VASP cooperation in crypto asset recovery

Assets move on-chain within minutes. By the time a victim recognises the loss, the funds may have already passed through several wallets. That is the first reality of crypto asset recovery – and the second is that movement leaves a trail.

A virtual-asset service provider (VASP) – any centralised exchange, over-the-counter desk, or similar platform that holds customer accounts – is often the point at which stolen crypto must be converted, withdrawn, or bridged. That conversion moment is a choke point. With the right legal instruments and on-chain tracing, it is frequently possible to reach a VASP, compel disclosure of account-holder identity, and freeze balances before they are dissipated. Whether that is achievable in your matter depends on speed, the forum chosen, and the quality of the on-chain evidence assembled before any application is made.

This guide sets out the step-by-step process: from the first hours after a loss, through on-chain tracing, to compelling VASP cooperation and obtaining the orders that can stop stolen digital assets from being cashed out.

Why VASPs are the critical choke point in crypto recovery

A centralised exchange is where pseudonymity ends. Users must provide identity documents to withdraw fiat or move funds to regulated banking; that data sits in the VASP's systems. On public blockchains, every transfer is permanently recorded – even when the wallet owner's identity is hidden. On-chain tracing connects an anonymous wallet to a deposit address at a known VASP, transforming a pseudonymous trail into an identifiable account.

In our experience, a meaningful share of stolen crypto moves toward a VASP within the first 24 to 72 hours. Criminals need to cash out. Mixers, bridges, and privacy protocols slow the process; they do not eliminate it. Blockchain-analytics tools – applied by practitioners familiar with transaction clustering and wallet attribution – can follow funds through layering steps and identify the exchange or VASP where value comes to rest.

Once a deposit address at a VASP is identified, three options open up: a voluntary freeze request; a disclosure order compelling the VASP to reveal account-holder information; or a formal freezing order over the digital assets. In most matters, all three tracks run simultaneously – because the window between deposit and withdrawal can be measured in hours.

Is the trail always recoverable? No. Deeply layered mixing, cross-chain bridges, and privacy coins each raise the difficulty. But the myth that all crypto movement is untraceable is wrong. Public blockchains are transparent by design; sophisticated on-chain tracing resolves a significant proportion of attempted obscuring. The cases that cannot be traced at all are a minority.

Step one: Preserve evidence and establish the on-chain trail

Before any legal process can be launched, the factual record must be assembled. Courts and VASPs require evidence, not assertions. The first task is to compile every transaction hash, wallet address, and timestamp from the moment of loss.

This means: (a) capturing full transaction records from the victim's own wallet or exchange account; (b) recording the receiving wallet address or addresses with timestamps; and (c) running immediate blockchain-analytics to follow the initial movement – even a few hops ahead of the loss event. Time invested here is not wasted. An application that arrives at court with a clean, verifiable on-chain map moves faster and meets less resistance than one relying on narrative alone.

Do not interact with the suspect wallets. Sending a test transaction or attempting any self-help on-chain can contaminate evidence and, in some forums, prejudice the applicant's legal position. Preserve, do not pursue.

Concurrently, notify the victim's own exchange or custodian if the loss originated there. Some VASPs maintain internal watch-lists and can flag the receiving addresses voluntarily. This is not a substitute for legal process, but it preserves options. The receiving VASP may also be operating under anti-money-laundering obligations that require it to act on credible third-party intelligence.

For guidance on the broader digital-asset investigation process, see our Crypto Asset Recovery insight hub.

How do you compel a VASP to cooperate if it does not act voluntarily?

Voluntary cooperation happens, but it is not reliable. A VASP may decline without a court order, or it may be located in a jurisdiction where its legal team requires formal legal process before releasing customer data. The primary instrument here is a disclosure order – served on the VASP to compel it to reveal the identity, contact details, and account history of the wallet holder.

The exact instrument depends on the forum. In common-law jurisdictions, a Norwich Pharmal order compels a third party – including a VASP – to disclose information that will help identify a wrongdoer. A Bankers Trust order compels disclosure of account-specific information to assist tracing. Both can be made without notice to the account holder, preventing dissipation before the VASP responds.

