As traditional finance houses seek to diversify and enter the decentralised world (Bitcoin’s value increased by 132% over the last five years), the obvious risks are less technical and more human.

Senior boards are hiring staff whose job specifications are sometimes not fully understood or wildly unfamiliar. Crypto traders often possess specific knowledge that is not broadly shared across an organisation, posing a significant risk to business operations. Little exemplifies this pattern more than a recent UK High Court case (held in private) brought by a London hedge fund that found more than 1.9 million USDC (a stablecoin called Circle, whose value is pegged to the US dollar) drained from its trading account. No one knows how this happened, there were no clear leads and no technical vulnerabilities.

Tracing stablecoins and the smoking gun

The approximately 1.9 million USDC drained was traced by Token Recovery, a blockchain forensics firm that confirmed the funds were consolidated into a single address ns then remained there for several days. Usually, funds are quickly laundered via tumblers and put out of reach by a process known as “smurfing,” whereby large sums of money are broken down into smaller transactions to remain undetected by anti-money laundering protocols and to frustrate tracing. The fact that this money remained in one place for several days indicated that the threat actor was likely unsophisticated and opportunistic. The hedge fund found that one employee, a software engineer (“Mark”), had recently resigned and, according to access logs, took a particular interest in the targeted wallets on the day of the theft. Luckily the fund had implemented monitoring software on his profile, which took a screenshot of his computer every few seconds, creating a video of his activities. The software had largely been forgotten but was now vital evidence, given the direction of blockchain forensics. The video showed that Mark had:

· reviewed the balances of the hedge fund’s crypto trading accounts.

· logged into the relevant servers which ran the trading engines.

· initiated memory dumps of those engines and copied them to his local system.

· loaded the files into a debugger and immediately navigated to the relevant private keys, which gave any holder the ability to withdraw funds from the relevant account.

· then, moments later, searched Google for “Metamask” (cryptocurrency wallet management software) and “what is a Polygon wallet?”, suggesting he intended to trade the funds on the Polygon market.

In all, this was key evidence, given there was no genuine reason for Mark to navigate to the private keys. It may have taken longer to consider this evidence without the forensics and laundering patterns.

Law enforcement

The incident was reported to police on several occasions, and a crime reference number was provided to be handled by Action Fraud, a triaging service for law enforcement. From the pace and manner following reporting, the hedge fund instructed its lawyers (law firm, Lawrence Stephens Limited), of which the author is a partner, to make a move more quickly, given the evidence at hand. This is the timeline’s first working day.

Urgent injunctions, nuclear options

On the second working day, the hedge fund and its legal team appeared in the High Court on an urgent basis, seeking highly intrusive court orders. The first was a proprietary injunction over the approximately 1.9 million USDC, which in the meantime had started moving and was being laundered more professionally. The second was a worldwide freezing injunction over Mark’s assets over £1,000 in value and up to $1.9 million (approximately £1.5 million) in total, preventing him from moving assets, except for his capped living expenses, without being in contempt of court. The third was a search and imaging order (an “Anton Piller” order) which allowed the legal team to search Mark’s premises for relevant documents and electronic devices, gain access to relevant accounts, compel the delivery of information and hardware and image the contents of those devices. There must be an extremely strong prima facie case to persuade the court to make an Anton Piller order, and the court appoints a supervising solicitor to safeguard a defendant’s interests during the search. The hearing was made on a “without notice” basis, meaning Mark had no knowledge that this was happening. The court issued the orders that night. A private investigator was then hired to follow Mark’s movements and monitor his home. Working day three was spent preparing documents for service and instructing forensic imaging experts who would image devices, and the supervising solicitors.

Home entry

Execution of the search was planned for working day four, a Friday. Service of documents was limited to between 0930 and 1400. There was always a risk that Mark might not be at home, that he (or any cohabitant) might refuse to open the door or that he might jump out of the window and run away. In any of those cases, a new court order would likely be required. Had he wilfully refused to open the door, he would have been in contempt of court. The investigator confirmed that Mark was seen entering the house the night before, and there was no evidence that he had left. The supervising solicitors knocked just after 0930 and woke the house. A relative opened the front door, shortly followed by Mark, who thought it was an Amazon delivery. Mark was immediately served with the Anton Piller order. He was not to be left out of sight for the day.

Search party

Two hours later, the legal team search party was allowed in. Since the funds are digital, any internet access is high-risk, and 30 seconds locked in a toilet is enough time to put the USDC or other assets out of reach. As ordered by the judge, his phone was imaged on site and returned without delay. All relevant electronic items were secured, including mobile phones, a PlayStation5 and USBs. Receipts and pages of old cheque books might reveal seed phrases or private keys. Mark was required to give the forensic imaging team access to all relevant accounts, including financial and crypto trading accounts.

Freezing order

Mark was also served with the worldwide freezing and proprietary orders on the search day. Although he could technically move funds and dissipate assets, if it were found that he had done so after service, he would have been in contempt of court (a criminal offence). The power of that deterrent may have been reinforced by his mother, who happened to be a lawyer. Non-compliance, in his mind, may be outweighed by the value of the assets. The freezing order also required him to detail all worldwide assets worth more than £1,000 on working day nine. This is vital. If he had the stolen funds or any proceeds, he would be required to disclose them, unless, in limited circumstances they were incriminating, or face contempt of court.

Settlement negotiations

Settlement offers yield quick results, especially when court hearings are imminent and pressure is greatest. As the first hearing was without notice, the process required a further hearing two weeks later to allow Mark to seek to amend the orders. This is called a “return date” and is for the benefit of the respondent. On working day nine, Mark was required to disclose his assets by 1730. This was the overwhelming pressure point for settlement because, without a deal, Mark would now have to disclose his assets. Eventually, Mark offered to agree to stay proceedings and discharge the orders, after which he would send more than 1.5 million USDC to the hedge fund directly, on a peer-to-peer basis. The hedge fund made a take-it-or-leave-it offer: recover the money first, or Mark has to disclose and the parties proceed to litigation, knowing he had more than 1.5 million USDC that could be paid into the court as security during the proceedings. Mark took the deal.

Peer-to-peer settlement

This was a pure peer-to-peer settlement. Mark sent the first dollar directly and then paid the balance. Upon receipt, the consent order was filed and proceedings were stayed. This was working day nine.

Decisive action

Understanding blockchain analytics helped to identify Mark where there were no other obvious targets in the aftermath of an emergency. Convincing evidence of wrongdoing led to draconian injunctions and the Anton Piller order, which put enormous pressure on Mark. The settlement offer resulted in Mark’s disclosure of approximately 1.5 million USDC, which was the determining factor. Within nine business days, the hedge fund’s team had changed the position from a complete unknown to obtaining more than 80% of the value of lost USDC, the hedge fund being satisfied that the balance had been dissipated and/or not worth the cost to pursue.

Often, published court proceedings involving lost cryptocurrency have yielded less-than-satisfactory results for victims. Accordingly, it is important to share success stories and show that recovery is real when the facts align, and the analytics are well understood.

This article first appeared in Digital Bytes (18th of August, 2026), a weekly newsletter by Jonny Fry of Team Blockchain.

How are MiCAR supervisors addressing real-world crypto risks like these?

Use code COMMUNITYTOKEN for 15% off your ticket.