How stablecoin freezes work in practice

On paper, a stablecoin transfer takes seconds. By the time a victim refreshes their wallet, the balance reads zero – and the assumption that follows is almost always wrong. Movement on a public blockchain is permanent, but it is not invisible. Every transfer leaves an immutable record, and that record is the starting point for a freeze.

Stablecoin freezes work through a two-track process: on-chain tracing establishes where the funds went, and legal process – typically a court order directed at the stablecoin issuer or a centralised exchange – compels a freeze of the identified wallet balance. Neither track works without the other, and timing determines whether both remain available. The window between transfer and cash-out is often narrow, measured in hours rather than days.

This analysis examines how each track operates, where the two converge, what can go wrong, and how the approach shifts when funds cross jurisdictions or move through mixing or bridging steps. It is written for practitioners, funders, and principals who need to understand the mechanics before deciding whether to act.

Why stablecoins are different from other crypto assets in a recovery context

Most stolen crypto moves through assets where no single issuer controls supply. Stablecoins are different. A centralised stablecoin issuer retains the technical ability to freeze a specific wallet balance – effectively blacklisting the address so that the tokens become immovable. That capacity is exercised by the issuer in response to valid legal process, and in some cases voluntarily when law enforcement or a court makes a sufficiently documented request.

That distinction matters enormously in practice. With a decentralised asset, the practical recovery route runs through a centralised exchange choke point: trace the funds to a point where they are deposited, then freeze the deposit account. With a stablecoin, a second route exists: freeze the tokens at the wallet level, before they ever reach an exchange. The wallet itself becomes the subject of the order.

We have traced stablecoin proceeds through chains of wallets that, at first glance, appeared designed to obscure origin. The on-chain footprint did not disappear. It compressed the search to a set of candidate wallets before a cash-out was attempted. That compression is what makes the issuer-level freeze feasible: you know which address to target.

Does that mean every stablecoin theft is recoverable? It does not. The issuer-level freeze requires that the tokens remain in a form controlled by that issuer. Once converted to a decentralised asset, or bridged to another network, the issuer loses that lever. Speed and chain-of-custody on the tracing side determine whether the issuer-level route is still open when you call.

Track one: on-chain tracing and how it builds the case for a freeze

On-chain tracing is the discipline of reconstructing the movement of funds across a public blockchain using the transaction record itself. Public blockchains are transparent by design: every transfer of value is recorded on-chain, permanently and in sequence, regardless of whether the parties involved intended that transparency. The challenge is interpretation, not access.

The trace begins at the originating wallet – typically the victim's address or the address of a compromised smart contract. From there, the trail follows the funds through successive transfers. Each hop is recorded: sender, receiver, amount, timestamp, transaction hash. Blockchain-analytics tools accelerate the clustering and attribution work, but the underlying data is public. The same record that the perpetrator cannot alter is the record that anchors the evidence bundle submitted to court.

What does "wallet clustering and attribution" actually mean? It means grouping addresses that behaviour patterns suggest are controlled by the same entity, and then testing whether any of those addresses can be linked to a known identity – for example, a verified account at a centralised exchange, or a public UBO register entry for a corporate wallet. Attribution converts an anonymous on-chain address into a target against which legal process can be directed.

Three patterns regularly complicate the trace. First, layering through multiple wallets in rapid succession, sometimes dozens, within minutes of the initial theft. Second, the use of automated swap protocols to convert the stablecoin to another asset mid-flight. Third, bridging: moving the value from one blockchain to another, which severs the continuous on-chain record and requires the analyst to pick up the trail on the destination chain. None of these steps is fatal to the trace. Each adds time and complexity, and time is the variable the perpetrator is exploiting.

The output of the tracing phase is a documented chain of custody: a visual and tabular record of every wallet that touched the funds, with timestamps, and an attribution assessment identifying any wallet that can be linked to an identifiable entity. That document is what counsel uses to draft the application for a freezing order or a disclosure order against a VASP.

