Attribution disputes: proving who controls a wallet

A payment leaves a wallet in seconds. By the time the victim recognises the loss, the funds may have crossed three chains, entered a mixing protocol, and arrived at an address registered to nobody. That is the first problem. The second problem – the one that matters in court – is different: who controls that address? Attribution disputes arise at precisely that junction: when on-chain tracing has followed the money to a wallet, but the identity behind the wallet is contested.

Attribution in crypto asset recovery means connecting a blockchain address to a person or entity with sufficient rigour to satisfy a court. The process draws on on-chain tracing, off-chain intelligence, and legal disclosure tools – primarily a Norwich Pharmal order or a Bankers Trust order directed at a centralised exchange. Attribution is rarely a single step; it is a layered argument, and it is almost always disputed by the other side.

This analysis sets out how attribution works, where it fails, and what the contrasting positions look like in practice – from the claimant's first trace to a contested freezing application and beyond.

Why attribution is the central battleground in crypto recovery

On-chain tracing can establish that stolen funds moved from wallet A to wallet B. The hard evidential question is not where the money went – it is who sat behind wallet B when it moved. That distinction is why attribution is contested in almost every defended crypto matter we handle.

A blockchain address is, by default, pseudonymous. The protocol records transactions without recording names. A claimant can show a flow of funds across dozens of hops and still face a defendant who says: the address belongs to someone else; I have no connection to it; the attribution methodology is unreliable. Courts have been willing to grant freezing relief and disclosure orders on the basis of attribution evidence, but that evidence is scrutinised. Every element of the attribution chain is a potential attack point.

The stakes are high on both sides. For the claimant, a failed attribution means no freezing order, no recovery, and a defendant who is free to move remaining assets. For an innocent third party incorrectly attributed, a freezing order can lock legitimate funds and cause serious commercial harm. Getting attribution right – and being able to defend it – is the practical core of crypto asset recovery.

As of early 2026, the volume of contested attribution evidence in litigation has increased markedly. Courts in several common-law jurisdictions are developing clearer expectations about what methodology is required and how it should be presented. The environment is not settled, but the direction is towards greater scrutiny, not less.

What does "attribution" actually mean on-chain?

Attribution, in its simplest form, means clustering blockchain addresses into groups that are controlled by the same entity, then matching that cluster to an identified person or organisation. The two steps are distinct and both must hold for attribution to be legally useful.

The first step – clustering – relies on heuristics observed in how blockchains work. One common heuristic is that addresses appearing together as inputs in a single transaction are likely controlled by the same entity, because only the holder of all relevant private keys can construct such a transaction. A second heuristic looks at the use of change addresses – the way residual value is returned to a wallet after a transaction. Blockchain-analytics tools apply these heuristics at scale, producing clusters of addresses that are probabilistically controlled by the same party.

The second step – identification – moves from a cluster to a name. This typically happens at the edge of the on-chain world: where funds are deposited to a centralised exchange, where they are converted to a fiat currency, or where they touch an identified service provider. A VASP's know-your-customer records are the most common identification bridge, accessed via legal process rather than technical means. In our experience, the identification step is the one that fails when attribution falls apart in court.

There is a third, often overlooked layer: timing and behavioural analysis. The pattern of transactions – the hour of day, the chain of hops, the choice of mixing or bridging tool, the sequence of conversion – can corroborate or undermine an attribution claim. A defendant who argues they never controlled an address faces a harder task when the timing of transactions aligns precisely with other activity linked to them.

Where does attribution evidence come from?

Attribution evidence arrives from three sources: the blockchain itself, third-party services, and legal compulsion. Each source has a different evidentiary weight and a different vulnerability to challenge.

The blockchain record is the most durable. It is public, immutable, and independently verifiable. Any expert can examine the same transactions from the same public ledger. That gives the on-chain element of attribution a degree of reliability that off-chain evidence cannot match. But the blockchain alone rarely proves identity. It proves movement.

