Asset tracing in the first 72 hours

Checklist

• Hour 0–6: identify the outflow transactions, the destination addresses and the chains involved; instruct a blockchain analytics provider to trace and to flag the attacker addresses with exchanges on its network.
• Hour 0–12: file a criminal complaint in the jurisdiction of the victim (Zug or Zürich prosecutor; Singapore Police Force), because exchanges respond faster to law-enforcement requests than to private letters and because prosecutors can order seizure.
• Hour 0–24: send freeze requests to every exchange and stablecoin issuer at which traced assets have arrived, with the complaint reference, the transaction hashes and an undertaking to follow with a court order.
• Hour 12–48: prepare and file an application for ex parte provisional measures in the court of the exchange's seat or the victim's seat: in Singapore a proprietary injunction and a disclosure order against the exchange (Bankers Trust type), in Switzerland provisional measures under Art. 261 ff. CPC or an attachment under Art. 271 DEBA where a claim for money exists against an identifiable debtor.
• Hour 24–72: obtain a worldwide freezing order in Singapore against persons unknown if the perpetrators are unidentified, with service by alternative means (including on-chain messaging or NFT where permitted).
• Within 72 hours: coordinate the civil and criminal tracks so that the civil disclosure yields identities that feed the prosecution and the criminal seizure supports the civil claim.
• Document the chain of custody of all evidence and the expert's methodology for later admissibility.
• Consider the mutual legal assistance route when assets sit in a third jurisdiction, using the Singapore–Switzerland channel described in Part H, Chapter VI.
• Keep a recovery budget: tracing, counsel in each jurisdiction, court fees and security for costs can exceed the value of smaller losses.
• Review with the client whether to publicise the addresses, which can deter laundering through compliant exchanges but can also alert the perpetrator.