Track two: what legal process compels the freeze?

Legal process is the bridge between the on-chain evidence and the real-world immobilisation of the funds. In appropriate cases, a court can grant a proprietary injunction or a freezing order directed at a stablecoin issuer, compelling it to freeze the balance of a specified wallet address – this is one of the most direct recovery tools available in crypto asset recovery.

Several instruments are relevant, and they interact. A proprietary injunction asserts the claimant's continuing proprietary interest in the stolen funds: the claim is that the tokens are still, in equity, the claimant's property. That proprietary claim survives through wallet hops, provided the tracing chain is unbroken. It is the doctrinal basis on which courts have accepted that the claimant retains sufficient interest to justify interim relief.

A worldwide freezing order extends the reach of the court's injunctive power to assets wherever they are held. Where the stolen tokens sit in a wallet connected to a VASP operating in a different jurisdiction, the worldwide freezing order is the instrument that asks the court to reach across that border. Enforcement of the order in the foreign jurisdiction then requires either direct recognition or a parallel application – which is where coordination with local counsel becomes critical.

A proprietary injunction against "persons unknown" addresses the situation where the perpetrator's identity has not yet been established. Courts in several common-law jurisdictions have granted such relief, treating the on-chain evidence as sufficient to identify the subject by their conduct and wallet address, even without a name. The order can be served by NFT airdrop to the wallet in question in appropriate cases.

A disclosure order against a VASP – analogous to a Norwich Pharmal order – compels the exchange or wallet service to provide account information linked to a target address. This is the standard disclosure tool when attribution requires information that only the service holds: KYC data, linked bank accounts, IP logs. The information obtained then supports either the proprietary claim or a separate civil fraud action against an identified defendant.

A Bankers Trust order serves a comparable function when the receiving entity is a bank rather than a VASP: it compels the bank to disclose account information to assist the tracing exercise.

The application for all of these is typically made without notice to the defendant. The reason is obvious: notification gives the target time to move the assets before the order takes effect. The gagging or no-notification order – which restrains any notified third party, such as the exchange, from telling the account holder that an order has been made – is a standard ancillary to the main without-notice application.

Which instrument is most useful in a given case depends on where the funds currently sit, how far attribution has progressed, and which forum the claimant can access with sufficient urgency. There is no universal answer. In our experience, the choice of instrument is often made in the first hours after the trace identifies a likely choke point.

How the two tracks converge: the mechanics of a stablecoin freeze in practice

The convergence of tracing and legal process is not a sequential handoff – it is a parallel operation under time pressure. Here is how that typically unfolds.

Within hours of the theft, the tracing team maps the movement of the stolen tokens and identifies any wallet that can be attributed to an identifiable entity, or any wallet still holding the original stablecoin balance. If the tokens remain in a stablecoin form controlled by a centralised issuer, two paths open simultaneously: a direct approach to the issuer and a parallel court application.

The direct approach to the issuer involves a documented, legally supported request asking the issuer to freeze the identified wallet balance pending court order. Some issuers will act voluntarily on a well-documented request from a law firm acting for the victim, particularly where the evidence of fraud is clear. Others require a court order before acting. Neither outcome is guaranteed; the strength of the request depends entirely on the quality of the on-chain evidence behind it.

The parallel court application seeks the proprietary injunction, freezing order, or both, with a supporting evidence bundle built on the on-chain trace. Courts in active common-law recovery hubs can issue without-notice orders within days when the urgency is established. The order, once granted, is served on the issuer, the exchange, or both, triggering the operational freeze of the relevant wallet or account.

What happens when those two paths arrive simultaneously at the issuer? The issuer's legal team assesses the court order, confirms the wallet address against its own records, and executes the freeze at the contract level. The tokens become immovable. The perpetrator cannot transfer, swap, or withdraw them. That immobilisation is what creates the conditions for the next step: enforcement.

