Since 2010, the Global Law Experts annual awards have been celebrating excellence, innovation and performance across the legal communities from around the world.
posted 2 hours ago
If you have discovered that cryptocurrency has been stolen from your wallet or lost to a scam, knowing how to recover crypto assets in Hong Kong requires immediate, methodical action, starting within hours, not days. Hong Kong courts now routinely treat digital assets as property capable of being traced, frozen and recovered through civil proceedings, and the practical toolkit available to victims has expanded significantly through 2025–2026 litigation and regulatory developments. This guide sets out the complete civil recovery process, from emergency preservation and blockchain forensic triage through to Norwich Pharmacal disclosure orders, interim injunctions, trial and cross‑border enforcement, together with the documents you need, realistic timelines, and expected costs.
Victims of cryptocurrency fraud in Hong Kong can pursue recovery through two parallel channels: a criminal complaint to the Hong Kong Police Force (specifically the Cyber Security and Technology Crime Bureau) and civil proceedings in the Court of First Instance. In practice, the civil route, tracing, interim preservation, compelled exchange disclosure and proprietary relief, delivers the most direct path to actual recovery of funds. Criminal investigations may assist, but they operate on law‑enforcement timescales and do not prioritise returning assets to individual victims.
This article focuses on the civil recovery process and its practical coordination with exchanges and blockchain forensic firms. The scope covers crypto asset recovery Hong Kong proceedings from the moment of detection through to judgment enforcement, including cross‑border considerations where funds have moved offshore.
Is there any realistic chance of recovering stolen crypto? The honest answer depends on speed and traceability. Where stolen funds land on a regulated, KYC‑compliant exchange and the victim acts within hours, recovery rates can be substantial. Industry observers expect that cases involving prompt preservation and clear on‑chain tracing evidence yield meaningful recoveries in a significant proportion of cases. Conversely, where funds pass through mixers or unregulated platforms and weeks elapse before legal action begins, recovery prospects diminish sharply.
By way of illustration: in one anonymised Hong Kong matter, a victim who detected an unauthorised transfer within four hours and immediately contacted both the receiving exchange and counsel obtained an ex parte freezing order within 48 hours and ultimately recovered the majority of the stolen USDT. In a contrasting case, a three‑week delay allowed funds to be laundered through multiple chains, reducing eventual recovery to a fraction of the loss. The critical variable in both instances was time to preservation.
The 2025–2026 period has seen Hong Kong courts strengthen their willingness to grant urgent interim relief over digital assets, with practitioner commentary noting an increasing emphasis on speedy exchange disclosure applications as the decisive factor in successful crypto asset recovery Hong Kong proceedings.
Before commencing proceedings, a claimant must establish standing and satisfy certain threshold requirements. The following eligibility criteria apply to the civil recovery process.
Who can sue. Any person or entity with proprietary title to the stolen assets may bring a claim. This includes the direct victim, an assignee of the victim’s rights, or a company whose treasury was compromised. Liquidators and trustees in bankruptcy may also pursue recovery on behalf of a corporate victim.
Standing for Norwich Pharmacal orders. To compel exchange disclosure in Hong Kong, the applicant must demonstrate that a wrong has been carried out (or arguably carried out), that the respondent (the exchange or intermediary) was innocently mixed up in the wrongdoing, and that disclosure is necessary to enable the applicant to pursue the wrongdoer. This requires showing a real and substantial cause of action, typically fraud or theft, underpinned by credible on‑chain evidence.
Foreign applicant eligibility. Overseas victims may bring claims in Hong Kong provided there is a sufficient jurisdictional nexus, for example, if the stolen funds transited through a Hong Kong‑licensed exchange or the perpetrator has assets within the jurisdiction. Foreign claimants should be aware that they may be required to provide security for costs and to give undertakings enforceable in Hong Kong.
