Crypto recovery and VASP regulation in Lithuania

A transfer confirmation arrives at 2 a.m. The funds have left the wallet. Within minutes the tokens are moving across two or three hops on a public blockchain, and the victim's first instinct is that the money is simply gone. That instinct is wrong – but the window for acting on it closes faster than most people expect.

Stolen or fraudulently obtained crypto can, in many cases, be traced on-chain and frozen before it reaches a cash-out point. Lithuania's regulatory system for virtual-asset service providers creates identifiable choke points where legal process can compel disclosure or halt a withdrawal. Whether that process succeeds depends on speed, the quality of the on-chain evidence, and coordination between investigators, local counsel, and the relevant platform.

This guide sets out the practical steps for crypto asset recovery in Lithuania: from the first hours after a loss, through on-chain tracing and VASP engagement, to the legal instruments available under Lithuanian and EU law.

Why Lithuania matters for crypto recovery

Lithuania has become one of the more active VASP licensing jurisdictions in the European Union. A significant number of centralised exchanges and virtual-asset service providers hold Lithuanian licences or registrations. That concentration is relevant to recovery: a licensed VASP operating under Lithuanian supervision is subject to identifiable regulatory obligations, including know-your-customer (KYC) requirements and anti-money-laundering (AML) rules that create traceable account data. Where stolen funds reach such a platform, that data is accessible through appropriate legal process.

The EU's Markets in Crypto-Assets regulation – known as MiCA – has reshaped the operating environment for VASPs across member states, including Lithuania. As of early 2026, the transition to full MiCA authorisation is consolidating the number of active licences and raising compliance standards. For recovery purposes, higher compliance standards mean better KYC records, which in turn means more useful disclosure targets.

Does Lithuania's position in the EU crypto-licensing market help a claimant? In our experience, yes – provided the funds actually reach a platform operating under Lithuanian or EU jurisdiction, and provided legal process is initiated before the assets are withdrawn or further dispersed.

Step 1: Secure the on-chain evidence in the first hours

On-chain tracing is the foundation of any crypto recovery in Lithuania. Public blockchains record every transaction permanently and transparently. Movement leaves a trail, even when the identity behind a wallet address is hidden.

The first practical step is to record and preserve the transaction data immediately: the originating wallet address, the transaction hash, the receiving address, the timestamp, and the amounts transferred. Do not close any application or browser session that shows this information. Export records in whatever format is available.

Blockchain-analytics tools can cluster wallet addresses, identify exchange deposit addresses, and in many cases attribute a receiving address to a named VASP within hours. That attribution is the bridge between the on-chain evidence and the legal process: once you know which platform received the funds, you know where to direct a disclosure or freeze request.

Common mistakes at this stage: waiting to see whether the funds "come back"; contacting the counterparty directly (which alerts them to take further steps); or assuming that because the wallet is anonymous, nothing can be done. None of those assumptions hold. We have traced funds through multiple hops to a cash-out address on a regulated platform, and the evidence from those first hours is almost always what makes the difference.

If you have suffered a loss and the funds are still moving, request a confidential case review immediately at info@axiomtracel.com. Speed matters more at this stage than at any other.

Step 2: Identify the VASP choke point and assess jurisdiction

Once on-chain tracing has identified a receiving exchange or VASP, the next question is jurisdictional: where is that platform regulated, and which legal system governs its obligations to respond to legal process?

A Lithuanian-licensed VASP is subject to Lithuanian law and, increasingly, to MiCA's harmonised EU requirements. That means a claimant seeking disclosure or a freeze must work through Lithuanian legal process – or, where assets have moved further, coordinate across the jurisdictions where the funds have landed. We regularly advise clients on exactly this sequencing: identifying the most accessible choke point rather than pursuing the most obvious one.

Several scenarios arise in practice. The funds may have moved to a centralised exchange holding a Lithuanian registration; they may have passed through a Lithuanian VASP before moving to an offshore or unregulated platform; or the Lithuanian connection may be to a shell or nominee entity rather than to the final asset holder. Each scenario calls for a different legal strategy.