Consider a matter we worked on in Asia, spring 2024, involving stablecoin proceeds in the high seven figures. The funds moved through four wallets within ninety minutes of the initial transfer. Attribution identified the fourth wallet as a deposit address at a centralised exchange registered in a common-law jurisdiction. A without-notice application, supported by the full on-chain trace, produced a freezing order within forty-eight hours. The exchange froze the deposit account. The issuer separately blacklisted the wallet address after receiving the court order. The defendant was identified through the KYC disclosure that followed. The recovery process then moved to enforcement against an identified defendant with frozen assets.

That sequence is the best-case scenario. It requires that the funds have not been converted or bridged before the application is made. It requires a court that can act with urgency. It requires an issuer and exchange that respond to legal process. All three conditions do not always align.

Where freezes fail: the friction points across borders and chains

The conditions for a successful stablecoin freeze are more demanding than the headline tool suggests. Understanding where the process breaks down is as important as understanding where it works.

The first and most common failure is conversion before the freeze. If the stolen stablecoins are swapped for a decentralised asset before the issuer-level freeze can be executed, the issuer loses its ability to blacklist the balance. The tracing chain survives – the swap transaction is on-chain – but the recovery route now depends entirely on the exchange choke point rather than the issuer. That is a harder path in many jurisdictions.

The second friction point is jurisdictional fragmentation. A worldwide freezing order issued by a court in one jurisdiction does not automatically bind an issuer or exchange based in another. Recognition and enforcement require either a treaty mechanism or a separate application in the foreign court. Where the relevant exchange is based in a jurisdiction with limited cooperation with the claimant's home forum, the order may be unenforceable without a parallel proceeding. We coordinate closely with local counsel in the relevant jurisdiction in those situations; local procedure governs what can be filed and in what timeframe.

Bridging introduces a third complication. When funds are moved from one blockchain to another through a bridge protocol, the on-chain record on the origin chain shows the funds entering the bridge contract and stopping. The trail resumes on the destination chain, but the two chains are not natively connected. Picking up the trail requires bridge-specific analytics and, sometimes, access to bridge operator data. Some bridges are decentralised with no operator to compel. Others have identifiable operators who can be reached by disclosure order, but the jurisdictional question then applies to them.

Mixing and privacy-enhancing protocols add a fourth layer. These are designed explicitly to sever the tracing chain. In practice, no mixer is perfectly opaque to a well-resourced tracing operation – patterns in timing, amounts, and entry/exit behaviour often survive analysis. But the evidential standard required to support a proprietary injunction rises when the trace is probabilistic rather than deterministic, and courts assess those applications differently.

A fifth failure mode is delay on the claimant's side. The victim discovers the loss and spends the first twenty-four hours attempting to resolve it informally, or investigating internally without engaging a tracing team. By the time a formal application is prepared, the funds have moved twice more. In our experience, every day of delay after a crypto theft narrows the realistic options. The on-chain footprint does not expire – but the issuer-level freeze window and the exchange deposit window both close as the perpetrator moves closer to a successful cash-out.

Contrasting positions: should victims rely on the issuer's voluntary freeze or pursue court process?

There is a genuine debate in practice about whether a claimant in a strong position should move directly to court or engage the issuer first. Both positions have merit; the right answer is almost always: both, in parallel.

The case for prioritising direct engagement with the issuer rests on speed. A major stablecoin issuer with a well-developed compliance function can, on a documented request, execute a wallet freeze faster than any court can issue an order. The operational freeze is a database update. The court process, even on an urgent without-notice basis, takes hours to days. If the evidence is clear and the request is well-supported, the issuer route may produce an interim freeze before the court order is even drafted.

The case against relying solely on voluntary issuer cooperation is straightforward. The issuer acts in its own interest and on its own assessment of the request. It may require a court order before acting. It may be headquartered in a jurisdiction where the claimant has limited leverage. It may have its own legal process requirements that add delay. A freeze based solely on the issuer's discretion is also more easily challenged by the perpetrator than a court-ordered freeze, because it lacks the judicial imprimatur that binds third parties.

