Crypto Fraud Recovery in England and Wales: Injunctions Against Persons Unknown

Most crypto fraud follows the same arc. Months of patient grooming by someone met online; a trading platform that looks convincingly real, complete with a dashboard showing your "profits" compounding; a small test withdrawal that works perfectly; and then, when you try to take out the balance, a demand for "tax" or "unlocking fees" — followed by silence. By the time the victim understands what has happened, the coins have hopped through a chain of unhosted wallets, often through a mixer, and usually into deposit addresses at overseas exchanges. The fraudsters have no names, no faces and no address for service. It looks, at first sight, like a claim that cannot even be started.

It can. Since 2019 the courts of England and Wales have built the modern playbook for exactly this situation — granting freezing injunctions against defendants identified only as "persons unknown", ordering cryptocurrency exchanges on the other side of the world to hand over account-holder identities, and permitting claim forms to be served by dropping an NFT into the thief's own wallet. English procedure has proved remarkably willing to bend its forms to the shape of the problem.

What follows is a staged guide to that playbook: what the law now says about crypto as property, the evidence you must assemble before any application, the injunctions and disclosure orders that do the heavy lifting, and — because false hope helps nobody — the sobering lessons of the first crypto-fraud tracing claim to reach a full English trial.

First principles: your coins are property

Everything in this field rests on a single proposition: cryptoassets are property in the eyes of English law. If they were not, there could be no proprietary injunction over them, no tracing of them through wallets, and no trust imposed on whoever ends up holding them.

The modern starting point is AA v Persons Unknown [2019] EWHC 3556 (Comm), where the Commercial Court granted a proprietary injunction over Bitcoin paid as a ransom after a cyberattack, holding that cryptocurrency is property capable of being the subject of such an order. The reasoning drew on the UK Jurisdiction Taskforce's legal statement on cryptoassets, and the decision has been applied consistently ever since: stolen coins can be traced, frozen and made the subject of a constructive trust in the hands of a recipient.

Parliament has since put the foundation on a statutory footing. The Property (Digital Assets etc) Act 2025 confirms that a thing is not prevented from being the object of personal property rights merely because it is neither a thing in possession (like a car) nor a thing in action (like a debt). Digital assets can therefore occupy a third category of personal property. For victims, the practical meaning is simple: the courts treat your stolen crypto the way they would treat stolen paintings or misappropriated funds — as yours, recoverable in principle from whoever holds it or its traceable proceeds.

Before any application: evidence and tracing

No judge will freeze anything on the strength of "I was scammed". The applications described below are granted on evidence, and the evidence phase — unglamorous and often skipped by panicking victims — decides everything that follows.

Assemble, immediately and completely:

Transaction records. Every transaction hash, every wallet address you sent funds to, every timestamp. These are the coordinates for the entire claim.
The platform and the people. Screenshots of the fake trading site (including URLs), the app, your account dashboard, and the full message history with whoever induced the transfers — WhatsApp, Telegram, dating apps, all of it, exported before accounts vanish.
Your own transfers. Bank statements and exchange records showing fiat in, crypto out, so the loss can be quantified in a currency a court can order.

Report the fraud to Action Fraud, and notify any identifiable exchange in the onward chain at once — many compliance teams will voluntarily restrict a flagged deposit address for a short period, which can hold funds in place while you get to court. But do not mistake either step for recovery. In practice the police rarely have the resources to pursue individual crypto frauds with overseas perpetrators, and an exchange's voluntary freeze is temporary. The civil claim is the mechanism that turns a pause into an order.

The other early investment is a blockchain tracing expert. A professional tracing report follows your coins through the wallet chain, applies recognised attribution methods to deal with mixing and splitting, and identifies the exchange deposit addresses where the trail goes cold — which is where your disclosure orders will be aimed. As the section on D'Aloia below explains, the tracing report is the load-bearing wall of the whole action. Economise on it and the structure can fail years later, at trial, after everything else has gone right.