For cross-border matters – where the VASP is licensed in Lithuania but the ultimate beneficial owner of the receiving wallet is identified in another jurisdiction – the process involves parallel steps: legal process in Lithuania for the platform's KYC data, and separate steps in the jurisdiction where the owner can be found or where other assets can be frozen. That parallel approach is standard in serious recovery matters. Relying on one jurisdiction alone rarely reaches the full picture.

Our wider analysis of recovery tools available in this environment is set out in the crypto asset recovery resource hub. The jurisdictional context for Lithuania specifically is covered at our Lithuania jurisdiction page.

How do disclosure orders work against a crypto exchange in Lithuania?

A disclosure order against a VASP compels the platform to release account-holder information: KYC data, transaction histories, IP logs, and linked payment accounts. In Lithuania, that process operates through the civil and, where a criminal complaint is filed, criminal-procedure system – with EU data-protection requirements applying alongside.

In a civil context, the instrument most closely analogous to a Norwich Pharmal order – a third-party disclosure order compelling a platform to identify a wrongdoer – requires a court application setting out the basis for the claim, the relevance of the information sought, and the proportionality of the request. Lithuanian courts are not the most familiar forum for this type of application, and the process typically takes longer than in common-law jurisdictions such as England & Wales or Singapore. Local admitted counsel must act on the ground.

In a criminal context, a formal complaint to Lithuanian law-enforcement authorities – particularly the Financial Crime Investigation Service – can trigger investigative steps including disclosure requests to VASPs that run in parallel with any civil action. Filing a criminal complaint early preserves options: it can unlock information channels that are not available to civil applicants acting alone. It does not guarantee prosecution, and the civil and criminal tracks should be run in parallel, not sequentially.

Where the VASP is a stablecoin issuer or holds stablecoin balances, it may be possible – on appropriate legal process and depending on the issuer's policies and governing documents – to request a freeze at the issuer level. That step is time-critical: stablecoin issuers can freeze specific token balances, but only where the balance has not already been converted or moved.

A detailed treatment of how disclosure orders function against crypto exchanges more broadly is available at disclosure orders against a crypto exchange.

What freezing instruments are available, and when can they be applied?

Freezing digital assets in Lithuania is possible, but the instruments and their conditions differ from those available in common-law hubs. This matters enormously for timing and strategy.

Interim relief in civil proceedings in Lithuania can include an application to the court for a precautionary measure – the civil-law equivalent of a freezing order – which prevents a defendant from disposing of identified assets pending the resolution of the main claim. That application requires evidence of the claim and of the risk of dissipation. It can be made urgently, but it is not equivalent to the without-notice worldwide freezing order available in English courts, which can reach assets outside the jurisdiction and bind third parties immediately.

Where a claimant needs the speed and reach of a worldwide freezing order, the better approach in many Lithuania-connected matters is to anchor the main proceedings in a common-law jurisdiction – England & Wales, Singapore, or another hub where the claimant has a sufficient connection – and then seek recognition of that order or parallel local steps in Lithuania. That cross-border strategy adds complexity but is often the most effective way to reach assets that have been dispersed across multiple platforms and jurisdictions.

A freezing order over digital assets granted in a common-law jurisdiction can, in principle, be presented to a Lithuanian VASP as part of a coordinated legal demand – though the platform's obligation to comply depends on Lithuanian law, which local counsel must advise on.

What is the right sequencing? That depends on where the assets are, how fast they are moving, and which courts are accessible given the facts of the matter. In our experience, the answer is rarely "start with Lithuania" unless that is where the assets have actually come to rest.

MiCA compliance and what it means for claimants in 2026

The transition to full MiCA authorisation across EU member states has practical consequences for claimants pursuing crypto recovery in Lithuania. As of early 2026, VASPs operating in Lithuania are either authorised under MiCA or in a transitional period leading to authorisation or exit from the market.

MiCA-authorised VASPs are subject to harmonised KYC and AML standards, record-keeping obligations, and cooperation requirements with competent authorities. That is good news for claimants: it means better-quality records and a more predictable compliance culture. Platforms that cannot meet MiCA standards are exiting the market, which in some cases means that assets held on those platforms need to be addressed before the platform ceases operations.

