Recovering Crypto Through Dubai's Courts (DIFC Digital Assets Law)

When a token collapses, an exchange freezes withdrawals or a rug-pull drains a wallet, UAE law now offers a structured route to recovery — combining DIFC property rights, worldwide freezing orders and criminal asset-tracing tools that did not exist three years ago.

The Legal Framework: Crypto as Property Under DIFC Law 2/2024

The foundational shift for crypto fraud recovery in the UAE arrived with DIFC Digital Assets Law No. 2 of 2024. For the first time, digital assets — including cryptocurrencies, tokens and NFTs — are expressly recognised as a distinct category of personal property capable of being owned, transferred, encumbered and, critically, made the subject of proprietary claims before the DIFC Courts. This is not merely definitional housekeeping. Before Law 2/2024, claimants seeking to recover crypto in the UAE faced the doctrinal difficulty that common-law jurisdictions historically struggled with: whether intangible, bearer-like digital tokens satisfied the requirements of a property right at all. Law 2/2024 resolves that in the affirmative for the DIFC's jurisdiction, giving victims a direct cause of action in conversion, breach of trust or unjust enrichment grounded in proprietary rather than merely personal rights.

The practical significance is considerable. A proprietary claim survives the insolvency of the defendant — it does not rank pari passu with unsecured creditors — and it supports the full range of proprietary remedies: constructive trust, tracing through mixed funds, account of profits and, most importantly for fraud victims, the Mareva (worldwide freezing) injunction and proprietary freezing order. Law 2/2024 also addresses the thorny question of situs: it deems a digital asset to be situated in the DIFC for jurisdictional purposes where the holder's private key is controlled from the DIFC or where the applicable system rules are governed by DIFC law, giving claimants a clear gateway to file.

Within the onshore UAE, no equivalent codified digital-asset property statute yet exists, which is why sophisticated practitioners routinely structure crypto recovery actions through the DIFC Courts even where the underlying transaction had no obvious DIFC nexus. The DIFC Courts' opt-in jurisdiction under Article 5(A) of the Judicial Authority Law (as amended) allows parties — and in certain cases even unilateral claimants in urgent ex parte applications — to invoke DIFC jurisdiction by agreement or by the nature of the asset. For criminal proceedings running in parallel, the relevant predicate offences are found in the Federal Penal Code, Federal Decree-Law 31/2021 (as amended by FDL 36/2022), which covers fraud (Articles 451–453), breach of trust (Article 450), money laundering as a stand-alone offence, and related computer-crimes provisions that capture unauthorised access to wallets and private keys.

The AML architecture has been comprehensively overhauled by Federal Decree-Law 10/2025 (in force 14 October 2025), which repeals FDL 20/2018 and, together with Cabinet Resolution 134/2025 (the Executive Regulations, in force 14 December 2025), introduces proliferation financing and tax evasion as new predicate offences, imposes personal criminal liability on senior managers of non-compliant entities, raises administrative fines to AED 100 million, and — critically for asset recovery — removes any statute of limitations for money laundering. This last point matters enormously: it means that proceeds of a rug-pull that were layered through multiple wallets years ago remain traceable and recoverable without a limitation bar on the ML charge.

Worldwide Freezing Orders: Jurisdiction, Procedure and the No-Nexus Rule

Speed is the defining variable in crypto fraud recovery. Blockchain assets can be bridged across chains, tumbled, converted to stablecoins and off-ramped to fiat within hours of a rug-pull. The UAE's freezing-order toolkit has expanded materially. Under DIFC Court Law No. 2 of 2025, the DIFC Courts may grant worldwide freezing orders (WFOs) in support of foreign proceedings without requiring the applicant to demonstrate that any asset is located within the DIFC or the UAE. This eliminated the most significant jurisdictional gap that previously hampered cross-border recovery: a victim whose funds had been dissipated offshore could not previously anchor a DIFC WFO if no local assets were identifiable. The 2025 amendment brings the DIFC Courts broadly in line with English Commercial Court practice under the Chabra jurisdiction and with the ADGM's own development of equivalent principles confirmed in A17 v B17 [2025], where the ADGM Courts granted a WFO in support of foreign arbitral proceedings with no requirement for an ADGM-sited asset.