Freezing the assets: injunctions against persons unknown

English procedure permits a claim against defendants who cannot yet be named, described instead by category: "persons unknown being the individuals who operated the website trading-platform.com and received the claimant's cryptoassets". That device, developed in other contexts, is now standard in crypto fraud claims, and it unlocks the court's injunction jurisdiction against people whose identities you hope the litigation itself will reveal.

Two forms of interim relief matter, and they are not the same:

A proprietary injunction attaches to your assets — the specific coins taken from you and their traceable proceeds, wherever they now sit. Because it restrains dealing with property that is arguably yours rather than the defendant's own wealth, the threshold is somewhat friendlier to claimants and the order follows the assets through the chain.
A worldwide freezing order restrains the defendant from dissipating their own assets generally, up to the value of the claim. The general doctrine — real risk of dissipation, full and frank disclosure, the safeguards for respondents — is covered in our guide to freezing orders, and it applies here with full force.

In practice crypto claimants seek both, and often add a Bankers Trust or Norwich Pharmacal disclosure order in the same application, so that one without-notice hearing produces a package: freeze the coins, freeze the fraudsters' assets, and compel the exchanges to say who they are.

These applications are made without notice — warning a crypto thief is an invitation to press "send" — which imposes the strictest duties of candour on the applicant, and the court will fix a return date at which the defendants (if they ever appear) can argue for discharge. The price of admission is the cross-undertaking in damages: your promise to compensate anyone wrongly restrained, which the court may require you to fortify. Injunctions here are not free options.

Making the exchanges talk: disclosure orders

The fraudsters are anonymous; the exchanges where the trail ends are not. They are regulated or semi-regulated businesses with compliance departments, and — critically — they hold "know your customer" records for the accounts that received your coins. The disclosure order is how you get them.

Two overlapping tools do the work. A Norwich Pharmacal order compels a third party mixed up in wrongdoing to identify the wrongdoer — the general doctrine is explained in our dedicated guide. Its cousin, the Bankers Trust order, is proprietary in character: where there is strong evidence your property has passed through an account, the institution can be ordered to disclose what it knows about the account and where the assets went. In crypto claims the orders are routinely sought together and typically yield the account holder's KYC identity documents, registration email and phone details, linked accounts, IP logs and — sometimes the most valuable line in the response — the remaining balance.

Until recently there was a genuine obstacle to using these tools against exchanges incorporated abroad, which is most of them. That has been substantially resolved: a dedicated information-orders gateway added to the service-out rules in 2022 now allows disclosure applications of this kind to be served on respondents outside the jurisdiction, and the courts have used it to direct orders at major overseas exchanges. Many exchanges, keen to appear cooperative to regulators, comply without a fight.

Be realistic about what comes back. The account may have been opened with stolen or synthetic identity documents, or by a paid money mule. But even then the disclosure is rarely worthless: it extends the tracing map, identifies onward transfers to further exchanges, and occasionally lands on an account whose holder is real, local and worth suing.

Serving defendants you cannot find

A claim must be served, and you cannot post a claim form to a wallet address. The courts have responded with striking flexibility under the alternative-service rules: service by email to addresses used in the fraud, service via the messaging apps on which the scam was conducted, and — first permitted at the interim stage of the D'Aloia litigation and in Osbourne v Persons Unknown — service by NFT airdrop, embedding notice of the proceedings in a token dropped into the very wallets that received the stolen funds. The logic is elegant: whoever controls the wallet will see it, and the blockchain itself records delivery. If the fraud was conducted through a channel, the courts will generally let you serve through that channel.

The cautionary tale: what the D'Aloia trial teaches

For years, crypto recovery claims lived at the interim stage — injunctions and disclosure orders granted against defendants who never showed up. D'Aloia v Persons Unknown [2024] EWHC 2342 (Ch) was the first such claim to run all the way to a full English trial, and every prospective claimant should absorb both halves of the result.

