A payment leaves your wallet on a Tuesday afternoon. By Wednesday morning it has moved through three addresses, crossed into a centralised exchange, and the person who sent it is unreachable. The instinct is despair. The professional instinct is different: open the block explorer and start counting hops.
Stolen crypto can be traced and frozen in the United States, provided action begins before the assets reach a cash-out point or move beyond the reach of domestic process. The primary tools are a temporary restraining order or preliminary injunction, combined with a disclosure order directed at a virtual-asset service provider (VASP) or centralised exchange, and on-chain tracing to identify the wallet or account where funds are held. Speed is the controlling variable. Every hour of delay narrows the window.
This guide walks through the step-by-step process: from the first hours after discovery, through on-chain tracing and court process in the United States, to the cross-border complications that arise when stolen assets move offshore before a freeze can be secured.
Why the United States Is a Critical Forum for Crypto Asset Recovery
The United States is one of the most effective jurisdictions for freezing digital assets, because a significant share of global centralised exchange activity either originates in, or routes through, US-regulated entities. That creates a choke point.
Several features make US process particularly useful. Federal courts can issue temporary restraining orders and preliminary injunctions on an ex parte basis – meaning without prior notice to the defendant – where there is a credible risk of dissipation. The court can also order an exchange to freeze a specific account or wallet balance while proceedings continue. Separately, a mechanism analogous to third-party disclosure is available to compel a VASP or financial institution to identify an account holder or produce transaction records, even before a defendant is fully identified.
For a claimant chasing funds across two legal systems, the hard part is not the claim – it is timing. A US centralised exchange will act on a valid court order within hours. The difficulty is getting that order in place before the funds move to a non-custodial wallet, convert to another token, or exit to an offshore platform outside US jurisdiction.
As of early 2026, US courts have continued to develop their approach to crypto-specific relief, including orders served by NFT airdrop on unidentified defendants and injunctions directed at stablecoin issuers. That expanding toolkit matters – but it does not remove the fundamental constraint: assets move faster than orders, so the first 24 to 48 hours after discovery are decisive.
Step 1: Preserve Evidence in the First Hours
The single most important action after discovering a theft is preserving the on-chain evidence before anything else changes. This step costs nothing and takes minutes; skipping it can complicate every subsequent step.
Record the transaction hash, the sending and receiving wallet addresses, the timestamp, and the block height for each transaction you can identify. Take screenshots of every exchange interface, email, message thread, or website that formed part of the scheme. Do not delete any communications, even ones that seem irrelevant. Do not attempt to contact the other party in a way that might prompt them to move funds.
Simultaneously, make a written note of how the funds were sent – which wallet, which exchange account, what authorisation was given – and by whom. That internal record will be the foundation of any witness statement filed in support of an injunction application.
Public blockchains are transparent: every on-chain movement is recorded and retrievable, even years later. The blockchain itself does not degrade. What does degrade is the off-chain evidence – server logs, email records, platform records at exchanges – which can be deleted or overwritten. Preserve whatever you can reach before seeking legal process to compel disclosure from parties who hold more.
In our experience, victims who act within the first few hours – even just to record transaction hashes and notify their own bank or platform – are measurably better placed than those who wait for advice before doing anything at all.
Step 2: On-Chain Tracing – Following the Money to a Choke Point
On-chain tracing maps the movement of stolen funds from the originating wallet through subsequent addresses to a point where the assets either rest or exit the blockchain. The goal is to identify a choke point: a custodial account at a regulated VASP where legal process can reach the funds.
Blockchain-analytics tools allow a specialist to cluster wallet addresses that are likely controlled by the same person, identify known deposit addresses belonging to centralised exchanges, and flag movement into privacy-enhancing protocols or cross-chain bridges. Each hop in the chain is documented.
