A payment leaves a wallet on a Tuesday morning. By the afternoon it has moved through three intermediate addresses and landed at a custodial service registered in Liechtenstein. The victim's instinct is that the money is gone. In our experience, that instinct is wrong – and this matter showed why.
Crypto asset recovery in Liechtenstein is achievable. Liechtenstein has enacted a dedicated token-law regime, recognises virtual assets as property, and its courts can issue disclosure and freezing orders against virtual-asset service providers operating within its jurisdiction. Movement leaves an on-chain trail, and that trail can lead enforcement to a regulated choke point where legal process carries real weight.
The account below reconstructs one such matter, anonymised. It covers the situation, the strategy we recommended, the process we coordinated, and the lessons a claimant – or their lawyer – can take forward.
The situation: funds routed through a Liechtenstein VASP
In early 2025, a commercial entity in Western Europe discovered that an authorised employee had redirected business funds into a personal wallet. The total involved was in the mid seven figures. The initial transfer was in a major stablecoin; subsequent movements converted part of the holding into a second asset before depositing the balance at a virtual-asset service provider (VASP) operating under Liechtenstein's token law.
The client came to us roughly 72 hours after the initial transfer – not fast, but not yet too late. The VASP had not yet processed a withdrawal request. That window mattered enormously.
Two complicating factors arose immediately. First, the perpetrator was a known individual, not an anonymous actor – which simplified identification but introduced employment-law sensitivities. Second, a portion of the funds had moved to a second wallet whose operator was outside Liechtenstein. We had two distinct targets requiring different strategies.
The strategy: on-chain tracing to a regulated choke point
On-chain tracing is most effective when it terminates at a regulated entity that is legally obliged to respond to court process. A VASP subject to Liechtenstein's token law sits squarely in that category.
We mapped the full on-chain movement using blockchain-analytics tools. The tracing confirmed that the main balance – representing the majority of the loss – sat in a custodial account at the Liechtenstein VASP. The secondary wallet appeared to connect to a centralised exchange in a different jurisdiction entirely. Our initial focus was the larger, more accessible pool.
For the Liechtenstein portion, the recommended instrument was a disclosure order against the VASP, to confirm account-holder identity and balance, followed immediately by a freezing order over the digital assets. Both applications were to be made without notice, to avoid any risk of tipping off the account holder. We coordinated closely with admitted local counsel in Liechtenstein; local procedure governed the filing at every stage. Explore our broader coverage of asset recovery in Liechtenstein for context on the legal environment.
The process: disclosure, freeze, and a second jurisdiction
Local counsel moved within hours of instruction. The disclosure order against the VASP was granted on an urgent without-notice basis and confirmed both the account identity and the outstanding balance. The freezing order followed the same day.
The VASP complied. The balance was frozen pending further proceedings. That step – disclosure then freeze, executed inside a single working day – preserved the recoverable pool before any withdrawal could be processed.
The secondary wallet presented a harder problem. The centralised exchange holding it operated outside Liechtenstein. We assessed the forum options: the client's home jurisdiction, the exchange's operating jurisdiction, and whether a proprietary injunction against persons unknown might extend reach. In the event, the exchange was subject to a jurisdiction with active VASP regulation. A disclosure order in that forum confirmed the account belonged to the same individual. A separate freezing application followed through local counsel there.
We have traced matters that required three forums simultaneously; this matter required two. The cross-border coordination – sequencing the Liechtenstein freeze before the second forum was approached, to avoid alerting the defendant – was the critical tactical decision. For a parallel pattern involving another offshore jurisdiction, see our case study on recovering stolen crypto from a defendant in Curaçao.
Transferable lessons for claimants and referring lawyers
Several points from this matter apply broadly to crypto asset recovery when funds move through a regulated European jurisdiction.
- The blockchain is the evidence trail. Public blockchains are transparent – movement is visible even when identities are hidden. Wallet clustering and attribution can identify the custodial endpoint within hours of commissioning a trace.
- Speed is not optional. The window between a deposit and a withdrawal at a VASP can be very short. In this matter, 72 hours was enough; in others we have worked, it was not.
- A regulated VASP is a choke point. Liechtenstein's token-law regime imposes know-your-customer obligations on VASPs and requires compliance with court process. That makes it a jurisdiction where a disclosure order carries practical force, not merely theoretical effect.
- Two forums mean two sets of counsel, two timetables, and two cost centres. Sequencing matters: freeze the larger pool first; do not approach the second forum in a way that could trigger a tip-off at the first.
- The perpetrator being a known individual did not simplify everything. Employment-law considerations, potential criminal referrals, and reputational sensitivity all required parallel management alongside the civil recovery track.
The steps above describe the general pattern. Your matter will turn on its specific facts – where the on-chain trail leads, how quickly, and which forums can act in time. If funds have already moved, time matters – request a confidential case review at info@axiomtracel.com.
For a broader view of how we approach digital-asset matters, visit our crypto asset recovery insight section.
About Axiom Trace
Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In matters like the one above, we regularly advise on the sequencing of multi-forum applications and coordinate with admitted local counsel in Liechtenstein and other coordinate jurisdictions. Our tracing work begins with the on-chain record, which is always the most reliable starting point. To discuss a matter, contact info@axiomtracel.com.
Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace coordinates closely with admitted local counsel in Liechtenstein; local procedure governs the filing. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.
Recovering cross-border or crypto assets?
Confidential first review. We map tracing and recovery options and tell you honestly whether a matter is worth pursuing.
Request a case review