Third-party services – blockchain-analytics tools – apply clustering and labelling to the raw chain data. Some labels are derived from the heuristics described above. Others come from proprietary intelligence: deposit addresses that an exchange has voluntarily shared, addresses linked to known scam operations, or addresses from prior investigations that have been identified by court order. The reliability of a specific attribution label depends entirely on how that label was originally established. A claimant who relies on a labelled cluster without understanding how the label was generated is exposed to a straightforward cross-examination on methodology.

Legal compulsion is the third source. A disclosure order directed at a VASP or centralised exchange can compel the production of KYC records, transaction histories, and IP address logs linked to a particular account. A Norwich Pharmal order, made without notice to the defendant to prevent asset movement, is the standard instrument here. A Bankers Trust order, where a bank rather than a VASP holds the relevant records, operates on the same logic. The information obtained by these orders converts pseudonymous attribution into identified attribution – and that is the moment when a recovery action typically becomes viable.

How quickly should you move to obtain disclosure? The answer matters. A VASP that receives a voluntary request from a claimant (without legal process) is under no obligation to preserve records. A court order changes that. In our experience, the window between a theft and the deletion or transfer of exchange records is measured in weeks, not months.

The contrasting positions: how attribution is challenged

Every contested attribution case has a predictable structure. The claimant argues: the funds left the victim's wallet, followed a traceable path, and arrived at an address that the defendant controlled. The defendant argues one or more of the following.

First position: the clustering methodology is unreliable. Common-input heuristics are not always correct. Coinjoin transactions deliberately break the heuristic. Privacy wallets, mixing protocols, and certain multi-signature arrangements can produce false positives. A defendant with technical resources will retain an expert to say that the chain of attribution contains at least one step that does not hold under scrutiny. If that step is the one that places the defendant in the picture, the case collapses.

Second position: the identification bridge is broken. Even if the cluster is correctly formed, the link between the cluster and the defendant may be weak. A VASP account may have been registered in the defendant's name but operated by a third party. KYC documents may have been falsified. An IP address may have been masked by a VPN or Tor. The defendant says: that account was opened fraudulently using my identity; I had no control over it.

Third position: the attribution evidence is tainted. Where attribution relies on proprietary labels from a third-party tool, the defendant may argue that those labels were derived from an earlier investigation that was itself unreliable, or from a jurisdiction where the underlying process would not be admissible in the forum hearing the claim. This is a sophisticated but increasingly common challenge.

Fourth position: the funds attributed are not the stolen funds. Mixing and chain-hopping create genuine uncertainty about which specific units of value arrived where. A defendant who received funds from a mixer may argue that those funds cannot be shown to be the stolen proceeds rather than legitimate deposits to the same address. Courts have approached this differently across jurisdictions – some applying a form of aggregated or blended tracing, others requiring a cleaner chain.

For a claimant, each of these positions requires a pre-emptive response, built into the attribution methodology from the outset. Addressing them after the fact, in contested proceedings, is harder and slower.

How courts approach attribution evidence – and what they expect

Courts in common-law recovery hubs have accepted blockchain-analytics evidence as a basis for granting interim relief, including proprietary injunctions and worldwide freezing orders. A freezing order or a proprietary injunction against persons unknown has been granted in crypto matters where the defendant's identity was not yet known at the time of application. That is significant: attribution does not have to be complete before relief can be obtained. But it must be sufficient to satisfy the forum's threshold for interim relief.

What does "sufficient" mean in practice? Courts generally expect: a coherent explanation of the methodology; an honest account of the assumptions and their known limitations; independent verifiability of the core on-chain data; and a clear statement of what the claimant does not yet know and how they propose to find it out (typically by way of a disclosure order against a VASP). An application that presents attribution as certain, when the methodology contains acknowledged gaps, is likely to fail – and may harm the claimant's credibility on the disclosure application that follows.

The without-notice character of a freezing or disclosure application places particular obligations on the claimant. Material facts must be disclosed to the court, including weaknesses in the attribution evidence. A freezing order obtained without full and frank disclosure is vulnerable to discharge on return, and a discharged order that has already frozen an innocent party's assets can generate significant liability.