The tracing process has two outputs. First, a trail: a documented sequence of transactions showing where the money went. Second, an attribution: an assessment of which exchange or platform currently holds the funds, or received them before a further transfer. That attribution is what drives the legal application – you need to know which entity to name in the order and which court has jurisdiction over it.
Several complications arise regularly in practice. Funds may pass through a mixer or tumbler, fragmenting the trail across many addresses. They may convert from one token to another – sometimes several times in quick succession. They may move from a chain with strong exchange coverage to one with weaker regulated infrastructure. None of these steps makes the trail impossible to follow; each one takes time, and time has a cost measured in the distance assets travel.
We have traced funds through multi-hop sequences across three chains before identifying a single custodial exchange account that could be the subject of a US court order. The trail existed; finding it required systematic work, not guesswork.
Step 3: Securing a Temporary Restraining Order or Preliminary Injunction in the United States
Once tracing identifies a custodial account or wallet at a US-regulated entity, the next step is applying to a federal or state court for an order freezing that account or balance pending the outcome of the underlying claim.
A temporary restraining order can be granted on an ex parte basis – without notifying the defendant – where the applicant demonstrates a likelihood of success on the merits of the claim, a risk of irreparable harm if the order is not made, and that the balance of hardship favours the applicant. In a crypto theft matter, the risk of irreparable harm is usually straightforward to establish: assets can move in minutes, and a defendant given notice will do exactly that.
An ex parte application is typically heard within hours to days of filing. Speed depends on the court, the completeness of the evidence presented, and whether the applicant can demonstrate urgency convincingly. A well-prepared application – with the on-chain trace, a witness statement, and a proposed order in hand – moves faster than one assembled in haste.
The order will typically identify the specific wallet address or exchange account to be frozen, name the exchange as a third party required to comply, and set a return date on which the defendant (if identified) can be heard. The exchange will act on the order promptly in most circumstances; a US-regulated VASP cannot ignore a domestic court order without serious consequences.
Where the defendant is not yet identified – for example, where the thief has used pseudonymous wallets – courts have shown willingness to issue injunctions against "persons unknown", naming the defendant by their wallet address or pseudonym. That approach allows the freeze to be secured before identification is complete, which is often the right sequencing: freeze first, identify second.
Step 4: Compelling Disclosure from a VASP or Exchange
Freezing an account is only half the task. The other half is identifying who controls it. A disclosure order directed at the exchange compels production of know-your-customer (KYC) records, account details, IP logs, and transaction history for the account holding the stolen assets.
In the United States, a mechanism similar to third-party disclosure – sometimes pursued through a discovery mechanism available to foreign and domestic litigants – can be used to compel a VASP or financial institution to produce records even before full proceedings are on foot, provided the applicant can show the records are relevant to a claim and cannot be obtained elsewhere. This is a powerful tool for identifying otherwise anonymous wrongdoers.
The records obtained from an exchange typically include identity documents, verification photographs, linked phone numbers and email addresses, and the withdrawal addresses to which funds were moved. That package often provides enough to name a defendant, issue proceedings against them, and – where assets have moved further – to trace the next hop in the chain.
For matters where funds have moved to an exchange in a different jurisdiction before a US order can be served, the US disclosure process can still be useful: it may reveal the downstream platform and the account details needed to commence parallel proceedings abroad. We coordinate closely with admitted local counsel in other jurisdictions when that step is necessary; local procedure governs the filing, but the evidentiary package comes from the US process.
There is a specific category worth mentioning separately. Where stolen funds convert into a US-dollar stablecoin – a common pattern, because stablecoins offer liquidity and relative stability – the stablecoin issuer can, on appropriate legal process, freeze specific token balances. Stablecoin issuer freezes are among the fastest-acting tools in crypto asset recovery: once the order is in place, the issuer can act within hours. Reaching that point still requires identifying the wallet, but the freeze itself is technically straightforward.
