Freezing, seizure and asset recovery · Lesson 1 of 5
Freezing and seizure options
8 min read
A trace that ends at an address still holding stolen funds is only worth something if someone can stop those funds moving. In crypto cases the time between a theft and the dispersal of its proceeds is measured in minutes and hours, so the investigator's choice of lever, and how fast and how precisely it is pulled, often decides whether victims get anything back. This lesson maps the legal standard onto the technical options and shows how an investigator picks the right one.
Freeze, seize, confiscate: the vocabulary
The FATF Glossary uses three words that recur in every asset recovery case. Their crypto equivalents are worth fixing early, because a request that asks for the wrong measure wastes the window.
| Term | FATF meaning (paraphrased) | Typical crypto equivalent |
|---|---|---|
| Freeze | Prohibit the transfer, conversion, disposal or movement of property; the owner keeps title and a third party may keep administering it | An exchange blocks withdrawals from an account; an issuer blocks an address from transferring its tokens |
| Seize | As a freeze, but the competent authority takes control of the property | Funds are moved to a wallet whose keys the authority controls |
| Confiscate | Permanent deprivation of property by order of a court or competent authority | A final order transfers title; the authority may return, sell or retain the assets |
Freezing and seizing are provisional measures: they hold assets while the case proceeds. Confiscation (called forfeiture in some systems) is the final outcome. The difference matters technically. A frozen exchange balance still sits on the exchange's books and depends on the exchange's continued existence and cooperation; a seized balance sits in the authority's own custody, with all the responsibilities described in the lesson Securing seized crypto-assets.
The international standard: R.4, R.38 and the 2023 revision
FATF Recommendation 4 requires countries to give competent authorities the power to identify, trace and evaluate property subject to confiscation; to take provisional measures such as freezing and seizing to prevent any dealing, transfer or disposal; to prevent or void actions that undermine recovery; and to confiscate laundered property, proceeds, instrumentalities and property of corresponding value, while protecting bona fide third parties. Provisional measures are expected to be available without prior notice to the owner, because notice would defeat their purpose.
In October 2023 the FATF Plenary revised Recommendations 4, 30, 31 and 38, their Interpretive Notes (including INR.40) and the Glossary, and published the revised text in November 2023. The main changes for investigators:
- Asset recovery as a policy priority, with operational frameworks to match, domestically and internationally.
- A power to suspend or withhold consent to transactions linked to money laundering, terrorist financing and serious crime, typically exercised by an FIU or another authority before any court order, to stop dissipation in the first hours.
- Non-conviction-based confiscation (NCBC) became a requirement, consistent with the fundamental principles of domestic law, rather than something countries should merely consider. It matters for crypto because many suspects are abroad, unidentified or dead.
- Confiscation linked to wider criminal conduct (extended confiscation), again subject to domestic legal principles.
- Mechanisms to manage frozen, seized and confiscated property and preserve its value (see the lesson Managing and realizing seized assets).
Recommendation 38 applies the same tools across borders: countries should act expeditiously on foreign requests to identify, freeze, seize and confiscate, including requests based on non-conviction-based proceedings, recognize foreign provisional and final orders, and have arrangements for managing and sharing confiscated assets. Recommendations 30 and 31 give investigators the powers to trace and to initiate freezing; Recommendation 40 covers the faster informal channels.
The UN Convention against Cybercrime (adopted December 2024) contains parallel provisions: Article 31 on freezing, seizure and confiscation of proceeds, Articles 49–51 on international cooperation for confiscation, and Article 52 on return and disposal. The Budapest Convention concerns data (expedited preservation in Article 16, search and seizure of stored computer data in Article 19), not assets; it helps preserve the records that a freeze request depends on. The Asset Recovery Guidance and Best Practices the FATF published on 4 November 2025 describes three main routes for securing virtual assets: obtaining the private keys, recovering from wallets held at exchanges, and freezes by stablecoin issuers.
The legal mechanics of each measure are national. The rest of this lesson is about the technical choice. For the channels themselves, see the lesson Legal authority and international cooperation.