In practice, a DIFC WFO application follows a three-stage structure. First, the applicant files ex parte, typically on a same-day or next-business-day basis, with a supporting affidavit that establishes: (i) a good arguable case on the merits of the underlying claim (including proprietary claim under Law 2/2024); (ii) a real risk of dissipation — in crypto cases this is readily demonstrated by the nature of blockchain portability; and (iii) that the balance of convenience favours granting the order. Second, the court grants the interim order, usually with a return date within 14 days. Third, at the inter partes hearing, the defendant may apply to discharge, vary or cross-undertake. The applicant must give the standard cross-undertaking in damages, which for HNW claimants is ordinarily acceptable but should be considered carefully where the defendant's assets may themselves be substantial.

Ancillary to the WFO, practitioners routinely seek a disclosure order requiring the respondent (and potentially third-party exchanges or custodians regulated under VARA Rulebooks 2.0, May 2025) to disclose wallet addresses, transaction histories and KYC data. VARA-licensed entities operating in Dubai are subject to Travel Rule obligations under Cabinet Resolution 134/2025, which mandates the collection and transmission of originator and beneficiary information for virtual asset transfers at or above AED 3,500 — a threshold deliberately set low to capture routine transactions. This regulatory data trail is a significant forensic resource that pre-litigation practitioners should seek to preserve by urgent letter before action to the VASP, copied to VARA, before any court application.

For onshore UAE freezing orders in support of criminal proceedings, the Federal Criminal Procedure Law, Federal Decree-Law 38/2022 (in force 1 March 2023, as amended by FDL 45/2023) provides the Public Prosecution with broad powers to seize and freeze assets linked to criminal investigations, including digital assets held on centralised exchanges. Article 44 et seq. of FDL 38/2022 permit provisional seizure orders on application by the prosecution, enforceable against financial institutions and VASPs. Where both civil DIFC proceedings and a criminal complaint are running in parallel — the dual-track strategy discussed below — coordination between counsel on timing of freezing applications is essential to avoid inconsistent orders or the criminal seizure pre-empting civil proprietary relief.

Blockchain Forensics and Legal Tracing: From Wallet to Recovery

Effective crypto fraud recovery in the UAE is built on the integration of two disciplines: blockchain forensic analysis and legal tracing doctrine. On the forensic side, licensed blockchain analytics firms (Chainalysis, Elliptic, CipherTrace and others) can map the movement of stolen funds through on-chain transactions, identify exchange deposit addresses, detect mixing or tumbling activity, and produce reports formatted for court use. The DIFC Courts have accepted blockchain analytics evidence in interim injunction applications, and practitioners should commission a forensic report before filing — both to strengthen the good-arguable-case threshold and to identify which regulated VASPs received the funds, since those are the entities against whom disclosure and proprietary orders can be enforced.

The legal tracing framework applicable in the DIFC draws on English equity: the lowest intermediate balance rule governs mixed-fund claims, and Re Hallett's Estate principles apply to allow a claimant to follow misappropriated crypto into a mixed wallet and assert a proportionate beneficial interest. Under DIFC Digital Assets Law 2/2024, these equitable tracing rules are now applied in the context of digital assets, with the statute providing that the proprietary nature of the asset is not defeated by the fact that it is fungible or that it has been mixed with other digital assets of the same type — a significant clarification that removes a potential defence available to sophisticated fraudsters who deliberately commingle stolen tokens with their own holdings.

Where funds have moved to a VARA-licensed exchange, the Travel Rule data collected under Cabinet Resolution 134/2025 (AED 3,500 threshold) and the KYC/AML records maintained under FDL 10/2025 provide a rich dataset. Victims' counsel should issue a preservation notice — citing the relevant VARA obligations and the potential criminal liability of exchange personnel under Article [senior manager liability] of FDL 10/2025 for facilitating money laundering — before the exchange acts on any withdrawal instruction from the suspected fraudster. This notice, backed by the threat of regulatory sanction, is often more immediately effective than waiting for a court order. If the exchange is licensed in the DIFC (under the DFSA's crypto-asset framework), the DFSA's supervisory powers provide an additional lever: a complaint to the DFSA can trigger supervisory engagement that freezes the account pending investigation.

