Disclosure orders against a crypto exchange

A crypto theft closes in minutes. The funds scatter across wallets, bridge through chains, and reach a centralised exchange – sometimes before the victim has filed a police report. At that point, one question matters above all others: can a court compel the exchange to identify the account holder and freeze the balance before it is withdrawn?

The answer, in the right jurisdiction, is yes. A disclosure order against a crypto exchange – sometimes called a Norwich Pharmal order or a Bankers Trust order depending on the relief sought – can compel a virtual-asset service provider to identify a wrongdoer and provide account data. Served on notice to the exchange but without warning to the target, the application can produce results within hours to days. Whether it will work depends on where the exchange operates, how quickly the application is filed, and how the on-chain trail is documented.

This analysis works through the mechanics, the strategic choices, and the honest limits of disclosure orders against crypto exchanges – from the first on-chain steps to enforcement across borders.

Why Disclosure at the Exchange Is the Critical Choke Point

Public blockchains record every transaction. Movement leaves a trail. The problem is that the trail leads to wallet addresses, not to names. The exchange is the place where pseudonymity ends: every centralised platform subject to anti-money-laundering rules must verify customer identity before permitting a withdrawal.

That verification record – name, address, identity document, linked bank account – is exactly what a disclosure order targets. On-chain tracing tools can follow the stolen funds from the victim's wallet through intermediary addresses to the deposit address at the exchange. Once that chain is documented, a claimant has the technical evidence needed to anchor an application in court. The exchange becomes the defendant to the disclosure application, not as the wrongdoer, but as a third party who holds information that identifies one.

In our experience, the exchange choke point is the single most productive step in a crypto asset recovery. If funds reach a centralised exchange and sit there, a well-constructed application can convert on-chain data into a name, an account, and – combined with a freezing order – an asset that cannot move. Miss that window, and the cash-out happens. The trail goes cold at the bank.

This is why speed is not a stylistic preference. It is the determinant of whether relief is available at all.

What Is a Disclosure Order, and Which Instruments Apply?

Two established instruments drive most disclosure applications against exchanges: the Norwich Pharmal order and the Bankers Trust order. They are related but distinct.

A Norwich Pharmal order compels a third party – here, the exchange – to disclose information that will identify a wrongdoer. The claimant does not need to sue the exchange itself. The application is brought against the platform as an innocent party who holds the identifying data. The court weighs the claimant's interest in obtaining the information against any countervailing interests of the exchange or its customer. Where funds have been demonstrably stolen and the on-chain trail is clear, courts in well-developed recovery jurisdictions have consistently held that the balance favours disclosure.

A Bankers Trust order operates similarly but is more specifically directed at tracing the route of misappropriated funds through accounts. It compels a financial institution – and modern courts have applied this to exchanges acting as quasi-banks – to disclose account information to assist the tracing exercise. Where the claimant's primary goal is to follow the money rather than immediately to identify the wrongdoer, a Bankers Trust order may be the more precise vehicle.

In practice, a single application often combines both: "Tell us who controls this account, and tell us every transaction associated with it." The application is typically made without notice to the account holder, accompanied by a gagging order preventing the exchange from tipping off its customer. This matters enormously – a forewarned wrongdoer will initiate a withdrawal or transfer the funds off-platform within minutes.

Where the wrongdoer has not yet been identified at all – a common position in crypto fraud – courts have also granted proprietary injunctions against persons unknown. This instrument allows the claimant to freeze assets and compel disclosure even before a named defendant exists. The exchange is served; the account is frozen; the identity is then revealed through the disclosure itself. The sequence is not circular: it is a recognised procedural mechanism for precisely this situation.

How Does On-Chain Tracing Build the Foundation for a Disclosure Application?

No court will issue a disclosure order on the basis of a victim's assertion alone. The application needs to be supported by evidence – and in a crypto matter, that evidence is the on-chain tracing report.

Blockchain-analytics tools allow practitioners to reconstruct the movement of funds from the originating wallet, through any intermediary wallets, to the deposit address at the exchange. Every on-chain movement is recorded permanently and cannot be altered. That immutability is, paradoxically, what makes public blockchains so useful for recovery: the wrongdoer cannot rewrite history, only try to obscure the trail through mixing, bridging, or splitting.