Where the defendant's identity is entirely unknown – as is common in crypto theft – a proprietary injunction against "persons unknown" can accompany the disclosure application. Courts in several well-developed forums have granted disclosure orders and freezing injunctions against "persons unknown" in crypto matters, treating wallet addresses as sufficient identification for service purposes.

Speed is non-negotiable. A disclosure application filed and served within 24 to 48 hours of identifying the VASP deposit will reach the account before many cash-outs are processed. Every additional day increases the risk that the balance has moved again, or been withdrawn entirely.

For asset tracing and evidence-gathering support leading up to a VASP disclosure application, our asset tracing service covers each stage of this process.

Which jurisdiction files the application – and does the VASP's location matter?

This is where the cross-border dimension becomes acute. A VASP incorporated in one jurisdiction, operating servers in another, and serving a claimant in a third creates genuine forum complexity. The answer is not always to sue in the VASP's home jurisdiction.

Courts in leading common-law jurisdictions – with strong interim-relief powers – can, in appropriate cases, issue orders with extraterritorial effect. A worldwide freezing order, granted by a forum with jurisdiction over the claimant's assets or the underlying dispute, can in principle reach assets and accounts held abroad, including at foreign VASPs. The order is then served on the VASP directly or through local counsel in the relevant jurisdiction.

The practical calculus turns on three questions: Does the forum have personal jurisdiction over the defendant or the VASP? Can the order be served effectively? Will the VASP comply, voluntarily or under threat of contempt? In our experience, VASPs operating in or serving regulated markets are more likely to comply with court-issued process than those operating in jurisdictions with minimal regulatory oversight.

Where the VASP is outside the reach of a single forum, parallel proceedings in two jurisdictions are sometimes necessary – one to freeze and one to compel disclosure. Allied local counsel in the VASP's jurisdiction can file a mirroring application once the primary forum has issued its order. The on-chain trace and the original disclosure order serve as the factual spine for both sets of proceedings.

Jurisdiction selection also affects timing. Some forums can issue a without-notice freezing and disclosure order within hours of an application. Others require longer lead times. The choice of forum at the outset can determine whether the balance is still there when the order arrives.

What happens after disclosure – freezing the balance and converting it to a judgment?

A disclosure order tells you who holds the account and what the balance is. That is necessary, but not sufficient. The balance can still move unless a freezing order is also in place – either obtained simultaneously with the disclosure application, or made at the return date once identity is confirmed.

A freezing order over digital assets – whether framed as a proprietary injunction or a standard asset-preservation order – directs the account holder (and in appropriate cases the VASP itself) not to deal with the identified balance. A stablecoin issuer, on receipt of appropriate legal process, can freeze specific token balances at the contract level – a technically precise tool that some practitioners use in parallel with a court order where the stolen asset is a stablecoin.

What comes next depends on whether the defendant cooperates or defaults. Where the defendant is identified and amenable to service, judgment can be sought on the underlying claim – fraud, breach of fiduciary duty, unjust enrichment – and the frozen balance then becomes the subject of enforcement. Where the defendant defaults or disappears, enforcement of a freezing order in the jurisdiction where the VASP holds the assets becomes the route to conversion.

Do not underestimate the enforcement step. A freezing order that no one enforces becomes a paper victory. The VASP must receive valid service. The account balance must be confirmed. Local counsel in the VASP's jurisdiction must be in a position to move quickly if the exchange attempts to release funds on the defendant's instruction.

A confidential assessment of whether tracing in your matter has reached the enforcement stage can be requested at info@axiomtracel.com.

Common mistakes that undermine VASP cooperation

The most damaging mistake is delay. Victims who spend the first 48 hours investigating informally, or waiting for an internal compliance process to run, frequently find that the VASP balance has cleared by the time an application is ready. Hours matter. The decision to instruct a specialist capable of filing an urgent application should be made as early as possible.

The second common error is approaching the VASP directly before any order is in place. A cold contact – particularly one that discloses the claimant's identity, the amount, or the on-chain evidence – can alert the account holder through the VASP's own notification processes. Gagging clauses exist in many disclosure order templates specifically to prevent this: the VASP is prohibited from notifying the account holder until a specified period has passed.