Cross-border tracing presents added complexity. Where stolen assets have been moved to wallets or exchanges in jurisdictions with which the UAE has mutual legal assistance (MLA) arrangements, the framework under Federal Law 39/2006 as amended by FDL 38/2023 enables the UAE Public Prosecution to seek evidence preservation and asset restraint requests to foreign competent authorities. The UAE's removal from the FATF grey list in February 2024, and the EU's subsequent removal of the UAE from its high-risk list in 2025, has materially improved the speed and receptiveness of MLA responses from key financial-centre counterparts, including Switzerland, Singapore and the UK — all of which are frequent destinations for laundered crypto proceeds.

The Dual-Track Strategy: Civil Proprietary Claims and Criminal Complaints

Experienced practitioners in Dubai run civil and criminal proceedings in parallel, each reinforcing the other. The criminal complaint — filed with the Dubai Police Economic Crimes Unit or directly with the Public Prosecution under the Federal Penal Code FDL 31/2021 — serves multiple functions: it triggers the prosecution's own seizure and freeze powers under FDL 38/2022; it creates formal investigative pressure on the fraudster that frequently accelerates settlement negotiations; and it generates an official record that strengthens the civil claimant's good-arguable-case threshold. Under Articles 451–453 of FDL 31/2021, fraud involving digital assets — including false promises of returns, deliberate misrepresentation of a token's utility or backing, and the structuring of a rug-pull — is punishable by imprisonment. The computer-crime dimension (unauthorised access to wallets, phishing for private keys) is separately prosecutable under the Cyber Crime Law.

The civil claim in the DIFC proceeds on its own track, seeking proprietary and personal remedies under Law 2/2024 and standard DIFC Rules of Court. The civil claim is not contingent on a criminal conviction: the standard of proof is the balance of probabilities, and a proprietary claim under a constructive trust or unjust enrichment theory does not require proof of fraud to the criminal standard. This is particularly important in collapse cases (as opposed to outright rug-pulls) where the founders may argue negligence or market forces rather than dishonesty — the civil claimant can still assert that the founders held investor funds on trust and failed to apply them as represented, giving rise to a proprietary claim that survives any insolvency under Federal Decree-Law 51/2023 (the Bankruptcy Law, in force 1 May 2024), which established the dedicated Bankruptcy Court and criminalises fraudulent and negligent bankruptcy.

Where the entity involved is a VARA-licensed VASP, an additional regulatory track is available: a formal complaint to VARA under the VARA Rulebooks 2.0 (May 2025), which impose detailed obligations on VASPs regarding client-asset segregation, disclosure and conduct. VARA has enforcement powers including licence revocation, public censure and referral to the Public Prosecution. A well-drafted regulatory complaint can precipitate a VARA inspection that surfaces internal records unavailable through civil disclosure alone. Similarly, if the entity is a listed company or issued tokens that constitute securities under Federal Decree-Law 32/2025 (which replaces the SCA with the Capital Markets Authority from 1 January 2026) and the related FDL 33/2025 (which codifies insider dealing and market manipulation offences with penalties to AED 200 million), the CMA regulatory track provides yet another avenue for information gathering and asset restraint.

A note on strategy sequencing: in most rug-pull cases, the WFO application should be filed before the criminal complaint is made public, to prevent the fraudster learning of the investigation and accelerating dissipation. Once the WFO is in place and served on relevant exchanges, the criminal complaint can be filed. The prosecution's subsequent seizure order, operating in parallel, creates a belt-and-braces restraint structure. Practitioners should also consider whether a Norwich Pharmacal-style disclosure order against a neutral party (such as a blockchain analytics firm holding data, an exchange or a payment processor) is appropriate to identify unknown defendants before proceedings are issued — the DIFC Courts have jurisdiction to grant such orders and they have been used effectively in crypto fraud cases.

VARA, DFSA and the Regulatory Dimension of Recovery

The virtual asset regulatory landscape in Dubai is bifurcated: VARA (Virtual Assets Regulatory Authority) governs VASPs operating in or from Dubai (outside the DIFC and ADGM), while the DFSA regulates crypto-token activities within the DIFC. Both regulators have roles to play in a fraud recovery strategy, and both have been progressively tightening their frameworks. VARA's Rulebooks 2.0, effective May 2025, impose granular obligations on licensed VASPs covering client-asset custody and segregation, AML/CFT compliance, disclosure requirements and — most relevantly for recovery — cooperation with law-enforcement and court orders. VASPs that fail to respond to court-issued freezing or disclosure orders, or that facilitate the movement of restrained assets, face significant regulatory consequences including licence suspension and referral for prosecution under FDL 10/2025.