The encouraging half: the court confirmed that USDT — a stablecoin — is property under English law, that it can be traced, and that it is capable of being held on constructive trust. The doctrinal architecture built at the interim stage held up under trial conditions.

The sobering half: the claimant lost against the exchange he pursued. His funds had been mixed with vast flows of other people's crypto in intermediate wallets, and the court was not persuaded, on the evidence presented, that his USDT had actually reached the specific exchange wallet he had targeted. The tracing analysis did not carry the burden. Years of litigation, a claim sound in law, and the case failed on proof.

The lesson is not that these claims are hopeless — it is that they are won or lost on tracing evidence. Mixing is not a legal defence; equity has tools for mixed funds. But those tools must be applied by a credible expert, consistently, transaction by transaction, to the standard a trial judge will accept. Choose your expert as carefully as your barrister, and choose which recipient to sue based on where the evidence is strongest, not where the deepest pocket sits.

The frontier: suing the developers

One further front deserves a mention. In Tulip Trading Ltd v van der Laan [2023] EWCA Civ 83, a claimant who said it had lost access to a fortune in Bitcoin after a hack sued the core developers of the relevant networks, arguing they owed duties — fiduciary in character — to write a software patch restoring the owner's access. The Court of Appeal held the question was properly arguable and should go to trial: a striking moment, since a duty of that kind would reshape the responsibilities of those who maintain blockchain networks. The claim itself later fell away without a trial of the issue, so the point remains open rather than established. Treat developer-duty claims as a frontier being surveyed, not a road you can currently drive on — but the Court of Appeal's willingness to entertain the argument tells you how seriously English courts take the field.

From order to money: judgment and enforcement realities

Most persons-unknown defendants never acknowledge service, which means claims commonly end in default judgment or summary judgment against the no-shows, with declarations that the traced assets are held on trust for the claimant and orders for their transfer or payment.

A judgment, though, is paper. Recovery in practice comes from a shorter list of sources: balances frozen at a compliant exchange before they could move; an identified account holder within reach of enforcement; a mule or local facilitator with real assets; or a settlement paid by someone in the chain who prefers not to litigate. Where the assets or the account holders sit abroad, you are into cross-border territory — our guide to enforcing judgments across borders explains the machinery, but be aware that enforcing an English judgment against an anonymous fraudster in a non-cooperative jurisdiction is often where campaigns end.

That makes proportionality the first question, not the last. A properly run recovery action — tracing expert, without-notice applications, disclosure rounds, service out — is an expensive undertaking, and overall costs can readily run into six figures. For losses in the hundreds of thousands or millions, with a live trail to exchanges holding funds, it can be decisively worth it. For a loss of ten or twenty thousand pounds, the honest advice is usually that full-dress litigation costs more than it can recover, and the realistic avenues are the free ones: Action Fraud, direct exchange complaints, and — where a UK bank processed the payments — a complaint about the bank's fraud handling.

One final warning. Fraud victims are systematically targeted a second time by fake "crypto recovery agents" who promise, for an upfront fee, to retrieve stolen funds. Genuine recovery runs through the court procedures described above, conducted by regulated professionals who can be verified. Anyone who guarantees recovery, demands payment in crypto, or claims special access to exchanges is running the sequel to the scam that brought you here.

The English playbook is real, and it is among the most developed in the common law world: property status confirmed by statute, injunctions and disclosure orders adapted to anonymous defendants, service by blockchain itself. What it is not is automatic. The victims who recover are the ones who move fast, preserve everything, invest in tracing that will survive a trial, and aim the claim where the evidence — not the anger — points.

This article is published by CommonBench for informational purposes only and does not constitute legal advice. If you are weighing the cost of a crypto recovery claim against the strength of your tracing evidence and need the authorities checked first, try CommonBench — AI-powered legal research with verified citations across five common law jurisdictions.