A payment leaves a wallet in seconds. By the time the victim realises what has happened, the funds may have crossed exchanges in two or three jurisdictions. Georgia – the Caucasus republic, not the US state – has emerged as a notable transit point in several crypto-fraud matters we have analysed. Its relatively open virtual-asset environment and active over-the-counter trading desks make it attractive to those looking to convert stolen tokens into fiat currency. That makes it a jurisdiction where early, coordinated action can still catch funds before they disappear entirely.
On-chain tracing works even when the thief assumes anonymity. Public blockchains are transparent, and movement leaves a forensic trail that leads – in many cases – to a virtual-asset service provider (VASP) or cash-out point where legal process can be applied. Georgia is a content-only jurisdiction for Axiom Trace: the steps described below reflect general practice, and local admitted counsel must act on the ground.
This case study walks through the situation, the strategy applied, the process that followed, and the lessons that transfer to similar matters.
Situation: funds moved on-chain within minutes
In autumn 2024, a principal based in Eastern Europe discovered that a significant volume of cryptocurrency – funds in the mid-six-figure range – had been transferred out of a self-custody wallet without authorisation. The loss emerged from a social-engineering scheme in which the victim had been persuaded to connect a wallet to what appeared to be a legitimate decentralised-finance protocol. The drain was near-instantaneous.
The victim's first instinct was that the money was gone for good. That assumption, though understandable, was wrong. Public blockchains record every transaction permanently and transparently. The funds had not vanished; they had moved – and movement leaves a trail.
Initial on-chain tracing, run within hours of the report, identified a sequence of hops through mixing-adjacent swap protocols before the funds arrived at deposit addresses associated with centralised exchanges – at least one of which appeared, from clustering analysis, to operate with a significant Georgian user base. A Georgian over-the-counter desk was also identified as a probable downstream cash-out point.
Strategy: choke points before the cash-out window closes
Speed is the dominant variable in crypto asset recovery. The window between a theft and irreversible fiat conversion is typically measured in hours to days, not weeks. Once tokens are converted to cash and withdrawn, the trail shifts from on-chain to banking – a slower and more contested environment.
The strategy here had two simultaneous objectives. First, identify the specific deposit addresses and, where possible, the account identifiers at the relevant VASPs. Second, determine which forums could move fast enough to support a disclosure order or a freezing order over digital assets before conversion occurred.
In our experience, matters involving Georgian cash-out points require parallel engagement: the victim's home forum for urgent interim relief, and local Georgian counsel for any steps that must be taken on Georgian soil. We coordinated the instruction of local admitted counsel in Georgia immediately. That coordination – across legal systems working simultaneously – is where cross-border recovery either succeeds or stalls.
A proprietary injunction was also considered in the victim's home jurisdiction, preserving a claim over the specific tokens as property rather than a simple debt.
To assess whether your situation has a comparable choke point, see our crypto asset recovery resources.
Process: from on-chain data to legal action
The process moved in three stages.
Stage one – forensic mapping. Blockchain-analytics tools attributed the receiving addresses to specific VASPs with reasonable confidence. One exchange had a known compliance contact. A second appeared to operate partly through Georgia. The clustering and attribution work took less than 24 hours from instruction.
On-chain tracing identified the wallet-to-wallet path with sufficient specificity to support a disclosure application. A Norwich Pharmal-type order – compelling a third party to disclose information identifying the wrongdoer – was the instrument used to compel the relevant VASP to produce account records. That application was made without notice, to avoid alerting the target.
Stage two – disclosure and identity. Account records obtained under the disclosure order confirmed a Georgian individual and a registered Georgian entity as the recipients of the converted funds. Georgian business-registry data and UBO register information corroborated the connection between the individual and several nominee-structured accounts.
Local counsel in Georgia was now engaged in a defined role: reviewing the domestic options for asset restraint and coordinating with Georgian financial-intelligence channels where appropriate.
Stage three – restraint and negotiation. A freezing order over digital assets – applied for in the victim's home court and recognised as a basis for parallel action – was sought against the identifiable balances. At the same time, the identified individual was approached through local counsel with a formal letter of claim. The existence of the on-chain trail and the disclosure materials significantly changed the negotiating position. A settlement was reached before full enforcement proceedings were required. The outcome was conditional on the cooperation of both courts and the target. No outcome of this kind is guaranteed.
For further context on Georgia as a jurisdiction in crypto-fraud matters, see our Georgia jurisdiction guide.
Lessons that transfer to other matters
What does this matter illustrate beyond its own facts?
First, the assumption that crypto is untraceable is the thief's best ally. When victims act on that assumption and delay, the window closes. On-chain data degrades in usefulness as hops accumulate and mixing becomes more sophisticated. Hours matter.
Second, Georgia is not a dead end. It has an active VASP sector and a functioning legal system. The challenge is coordination: finding local counsel who understands both crypto-asset claims and the domestic procedural requirements – and engaging them fast enough to be useful.
Third, the disclosure instrument is often the turning point. A Norwich Pharmal-type order, or its functional equivalent in the forum that can move fastest, converts an anonymous wallet address into a named defendant. Everything after that – the freezing order, the proprietary injunction, the negotiated settlement – depends on that identification step.
Fourth, cross-border recovery is not a single jurisdiction problem. The victim's home court, the VASP's registration forum, and the cash-out jurisdiction each play a role. Getting those threads to move in parallel – rather than sequentially – is what determines whether funds are still reachable when legal process arrives.
If your situation involves stolen cryptocurrency that has moved on-chain through one or more jurisdictions, the first question is not whether recovery is possible. The first question is whether the trail is still warm enough to support action. We can tell you that within a confidential case review.
For a related analysis of recovery prospects for specific token types, see our piece on whether stolen Litecoin is recoverable.
To assess whether your matter has a viable choke point – and whether Georgia or another transit jurisdiction is in play – contact us at info@axiomtracel.com.
About Axiom Trace
Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In matters like the one described above, we have moved from instruction to forensic attribution within a single working day – and to a legal application within 48 hours. We do not promise outcomes; we tell clients honestly what the trail shows and what it can support. To discuss a matter, contact info@axiomtracel.com.
Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction. The steps described above reflect general practice in this type of matter; local admitted counsel must act on the ground in Georgia and any other jurisdiction where proceedings are filed. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.
Recovering cross-border or crypto assets?
Confidential first review. We map tracing and recovery options and tell you honestly whether a matter is worth pursuing.
Request a case review