A payment clears. Within minutes the funds have moved on-chain, passed through two intermediary wallets, and landed at a centralised exchange registered in the Seychelles. The victim watches the trail go cold on a Saturday evening and concludes the money is gone for good. That conclusion is understandable. It is also, in our experience, premature.
As of early 2026, the Seychelles remains an active choke point for crypto asset recovery. On-chain tracing can follow funds from the point of theft to an exchange account, and coordinated legal process – including a freezing order and a disclosure order directed at the platform – can reach assets before they are cashed out or further dispersed. The timeline is tight, measured in hours to days, but the trail on a public blockchain does not disappear.
This anonymised case study walks through the situation we encountered, the strategy we applied, the process we followed, and the lessons that transfer to similar matters.
Situation: funds moved on-chain within the hour
A commercial client based in the Gulf – a mid-sized trading business – discovered, on a Wednesday morning in autumn 2024, that a sum in the high six figures (denominated in a major stablecoin) had left its custody wallet overnight. The transfer had been authorised by an employee responding to what appeared to be a routine internal instruction. It was not. The instruction was fabricated as part of a business-email-compromise fraud.
By the time the client contacted us, roughly fourteen hours had elapsed. The stolen stablecoin had moved through three wallets and arrived at a centralised exchange operating under a Seychelles registration. A small portion had already been converted and withdrawn. The bulk remained, sitting in an account the exchange could identify and freeze on receipt of appropriate legal process.
The client's instinct was to contact the exchange directly and ask for a voluntary hold. That step is not wrong. It is simply insufficient on its own, and exchanges in this position routinely decline informal requests without a court order behind them.
For a broader picture of how impersonation fraud routes funds on-chain, see our guide on how an impersonation scam works and where the money goes.
Strategy: on-chain tracing to a jurisdictional choke point
Speed decided the first decision. We did not wait for a full forensic reconstruction before initiating legal steps. Instead, we ran both tracks simultaneously: blockchain-analytics tools to map the wallet trail, and urgent consultation with local counsel in the Seychelles to assess the availability of interim relief.
The public blockchain provided a complete and timestamped record of every hop. Wallet clustering and attribution placed the receiving exchange account with a high degree of confidence. That tracing evidence became the evidentiary foundation for the legal application.
The Seychelles, as a coordinate jurisdiction, requires admitted local counsel to file any court application. We coordinated closely with local counsel from the outset. The strategy rested on two instruments: a freezing order directed at the exchange, and a disclosure order requiring the exchange to produce account-holder information and transaction records. Both applications were made without prior notice to the account holder – a standard precaution to prevent dissipation before the order takes effect.
The question we had to answer honestly was whether local process could move fast enough. Not every Seychelles matter succeeds at this stage. In this instance, the exchange was responsive to formal process, which is a material variable.
Our crypto asset recovery practice covers the full range of on-chain and exchange-level strategies we apply in matters like this.
Process: from tracing to order to account hold
The sequencing mattered as much as the substance.
- Within the first four hours of instruction, we had a preliminary wallet-attribution report identifying the receiving exchange and the approximate balance still held there.
- We briefed local counsel in the Seychelles on the same day. They began drafting the without-notice freezing application that evening.
- The application was filed within roughly 48 hours of our instruction. It was supported by on-chain evidence, a concise account of the fraud, and the usual undertaking in damages from the claimant.
- The court granted the freezing order. The exchange received formal service and implemented an account hold within hours of receiving the sealed order.
- The separate disclosure order then required the exchange to produce know-your-customer records for the account holder. Those records, once obtained, opened a parallel investigative thread to identify the individual behind the fraud.
The converted and withdrawn portion of the funds – the fraction already cashed out before the order arrived – was not recovered through this process. That is an honest limit. Every hour of delay before a freeze application narrows what can be reached. The remainder, still held on the exchange at the time of the order, was preserved pending further proceedings.
For jurisdiction-specific detail on how local process operates, see our Seychelles asset recovery overview.
Transferable lessons for crypto asset recovery
What does this matter teach practitioners and victims approaching a similar situation?
First, the myth that crypto is untraceable is simply wrong. Public blockchains are transparent. Movement leaves a timestamped, permanent record we can follow to a cash-out point. The challenge is not the tracing; it is acting on that trace before the exchange account is emptied.
Second, the Seychelles is a real and workable jurisdiction for freezing digital assets. It is not a black box. Coordinated legal process – a freezing order paired with a disclosure order – can produce a hold within days if the application is prepared properly and local counsel are engaged immediately.
Third, parallel tracks matter. Running on-chain tracing and legal preparation simultaneously, rather than sequentially, compresses the timeline materially. We regularly advise clients to begin both on the day of instruction.
Fourth, the disclosure order is as important as the freeze. Preserving assets is the first objective. Identifying the person behind the account is the second. The two instruments serve different purposes and should both be sought where evidence supports the application.
Fifth, watch for second-stage recovery scams. After a crypto theft becomes known, victims are frequently targeted by operators who promise guaranteed fund return for an upfront fee. Real crypto asset recovery involves court process, local counsel, and verifiable legal steps – not advance payments to unknown intermediaries.
If funds have already moved and you are assessing whether a similar process could apply to your matter, time matters. Request a confidential case review at info@axiomtracel.com.
About Axiom Trace
Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In our experience, the cases that reach a productive outcome are the ones where tracing and legal preparation begin on the same day. We have traced funds through multiple wallet hops to exchange accounts across several jurisdictions, and we know where the process is most likely to hold. To discuss a matter, contact info@axiomtracel.com.
Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. We coordinate closely with admitted local counsel in the Seychelles; local procedure governs the filing. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.
Recovering cross-border or crypto assets?
Confidential first review. We map tracing and recovery options and tell you honestly whether a matter is worth pursuing.
Request a case review