Wallet clustering and attribution techniques allow analysts to group addresses controlled by the same entity, even where the wrongdoer has attempted to fragment the funds. Cross-chain movements – where funds are bridged from one blockchain to another – add complexity but do not necessarily defeat the trail. Each bridge transaction leaves its own record.

The resulting report serves two purposes. First, it provides the evidential foundation for the disclosure application: here is the originating theft; here is the movement; here is the deposit at this exchange. Second, it anticipates the exchange's likely response – that it cannot confirm whether an account exists – by demonstrating that the blockchain record is not speculative. The funds went somewhere. That somewhere is documented.

We have traced funds through multiple wallets, across two chains, and to a centralised exchange within a matter of hours. Speed in the tracing phase is directly linked to speed in the legal application. Every hour of delay is an hour in which the account holder can request a withdrawal.

Which Jurisdictions Can Grant These Orders – and Does the Exchange's Location Matter?

This is where many claimants encounter the first real friction. The disclosure order is only as useful as the court that grants it, and that court's reach over the exchange depends on a combination of factors: where the exchange is incorporated, where it operates, and whether it has submitted to the jurisdiction of the forum.

Courts in well-developed common-law recovery jurisdictions – England and Wales, Singapore, Hong Kong, the British Virgin Islands, the Cayman Islands, and a growing number of offshore centres – have shown consistent willingness to grant Norwich Pharmal and Bankers Trust orders against exchanges. Several have dealt specifically with crypto matters and have adapted their procedural tools to the characteristics of digital assets. Service of proceedings by NFT airdrop, for example, has been permitted in appropriate cases where other forms of service are impractical.

The more difficult question arises when the exchange operates from a civil-law jurisdiction, or from a jurisdiction that does not yet have a developed digital-asset recovery regime. In those cases, the claimant may need to obtain an order in one forum and then seek its enforcement – or a parallel order – in the exchange's home jurisdiction. That is a two-step process, and it takes longer. Whether the delay is fatal depends on whether the assets are still on the platform.

For claimants pursuing a globally-operated exchange with users across many jurisdictions, the most productive approach is often to identify the jurisdiction in which the exchange is most clearly subject to process – whether by incorporation, by its terms of service, or by its regulatory registration – and to file there first. A disclosure order from a court the exchange recognises as having authority over it is far more likely to produce compliance than a foreign order that the exchange treats as advisory.

Enforcement of foreign judgments and orders adds another layer. The exchange may be registered in one place, its servers in another, and its beneficial owners in a third. Each hop requires either recognition of the original order or a fresh application in the local forum. Allied counsel in those jurisdictions must act on the ground. This is not a reason to abandon the strategy; it is a reason to map the enforcement route before filing.

What Happens When the Exchange Resists or Is Outside the Court's Reach?

Exchanges do not always comply smoothly. A well-advised exchange will require that the order be formally served in accordance with its terms of service, and will apply its own legal team to assess the validity of the order before disclosing anything. That process takes days. In some cases, the exchange will apply to set aside the order on the basis that the court lacks jurisdiction, that the application was procedurally defective, or that the customer's privacy rights outweigh the claimant's interests.

These are real obstacles, not theoretical ones. The solution is rigorous preparation before the application is filed. The evidence package must be complete. The jurisdictional basis must be clear. The legal argument must anticipate the exchange's likely objections and address them in the supporting materials.

Where an exchange is genuinely outside the reach of any available court – because it operates from a jurisdiction with no functioning legal system for this purpose, or because it operates without registration anywhere – the choke point may lie elsewhere. The bridge protocol, the stablecoin issuer, or a downstream bank may offer an alternative point of leverage. Stablecoin issuers can, on appropriate legal process, freeze specific token balances – a significant tool where stolen funds have been converted to a dollar-pegged stablecoin before withdrawal.

