How VASPs respond to a lawful freeze request

A freeze request lands at a virtual-asset service provider (VASP). What happens next determines whether stolen crypto is held or lost forever. This analysis examines how VASPs actually respond to lawful freeze requests – the internal triage they run, the legal thresholds they apply, and the operational realities that accelerate or stall a recovery effort.

When a VASP receives a court-ordered freeze request or a disclosure order, it is not obliged to act on goodwill alone. The request must satisfy the VASP's internal compliance threshold, which varies by jurisdiction, corporate structure, and the specific instrument presented. A freezing order over digital assets, a disclosure order against a VASP, or a stablecoin issuer freeze each triggers a different internal workflow – and the gap between a request that succeeds in hours and one that stalls for weeks is almost always procedural, not substantive.

This analysis works through each stage: how VASPs classify incoming requests, the instruments that command the fastest compliance, where cross-border friction concentrates, and what practitioners and victims can do to improve the odds of a timely hold.

Why VASP Compliance Is Not a Binary Switch

The first thing to understand is that a VASP's compliance team does not read a court order and immediately freeze funds. It reads the order through the lens of its own compliance policy, the law of its registration jurisdiction, and the identity of the issuing court.

A freezing order over digital assets issued by an English or Singaporean court carries immediate weight with most major VASPs because those courts have broad international recognition. An equivalent instrument from a less-familiar forum may require a secondary layer of validation – sometimes a local court order in the VASP's home jurisdiction.

In our experience, the single most common cause of delay is a mismatch between the form of the instrument and the VASP's internal intake procedure. VASPs run triage roughly as follows: first, is this a lawful order from a recognised court or authority? Second, does it identify the account or wallet with sufficient precision? Third, does acting on it expose the VASP to liability in its own jurisdiction? Each question represents a potential hold point.

Practitioners in cross-border recovery note that VASPs are neither banks nor brokers – their compliance infrastructure has matured rapidly but unevenly. A centralised exchange with a large compliance team in a well-regulated jurisdiction will process a well-drafted freezing application in a matter of days. A smaller VASP registered in a lighter-touch regime may lack the internal process to handle a novel legal instrument at all.

Which Instruments Command the Fastest Response?

Speed of VASP compliance correlates closely with the instrument's form and the forum that issued it. Not all freeze requests are equal.

A proprietary injunction granted without notice – freezing specific token balances on an identified wallet – is the instrument most likely to produce a same-day or next-day response from a well-resourced VASP. It names the asset, identifies the wallet, and comes from a court the VASP recognises as having authority.

A disclosure order against a VASP – compelling it to disclose account information to identify the wrongdoer – is analytically different. It does not freeze anything immediately. But it is often the instrument that makes the freeze possible by revealing which wallet to target. Practitioners routinely seek both instruments in sequence, or in some cases simultaneously, to avoid the intelligence gap that allows funds to move while disclosure is awaited.

A stablecoin issuer freeze operates differently again. Where the asset is a stablecoin, the issuer controls a smart-contract mechanism that can freeze a specific balance on appropriate legal process. We have traced stolen stablecoin balances to a wallet and coordinated a freeze request directly to the issuer – a channel that exists independently of the VASP holding the wallet. The speed of that channel depends on the issuer's internal process, but it has in practice been faster than waiting for a full court order to work through a VASP's compliance queue.

A Bankers Trust order, adapted to crypto contexts, compels disclosure of account information. Where the VASP holds user data in a format analogous to a bank account – identity documents, IP logs, withdrawal history – this instrument is well-suited. The challenge is that not all VASPs treat themselves as holding "account" information in the traditional sense, and some resist disclosure on that basis.

What instrument works best depends on the specific facts: where the funds are, which VASP holds them, and how fast they are moving. That analysis is the starting point of any recovery effort.

For a confidential read on which instruments apply to your situation, contact info@axiomtracel.com.

How Does Cross-Border Friction Affect the Response Timeline?

Most crypto theft is cross-border by design. Stolen assets move through wallets in multiple jurisdictions within minutes of the theft. By the time a victim's lawyer identifies the VASP holding the funds, the trail may already span three or four legal systems.

