A payment leaves your wallet in minutes. By the time you discover the theft, the funds may have moved across three chains and arrived at a centralised exchange registered in Malta – or used Malta's regulated virtual-asset environment as a corridor. What happens next depends on one question: can the exchange be compelled to identify the recipient and freeze the balance before withdrawal?
In Malta, digital-asset disclosure orders are available through civil proceedings directed at virtual-asset service providers (VASPs) regulated under the country's virtual-financial-assets regime. A Maltese court can compel a VASP to disclose account information and, in appropriate cases, grant interim relief to prevent dissipation. These tools mirror the Norwich Pharmal and Bankers Trust disclosure doctrines developed in common-law courts, adapted to Malta's civil-law and mixed-law context. Speed determines whether they are effective.
This guide walks through each stage: gathering on-chain evidence, grounding a disclosure application, coordinating with the receiving VASP, and enforcing any resulting order – including what happens when assets have already moved on to a second jurisdiction.
Why Malta matters as a crypto recovery jurisdiction
Malta was among the first jurisdictions to enact a dedicated virtual-financial-assets legislative framework, positioning its financial regulator as the licensing authority for many VASPs operating across Europe and beyond. That regulatory infrastructure is the asset-recovery practitioner's first point of leverage.
A licensed VASP in Malta is subject to both court process and regulatory oversight. That dual accountability matters. Where a VASP is unregulated and offshore, compelling disclosure requires a foreign court order and an uncertain enforcement chain. In Malta, the same VASP holds a licence it cannot afford to lose – which creates a material incentive to comply with legal process promptly.
In our experience, this regulatory exposure shortens the practical response time between service of a disclosure order and cooperation from the VASP. That difference can be the margin between funds still on the platform and funds already withdrawn.
The jurisdiction is also significant for cross-border matters. A claimant based in the European Union, the Gulf, or Asia may find that stolen funds passed through a Maltese-regulated exchange as a conversion or cash-out point. The order obtained in Malta may be the only legally effective mechanism to interrupt that flow – even if the underlying fraud occurred elsewhere entirely.
To understand the broader range of on-chain tracing tools that complement a Maltese disclosure application, see our Crypto Asset Recovery insight hub.
Step one: securing and interpreting the on-chain evidence
Before any application is filed, the evidentiary foundation must be in place. A disclosure order is not granted on suspicion alone. The court needs to see that a loss occurred, that the funds moved to a specific wallet or account, and that the respondent VASP is likely to hold information about the person controlling that account.
On-chain tracing begins at the point of the theft and follows the transaction graph forward. Blockchain-analytics tools can identify the receiving wallet, cluster associated addresses, flag known exchange deposit addresses, and establish a probabilistic link between the stolen funds and a specific VASP. Public blockchains are transparent: the movement is recorded immutably, even when the identity behind the wallet is hidden.
The output of that tracing exercise needs to be packaged into a form the court can understand. That typically means a chronological reconstruction of the transactions, a clear identification of the receiving address or addresses, and an explanation of how the analyst attributed those addresses to the respondent VASP.
Two common mistakes at this stage cost claimants time they cannot recover. First, relying on an incomplete chain of custody – the evidence must show an unbroken path from the claimant's wallet to the VASP. Second, treating blockchain screenshots as self-explanatory. A Maltese court will require the tracing methodology to be explained in plain terms, not assumed.
Do not wait to perfect the evidence before beginning the coordination process with local counsel. The two tracks run in parallel. Hours matter here.
Step two: what grounds a Maltese disclosure application?
Malta operates a civil-law system with significant EU-law overlay. The disclosure doctrines available in a pure common-law court – the Norwich Pharmal order, the Bankers Trust order – do not apply by that name in Maltese civil proceedings. However, the functional equivalent is available: a Maltese civil court can order a third party to disclose information that is necessary to identify a wrongdoer or trace misappropriated assets, as an adjunct to a substantive claim or on a precautionary basis.
The application must identify a real and arguable cause of action – typically fraud, unjust enrichment, or a breach giving rise to a proprietary claim over the misappropriated assets. It must also show that the VASP is the gatekeeper of information the claimant cannot otherwise obtain. Where on-chain tracing has identified the VASP as the exchange receiving the funds, that gateway condition is satisfied.
Three elements are consistently tested by the court:
- Is there a sufficiently serious underlying claim? A speculative or minimal-value claim will not support urgent relief.
- Is the VASP the appropriate respondent – does it actually hold the account data sought?
- Is the disclosure proportionate to the harm? The court will not grant a fishing expedition.