Courts have also addressed the question of service where the defendant's identity remains unknown. In appropriate cases, proceedings have been served by NFT airdrop to the target wallet – a development that reflects the willingness of courts in certain forums to adapt procedure to the asset class. This does not solve the attribution problem, but it removes one procedural obstacle where identity is disputed and on-chain contact is the only available method.

Cross-border attribution: where the hard problems compound

Attribution disputes become more acute when funds have crossed jurisdictions. A theft originating in one country, routed through intermediaries in a second, with cash-out occurring at an exchange in a third, creates a multi-forum attribution problem. Each jurisdiction has its own procedural rules for obtaining disclosure, its own standards for freezing relief, and its own approach to the admissibility of on-chain evidence.

The disclosure order obtained from a VASP in one jurisdiction may not be automatically usable in proceedings in another. Letters of request – the formal mechanism for cross-border judicial assistance in evidence gathering – can be used to seek the same records through local process in the target jurisdiction. The time involved varies: some jurisdictions respond promptly; others do not. Meanwhile, the defendant has notice of at least some of the proceedings, and has reason to move assets that have not yet been frozen.

In our experience, cross-border attribution cases require a coordinated strategy rather than a sequential one. The goal is to move in several jurisdictions as close to simultaneously as possible: obtaining a freezing order in the claimant's primary forum while pursuing disclosure and recognition of that order in the jurisdictions where identified assets are held. The New York Convention provides a mechanism for recognising arbitral awards; recognition of court orders for interim relief requires separate analysis under each relevant jurisdiction's private international law.

A matter handled in the Gulf during summer 2025, involving stolen funds in the high seven figures, illustrates the pattern. On-chain tracing placed the stolen assets at an exchange operating in one jurisdiction with cash-out accounts linked to individuals in two others. The attribution evidence was strong on the chain-hop analysis but thin on the final identification step in the third jurisdiction. Disclosure proceedings were commenced in two forums in parallel; the third required a letters-of-request procedure that added several weeks to the timeline. By the time full identification was complete, partial recovery had been achieved in the two faster forums. The third remained contested. The lesson: attribution quality is not uniform across the chain, and the weakest link determines the timeline in the jurisdiction where it matters most.

Building attribution evidence that holds under challenge

A defensible attribution case is built from the start with challenge in mind. That means four things in practice.

Document the methodology explicitly. Every assumption in the clustering and identification chain should be recorded, not just the conclusion. Courts do not accept attribution as a black-box output. The analyst must be able to say: this label comes from this source, which is reliable for this reason, and this hop is based on this heuristic, which has this known failure mode.

Identify the weakest link early. In every attribution chain there is one step where the evidential weight is thinner than the rest. Identifying that step early allows the claimant to address it – either by obtaining additional evidence before applying for relief, or by framing the application to reflect the genuine uncertainty without understating the strength of the rest of the chain.

Use legal process to close the identification gap before it becomes a point of attack. A disclosure order against a VASP, obtained on a without-notice basis, typically converts a probable attribution into a proven one. The application should be made as soon as there is sufficient evidence to satisfy the threshold for disclosure – not after the full chain is established, because waiting may allow records to be lost or moved.

Anticipate the counter-methodology. A defendant in a well-resourced matter will retain a technical expert to challenge the methodology. The claimant's attribution evidence should be prepared with that challenge in mind: the assumptions should be conservative; the known failure modes of each heuristic should be acknowledged; and where proprietary labels are used, the source and derivation of those labels should be traceable and verifiable.

In our experience, cases that fail on attribution do not usually fail because the methodology was wrong. They fail because the methodology was not explained clearly enough to survive a competent challenge. That is a fixable problem if addressed from the outset.

What attribution cannot do – and what fills the gap

Attribution is a tool with real limits. It establishes a probabilistic connection, not a certainty. Even a strong attribution case involves assumptions that can be contested. The goal is not to eliminate all doubt – courts do not require that – but to establish attribution at a level that satisfies the standard applicable to the relief sought.