Step 5: Cross-Border Complications – When Funds Exit the United States
The most common complication in US crypto recovery matters is that funds move offshore before – or concurrent with – a US freeze application. A defendant who anticipates legal pressure may withdraw from a US exchange to a non-custodial wallet, then deposit at an offshore platform. That sequence removes the US choke point.
What remains is the on-chain trail. The trail does not disappear when funds leave US jurisdiction; it continues on-chain, and it can be followed to wherever the funds land next. The question becomes: which jurisdiction's courts and VASPs can be engaged at the next choke point?
Several offshore platforms that receive stolen crypto operate in jurisdictions with their own asset-recovery tools and their own timetables. Some are responsive to letters rogatory or letters of request transmitted through judicial cooperation channels. Others require a local proceeding filed by local counsel. We have coordinated matters that required simultaneous or sequential proceedings in multiple jurisdictions – the US proceeding to freeze what was there, and a parallel proceeding elsewhere to address what moved.
The recognition and enforcement of foreign judgments and arbitral awards under the New York Convention can also be relevant where a claimant has obtained a judgment or award in one jurisdiction and needs to enforce it against assets located in the United States. That process is distinct from the emergency freezing process described above, and typically slower – but it is an important tool for matters where the judgment exists but the assets have subsequently moved into the US.
Asset recovery in the United States is not straightforward when funds are already offshore. But the US proceeding often has residual value: KYC records, transaction data, and account history obtained through US disclosure process can support the foreign proceeding. The two processes feed each other. Explore our crypto asset recovery resource hub for further analysis of how these cross-border sequences work in practice.
Viability Signals – When a US Freeze Application Is Worth Pursuing
Not every crypto theft generates a viable freeze application. Honest assessment at the outset saves time and cost.
The strongest cases for a US freeze application share several features. The stolen funds are currently held, or recently were held, at a US-regulated VASP. The amount involved justifies the cost of emergency legal proceedings (which involves court filing fees, counsel time, and tracing-specialist time). The on-chain trail is sufficiently clear to identify the account to be frozen. And the theft occurred recently enough that there is a reasonable prospect the funds have not yet moved beyond reach.
Weaker cases – where the funds moved through a mixer immediately, where the receiving platform is entirely offshore with no US nexus, or where the sum involved is modest relative to the cost of proceedings – may still have options, but those options may sit in a different jurisdiction or require a different strategy. The viability question is always specific to the facts; generic answers are not reliable guides. You can take an initial read on your matter using the United States jurisdiction guide, which sets out the procedural environment in more detail.
Two scenarios to illustrate the range:
A matter in North America, autumn 2024, involving funds in the mid six figures that moved from a victim's exchange account to a wallet and then to a second US-based platform. The on-chain trace was complete within 24 hours. A temporary restraining order was filed the following morning. The exchange complied. The account was frozen, the KYC records identified the account holder, and the matter proceeded to negotiated recovery.
A separate matter, also touching the US, spring 2025, involving funds in the high six figures that moved through four hops before exiting to an offshore platform with no US regulatory nexus. The US process yielded KYC records from the intermediate exchange – which identified the defendant – but the freeze had to be pursued through a different jurisdiction where the funds eventually settled. The US step was still worth taking; it provided the identity evidence that made the offshore step viable.
The pattern is consistent: where US-regulated entities are in the chain, US process is almost always worth engaging. Where funds have fully exited, the US step may still contribute evidentiary value to the next forum.
Common Objections – and What the Evidence Actually Shows
The most persistent misconception we encounter is that once crypto leaves a wallet, it is untraceable and nothing can be done. That view is understandable – it matches the marketing of many scams – but it is incorrect as applied to the majority of thefts.
Public blockchains are transparent. Every transaction is recorded, time-stamped, and retrievable. The movement of stolen funds leaves a trail that can, in most cases, be followed to a point where regulated infrastructure intersects with the chain. That intersection is where legal process can act.