The practical resolution is that a competently run stablecoin recovery begins with simultaneous engagement: the tracing team outputs the evidence bundle; legal counsel begins drafting the without-notice application; and a parallel request is made to the issuer's compliance or legal response team, referencing the pending court application. The court order, when granted, serves as the formal basis for the freeze. The issuer engagement may produce an earlier operational freeze that preserves the position until the order arrives.

What about victims who receive unsolicited approaches from "recovery specialists" claiming they can recover stolen crypto without legal process, for an upfront fee? No recovery specialist can circumvent court process to compel an issuer or exchange to return funds; any claim to the contrary is a red flag for a secondary fraud. Legitimate recovery work follows the legal track described above. It does not promise outcomes, and it does not ask victims to pay upfront fees in advance of any process being commenced. The recovery scam targeting fraud victims is one of the most prevalent secondary victimisation patterns we see – and it is worth naming plainly.

The cross-border dimension: enforcement after the freeze

Freezing the assets is not recovery. It is the precondition for recovery. The step that follows – converting the frozen position into actual return of value to the claimant – requires enforcement, and enforcement is where cross-border complexity is most acute.

Where the frozen assets are held at an exchange, enforcement depends on the legal regime governing that exchange. A court order directing the exchange to transfer the frozen balance to the claimant requires that the court has jurisdiction over the exchange and that the exchange is obliged to comply. Where the exchange is in the same jurisdiction as the court, this is relatively straightforward. Where the exchange is overseas, the claimant needs either a judgment recognised under the enforcement rules of the exchange's jurisdiction, or a fresh application in that jurisdiction.

Enforcement of a foreign judgment or arbitral award in the exchange's jurisdiction follows the recognition and enforcement regime of that jurisdiction. For arbitral awards, the New York Convention provides a widely ratified framework for recognition across most states. For court judgments, recognition depends on bilateral or regional treaty arrangements, or common-law reciprocity rules. Neither route is automatic, and neither is fast. The realistic timeline for cross-border enforcement runs to weeks or months, depending on the jurisdiction.

That timeline is one reason why the initial freeze matters so much. A frozen position does not dissipate. It may lose value if the underlying asset is volatile – though a stablecoin freeze does not carry that risk, by definition – but it remains available for enforcement proceedings. The freeze buys time. Time is what the enforcement process requires.

The practical cross-border strategy for a stablecoin recovery that involves a foreign exchange or issuer will typically involve: the primary court in the claimant's preferred forum issuing the freezing and disclosure orders; local counsel in the exchange's jurisdiction being retained to obtain recognition of those orders or to file parallel applications; and the tracing and evidence team maintaining the integrity of the on-chain record throughout, because that record is the basis of every application in every forum.

For a more detailed examination of how the on-chain tracing process integrates with enforcement strategy, see our analysis at the Axiom Trace crypto recovery insight centre. For an account of how these principles applied in a specific cross-border matter, the case study on tracing fraud proceeds through Malta illustrates several of the patterns described here.

If you are at an earlier stage – assessing whether tracing and freezing is a realistic option for a specific set of facts – our asset tracing service page at axiomtracel.com/services/asset-tracing/ sets out the viability indicators we apply.

What a realistic stablecoin recovery engagement looks like

The question practitioners and principals most often ask at the outset is: what exactly does Axiom Trace do, and when does it stop?

The engagement begins with a rapid triage: the victim provides transaction details, the tracing team runs an initial on-chain review, and within a short window we can usually confirm whether the funds are still in a form that supports an issuer-level or exchange-level freeze. That initial assessment shapes the advice on urgency and the choice of forum.