A separate but connected question is whether a precautionary warrant – Malta's interim relief mechanism – should be sought in parallel to freeze the account while the disclosure application is processed. In most fraud matters, the two applications are coordinated. Filing for disclosure without simultaneously seeking to freeze the balance creates a window for dissipation that the respondent or the account holder can exploit.
We regularly advise claimants to treat the disclosure and freezing steps as one coordinated action rather than sequential filings. The procedural rhythm of the Maltese courts permits this approach, and local admitted counsel in Malta are familiar with it in the virtual-asset context.
How does a Maltese precautionary warrant work in crypto matters?
Malta's precautionary warrant is the principal interim relief tool available to claimants before judgment. It is designed to preserve the status quo while substantive proceedings are resolved. In a digital-asset context, it operates to freeze the balance held at the VASP pending the outcome of the claim.
The application is typically made without notice to the account holder. This is deliberate. A freezing application made on notice risks tipping off the account holder, who may withdraw funds within hours of learning that proceedings are imminent. The without-notice mechanism – combined with a gagging obligation on the VASP not to notify the customer – is the standard approach in urgent fraud matters.
The applicant must give a cross-undertaking in damages: a commitment that, if the warrant later proves unjustified, the applicant will compensate the respondent for losses caused by the freeze. This is not a deterrent to proceed – it is a standard feature of interim relief in nearly every jurisdiction. It does, however, require the claimant to have a realistic view of the strength of their claim before filing.
Timing from application to the grant of a precautionary warrant varies. In urgent matters where the evidentiary foundation is strong, Maltese courts can move quickly. The period from filing to an initial hearing is measured in days rather than weeks in genuinely urgent cases. The practical constraint is almost always the quality of the evidence and the speed with which it can be assembled – not the court's calendar.
What happens if the VASP does not comply? A licensed VASP that ignores a court order in Malta faces both contempt proceedings and regulatory consequences. In our experience, this combination produces compliance at a rate significantly higher than unlicensed offshore respondents.
Cross-border complications: when the funds move on before the order arrives
The scenario every recovery practitioner fears is this: the on-chain tracing points to a Maltese VASP, the application is filed, and by the time the order is served the account has been emptied – the balance withdrawn to a second wallet or transferred to an exchange in a different jurisdiction.
This is not the end of the recovery. It is, however, a material complication that changes the strategy.
If the funds have moved to a second VASP in another EU member state, the existing Maltese proceedings and any resulting judgment may be enforceable there under EU civil-procedure instruments, which provide for mutual recognition of civil judgments within the Union. A Maltese disclosure order, once obtained, may also support a parallel application in the second jurisdiction – the Malta order demonstrates that a court has already adjudicated on the legitimacy of the tracing exercise.
If the funds have moved outside the EU – to an exchange in a third country – the position becomes more complex. The claimant will need to assess whether that second jurisdiction has an extant legal process for digital-asset disclosure, and whether a foreign judgment from Malta carries weight there. Recognition of foreign judgments is not automatic outside the EU; it depends on bilateral arrangements or the domestic law of the receiving state.
In those circumstances, a parallel multi-jurisdictional strategy may be necessary: proceedings in Malta for the initial chain of custody, simultaneous proceedings in the second forum using the Maltese tracing evidence as the foundation. We have traced funds through exactly this kind of two-stage movement – Gulf region matter, late 2024, funds passing through a regulated European exchange before reaching a second platform in a non-EU jurisdiction – and the Maltese disclosure order proved critical as an evidentiary anchor in the second forum.
For a case study in adjacent multi-jurisdictional complexity – particularly where a VASP in a lightly regulated offshore territory is the respondent – see our analysis of court orders against crypto exchanges in Curaçao.
What a disclosure order actually obtains – and what it does not
A disclosure order against a Maltese VASP will typically compel production of: the account registration details tied to the receiving wallet address; identity-verification documents submitted on account opening (under the anti-money-laundering and know-your-customer obligations that regulated VASPs must maintain); and transaction records showing deposits, withdrawals, and any internal transfers.
That data allows the claimant to identify the account holder by name, to understand how the funds were handled after arrival, and to determine whether a proprietary claim can be grounded against an identifiable person. In many cases, the identity obtained through the VASP disclosure is the first concrete step toward a substantive claim – the moment an anonymous crypto theft becomes a fraud claim against an identified defendant.
What a disclosure order does not do: it does not freeze funds automatically (that requires the parallel precautionary warrant); it does not guarantee that the identity documents on the account are accurate (fraudsters use synthetic or stolen identity documents); and it does not by itself constitute evidence of liability. The information obtained must still support a substantive claim on its merits.