The VARA Issuance Rulebook (June 2025) specifically addresses token issuers, including requirements for whitepaper accuracy, disclosure of tokenomics, use-of-proceeds commitments and ongoing reporting. In a rug-pull scenario, these obligations become the evidential foundation for a civil misrepresentation claim and a criminal fraud complaint: if the whitepaper represented that funds would be used for development and they were instead extracted to the founders' wallets, the Issuance Rulebook creates a regulatory baseline against which the misrepresentation can be measured precisely. This is particularly useful where the fraudster argues that the token's failure was due to market conditions rather than dishonesty — compliance gaps in the issuance process establish a pattern of reckless or deliberate misrepresentation.

The Travel Rule under Cabinet Resolution 134/2025 — with its AED 3,500 threshold — means that virtually all meaningful crypto transfers above that amount must carry originator and beneficiary data. In a tracing exercise, this is a powerful tool: if the stolen funds passed through any VARA-licensed VASP at any stage (even as a transit point), Travel Rule records will identify the next hop in the chain. Practitioners should seek these records urgently, both through regulatory channels (VARA inspection) and through civil disclosure orders, since Travel Rule data is time-limited in its accessibility once funds are moved to non-custodial wallets or cross-border platforms.

For exchange collapses that involve potential insolvency, the interaction between VARA's client-asset segregation rules and the Bankruptcy Law FDL 51/2023 is a developing area of practice. The dedicated Bankruptcy Court established under FDL 51/2023 has jurisdiction over insolvent VASPs, and the question of whether properly segregated client crypto assets form part of the insolvent estate — or are held on trust and thus recoverable in priority — will turn on whether the VASP complied with VARA's segregation requirements. Where it did, clients stand outside the insolvent estate; where it did not, victims may need to assert a proprietary claim based on the constructive trust principles discussed above, using Law 2/2024 as the statutory foundation.

Enforcing Judgments: Domestic Execution and Cross-Border Recognition

Obtaining a DIFC judgment or arbitral award is only the first step; enforcement is where recovery is actually realised. Within the UAE, the DIFC Courts have a well-established enforcement route through the Joint Judicial Committee (JJC), which facilitates recognition and execution of DIFC judgments by the onshore Dubai Courts. For practical purposes, a DIFC freezing order or final judgment can be enforced against assets held in onshore UAE accounts, including crypto assets held on VARA-licensed exchanges, via this mechanism. The process is materially faster than seeking independent recognition before an onshore court, and practitioners should factor JJC enforcement into the recovery timeline from the outset.

Cross-border enforcement of DIFC judgments against defendants or assets in foreign jurisdictions depends on bilateral arrangements. The UAE has entered into judicial cooperation treaties with a range of states, and the framework under Federal Law 39/2006 as amended by FDL 38/2023 provides the procedural basis for MLA requests that include requests for recognition and execution of civil asset-recovery judgments. In FATF-compliant jurisdictions — whose number has expanded as a result of the UAE's grey-list removal in February 2024 — the enhanced cooperative environment means that UAE asset-recovery orders are receiving faster and more substantive responses. In particular, the UAE's MLA relationship with the UK, Switzerland and Singapore (key crypto-laundering destinations) has improved measurably.

Where assets are held by an entity with no presence in the UAE, the DIFC's worldwide freezing order jurisdiction under DIFC Court Law 2/2025 — which requires no local-asset nexus — allows the DIFC Courts to restrain those assets and order their disclosure. Enforcement of that order in the foreign jurisdiction will require separate recognition proceedings, but the existence of a DIFC WFO substantially strengthens any such application, particularly in common-law jurisdictions that recognise the DIFC's legal architecture. Practitioners should consider whether to seek concurrent injunctions in the relevant offshore jurisdictions at the same time as the DIFC WFO, particularly in the British Virgin Islands, Cayman Islands or Singapore, where crypto-holding structures are common and courts have well-developed freezing jurisdictions.

