A rug pull: can the funds be traced and frozen?

On-chain, the money left within minutes. The liquidity pool drained, the developers vanished, and the token price collapsed to zero. If you are reading this, you have probably just watched it happen – or you are advising someone who has. The instinct is to assume the funds are gone. That instinct is wrong, and acting on it too quickly costs you the window to do something about it.

Rug pull funds can, in a meaningful number of cases, be traced and – where they reach an identifiable choke point – frozen. Public blockchains are transparent: every transfer is recorded, and on-chain tracing tools can follow proceeds from the exploit wallet through mixing steps and bridging transactions to the point where the perpetrators attempt a cash-out. At that cash-out point, legal instruments including a freezing order over digital assets and a disclosure order against a virtual-asset service provider (VASP) become available. Speed and the quality of the initial trace determine whether those instruments arrive in time.

This guide walks through the tracing and freezing process step by step: what to preserve first, how on-chain tracing works, where the legal choke points are, what cross-border friction looks like, and how to assess whether your matter is worth pursuing.

Why Speed Is the Only Variable You Control

The most important decision you make in the first 24 hours is whether to act or wait. Waiting is almost always the wrong choice. In our experience, proceeds from a rug pull typically move through multiple wallets and across at least one bridge within hours of the event. Each hop adds complexity; each bridge crossing changes the asset's apparent origin chain and can fragment amounts into patterns that require more analytical work to reassemble.

As of early 2026, the largest centralised exchanges apply know-your-customer checks that create a durable link between a wallet address and a verified identity. That link is the recovery practitioner's primary target. But exchanges are not under a legal obligation to freeze funds voluntarily – they require court process. Court process requires evidence. Evidence requires a trace. A trace requires time. Every day you delay, the funds move further from the exploit wallet and closer to a jurisdiction or mixing service where the trace becomes harder to close.

Speed is honest here: it is not a sales argument. Dissipation – the deliberate movement of assets to defeat a potential claim – is the single biggest reason rug pull recoveries fail. Time is not on your side, but it has not run out yet.

What can you do right now? Three things: preserve evidence, start an on-chain trace, and take legal advice on interim relief. This guide covers all three.

Step 1: Preserve Everything Before You Do Anything Else

Before you contact anyone, screenshot and export every record you have. Courts and solicitors operating at speed need evidence they can put in front of a judge at short notice – and evidence you have not yet saved may disappear when the project's social channels go dark.

Preserve, in this order:

• Your wallet transaction history, exported in full, with timestamps and transaction hashes
• Every communication from the project: Telegram announcements, Discord messages, the project's own website (archive it using a web-archive tool), and any direct messages with team members
• The token contract address, the liquidity pool contract address, and any deployer wallet addresses you can identify
• All records of how you acquired your tokens: exchange deposits, bridge transactions, and any KYC documentation you submitted to any platform involved
• Marketing materials, whitepaper, and roadmap documents – these become relevant if the matter proceeds to fraud litigation

Do not move your remaining assets to a new wallet before taking advice. In some matters, the movement of assets after the event – even your own – has complicated tracing and created unnecessary questions in subsequent proceedings. Take advice first.

A confidential case review tells you what evidence matters most for your specific chain and token structure. Our crypto recovery insight hub sets out the broader context for digital asset tracing and freezing.

How Does On-Chain Tracing Actually Work?

On-chain tracing is the process of following funds from the exploit wallet, hop by hop, until they reach an identifiable endpoint. Public blockchains record every transaction permanently; the challenge is not finding the data but interpreting it at volume and across chains.

In a typical rug pull, the deployer wallet drains the liquidity pool into a single address they control. From there, proceeds commonly move through one or more of the following patterns:

• Layering through intermediate wallets – small and irregular amounts sent to addresses with no prior history, intended to fragment the trail
• Cross-chain bridging – assets moved from the exploit chain (often an EVM-compatible chain) to another chain such as a Bitcoin-adjacent protocol or a higher-anonymity network
• Conversion to a stablecoin – converting volatile token proceeds into a USD-pegged stablecoin on a decentralised exchange, before attempting to move value off-chain
• Cash-out via a centralised exchange – depositing into a VASP that has KYC records, which is the point at which legal process becomes directly effective

Blockchain-analytics tools cluster wallets by shared behaviour patterns and known-entity tags. A wallet that receives proceeds from your exploit and subsequently deposits into a tagged exchange address is a target for a disclosure order. That order compels the exchange to identify the account holder. The identity, once obtained, supports a freezing application.