A related misconception is that on-chain tracing is only useful if the thief made mistakes. In practice, the constraint is not the thief's caution; it is the infrastructure they use. Cashing out meaningful amounts of crypto into fiat currency almost always requires a regulated VASP with KYC requirements. That is the structural choke point that makes recovery possible, regardless of how carefully the intervening hops were managed.
A third misconception – and one worth addressing directly, because it causes additional harm to victims – is that paying a fee to an organisation that promises guaranteed crypto recovery will produce results. It will not. What it will produce is a second loss. Real recovery work requires legal process, court orders, and exchange compliance. It costs money, takes time, and produces conditional outcomes – not guarantees. Anyone offering a guaranteed percentage return of stolen crypto, in exchange for an upfront fee, is operating a recovery scam.
The honest position is this: crypto asset recovery in the United States is viable in the right circumstances, conditional on the evidence, the location of the funds, and the speed of action. It is not guaranteed. It is not impossible. Those two facts are both true, and keeping them in tension is the basis of a realistic recovery strategy.
For a further view on how US proceedings intersect with offshore structures and exchange choke points in other regions, see our analysis of court orders against crypto exchanges in Curaçao, which addresses some of the most common offshore destinations for funds that exit the US chain.
The steps above cover the typical pattern in US crypto freezing matters. Your matter turns on specific facts: where the funds went, how quickly, which platforms are in the chain, and whether a US entity is still in scope. A confidential case review will tell you whether a freeze application is worth pursuing and what the realistic timeline looks like. Contact info@axiomtracel.com to request one.
Frequently Asked Questions
Q: Can stolen crypto really be traced and frozen in the United States?
A: Yes – and the United States is one of the more effective forums for this, precisely because a significant share of global exchange activity touches US-regulated entities. On-chain tracing can follow stolen funds across multiple hops and identify custodial accounts at those entities. A temporary restraining order or preliminary injunction can then freeze the account, often within hours of filing. The key variable is whether US-regulated infrastructure is still in the chain when the application is made. If funds have fully exited to offshore platforms, different forums apply – though the US disclosure process may still yield identity evidence that supports a foreign proceeding.
Q: How quickly do I need to act after a crypto theft?
A: Hours matter, not days. On-chain, funds can move through multiple hops in minutes. The window for a US freeze application is open only while funds are in a custodial account at a US-regulated virtual-asset service provider. Once those funds withdraw to a non-custodial wallet or deposit at an offshore exchange, the US choke point is gone. The first priority – which takes minutes, not legal advice – is recording every transaction hash, wallet address, and timestamp you can identify. The second priority is engaging a tracing specialist and local counsel to assess whether a court application is viable before the window closes.
Q: How is a real recovery specialist different from a recovery scam?
A: A legitimate crypto asset recovery engagement involves court proceedings, formal legal process, and engagement with regulated exchanges. It requires real on-chain tracing, a witness statement, a court application, and compliance by a regulated entity. It takes time and costs money – and it produces conditional outcomes, not guaranteed ones. A recovery scam, by contrast, promises guaranteed or near-guaranteed return of funds in exchange for an upfront payment, often claiming to have special access to exchanges, law enforcement, or blockchain tools. That claim is false. No specialist can guarantee recovery, and no one with genuine access to legal process needs to charge an upfront fee before showing you any evidence of progress. If someone has approached you offering guaranteed crypto recovery, treat it as a second fraud attempt.
About Axiom Trace
Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In the United States, we coordinate closely with admitted local counsel; local procedure governs the filing, and we provide the tracing intelligence and strategic coordination that drives the application. Our work is not guaranteed; recovery depends on the facts, the speed of action, and the courts and platforms in scope. To discuss a matter, contact info@axiomtracel.com.
Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace coordinates closely with admitted local counsel in the United States; local procedure governs the filing. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.
Recovering cross-border or crypto assets?
Confidential first review. We map tracing and recovery options and tell you honestly whether a matter is worth pursuing.
Request a case review