For criminal asset confiscation, the UAE's AML framework under FDL 10/2025 provides for the confiscation of proceeds of money laundering and predicate offences, with no limitation period. Confiscated assets are held by the state, but victims may apply as injured parties for restitution orders within the criminal proceedings under FDL 38/2022. The interplay between criminal confiscation and civil proprietary recovery requires careful management: if the prosecution seizes the assets first, the civil claimant must register their interest promptly to avoid being displaced by a state confiscation order that does not provide for private restitution.

Strategic Considerations: Timing, Costs and Realistic Expectations

Crypto fraud recovery in the UAE is an area where speed, legal precision and forensic preparation determine outcomes far more than they do in conventional asset recovery. The window between the fraud and irreversible dissipation of assets is typically measured in hours to days on a blockchain. Victims and their GCs should therefore treat the first 24–72 hours as a crisis-response period: commission blockchain analytics immediately; preserve all documentary evidence (whitepapers, communications, wallet addresses, transaction confirmations); send preservation notices to all known VASPs through which funds may have passed; and instruct counsel to prepare an ex parte WFO application. The DIFC Courts operate an urgent applications procedure that can accommodate same-day filings in genuine emergencies.

On costs, practitioners should give clients a realistic picture. DIFC litigation is well-resourced but not inexpensive: WFO applications, blockchain forensic reports, senior-counsel involvement and the cross-undertaking in damages together represent a material upfront investment. Against that, the proprietary nature of the claim under Law 2/2024 means that, if assets are successfully frozen and traced, the claimant's recovery is not diluted by other unsecured creditors. For institutional claimants or HNW individuals with significant losses, the economics are typically compelling; for smaller losses, the parallel criminal complaint route — which carries no filing fee and triggers the prosecution's own investigative apparatus at public expense — may provide more cost-efficient relief in the first instance, with civil proceedings initiated once the prosecution has developed the evidentiary record.

Beneficial ownership identification is a recurring practical challenge. Fraudsters operating rug-pulls typically use layered corporate structures, nominee directors and offshore holding vehicles to obscure their identities. Cabinet Decision 109/2023 requires UAE companies to maintain and disclose beneficial ownership registers where a natural person holds 25% or more of shares or voting rights. Where the fraudster's entity is UAE-incorporated, a beneficial ownership search is an early investigative step. Where the entity is offshore, MLA and forensic investigation are required. The AML manager-liability provisions of FDL 10/2025 are also relevant here: where a corporate vehicle was used to facilitate the fraud, senior managers who knew or ought to have known of the ML activity face personal criminal exposure, which creates a powerful incentive for cooperation and asset disclosure that skilled practitioners can leverage in settlement negotiations.

Finally, clients should be counselled on the difference between recovery in a genuine market collapse — where founders may have acted in good faith but failed to deliver — and a premeditated rug-pull. The legal tools available are largely the same, but the criminal dimensions and the prospects of cooperation differ materially. In a genuine collapse, founders may be willing to cooperate with an asset-tracing exercise and enter a structured recovery arrangement under the supervision of the Bankruptcy Court under FDL 51/2023, which offers restructuring as well as liquidation tracks. In a premeditated rug-pull, the criminal complaint, WFO and international enforcement strategy must be deployed aggressively and simultaneously from day one.

Practical checklist

• Commission blockchain analytics report within 24 hours of discovering the fraud
• Send written preservation notices to all known VASPs citing VARA obligations and FDL 10/2025
• File an ex parte worldwide freezing order application in the DIFC Courts under Law 2/2025
• Assert proprietary rights under DIFC Digital Assets Law 2/2024 in the WFO supporting affidavit
• File a parallel criminal complaint with Dubai Police Economic Crimes Unit under FDL 31/2021
• Request Travel Rule records from VARA-licensed VASPs for all transfers above AED 3,500
• Conduct beneficial ownership search under Cabinet Decision 109/2023 to identify natural-person defendants
• Register victim interest in any criminal asset-seizure proceedings under FDL 38/2022 to preserve restitution rights

Frequently asked questions

Related guides

• VARA Rulebooks 2.0 and Crypto Licensing in Dubai (AML for VASPs)
• The UAE Virtual Asset Travel Rule: AED 3,500, VARA vs ADGM
• Defending VARA Enforcement: Fines, Cease-and-Desist and Licence Action
• White-Collar & Financial Crime — full guide

Published 15 July 2026. General information only — not legal advice. Contact us for matter-specific advice.