What on-chain tracing cannot do: it cannot, by itself, freeze anything. The trace is evidence. Legal instruments do the freezing. That distinction matters because victims sometimes pay for tracing services that stop at the report stage – at which point, without legal follow-through, the money remains accessible to the perpetrators.

Where Are the Legal Choke Points – and Do They Work Across Borders?

Choke points are the moments where traceable on-chain movement intersects with an identifiable, legally reachable actor. They are where legal instruments can interrupt the dissipation. Three choke points appear consistently in rug pull matters: the centralised exchange deposit, the stablecoin balance, and the fiat off-ramp.

The centralised exchange deposit. When proceeds reach a VASP operating in a regulated jurisdiction, a disclosure order can compel that VASP to identify the depositing account. This is the most common recovery pathway in our experience. A freezing order over digital assets can follow, preventing withdrawal while proceedings are commenced.

The stablecoin balance. Certain stablecoin issuers have the technical ability to freeze specific token balances on appropriate legal process. Stablecoin freezing via VASPs is a developing but increasingly used tool. It requires identifying the specific token contract and balance, then obtaining or coordinating the legal process that triggers the issuer's freeze function. Speed here is critical: balances can be bridged or converted in minutes.

The fiat off-ramp. If proceeds reach a bank – through a VASP's settlement account or a peer-to-peer transfer – a Bankers Trust order can compel the receiving bank to disclose account details. A domestic or worldwide freezing order can then be sought against the account holder.

The cross-border dimension complicates each of these. A VASP registered in one jurisdiction, a defendant apparently located in a second, and a claimant in a third creates a multi-forum problem. A freezing order obtained in one court may need recognition in another before it binds local actors. A worldwide freezing order can, in principle, reach assets outside the forum in which it is granted – subject to conditions and safeguards imposed by that court. In our experience, the choice of the lead forum should be driven by where the most identifiable assets sit, not by where the victim is located.

Anti-suit and anti-dissipation tools are also available in some forums for defendants who are known, or who can be identified through the disclosure phase. Where defendants are unknown, a proprietary injunction against "persons unknown" – an instrument that courts in several common-law jurisdictions have granted in crypto matters – is an alternative route to an early freeze without naming the perpetrator.

What Does a Viable Recovery Mandate Look Like?

Not every rug pull is recoverable. The honest assessment depends on four variables.

Is the trace closeable? A trace that ends at a high-anonymity mixing service with no onward VASP deposit may not yield an identifiable target in a recoverable timeframe. A trace that reaches a KYC-compliant exchange within two or three hops of the exploit wallet is materially more promising. This varies significantly with the sophistication of the perpetrators and the chains they use.

Is the amount sufficient to justify the cost of proceedings? Cross-border crypto recovery involves legal fees, investigative costs, and potentially multiple sets of local counsel. These are real costs. The arithmetic has to work. We do not encourage clients to pursue matters where costs are likely to outweigh realistic recovery – and any specialist who promises recovery without first discussing costs should be treated with scepticism.

Can an identifiable defendant be reached? Legal process needs a target. Where KYC records are obtainable, a human or corporate identity can be attached to the exploit wallet. Where the perpetrators operated entirely through anonymous structures and non-KYC venues, the defendant identification problem is harder – though not always insurmountable.

Is the forum reachable within the available time? Courts in recovery-friendly jurisdictions can move quickly on urgent interim applications – measured in hours to days, not weeks – but that speed requires complete, well-prepared evidence at the point of filing. If the tracing report is not ready, the application cannot be made. This is another reason the trace must start immediately.

Our asset tracing service combines on-chain analysis with legal coordination from the first day of a mandate – precisely because the trace and the legal strategy must develop in parallel, not in sequence.

Can a Rug Pull Matter Be Pursued Across Multiple Jurisdictions?

Almost certainly, yes – and almost certainly, it will have to be. Rug pull perpetrators rarely operate from a single jurisdiction, and the VASPs, exchanges, and banks that hold their funds may be regulated in several countries simultaneously.

Multi-forum strategy means selecting one lead forum where interim relief is obtained first, then coordinating recognition and enforcement in any secondary forum where assets are physically located or where a VASP must be compelled to act. The New York Convention does not apply to court judgments in fraud matters – that instrument governs arbitral awards – but the recognition and enforcement of foreign judgments under domestic rules and bilateral treaties remains an available route for most common-law and many civil-law forums.