When to involve law enforcement. Filing a report with the Cyber Security and Technology Crime Bureau is advisable in parallel with civil proceedings. A police reference number strengthens the urgency narrative in ex parte applications, and law enforcement may independently freeze accounts under the Anti‑Money Laundering and Counter‑Terrorist Financing Ordinance (Cap. 615).
The recovery process follows a defined sequence. Each step below identifies who acts, the primary documents involved, and realistic timing. Speed is the single most important variable, the entire early phase should be compressed into hours and days, not weeks.
| Step | Who does it | Typical duration |
|---|---|---|
| Preserve & triage: record txIDs, preserve wallets, instruct forensic firm | Victim / counsel / blockchain forensics | 0–48 hours |
| Urgent interim relief: ex parte freezing / proprietary injunction | Claimant’s counsel, HK Courts | 1–7 days (if urgent ex parte) |
| Norwich Pharmacal / disclosure orders to exchanges | Claimant’s counsel (file + serve) | 3–21 days (varies by forum & service) |
| Disclosure / forensics correlation & interlocutory hearings | Counsel + forensic reports | 2–8 weeks |
| Trial / judgment obtaining proprietary relief | Claimant’s counsel, Court | 3–9 months (depends on complexity) |
| Enforcement / repatriation / negotiation with exchanges | Enforcement counsel, exchanges, foreign courts | Months to years (cross‑border) |
The first 48 hours are decisive. Every action in this phase aims to document the theft, preserve volatile evidence, and alert regulated intermediaries before funds are moved further.
Record transaction identifiers. Immediately capture the transaction hash (txhash) for every suspicious transfer. Use a blockchain explorer (Etherscan for Ethereum, blockchain.com for Bitcoin, or the chain‑specific equivalent) to export timestamped screenshots of the relevant wallet addresses and transaction flows. These screenshots should include the block number, timestamp, sender address, recipient address, and value transferred.
Contact receiving exchanges. If asset tracing Hong Kong analysis shows that stolen funds have landed on a regulated exchange, check the Securities and Futures Commission (SFC) list of licensed virtual asset trading platforms, contact the exchange’s compliance or law‑enforcement liaison desk immediately. Most major exchanges will place a temporary hold on flagged accounts upon receipt of a credible fraud complaint accompanied by a police report reference number.
Instruct a blockchain forensics firm. Engage a specialist provider to run an initial tracing analysis. The firm should confirm: the provenance of the stolen assets, the on‑chain path from victim to destination, whether funds have been converted or mixed, and whether they currently rest in an identifiable exchange wallet. Preserve the forensic firm’s methodology notes, these will form a critical exhibit in subsequent court applications.
Preserve device images and communications. If the victim’s device was compromised, take a forensic image before any remediation. Preserve all communications with the perpetrator (emails, Telegram messages, WhatsApp transcripts) with original timestamps intact. These will support the affidavit of loss.
File a police report. Report the theft to the Cyber Security and Technology Crime Bureau. Obtain and record the reference number, this is required for exchange cooperation requests and strengthens urgency arguments in court.
Once preservation is in train, the next step is to obtain court orders that restrain the stolen assets. In Hong Kong, two principal forms of interim relief are available for crypto cases.
Mareva (freezing) injunction. A freezing order crypto Hong Kong application restrains the defendant from dealing with assets up to a specified value. It is available on an ex parte (without notice) basis where there is a good arguable case of fraud and a real risk of dissipation. The applicant must give a cross‑undertaking in damages.
Proprietary injunction. Where the claimant can demonstrate that the stolen crypto is identifiable as their property, even after on‑chain transfers, a proprietary injunction may be obtained. This remedy follows the assets themselves rather than restraining the defendant’s assets generally. It is particularly powerful for crypto because blockchain tracing can often establish a clear chain of custody from victim wallet to current holding address.