It is also worth considering whether the exchange has a parent company, a regulated subsidiary, or a correspondent banking relationship in a jurisdiction that can be reached. Chabra relief – a freezing order directed at a third party who holds assets belonging to or for the benefit of the wrongdoer – can in appropriate cases reach the exchange as an asset holder, not merely as a data source.

The honest position is this: where the exchange is beyond any court's reach, disclosure from the exchange is not available through legal process. The tracing exercise may still identify downstream cash-out points at banks, or on-chain destinations at better-regulated platforms. The strategy shifts; it does not necessarily end.

If you are at this stage of assessment, a confidential case review will identify which choke points remain available on your specific facts. Contact us at info@axiomtracel.com to discuss the position.

The Freezing Order: Combining Disclosure with Interim Relief

A disclosure order tells you who the wrongdoer is. It does not, by itself, stop them from withdrawing their funds. For that, a separate instrument is needed: a freezing order.

In crypto matters, disclosure and freezing applications are typically pursued together – sometimes in the same hearing, sometimes on staggered timelines depending on the speed of the tracing work. The sequencing matters. If the on-chain evidence is strong enough to identify the exchange account before the identity is confirmed, it may be possible to obtain an interim freezing order over the account – framed against persons unknown – at the same time as, or even before, the disclosure order is served.

A worldwide freezing order can, in principle, reach assets outside the forum, subject to conditions and safeguards. In a crypto context, where the "location" of a digital asset is a contested legal question in many jurisdictions, the practical effect is often that the order is served on the exchange as the custodian of the asset, and the exchange is directed not to permit any dealing with the identified wallet balance.

The combination of disclosure and freezing – served on the exchange on the same day, without notice to the account holder – is the standard Axiom Trace approach where the facts support it. Disclosure identifies; the freezing order holds. The gap between the two is the moment of greatest risk. In our experience, that gap is measured in hours, and the application timetable must be built around closing it.

After the freeze, enforcement follows: a judgment or arbitral award in the underlying dispute, recognition and enforcement in the jurisdiction where the assets sit, and ultimately conversion of the frozen balance into a recovery. That downstream process takes weeks to months. But the freeze is what makes it possible at all.

Contrasting Positions: Does the Disclosure Order Strategy Actually Work?

It is worth addressing the sceptical position directly, because it is not without force.

Critics of the disclosure order approach point to several structural weaknesses. First, sophisticated wrongdoers do not leave funds on a centralised exchange. By the time a court order is served, the account may be empty. The disclosure order produces a name and an address – useful for the underlying claim – but nothing to freeze. Second, exchanges with international user bases may receive disclosure orders from multiple jurisdictions and have inconsistent compliance policies, meaning the outcome depends more on the exchange's internal processes than on the legal merit of the application. Third, in cross-border matters, the time required to domesticate a foreign order may exceed the time the funds remain on the platform.

These criticisms are accurate as far as they go. But they describe situations where the disclosure order strategy has been applied too slowly or without sufficient parallel action, not situations where the strategy is inherently unworkable.

The counter-position – which reflects our experience in this work – is that disclosure orders are most effective when they are pursued as part of a coordinated multi-step application: on-chain tracing first, freezing application second, disclosure third (or concurrently), with allied counsel in the exchange's jurisdiction standing by to domesticate the order within hours. That architecture removes most of the timing risk. What remains is the factual question of whether the funds are still on the platform when the order is served.

Is there a scenario in which the funds have moved before the order can be served? Yes. Does that mean the recovery is over? Not necessarily. The disclosure may still identify the wrongdoer for the purposes of the underlying claim. The traced path may lead to a second exchange, a bank account, or a stablecoin holding that offers a fresh choke point. A lost window at one exchange is not the end of the matter; it is a reason to accelerate work at the next.

What disclosure orders cannot do is recover funds that have been cashed out into an unregulated system with no legal presence anywhere. That is a genuine limit. Honest practitioners acknowledge it.

Consider a matter we coordinated in the Asia-Pacific region in autumn 2024 involving a business email compromise that routed funds through several wallets before deposit at a centralised exchange. The on-chain trail was documented within a working day. A coordinated application – freezing order and disclosure order, served on the exchange simultaneously – produced account identification within days and preserved a balance that was still on the platform. The underlying claim proceeded with a named defendant and a frozen asset. That is the best-case version of this strategy. It worked because the speed of the tracing matched the speed of the application.