Letters of request are the tool for extracting evidence from foreign jurisdictions where a court has no direct compulsion power over a foreign-based VASP. Functionally equivalent to what practitioners in some jurisdictions describe as discovery assistance from foreign courts, a letter of request asks a foreign court to compel a local bank or exchange to produce records. The process takes weeks rather than hours. That is why the primary VASP disclosure and freezing applications must be made in the jurisdiction where the VASP operates, not through a letters process from the claimant's home court.

In our experience, matters with a cross-border element require allied counsel in each relevant jurisdiction to act on the ground. Coordination between those teams – on timing, on the form of orders, and on the sequencing of applications – is where multi-forum rug pull recovery is won or lost. Getting the sequencing wrong can tip off a defendant, allow assets to move again, or produce a freezing order in a forum that cannot practically reach the target assets.

Avoiding Second-Stage Scams: A Warning You Should Read Now

Recovery scams target rug pull victims with particular aggression. The pattern is consistent: within days of a visible exploit, accounts posing as recovery specialists contact victims – often through the same Telegram or Discord channels where the original project operated – and promise to recover funds for an upfront fee. Some use sophisticated websites and fake testimonials. No legitimate recovery specialist charges an upfront fee and promises a specific outcome.

The myth this plays on is the same myth that recovery scams exploit in every asset class: that the money is already gone, so any chance of getting something back is worth pursuing on whatever terms are offered. That thinking leads to a second loss on top of the first.

What distinguishes a real specialist? Transparency about costs and process; an honest assessment of whether the matter is viable before any engagement; no promise of a specific recovery rate or amount; and verifiable, conflict-checked engagement terms. We decline matters we do not believe are realistically recoverable – and we say so at the case review stage, before costs are incurred.

If you have already been approached by a recovery operator whose terms made you uneasy, that instinct deserves attention. A second opinion costs nothing but time.

Frequently Asked Questions

Q: Can stolen crypto really be traced and frozen?

A: Yes, in a meaningful number of cases. Public blockchains record every transaction permanently, and blockchain-analytics tools can follow proceeds from an exploit wallet to the point where assets reach a centralized exchange or stablecoin balance accessible through legal process. At that point, a freezing order over digital assets or a disclosure order against a virtual-asset service provider can interrupt dissipation. The outcome depends on how quickly the trace is started and whether proceeds reach an identifiable, legally reachable choke point before they are further dispersed or mixed.

Q: How quickly do I need to act after a crypto theft?

A: Immediately. In our experience, proceeds from a rug pull move through several wallets within hours of the event. Each hop adds complexity; each bridge crossing changes the apparent origin chain. Courts in recovery-friendly jurisdictions can hear urgent interim applications within hours to days of filing – but only if a tracing report is ready and the evidence is complete. Waiting to see whether the developers reappear, or hoping the exchange will act voluntarily without legal process, almost always narrows your options. The first 48 hours are not a period for caution; they are the window in which the recovery path is either kept open or closed.

Q: How is a real recovery specialist different from a recovery scam?

A: A genuine specialist will not promise a specific outcome, will not charge a large upfront fee before conducting any analysis, and will give you an honest assessment of whether your matter is worth pursuing before engagement. Recovery scams typically promise guaranteed or high-probability recovery, create urgency to close the engagement quickly, and disappear after the upfront payment is made. A real specialist's first obligation is to tell you the truth about viability – including if the answer is that the matter is not realistically recoverable at proportionate cost. If a firm's first communication is a promise rather than a question, that is the signal to disengage.

Related Topics in Crypto Asset Recovery

• Crypto Asset Recovery – insight hub: the full range of on-chain tracing, VASP choke points, and freezing strategies for digital assets.
• Asset Tracing Service: how Axiom Trace combines forensic investigation and legal coordination from day one of a mandate.
• Freezing Stablecoins via VASPs: a detailed look at stablecoin freeze mechanisms and the legal process required to trigger them.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel in the relevant jurisdiction where proceedings must be filed. In our experience, the matters that succeed are those where tracing and legal strategy begin simultaneously – not sequentially. We have traced rug pull proceeds through bridging transactions, multi-hop wallet chains, and cross-chain conversions to cash-out points that legal process could reach. To discuss a matter confidentially, contact info@axiomtracel.com.

If funds have already moved, time matters – request a confidential case review at info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.