The core friction is jurisdictional recognition. A freezing order from one court does not automatically bind a VASP registered in another country. The VASP may need to see a local court order – issued in its own jurisdiction – before it will act. That means two parallel proceedings: one to obtain the originating order, one to have it recognised or replicated locally.

Recognition of foreign judgments and arbitral awards under the New York Convention provides a useful analogy, but freezing orders are interim relief – they move faster and on different procedural tracks than final judgments. In practice, interim relief in a cross-border crypto matter may require urgent applications in two or more forums simultaneously.

We regularly advise clients that the most time-efficient structure is often to identify the VASP's registration jurisdiction first, then build the instrument that will be recognised there, rather than starting with the claimant's home court and working outward. That is a counterintuitive approach for most litigators, but it reflects how VASPs actually respond.

Where funds have moved across multiple VASPs – a common pattern in laundering – the position becomes more complex. On-chain tracing can identify the movement, but each VASP in the chain is a separate legal entity in a separate jurisdiction. Each requires its own compliance engagement. The practical reality is that recovery teams must prioritise: which VASP is holding the largest balance right now, and which is reachable fastest?

Consider a matter we handled in the Asia-Pacific region, late 2024, involving funds in the low seven figures. The theft moved through four wallets across three VASPs in different jurisdictions. On-chain tracing identified the final holding wallet within 48 hours. The difficulty was not the trace – it was the simultaneous coordination of freeze requests in two jurisdictions while the third was assessed for a local recognition application. The timeline from trace to freeze was measured in days, not hours, precisely because of that cross-border coordination layer.

What Happens Inside a VASP's Compliance Queue?

When a freeze request arrives at a VASP, it typically enters a compliance triage queue. Understanding that internal process helps practitioners draft requests that move faster.

The first filter is form: does the request come with a valid court order, or is it a law-enforcement letter, a victim's direct appeal, or a demand from a foreign agency? Court orders command the highest internal priority. Informal requests – however urgent – may sit in a general inbox for days.

The second filter is specificity. A freezing application that identifies the wallet address, the asset type, the approximate balance, and the basis for claiming ownership of the funds will move through a VASP's compliance queue faster than a general order to freeze "all assets" of a named account holder. Precision is not just legally required; it is operationally necessary for the VASP to execute the freeze without freezing innocent third-party funds.

The third filter is liability exposure. A VASP that freezes funds without proper authority faces claims from the account holder. Most well-regulated VASPs will not act on anything less than a clear court order precisely for this reason. Some will notify the account holder – despite any gagging or no-notification order in the originating jurisdiction – if their local law requires notification. That is why gagging orders must be assessed jurisdiction by jurisdiction.

After the compliance queue, a VASP typically routes the request to legal review. In-house counsel will assess whether the instrument is valid on its face, whether the issuing court has jurisdiction, and whether acting on it conflicts with any other obligation. That review may take hours at a large, well-resourced exchange, or days at a smaller platform.

What practitioners can do to shorten that timeline: provide a clean, standalone summary of the order alongside the instrument itself; include a contact point for urgent queries; and, where possible, engage the VASP's legal team directly rather than sending to a general compliance address. These steps sound simple. In practice, they regularly make the difference between a same-day hold and a week-long delay.

What Are the Contrasting Positions on VASP Cooperation?

There is a genuine tension in the VASP ecosystem between two competing positions on how far a platform should cooperate with external freeze requests.

The first position holds that VASPs, as regulated entities, should cooperate fully and promptly with lawful process. This view is dominant among VASPs registered in jurisdictions with strong anti-money-laundering frameworks. It treats compliance with court orders as integral to operating a legitimate platform. Many of the largest centralised exchanges now maintain dedicated legal-process teams precisely because the volume of lawful requests has grown to the point where it demands a structured response.

The second position holds that a VASP's primary obligation is to its users – that it should scrutinise external orders carefully, demand local court recognition before acting, and push back on requests that appear designed to harass or overreach. This position is not illegitimate. It reflects genuine concerns about fraud (there are fake "court orders" in circulation) and about the extra-territorial reach of foreign courts.

In practice, the tension resolves differently depending on the VASP's jurisdiction and the requesting court's reputation. A well-drafted proprietary injunction from a court with strong international standing will overcome most resistance from a reputable VASP. A poorly drafted order from a less-familiar forum will face serious scrutiny – and may require additional steps before the VASP acts.

