a jurisdiction with a functioning mutual legal assistance regime. Enforcement proceedings were commenced. The outcome remained contingent on the defendant's co-operation and the speed of local proceedings – but the asset was frozen rather than spent.

A matter in Western Europe, winter 2023, involving funds in the high six figures in a major stablecoin. The victim transferred the stablecoin to an address presented as belonging to an OTC settlement account. Within twenty minutes the funds had moved twice. Tracing identified a high probability of attribution to an account at a regulated exchange in a common-law jurisdiction. A concurrent application to the stablecoin issuer and to the relevant court produced a contract-level freeze of the balance still traceable to the original transfer, and a proprietary injunction over the exchange account. Part of the funds had already been converted and withdrawn; the balance that remained in stablecoin form was recoverable in principle. Litigation to enforce against the identified defendant was ongoing.

Neither outcome was certain at the point of application. Both required speed, a clear on-chain trail, and co-operation from the relevant exchange. Both also required the victim to instruct recovery counsel within a timeframe measured in hours, not days.

What Is the Honest Assessment of Recoverability?

This is the question every victim deserves a direct answer to – and one that many recovery operators, including fraudulent ones, answer dishonestly.

Recoverability depends on four variables, in roughly this order of importance:

• Speed of engagement. A trail that is followed within hours may lead to a live exchange deposit. The same trail, followed after a week, may lead only to empty wallets.
• Quality of the on-chain evidence. A direct, single-hop transfer to a major regulated exchange is the most tractable case. A multi-hop movement through a mixer before a cross-chain bridge is the hardest.
• Forum availability. If no court in any jurisdiction that the victim can access has power to compel the relevant exchange to act, the legal pathway is blocked regardless of how strong the tracing evidence is.
• Defendant solvency and co-operation. Even a freezing order and a judgment in the victim's favour do not guarantee that the defendant has assets from which a judgment can be satisfied.

The myth worth addressing here is a persistent one: that once crypto leaves a wallet, nothing can be done, and that anyone claiming otherwise is running a recovery scam. This conflates two separate things. It is true that recovery scams are common – a second-wave fraud targeting people who have already been defrauded, promising to retrieve funds for an upfront fee and delivering nothing. Victims should be alert to that pattern.

But the conclusion that nothing can be done in a real case is false. The instruments described in this analysis – proprietary injunctions, Norwich Pharmal orders, stablecoin freezes, disclosure orders against VASPs – are used by real courts in real proceedings with real outcomes. The difference between a legitimate recovery practice and a recovery scam is not that one promises to succeed; it is that a legitimate practice is honest about the conditions under which recovery is possible and does not collect fees in exchange for a promise it cannot keep.

Our asset tracing service sets out exactly how we approach a mandate: what we do, what we cannot do, and what the client needs to bring to make tracing viable.

For a confidential read on whether funds lost to a fake OTC desk are recoverable, request a case review at info@axiomtracel.com.

Related Resources

• Crypto Asset Recovery – resource hub: an index of tracing methodologies, freezing instruments, and on-chain recovery guides across our digital asset practice.
• Asset Tracing Service: how Axiom Trace conducts follow-the-money analysis from payment instruction to cash-out point, in crypto and traditional finance.
• How to Recover Stolen TRON: a chain-specific guide to on-chain tracing, exchange choke points, and freezing applications for TRON-based theft.

Frequently Asked Questions

Q: Can stolen crypto really be traced and frozen?

A: Yes – with conditions. Public blockchains record every transfer, so on-chain tracing can follow funds from the victim's wallet through intermediate addresses to a regulated exchange or virtual-asset service provider. At that choke point, a disclosure order and a proprietary injunction can freeze the account and compel identity disclosure. The process works when the trail is followed quickly and the funds have passed through a regulated venue. It is not guaranteed, and it is not instantaneous.

Q: How quickly do I need to act after a crypto theft?

A: Speed is the single most important variable. Fraudsters move funds in minutes and aim to exit every regulated venue before legal process can reach them. In our experience, matters where the victim engaged recovery counsel within hours – rather than days or weeks – had significantly better access to on-chain choke points. If you have just discovered a theft, the priority is to capture the transaction hash, preserve all communications with the fake desk, and seek specialist advice immediately. Do not wait for a conventional lawyer referral cycle.

Q: How is a real recovery specialist different from a recovery scam?

A: A recovery scam – a second-wave fraud targeting people who have already been defrauded – typically approaches the victim unsolicited, promises a high or guaranteed recovery rate, and requests an upfront fee before any work is done. A legitimate recovery practice does the opposite: it assesses the matter honestly, tells the client clearly when the facts do not support the cost of proceedings, and structures fees in a way that aligns with the work performed. No legitimate specialist promises a guaranteed outcome. Crypto asset recovery depends on specific facts, and any operator who claims otherwise is not offering legitimate services.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and co-ordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In our experience, the difference between a recoverable and an unrecoverable matter is usually time and the quality of the initial tracing. We have traced funds from fake OTC fraud, investment scams, and insider theft across multiple jurisdictions and on-chain environments. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.