Where the funds are decides the lever
The first question is not "what does the law allow?" but "who, if anyone, can technically stop these funds?".
| Where the traced funds are | Who can stop them | Lever | Main limit |
|---|---|---|---|
| Account at a custodial exchange or broker | The provider | Voluntary hold, then freeze or seizure order | Provider must be reachable and willing; foreign providers may need a domestic order |
| Freezable stablecoin in an unhosted wallet | The issuer | Address-level freeze; in some designs burn and reissue | Not all tokens are freezable; holders swap fast |
| Inside a protocol with an admin or guardian role (bridge, lending pool) | The protocol's key holders or governance | Pause or blocklist | Depends on design and governance; often only immediately after an exploit |
| Native coins (BTC, ETH) in an unhosted wallet | Only the key holder | Seizure via lawful access to keys, or monitoring until funds reach a provider | No third party can freeze them |
| On a chain whose validators can censor or upgrade | Validator set or core developers | Network-level freeze | Rare, contested, depends on governance |
The last row happened in May 2025: after about USD 223 million was drained from the Cetus decentralized exchange on the Sui network, validators blocked about USD 162 million held at the attacker's addresses, and an on-chain governance vote later approved returning those funds through a multisignature trust. Such interventions are exceptional and cannot be planned on; most chains have no such mechanism.
Where nobody can freeze the funds, the realistic plan is to monitor the addresses with alerts and to prepare requests for the providers where the funds are most likely to arrive. A freeze request is useless until funds reach someone able to act on it.
Voluntary and issuer freezes from the investigator's side
The IDFE-CC lesson Freezes, law-enforcement requests and asset recovery explains how a provider receives and handles such requests. From the other side of the table, the investigator's job is to make acting easy and safe for the provider. Providers act fastest on requests that are verifiable, precise and limited to traced value.
{
"request_id": "FRZ-2026-014",
"sent_utc": "2026-03-14T03:02:00Z",
"recipient": "stablecoin issuer, compliance desk (portal)",
"legal_basis": "urgent request; formal order to follow within agreed period",
"asset": "USDT (ERC-20)",
"address": "0x7cE1…40aB",
"amount_traced": "2,500,000.00",
"trace": "theft tx 0x91d2…e07f, block 24,679,412, direct transfer, 1 hop",
"confidence": "grade A, deterministic link",
"requested_action": "block address; preserve records",
"contact_verification": "agency switchboard, case officer ID"
}The record names the exact token, chain and address, the traced amount rather than the whole balance, and the on-chain evidence for the link, with its confidence grade (see the lesson Tracing to an evidential standard). It also says what legal follow-up will come and how the recipient can verify the sender, since forged police requests are common. A request built on a weak heuristic link, or one asking to freeze an exchange's entire hot wallet, will be refused or will freeze innocent customers.
Remember three limits. A voluntary hold is time-limited and lapses unless an order follows. An issuer freeze locks tokens without returning them; recovery still needs a legal process, after which some issuers can burn the blocked balance and reissue an equivalent amount to an address the authority controls. And a freeze is evidence too: record when it took effect, the block height and the frozen balance, because the defense will ask.
Smart-contract pauses
Many DeFi contracts include an admin role able to pause transfers, blocklist addresses or upgrade the code. Bridges commonly pause after an exploit to stop further losses, as the Ronin bridge was halted in 2022 once the theft was discovered. For investigators, the questions are factual: does the contract have a pause or blocklist function, who holds the role (a single key, a multisignature wallet, a governance contract), and how fast can they act? The verified source code and the contract's role assignments answer the first two (see the IDFE-BA lesson Decoding smart contract interactions). A protocol team is not a law-enforcement body; its action is voluntary or follows an order, and it should be documented like any other freeze.
Speed as the decisive factor
The FATF's 2025 guidance warns that in virtual asset cases the window for seizure may close within minutes. Freezes succeed when the first hours are organized:
- Fix the seeds: theft txids, attacker addresses, amounts per asset and chain.
- Identify freezable assets first: stablecoins at the issuer, funds already at a provider.
- Send precise urgent requests through verified channels, and use any FIU suspension power available.
- Put alerts on every attacker address and the next likely hops.
- Share indicators through law-enforcement channels and, where the law allows, industry alert networks.
- Record each request, response and freeze with UTC times for the case file.
Order matters because attackers know which assets can be frozen and move those first: stablecoins are swapped and exchange deposits withdrawn while the slower legal process is still being prepared.
Exam focus: the FATF meanings of freeze, seize and confiscate and their crypto equivalents; what Recommendation 4 requires, including provisional measures without prior notice; the October 2023 revision (asset recovery as policy priority, power to suspend or withhold consent to transactions, mandatory non-conviction-based confiscation, asset management); Recommendation 38 and foreign NCBC requests; matching the lever to where the funds are; what a precise freeze request contains and why it is limited to traced value; the limits of voluntary holds, issuer freezes and protocol pauses; first-hour priorities.