There is a third, less-discussed position: some VASPs in lighter-regulated jurisdictions will cooperate with neither court orders nor law enforcement until faced with a local proceeding. For those platforms, the only effective route is a local court order in the VASP's jurisdiction, obtained with the assistance of local counsel who knows that court.

Does this mean recovery is impossible where the VASP is in a difficult jurisdiction? Not necessarily. It means the strategy must account for the specific legal environment rather than assuming a universal compliance standard. On-chain tracing can identify if funds move to a more accessible platform, which may allow the recovery effort to pivot.

How Does On-Chain Tracing Feed the Freeze Request?

A freeze request without an accurate wallet identification is worthless. This is where on-chain tracing is not just useful – it is the precondition for everything that follows.

Public blockchains are transparent. Every transaction is recorded and permanently visible, even when the identity behind the wallet is concealed. Blockchain-analytics tools allow practitioners to reconstruct the movement of funds from the victim's wallet through intermediate addresses to the point where the asset reaches a VASP or is converted.

Wallet clustering and attribution techniques allow analysts to group wallets that are likely controlled by the same actor, even when the actor is using multiple addresses to obscure the trail. Where a wallet cluster is linked to a known VASP deposit address, it becomes possible to identify which platform holds the funds and present that intelligence to a court as the basis for a freeze application.

The limitation is that on-chain tracing identifies wallets, not people. To move from wallet to identity, a disclosure order against the VASP is typically required – compelling the exchange to produce the account details, IP logs, and KYC documentation associated with the deposit address. That disclosure then feeds the identity layer of the claim and enables enforcement against individuals, not just wallets.

Speed matters here. Funds can move from one wallet to another in seconds. A trace that was accurate at 9 a.m. may be outdated by noon if the wrongdoer is actively managing the asset. Practitioners in cross-border recovery work to compress the time between the trace and the freeze application to the shortest possible window – ideally within the same working day.

We have traced stolen crypto through chains of intermediate wallets to a final deposit address at a centralised exchange within hours of the theft being reported. The trace itself takes as long as the complexity of the chain allows. What takes longer – and what matters most – is translating that trace into a legally valid freeze request that the VASP will accept.

Our asset-tracing service covers this end-to-end process: from on-chain analysis to a brief suitable for urgent legal action.

When a Freeze Fails: What the Recovery Team Does Next

A freeze attempt fails. What then? This is the scenario most victim-side practitioners dread and most victims assume is fatal. It is not always so – but the options narrow quickly.

If the freeze fails because the funds have already moved before the order was served, on-chain tracing resumes from the last known wallet. The question is whether the funds have reached another VASP or been converted to a harder-to-trace asset. Where they have reached another VASP, the process begins again in a new jurisdiction.

If the freeze fails because the VASP did not accept the instrument, the recovery team reassesses the instrument and the forum. Sometimes a reissued order from a local court in the VASP's own jurisdiction will succeed where the foreign order did not. This adds time – typically days to weeks depending on how responsive local courts are to urgent applications.

If the funds have been converted to cash and withdrawn, on-chain tracing loses its primary utility. The trail shifts to conventional financial forensics: correspondent banks, receiving banks, and the payment trail reconstruction that follows fiat movement.

Where funds are converted to cash in a jurisdiction that respects the New York Convention, enforcement of a final award or judgment through recognition and enforcement proceedings remains a live option – provided the wrongdoer can be identified and has assets in reach. That is a longer-form recovery path, measured in months rather than days, but it is not without precedent.

The honest assessment is this: a failed freeze narrows the recovery window but does not necessarily close it. What it does is change the instruments available and the jurisdictions where they can be applied. Recovery at that stage depends on the quality of the intelligence gathered before and during the freeze attempt.

There is one myth worth confronting directly here. Some victims, having seen a freeze fail, are approached by operators who claim to use "specialist blockchain recovery software" or unofficial back-channel access to exchanges to reverse the transaction. These are almost always second-stage recovery scams. No legitimate practitioner reverses a blockchain transaction. What we do is trace, freeze through legal process, and enforce. If someone offers something different, the offer is not what it appears.