The travel rule – which requires VASPs to pass originator and beneficiary information with crypto transfers above a defined threshold – applies under MiCA and strengthens the information trail between platforms. It is now more difficult for a VASP to claim it has no information about the sender of funds it received. That rule creates an additional basis for disclosure requests.

For claimants, the practical implication is this: if funds have moved to a MiCA-authorised VASP in Lithuania, the platform has records, it has compliance obligations, and it has supervisory relationships with the Bank of Lithuania. Those relationships can be relevant if the platform is unresponsive to a legal demand. A complaint to the supervisor is not a substitute for legal process, but it can create additional pressure for cooperation.

Avoiding recovery scams – a word on realistic expectations

One of the most damaging things that can happen after a crypto theft is a second loss to a recovery scam. These operations target people who have already lost funds. They promise to "retrieve" stolen crypto, often citing alleged connections to exchanges or law-enforcement databases, and charge upfront fees for services they cannot and will not deliver.

Real crypto asset recovery does not work that way. No legitimate specialist promises a specific outcome or charges large sums before any investigative work is done. The honest position is that recovery is possible in the right circumstances – where on-chain evidence is strong, where the funds have reached a regulated platform, and where legal process is initiated quickly – but it is conditional, not guaranteed.

The myth that once crypto leaves a wallet nothing can be done is exactly what recovery scammers rely on. They exploit the victim's sense of hopelessness to sell a false alternative. The reality is more nuanced: on-chain tracing can often follow funds to a point where legal tools become available, but that work requires genuine forensic capability and qualified legal process – not access to a supposed "blockchain recovery algorithm."

If you are assessing a recovery service, ask two questions. First: do they propose to trace the funds on-chain and then apply identifiable legal instruments? Second: do they make any promise of recovery? If the answer to the second question is yes, that is a warning sign.

The steps above describe the typical pattern for a Lithuania-connected crypto recovery. Your matter turns on specific facts: where the money went, how fast, and which platforms and forums are in the picture. A confidential case review gives you a realistic assessment of whether pursuit is viable. Contact us at info@axiomtracel.com.

Related resources

• Crypto asset recovery: the full resource hub – overview of on-chain tracing, VASP engagement, and freezing tools across jurisdictions.
• Lithuania jurisdiction profile – regulatory environment, civil procedure, and coordination considerations for Lithuania-connected matters.
• Disclosure orders against a crypto exchange – how to compel a VASP to release account data, step by step.

Frequently asked questions

Q: Can stolen crypto really be traced and frozen in Lithuania?

A: In the right circumstances, yes. Public blockchains are transparent: on-chain movements remain visible even when wallet addresses are pseudonymous. Where stolen funds reach a Lithuanian-licensed virtual-asset service provider, that platform holds know-your-customer records that are accessible through legal process. Freezing is available through civil precautionary measures and, in some cases, through criminal-procedure channels. Recovery is conditional, not certain – it depends on speed, the strength of the on-chain evidence, and which forums can act.

Q: How quickly do I need to act after a crypto theft?

A: As quickly as possible – ideally within hours. Digital assets can move through multiple wallets and be exchanged or withdrawn within a day. Once funds have been cashed out at an unregulated platform or converted to cash, the legal tools available become significantly weaker. The first priority is to preserve on-chain evidence and initiate tracing before the trail goes cold. Contacting a specialist and filing a formal complaint to law enforcement in parallel, rather than sequentially, preserves the most options.

Q: How is a real recovery specialist different from a recovery scam?

A: A legitimate specialist proposes to trace funds on-chain using blockchain-analytics tools, identify the regulated platform where those funds have landed, and apply named legal instruments – disclosure orders, freezing applications, or coordinated criminal complaints – through qualified local counsel. No legitimate specialist promises a specific recovery outcome or charges large upfront fees before any investigative work is done. If a service guarantees recovery or claims access to a proprietary "retrieval system," treat that as a warning. Second-stage recovery scams are specifically designed to target people who have already lost funds to crypto fraud.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In our experience, the cases that succeed are those where tracing begins early and legal process follows the evidence. We have traced funds through multi-hop blockchain transfers to regulated platforms, and we understand the specific considerations that apply when Lithuania is a link in the chain. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction. The steps described reflect general practice; local admitted counsel must act on the ground in Lithuania. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.