A second misconception worth addressing here: some clients assume that once the identity is revealed, recovery follows automatically. It does not. The identity disclosure is the beginning of the next phase – enforcement against a now-identified person, which may require proceedings in a third jurisdiction where that person holds assets. Recovery is conditional at every stage.
Practical preparation: what claimants and their advisers should do now
If stolen funds have reached a Maltese VASP – or if you have reason to believe they have – the following steps apply regardless of whether formal proceedings have begun.
First, preserve every record of the original transaction. Wallet addresses, transaction hashes, timestamps, screenshots from your own platform, and any communication with the fraudster. These form the foundation of the tracing exercise. Deleting or losing records at this stage creates gaps that are difficult to close later.
Second, do not contact the VASP directly before legal counsel is engaged. An informal query to the exchange puts the account holder on notice. It may accelerate a withdrawal rather than prevent one. The without-notice mechanism exists precisely because informal contact can defeat the purpose of the application.
Third, begin the on-chain tracing exercise immediately. The blockchain data is public and permanent, but the exchange account it leads to is not. The VASP may have a withdrawal pending approval, or the account holder may attempt to move the funds to a non-custodial wallet as soon as any suspicion of proceedings reaches them.
Fourth, instruct local admitted counsel in Malta in parallel with the tracing exercise. Malta is a coordinate jurisdiction for Axiom Trace: we coordinate closely with admitted local counsel there, and local procedure governs the filing. The drafting of the application and the preparation of the evidence run simultaneously – not sequentially.
The contextual bridge is straightforward. A disclosure application that is well-prepared and filed quickly stands the best realistic chance of reaching funds that are still on the platform. Preparation quality and filing speed are the two variables most within the claimant's control.
To understand how your matter compares to others we have assessed, and whether the tracing evidence you hold is likely to support a Maltese application, request a confidential case review at info@axiomtracel.com.
Related resources
- Crypto Asset Recovery – overview of on-chain tracing tools and exchange disclosure strategies
- Malta as a recovery jurisdiction – regulatory context and civil process
- Court orders against crypto exchanges in Curaçao – multi-jurisdictional disclosure in offshore contexts
Frequently asked questions
Q: Can stolen crypto really be traced and frozen in Malta?
A: Yes – subject to the evidence available and the speed of action. Public blockchains record every transaction permanently. Blockchain-analytics tools can follow stolen funds from the theft wallet to a receiving address at a Maltese virtual-asset service provider. Once the VASP is identified, Maltese civil proceedings can compel disclosure of account information and, through a precautionary warrant, freeze the balance. Neither outcome is guaranteed, but both are procedurally available where the tracing evidence is solid and the application is filed before the funds are withdrawn. On-chain tracing and asset recovery in Malta are established – not experimental.
Q: How quickly do I need to act after a crypto theft?
A: As quickly as possible. Hours, not days. A virtual-asset service provider cannot freeze an account it has not been ordered to freeze, and a court cannot grant relief on an application that has not been filed. From the moment the theft is identified, there are two parallel races: the fraudster moving funds out of the platform, and the claimant assembling evidence and initiating proceedings. The window for a meaningful precautionary warrant – one that reaches funds still on the exchange – closes as soon as withdrawal occurs. Delay beyond the first 24 to 48 hours materially narrows the options available, though later-stage recovery through identity disclosure and enforcement against the account holder remains possible even after the balance has moved.
Q: How is a real recovery specialist different from a recovery scam?
A: A legitimate asset-recovery specialist – whether a law firm, an independent boutique, or a forensic tracing practice – will never guarantee recovery, never demand an upfront fee in crypto, and will explain clearly what legal process applies to your matter and why. Recovery scams typically target people who have already lost funds to fraud. They promise guaranteed return of assets in exchange for an advance payment, then disappear. Axiom Trace is an independent firm: we conduct on-chain tracing, coordinate legal proceedings with local admitted counsel, and advise clients honestly on the realistic prospects of each stage of a matter. We do not promise outcomes we cannot control. If anyone has approached you offering guaranteed crypto recovery for an upfront payment, treat that contact as a second fraud attempt.
About Axiom Trace
Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. We coordinate closely with admitted local counsel in Malta; local procedure governs the filing of any precautionary warrant or disclosure application there. We have followed stolen digital assets through multi-stage on-chain movements into regulated exchange environments in multiple jurisdictions, and we understand where the procedural pressure points lie. To discuss a matter, contact info@axiomtracel.com.
Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace coordinates closely with admitted local counsel in Malta; this guide does not constitute Maltese legal advice and does not substitute for instruction of qualified Maltese practitioners. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.
Recovering cross-border or crypto assets?
Confidential first review. We map tracing and recovery options and tell you honestly whether a matter is worth pursuing.
Request a case review