Ex parte affidavit checklist. The supporting affidavit for an urgent application should address:
Applications are made to the Court of First Instance. In cases of genuine urgency, the duty judge can hear ex parte applications outside normal court hours. The likely practical effect is that orders are typically obtained within one to seven days of filing, provided the affidavit evidence is properly prepared.
Even where an exchange has voluntarily frozen an account, the claimant will usually need a court order to obtain the account holder’s identity and transaction records. The primary mechanism to compel exchange disclosure in Hong Kong is the Norwich Pharmacal order.
What is a Norwich Pharmacal order? It is a court order compelling an innocent third party, here, the crypto exchange, that has been “mixed up” in wrongdoing to disclose information necessary for the claimant to pursue the wrongdoer. The exchange is not itself alleged to have acted wrongfully; it is a conduit whose records are essential to identifying the fraudster and tracing the assets.
Requirements for the application. The applicant must demonstrate: (a) a wrong has been or is arguably being committed; (b) the respondent exchange is mixed up in the wrongdoing, however innocently; (c) the information sought is necessary for the applicant to pursue the wrongdoer; and (d) the order is proportionate, the disclosure sought is no wider than necessary.
Supporting evidence. The application should be supported by an affidavit exhibiting the blockchain forensics report, screenshots of the relevant transactions, and the police report reference number. Where confidentiality is a concern (for example, to avoid tipping off the fraudster), the applicant can apply for a sealing order to limit public access to the filed materials.
Service on overseas exchanges. Many exchanges that service Hong Kong users are incorporated outside the jurisdiction. Service may require leave of the court under Order 11 of the Rules of the High Court or, in practice, can sometimes be effected through the exchange’s Hong Kong registered office or agent for service. Early investigation of the exchange’s corporate structure and service address is essential to avoid delay.
Norwich Pharmacal crypto applications typically take between three and 21 days from filing to order, depending on whether the exchange is served within or outside Hong Kong and whether it consents to the disclosure or contests the application.
With interim relief in place and disclosure obtained, the claim proceeds to its substantive phase. The claimant must convert the interlocutory preservation into final relief.
Proprietary remedies at trial. If the tracing evidence establishes that the stolen crypto (or its traceable proceeds) remains identifiable, the claimant may obtain a proprietary remedy, effectively a declaration that the assets belong to the claimant and an order for their return. Where the crypto has been converted into other assets or fiat currency, equitable tracing rules allow the claim to follow the proceeds.
Standard of proof. The civil standard, the balance of probabilities, applies. The court will assess the blockchain forensics report, witness evidence, and the totality of the documentary record. Gaps in the chain of tracing evidence are the most common reason for partial or failed recovery at this stage.
Enforcement within Hong Kong. Where the assets are held by a Hong Kong‑licensed exchange, enforcement is relatively straightforward: the court order directs the exchange to release or transfer the crypto to the claimant or to pay the fiat equivalent.
Cross‑border enforcement. Where the judgment must be enforced overseas, because the exchange or the defendant’s assets are in another jurisdiction, the claimant needs local enforcement counsel. Hong Kong judgments may be enforceable under reciprocal enforcement arrangements, the common law, or statutory regimes in the enforcement jurisdiction. Each route has its own procedural requirements, timelines and costs. Early analysis of the enforcement landscape is essential, there is little point obtaining a Hong Kong judgment if the assets sit in a jurisdiction where enforcement is impractical.
Negotiation with exchanges. In some cases, particularly where a regulated exchange has already frozen the relevant account and the fraudster has not appeared to contest the proceedings, practical resolution can be achieved through negotiation. The exchange, having complied with the court’s orders, may agree to return the funds directly to the claimant upon production of the court order and supporting identification.