If the matter is viable, the tracing work deepens: full wallet clustering and attribution, documentation of the chain of custody, identification of the most accessible choke point. That output is handed to legal counsel – our own or co-counsel in the relevant jurisdiction – who uses it to draft the without-notice application. We remain involved throughout the court process as the source of the technical evidence, updating the trace as the defendant's wallet activity continues.

Post-freeze, our role typically shifts to supporting the disclosure phase: using the KYC and account information obtained through the disclosure order to build the civil fraud case or the enforcement application. The on-chain and off-chain evidence are assembled into a package that is usable by litigation counsel or insolvency practitioners moving toward judgment and enforcement.

What we do not do: we do not promise recovery. We do not guarantee that a freeze will be obtained, that the assets will still be in place when an application is made, or that enforcement will succeed. Asset recovery in the crypto context is conditional on facts that change in real time. A realistic engagement acknowledges those conditions openly and allocates effort to the steps that remain actionable given the current state of the chain.

A matter in the Gulf, late 2025, involving a mid-seven-figure stablecoin transfer, illustrates the limits as clearly as it illustrates the possibilities. The tracing team traced the funds through six wallets to a known exchange. The exchange operated in a jurisdiction where the claimant's court had no direct enforcement mechanism. A parallel application in the exchange's jurisdiction was filed by local counsel. The exchange froze the account. But the defendant had partially converted a portion of the balance to a decentralised asset before the freeze executed. That portion was unrecoverable by the issuer-level route. The recovery was partial, not complete. The partially recovered amount was nonetheless material. An honest assessment of those probabilities at the outset shaped the decision to proceed – and the funding structure that made it viable.

Related analysis

• Crypto Asset Recovery – insight centre: on-chain tracing methods, exchange choke points, and freezing digital assets across borders.
• Asset Tracing service: how we assess viability and structure a tracing engagement from first contact to freeze.
• Case study – tracing fraud proceeds through Malta: a cross-border matter illustrating how on-chain and off-chain evidence combine in enforcement.

Frequently asked questions

Q: Can stolen crypto really be traced and frozen?

A: Yes, in many cases. Public blockchains record every transfer permanently and transparently, which means on-chain tracing can follow the movement of stolen funds even through chains of wallets. Where those funds reach a centralised exchange or remain in a stablecoin form controlled by an identifiable issuer, legal process – a proprietary injunction, a freezing order, or a disclosure order against a virtual-asset service provider – can immobilise them. Recovery is not guaranteed; it depends on how quickly the funds are traced, whether they have been converted or bridged, and which jurisdictions are involved. But the starting premise that crypto is untraceable is wrong.

Q: How quickly do I need to act after a crypto theft?

A: Urgency is real. The window for an issuer-level stablecoin freeze can close within hours if the stolen tokens are swapped to a decentralised asset. The window for an exchange-level freeze closes when the deposit account is withdrawn. Without-notice court applications in active common-law jurisdictions can produce orders within days, but the evidence bundle must be ready before the application is filed. In our experience, every day of delay narrows the available options. The on-chain record does not disappear, but the actionable choke points do. Contact a tracing team as soon as the theft is confirmed, not after internal investigation is complete.

Q: How is a real recovery specialist different from a recovery scam?

A: A legitimate specialist follows the legal process described above: on-chain tracing, court orders, coordination with exchanges and issuers, enforcement. No recovery specialist can bypass that process or guarantee that funds will be returned. If someone approaches you after a crypto loss offering to recover your funds without court involvement, for an upfront fee paid in crypto, that is a strong indicator of a secondary fraud – known as a recovery scam – targeting victims of the original theft. Legitimate recovery work is structured around identifiable legal instruments, verifiable steps, and honest assessment of viability. It does not promise outcomes.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In crypto matters, our tracing work has supported without-notice applications across multiple jurisdictions and directly informed the evidence bundles used to obtain proprietary injunctions and disclosure orders against virtual-asset service providers. We apply the same forensic discipline to matters of all sizes, and we give an honest assessment of viability before any engagement begins. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.