To assess whether a similar approach is viable on your facts, contact us at info@axiomtracel.com for a confidential case review.

Practical Viability: What Makes a Disclosure Application Strong or Weak?

Not every crypto fraud produces a viable disclosure application. The decision to file should be driven by an honest assessment of four factors.

First, the quality of the on-chain trail. Is the movement from the victim's wallet to the exchange account documented by blockchain-analytics evidence that a court will find reliable? A clean, direct trail – victim wallet to deposit address in two or three hops – is much stronger than a fragmented trail through mixers or multiple chains. The latter can still be followed, but it requires more analysis time and more evidential explanation in the supporting materials.

Second, the jurisdiction of the target exchange. Is the exchange registered somewhere that can be served? Does it have a compliance function that will respond to a court order? Has that jurisdiction developed its disclosure order practice to cover digital assets? These questions have different answers for a major regulated exchange and for a smaller offshore platform.

Third, the timing. How long ago did the theft occur? Are the funds likely still on the platform? For a matter that is weeks old, the funds may already be gone. For a matter that is hours or days old, the urgency of the application is the dominant factor. Every additional day between the theft and the application reduces the probability that the funds remain on the platform.

Fourth, the proportionality of the exercise. A disclosure application involves legal costs in the application jurisdiction and potentially in the exchange's jurisdiction. The amount at stake must justify those costs. For very small sums, the arithmetic may not work. For claims in the mid-five figures and above, the calculation becomes more favourable. For high-value matters, the disclosure order is almost always worth pursuing.

The asset tracing service at Axiom Trace includes a viability assessment before any application is filed. That assessment covers the four factors above and gives the claimant an honest read on the prospects before costs are committed.

Related Topics in Crypto Asset Recovery

• Crypto Asset Recovery – practice overview: the full picture of on-chain tracing, exchange choke points, and digital asset freezing.
• Digital asset disclosure orders in Nevis: how an offshore jurisdiction has developed its disclosure order practice for crypto matters.

Frequently Asked Questions

Q: Can stolen crypto really be traced and frozen?

A: Yes – conditionally. Public blockchains record every transaction permanently. Blockchain-analytics tools can follow stolen funds from a victim's wallet to a deposit address at a centralised exchange. If those funds are still on the exchange, a coordinated application for a disclosure order and a freezing order can identify the account holder and prevent withdrawal. The critical variable is timing: the sooner the application is filed after the theft, the better the prospects. No outcome is guaranteed, and results depend on the specific facts of each matter.

Q: How quickly do I need to act after a crypto theft?

A: As quickly as possible – ideally within hours of discovery. A freezing or disclosure application is typically made without notice to avoid tipping off the wrongdoer, and the process can produce an emergency order within hours to days in jurisdictions with a well-developed crypto recovery practice. Every additional hour after the theft is an hour in which the wrongdoer can request a withdrawal from the exchange. If the funds have already left the platform, the disclosure order may still identify the wrongdoer but the freezing window will have closed. Early contact with a recovery specialist is the single most important step.

Q: How is a real recovery specialist different from a recovery scam?

A: A legitimate recovery specialist – like Axiom Trace – uses recognised legal instruments: Norwich Pharmal orders, freezing orders, disclosure applications filed in real courts. We describe what can and cannot be done on the specific facts; we do not promise recovery or guarantee a percentage return. Recovery scams typically approach victims who have already lost funds, ask for upfront fees, and either disappear or deliver nothing. They offer certainty where none exists. Any service that promises to return your crypto for a fee paid in advance, without court proceedings, is not a recovery service. It is a second fraud.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed.

We regularly advise on time-critical matters where on-chain tracing and a disclosure application must move in parallel. We have coordinated recovery work across multiple jurisdictions and asset classes, always anchored in realistic assessment of what the evidence and the available legal instruments can achieve. No outcome is guaranteed; honest case assessment is the starting point for every engagement. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.