For a realistic assessment of where your matter stands after a failed freeze, request a confidential case review: info@axiomtracel.com.

Practical Preparation: What a Recovery-Ready Request Looks Like

Most freeze requests that stall do so because of avoidable procedural shortcomings. This section sets out what a well-prepared request looks like from the VASP's perspective.

First, the instrument itself must be correctly drafted for the asset class. A generic freezing order that does not address digital assets specifically may leave the VASP uncertain whether its token balances fall within scope. Courts in established crypto-recovery jurisdictions have developed forms of order that speak to blockchain addresses, token types, and private key control. Using those forms – or adapting them with the help of local counsel who knows that court's practice – avoids the first internal filter at the VASP's compliance desk.

Second, the accompanying brief should set out the on-chain tracing evidence in a format that a compliance officer, not just a judge, can follow. That means a clear wallet-to-wallet transaction map, an identification of the VASP deposit address, and a statement of the balance at the time of the application. That intelligence should be current – ideally checked within hours of filing.

Third, the service point matters: knowing whether to serve the VASP's legal team, its compliance officer, or its designated legal-process inbox can shorten the response time from days to hours. We identify the correct service point as part of preparation, not as an afterthought.

Fourth, where a gagging or no-notification order is in place, the recovery team must verify whether the VASP's home jurisdiction will respect that restriction. Some will; some are legally required to notify the account holder regardless. Where notification cannot be prevented, the team must be ready to move to the next stage immediately after service.

Fifth, a contingency chain must be in place before the freeze request is served. If the VASP delays, or if the funds move at the moment of service, the next application – in the next jurisdiction or to the next platform – should already be drafted. The difference between a recovery team that responds to events and one that anticipates them is usually the difference between a hold and a miss.

For more on how we approach crypto asset recovery end to end, see our crypto recovery insight hub.

If you are dealing with a matter where funds are still on-chain and moving, consider an initial assessment alongside our analysis of freezing stolen Litecoin before it is cashed out, which addresses the specific timing pressures in altcoin recovery.

Related Analysis

• Crypto Asset Recovery – Insight Hub: on-chain tracing, exchange choke points, and freezing digital assets across borders.
• Asset Tracing Service: from blockchain-analytics output to a brief ready for urgent legal action.
• Freezing Stolen Litecoin Before It Is Cashed Out: timing, instruments, and the specific pressures of altcoin recovery.

Frequently Asked Questions

Q: Can stolen crypto really be traced and frozen?

A: Yes, in many cases. Public blockchains record every transaction permanently. Blockchain-analytics tools allow practitioners to follow funds from the victim's wallet through intermediate addresses to a virtual-asset service provider. Once the holding wallet is identified, a freezing order over digital assets – or a stablecoin issuer freeze – can be sought on an urgent basis. Whether a freeze is achievable depends on the specific facts: how fast the funds moved, which platform holds them, and how quickly lawful process can be served. Speed matters; delay narrows the options.

Q: How quickly do I need to act after a crypto theft?

A: As quickly as possible – hours, not days. On-chain tracing can identify where funds have moved within hours of the theft. The window for an effective freeze is at its widest before the wrongdoer moves the asset to a second or third wallet, converts it to another asset, or withdraws it to fiat. A freeze application is typically made without notice to avoid alerting the defendant, and courts in established jurisdictions can grant emergency relief within hours. Every day that passes increases the risk that the trail goes cold or the funds leave reachable platforms.

Q: How is a real recovery specialist different from a recovery scam?

A: A legitimate crypto asset recovery specialist uses lawful process – court orders, disclosure orders against virtual-asset service providers, and on-chain tracing – to trace and freeze stolen funds through established legal channels. No fee is guaranteed; no outcome is promised. A recovery scam typically appears after a loss, charges an upfront fee, and claims to use proprietary software or back-channel access to exchanges to "reverse" a transaction. Blockchain transactions cannot be reversed by a third party. If someone offers that, they are not offering recovery – they are offering a second theft.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed.

In our experience, the cases that end in recovery share one characteristic: they were acted on quickly, with accurate intelligence and correctly drafted instruments. We build that readiness as a matter of course – not after the freeze has already failed.

To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.