Third: using inadequate on-chain evidence. A VASP's legal team will scrutinise the tracing report that accompanies a disclosure application. If the connection between the theft wallet and the VASP deposit address relies on low-confidence heuristics, the application is weaker and the account holder has more room to contest. Blockchain-analytics work should be done rigorously and documented in a format courts accept.

Fourth – and worth stating clearly – do not engage recovery services that promise to recover funds by contacting the VASP "informally" or through back-channel relationships with exchange staff. This approach is, at best, ineffective. At worst, it constitutes a second fraud: such services take upfront fees, produce no enforceable result, and may damage the claimant's legal position. Real recovery through VASP cooperation is a legal process, not a negotiation conducted behind the scenes.

Cross-border enforcement: when the VASP is in a different jurisdiction from the stolen funds

Cross-border situations – a claimant in Europe, a VASP in Asia, a defendant connected to the Americas – require coordinated action across forums. No single order resolves all of this automatically.

The starting point is recognition: will the VASP's home jurisdiction recognise and give effect to a freezing or disclosure order obtained abroad? In some jurisdictions, a foreign order can be enforced directly. In others, a domestic application must be made, relying on the foreign order as supporting evidence. In a small number of jurisdictions, the practical cooperation of the VASP is the only realistic route.

We regularly advise on the sequencing of multi-jurisdictional proceedings in crypto matters. The practical pattern is: obtain an order in the most favourable forum first; serve it on the VASP; simultaneously instruct local counsel in the VASP's jurisdiction to mirror or enforce the order locally. The on-chain evidence package – transaction maps, wallet clustering reports, attribution analyses – travels with both sets of proceedings.

Where the stolen assets have moved to more than one VASP in more than one jurisdiction, triage is necessary. Resources and legal costs are finite. The priority order for applications is: the VASP holding the largest identifiable balance; the VASP in the most cooperative jurisdiction; and any VASP whose balance is most at risk of imminent withdrawal.

For a deeper examination of how disclosure orders function in specific offshore centres, see our analysis of digital asset disclosure orders in the Cayman Islands.

Related topics

• Crypto Asset Recovery – full insight hub: on-chain tracing, wallet attribution, and freezing digital assets at every stage of a matter.
• Asset Tracing: how Axiom Trace reconstructs payment trails from blockchain data and banking records into actionable court-ready evidence.
• Digital Asset Disclosure Orders in the Cayman Islands: jurisdiction-specific analysis of how Cayman courts approach VASP disclosure and proprietary injunctions in crypto matters.

Frequently asked questions

Q: Can stolen crypto really be traced and frozen?

A: Yes – in many cases. Public blockchains record every transaction permanently. Blockchain-analytics tools and wallet attribution techniques can follow stolen funds from the theft wallet through layering steps to a deposit address at a virtual-asset service provider. Once identified, a disclosure order can compel the VASP to reveal the account holder's identity, and a freezing order can preserve the balance. Neither outcome is guaranteed; the result depends on speed, the forum selected, and the quality of the on-chain evidence. Acting within the first 24 to 48 hours materially improves the prospects.

Q: How quickly do I need to act after a crypto theft?

A: As quickly as possible. Stolen digital assets move fast – wallets can be emptied and accounts closed within hours of a deposit. An urgent application to court for a without-notice freezing and disclosure order is typically measured in hours to days from instruction. Every day of delay increases the risk that the virtual-asset service provider balance has already cleared. The first step is to preserve on-chain evidence and take specialist legal advice; self-help actions, including contacting the exchange informally, can prejudice a subsequent application.

Q: How is a real recovery specialist different from a recovery scam?

A: A genuine specialist uses legal process – disclosure orders, freezing injunctions, and on-chain tracing – to reach assets through courts and virtual-asset service providers. There are no guarantees of recovery, and no reputable practitioner will promise a specific outcome or a percentage return. Recovery scams operate differently: they typically demand upfront fees, claim informal access to exchange staff or law-enforcement channels, and produce no enforceable result. If a service offers to recover your funds for an advance payment without reference to court proceedings, that is a warning sign. At Axiom Trace, we explain what is realistically achievable before any engagement, and we do not promise outcomes we cannot deliver.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In our experience, early instruction and rigorous on-chain evidence are the two factors that most determine whether a recovery remains viable. We have traced digital assets through multiple layering steps and across jurisdictions to identify VASP choke points that courts can act on. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.