Assembling the correct evidence at the outset is critical. The table below sets out the documents needed for asset tracing Hong Kong proceedings and subsequent court applications. Incomplete documentation is one of the most common causes of delay.
| Document | Notes |
|---|---|
| Transaction IDs (txhash), wallet addresses, block explorer screenshots | Export from wallet or blockchain explorer; timestamped screenshots showing block number, timestamp, sender, recipient and value; essential foundation for the forensic chain |
| Exchange account KYC records (if funds touched an exchange) | Obtained from the exchange via Norwich Pharmacal order or voluntary disclosure; includes account holder name, email, withdrawal records and IP logs |
| Blockchain forensics report | Issued by a specialist forensic vendor; must include methodology statement, chain of custody, hashed report file, and CSV of traced transactions across all relevant blockchains |
| Device and server forensic images | Forensic bit‑for‑bit images of compromised devices; issued by forensic lab with hash value verification; preserve before any remediation of the device |
| Affidavit of loss / witness statement | Sworn statement setting out the facts of the fraud, the value of the loss and the steps taken to preserve evidence; drafted by the claimant’s solicitor |
| Bank statements and fiat correspondence | From the victim’s bank and, where relevant, exchange withdrawal records showing conversion between crypto and fiat currency |
| Identification and proof of ownership documents | Identity documents, account ownership records, and wallet custody evidence (including, where relevant, evidence of control over private keys or seed phrases) |
| Evidence of communications with the perpetrator | Emails, chat logs, Telegram and WhatsApp transcripts with original timestamps preserved; screenshot plus native export where possible |
Practical tips on evidence gathering. Begin collecting documents from the moment the theft is detected, do not wait for legal advice. Wallet screenshots should be taken immediately because blockchain explorer interfaces may change, third‑party labelling may be updated, and some data may become harder to retrieve over time. Store all evidence in an organised, date‑stamped folder structure and provide a complete copy to your solicitor and forensic firm at the first meeting.
The blockchain forensics report deserves particular attention. It should be prepared by a firm using industry‑recognised tools and methodologies, and it must be capable of withstanding scrutiny in court. The report should clearly map the flow of funds from the victim’s wallet through any intermediate addresses to the final destination, identify whether funds have been mixed or converted to other tokens, and state the current location and value of the traced assets. Request that the firm provide the report in a format suitable for exhibiting to an affidavit, with a methodology appendix that a non‑technical judge can understand.
The timeline for crypto asset recovery Hong Kong proceedings varies significantly depending on the complexity of the on‑chain tracing and the jurisdictions involved. Below are two representative scenarios.
Scenario 1: Funds land on a regulated Hong Kong exchange. This is the most favourable scenario. The victim detects the theft promptly, the receiving exchange cooperates with a temporary freeze, and a Norwich Pharmacal order is obtained to confirm the account holder’s identity. In straightforward cases, interim relief is obtained within one to two weeks, disclosure follows within a further two to four weeks, and settlement or judgment may be achievable within three to six months.
Scenario 2: Complex cross‑chain movement involving overseas exchanges. Where stolen funds are swapped across multiple blockchains, passed through mixers, or land on exchanges in jurisdictions with limited cooperation frameworks, the recovery timeline extends materially. Forensic tracing may take several weeks, overseas service of Norwich Pharmacal orders adds further delay, and enforcement proceedings in foreign courts can take months to years.
| Milestone | Typical duration | Critical deadline / note |
|---|---|---|
| Exchange notification and voluntary hold | 0–48 hours | Act within hours of detection; delay beyond 48 hours sharply reduces prospects |
| Ex parte freezing / proprietary injunction | 1–7 days | Apply before assets are dissipated; duty judge available for genuine emergencies |
| Norwich Pharmacal order (domestic service) | 3–21 days | Seek disclosure within 14 days of filing where possible |
| Norwich Pharmacal order (overseas service) | 4–8 weeks | Investigate exchange service address early to minimise delay |
| Forensic correlation and interlocutory hearings | 2–8 weeks | Forensic report must be ready before substantive hearing |
| Trial / judgment | 3–9 months | General limitation period for fraud: 6 years from cause of action |
| Enforcement abroad | Months to years | Depends entirely on the enforcement jurisdiction and cooperation regime |
Limitation periods. The general limitation period for claims in fraud is six years from the date of the cause of action. However, the urgent preservation windows described above are measured in hours and days, missing the early preservation phase does not extinguish the claim but may render it unenforceable in practice because the assets will have been dissipated.
