On-chain, money does not disappear. It moves. In our experience, the moment a victim concludes that stolen crypto is gone for good, the trail is still warm – and in several matters involving Lithuania's virtual-asset environment, that trail has led to a recoverable choke point. This case study describes one such matter: anonymised, with amounts expressed as ranges and no identifying detail retained.
Crypto fraud proceeds traced through Lithuania can, in appropriate circumstances, be frozen before cash-out, using a combination of on-chain tracing, a freezing order over digital assets, and a disclosure order against the virtual-asset service provider (VASP) that received the funds. Speed is the deciding variable. The window between a transaction and successful dissipation is measured in hours, not weeks.
What follows covers the situation our client faced, the strategy we applied, the process that unfolded, and the lessons that transfer to similar matters.
The situation: funds moved fast, then appeared to stop
A corporate client – a mid-size trading firm based in Western Europe – discovered in the early hours of a weekday morning that a significant sum had left a business wallet without authorisation. The loss fell in the mid-six-figure range. Initial internal review suggested an account-compromise event, though the exact mechanism was not immediately clear. The client's first instinct was to contact their exchange. The exchange confirmed the outbound transactions but explained it could take no unilateral action.
Within the first two hours, blockchain-analytics tools confirmed the funds had moved through three intermediate wallets before reaching a deposit address at a centralised exchange operating under a Lithuanian virtual-asset service provider licence. That is where the on-chain trail paused. From that point, the funds were at risk of being withdrawn or converted. The client contacted Axiom Trace the same morning.
Lithuania is relevant here for a specific reason. As of early 2026, Lithuania has an established VASP licensing regime administered by a financial supervisory authority. Licensed VASPs in that system operate under anti-money-laundering obligations that include the ability – and in certain circumstances the requirement – to act on legal process. That creates a usable choke point, provided the right steps are taken in time.
Why Lithuania? Understanding the jurisdictional angle
Not every jurisdiction offers the same leverage over a VASP. Lithuania's licensing system means that a regulated exchange operating there is subject to identifiable legal obligations and is reachable through formal process. That is not a guarantee of success, but it is a precondition for meaningful action.
The receiving VASP in this matter was incorporated and licensed in Lithuania. That fact determined the entire strategic approach. A disclosure order against a VASP requires the VASP to be within the reach of a court or regulatory authority that can compel production. Without that anchor, the order is theoretical. With it, the process becomes concrete.
We have traced funds through several Baltic and Northern European VASP structures in recent years. Lithuania comes up with meaningful frequency. The combination of EU regulatory alignment, accessible corporate registration data, and the VASP licensing register makes beneficial ownership and registered-agent information obtainable earlier than in some offshore alternatives. For a full picture of our Lithuania-related work, see our Lithuania jurisdiction overview.
The strategy: trace, preserve, disclose
The strategy followed three stages in sequence, with the first two running partly in parallel.
First, on-chain tracing to confirm attribution. Blockchain-analytics tools mapped the movement from the source wallet through the intermediate hops to the deposit address. Wallet clustering and behavioural analysis produced a working hypothesis: the deposit address was linked to a specific account at the Lithuanian VASP, not a pass-through to another chain. That hypothesis needed to be confirmed through disclosure, but it was strong enough to support an urgent application.
Second, preservation. In parallel with the tracing work, we coordinated with local counsel in Lithuania to assess the basis for an urgent application for a freezing order over the digital assets held at the VASP. The application was made without notice – the standard approach where tipping off the account holder would defeat the purpose. The VASP was required to hold the relevant balance pending the outcome of proceedings. This is the point at which speed matters most: if the account holder had withdrawn first, the freezing order would have reached an empty account.
Third, disclosure. Once the preservation measure was in place, a disclosure order against the VASP produced account-holder identity information. That information, combined with the on-chain tracing record, formed the evidential basis for the client's substantive claim. For background on the broader crypto recovery process, our crypto asset recovery overview sets out the general methodology.
How the process actually unfolded
The timeline was tight. From the client's first call to the filing of the without-notice application took less than 48 hours. That pace required the on-chain analysis to run concurrently with the drafting of the legal application – not sequentially. Local counsel in Lithuania moved quickly once instructed; the licensing framework gave them a clear basis on which to approach the court.
The VASP complied with the preservation order within the required period. Account-holder records were produced on the disclosure order. The information matched the cluster attribution from the on-chain analysis: the account was registered to an individual using identity documents that, on further investigation, appeared to be linked to a pattern of similar frauds.
At that stage, the client had a preserved asset pool and an identified respondent. Whether and how to proceed to judgment was a decision for the client and their legal team, informed by the cost and likely enforceability of a Lithuanian judgment against the identified individual. That is beyond the tracing and preservation work we provide – but the work we provided made the decision a real one, not a theoretical one. For context on the type of fraud scheme that often generates this pattern, see our analysis of how a fake OTC desk works and where the money goes.
Transferable lessons
Four observations carry across to similar matters.
The deposit address is the choke point. Once funds reach a regulated exchange, they are at their most legally reachable – but only briefly. Acting before withdrawal is the entire game.
VASP jurisdiction determines strategy. A VASP licensed in an EU member state operates under a legal system where court orders have teeth. That is a different position from a VASP domiciled offshore with no licensing anchor. Know where the receiving exchange is registered before deciding whether a freezing application is worth pursuing.
On-chain tracing and legal process are interdependent. Neither is sufficient alone. The tracing identifies the target; the legal instrument preserves it. Running them in parallel – not in sequence – is what makes tight timelines achievable.
Do not assume the money is gone. On public blockchains, movement leaves a permanent record. We have traced funds through five wallets and recovered a usable attribution in matters where the initial assumption was that the trail had gone cold. The assumption that stolen crypto is untraceable is, in our experience, the single most damaging myth a victim can carry into the first 24 hours.
If funds have already moved and you are uncertain whether a trail exists, time matters – request a confidential case review at info@axiomtracel.com.
About Axiom Trace
Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In matters involving regulated VASPs, we have coordinated urgent tracing and preservation work across multiple jurisdictions where hours determined whether a meaningful asset pool survived. To discuss a matter, contact info@axiomtracel.com.
Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. The steps described above reflect general practice; local admitted counsel must act on the ground in Lithuania. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.
Recovering cross-border or crypto assets?
Confidential first review. We map tracing and recovery options.
Request a case review