There are fact patterns where on-chain attribution will not, by itself, support a recovery action. Where funds have been routed through a well-constructed mixing protocol, the individual transaction heuristics may be genuinely broken. Where a chain of nominee accounts and VASPs in non-cooperative jurisdictions has been used, the identification bridge may never be established by legal process alone. In those cases, off-chain intelligence – surveillance, open-source investigation, corporate registry analysis, cross-referencing with known fraud typologies – becomes the primary tool, with on-chain tracing providing corroboration rather than proof.

This is also where the offshore and corporate dimension enters. An attributed address that leads to a shell company in a non-transparent jurisdiction requires a different set of tools: a UBO register query, a piercing of the corporate veil analysis, a challenge to a nominee arrangement. The on-chain element and the corporate element must be worked together.

The myth that on-chain funds are untraceable deserves direct treatment here. Public blockchains are transparent: every transaction is recorded and verifiable. The challenge is not invisibility – it is attribution. The funds left a trail. Whether that trail can be connected to an identified person, in a form that satisfies a court, is a different question. It is answerable more often than victims expect, and less reliably than recovery scam operators claim. The honest answer is: it depends on the path the funds took, the jurisdiction of the cash-out point, and how quickly the process was started.

Are there recoveries where attribution was disputed, fully contested, and then upheld? Yes. Are there cases where the attribution chain broke and recovery failed? Also yes. The viability of a specific matter depends on its specific facts. We would encourage any claimant assessing a potential recovery action to evaluate the attribution evidence critically before committing resources to litigation.

To assess whether the attribution evidence in your matter is sufficient to support a freezing or disclosure application, contact Axiom Trace for a confidential case review: info@axiomtracel.com.

Related topics in crypto asset recovery

• Crypto asset recovery – overview and guidance from Axiom Trace
• Asset tracing services: from payment trail to recoverable asset
• Court orders against crypto exchanges: a cross-border enforcement perspective

Frequently asked questions

Q: Can stolen crypto really be traced and frozen?

A: In many cases, yes – but with important qualifications. Public blockchains record every transaction, so on-chain tracing can follow funds through multiple hops to a cash-out point or identified wallet. Freezing typically requires a court order – a worldwide freezing order or a proprietary injunction – directed at an exchange or issued against an identified or unknown defendant. Speed matters: the longer the gap between theft and application, the greater the risk that funds have been withdrawn or moved beyond reach. No recovery is guaranteed; viability depends on the specific path the funds took.

Q: How quickly do I need to act after a crypto theft?

A: As quickly as possible. Exchange records are not preserved indefinitely. A virtual asset service provider (VASP) that receives funds has no automatic obligation to hold them once they have been withdrawn. A disclosure order, obtained without notice to the defendant through a Norwich Pharmal order or equivalent, can compel the preservation and production of know-your-customer records and transaction data. In our experience, delays beyond a few weeks meaningfully narrow the options. The first 48 to 72 hours after discovery of a loss are the most critical for preserving the evidence needed to support an attribution argument.

Q: How is a real recovery specialist different from a recovery scam?

A: A genuine cross-border recovery specialist traces assets through legal process – court orders, disclosure applications, coordination with local counsel – and charges fees for investigative and legal work, not for a promised outcome. Recovery scams operate in reverse: they approach victims of prior fraud, promise to recover lost funds, and charge upfront fees before disappearing. A real specialist will never guarantee recovery, will explain the methodology and the limits of the evidence, and will be transparent about costs before any engagement. If a firm contacts you unsolicited after a loss and promises a specific return, treat that as a warning sign, not an offer of help.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In our experience, attribution disputes are decided long before the hearing: the quality of the on-chain methodology and the speed of the disclosure application determine whether recovery remains possible. We have coordinated multi-forum crypto recovery matters where attribution was the central evidential issue – and where the difference between success and failure was the rigour of the analysis prepared at the outset. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.