Transparency about recovery costs is essential for informed decision‑making. The table below sets out the principal cost components, with indicative ranges based on current practitioner experience.
| Item | Typical range (HKD / USD) | Notes |
|---|---|---|
| Urgent freezing application (law firm time) | HKD 30,000–150,000 (USD 3,800–19,000) | Ex parte filings, drafting affidavit, counsel appearance; range depends on firm and complexity |
| Norwich Pharmacal / disclosure application | HKD 40,000–200,000 | Includes drafting, service and possible overseas service costs |
| Blockchain forensics report | HKD 20,000–300,000 | Dependent on blockchain complexity, number of wallets and chain analysis tools used |
| Full civil litigation (to judgment) | HKD 300,000–2,000,000+ | Depends on complexity, number of hearings and foreign enforcement needs |
| Enforcement abroad (per jurisdiction) | Varies widely (USD 10,000–100,000+) | Local counsel fees, translations, filing fees; jurisdiction‑dependent |
| Court fees (Hong Kong) | HKD 2,000–20,000 | Filing and hearing fee bands; check the current Hong Kong Judiciary fee schedule |
| Disbursements (service, courier, translations) | HKD 2,000–50,000 | Depending on scope and number of jurisdictions involved |
Fee arrangements. Most Hong Kong law firms handling crypto recovery work on a time‑cost basis. Some firms may offer partial contingency or success‑fee arrangements for high‑value cases, although these remain the exception rather than the norm under Hong Kong’s legal framework. Discuss fee structures at the outset and establish a realistic budget before proceedings begin.
Tax considerations. Whether a theft loss is tax‑deductible in Hong Kong depends on the nature of the assets and the claimant’s tax position. Hong Kong does not impose capital gains tax in most circumstances, and the treatment of crypto theft losses varies depending on whether the assets were held for trading or investment purposes. Specialist tax advice should be obtained, the interaction between recovery proceeds, deductible losses and the Inland Revenue Department’s evolving position on digital assets requires careful analysis.
The 2025–2026 period has consolidated several trends that directly affect how to recover crypto assets in Hong Kong. Courts have continued to treat cryptocurrency as property capable of being the subject of proprietary claims, freezing injunctions and tracing orders, a position now well‑established through a growing body of reported decisions. The Securities and Futures Ordinance (Cap. 571) licensing regime for virtual asset trading platforms, overseen by the SFC, has expanded the number of regulated exchanges operating in Hong Kong, creating more potential points at which stolen funds can be identified and frozen.
Early indications suggest that judges are granting preservation and disclosure orders more readily and more quickly in crypto cases, reflecting the recognised risk that digital assets can be moved globally within minutes. The likely practical effect for claimants is that the emphasis has shifted forward: the critical investment is in the first 48 hours of preservation and forensic triage, followed by the earliest possible exchange disclosure application. Cases that are well‑prepared at the interlocutory stage now have materially improved prospects of meaningful recovery.
This article was produced by Global Law Experts. For specialist advice on this topic, contact Gregory Payne at Payne Velasco, a member of the Global Law Experts network.
Member
Find the right Legal Expert for your business
Sign up for the latest advisor briefings and news within Global Advisory Experts’ community, as well as a whole host of features, editorial and conference updates direct to your email inbox.
Naturally you can unsubscribe at any time.
Global Advisory Experts is dedicated to providing exceptional advisory services to clients around the world. With a vast network of highly skilled and experienced advisors, we are committed to delivering innovative and tailored solutions to meet the diverse needs of our clients in various jurisdictions.
