How can exchanges, cross-chain protocols and law enforcement agencies collaborate to recover assets? Analyze the recovery process and industry cooperation.
Author: Lawyer Shao Jiaio
The exchange was stolen and it happened again. Only this time, the amount was about $350 million, and the victim switched to Bitget.
In the early morning of September 25, 2026, Bitget suffered a security incident. According to the security announcement issued by the platform, at 02:31:11 Beijing time, the system detected abnormal transfers in some hot and warm wallets. The preliminary assessment involved an amount of approximately US$351.6 million. The cold wallet was not affected. Bitget stated that the relevant losses were within the coverage of the user protection fund, and the currency withdrawal function was temporarily closed, waiting for the orderly recovery after the safety verification is completed.
The more I read this kind of news, the harder it is for me to focus only on "how much money was lost." The more realistic question is: whose hands will the money pass through next, and which participants will have time to do something? How to make up for the losses will first test Bitget; whether the funds can be blocked also depends on the exchanges, exchange services, cross-chain protocols, aggregation applications along the way, as well as the people who actually have business authority.
After the incident, Bybit co-founder and CEO Ben Zhou expressed his willingness to provide help to Bitget and said that the team is updating the LazarusBounty platform to help track the flow of stolen funds. In critical moments, competitors are willing to lend a hand, and this kind of industry mutual assistance deserves recognition.
Similar mutual aid has occurred in previous theft incidents. After Bybit was stolen in 2025, Bitget CEO Gracy Chen publicly offered to assist in tracking and investigation. According to Bybit’s official event timeline, Bitget also transferred 40,000 ETH to Bybit at that time to provide liquidity support. Providing liquidity and recovering stolen assets are two different tasks, but they illustrate one thing together: after a major security incident occurs, it is difficult for a single platform to complete all responses alone.
After showing solidarity, the real hard work begins. Stolen assets may be quickly exchanged for other currencies, split into multiple addresses, or moved to another chain. Some of the services that funds pass through can control escrow accounts, some have control over unsettled transactions, and some can only manage front-end entry, routing or partial execution. Investigators and injured parties must find the subject who is truly capable of taking action as quickly as possible.
Collaboration in recovering stolen goods really tests three things: whether addresses on the chain can be mapped to specific transactions, whether business permissions can be converted into disposal actions, and whether temporary measures can be smoothly integrated into formal procedures.
These three things also determine the order of discussion in this article. Public statements can convey goodwill; whether funds can be blocked requires a layer-by-layer answer to who controls this link, which step the transaction has taken, what measures are supported by the existing materials, and how to complete subsequent disclosure, preservation, and return.
Step one: Find out who really has the authority to do so
The first step in translating industry solidarity into action is to identify who has actual authority over the relevant transactions. Service providers that receive assets and make payments after completing the exchange may control unsettled assets; custody exchanges may control associated accounts and deposit and withdrawal permissions; operators of cross-chain protocols or aggregation applications may only control the front-end, routing, transaction forwarding, or part of the execution process.
To determine the objects of assisted investigation, platform names and technical labels can only provide a starting point. What is really useful is the business process and control relationship. The injured party can use this to find a subject that can accept the request; the operator who receives the request can also use this to confirm what he can suspend, verify, save, and what things are beyond his authority.
Legal obligations must also be judged based on the specific business and applicable jurisdiction. In accordance with the international standards of the Financial Action Task Force (FATF), virtual asset service providers should usually implement preventive measures such as customer due diligence, record keeping and suspicious transaction reporting. The specific scope of application and implementation methods are implemented by the laws of each jurisdiction. Legal verification, preservation or reporting obligations that have been triggered should be performed in accordance with applicable regulations; whether transactions can also be restricted or information provided to specific objects needs to be judged separately.
This analysis also applies to businesses using decentralized technologies. In the DeFi special report released by FATF in July 2026, it focused on who has control or sufficient influence over relevant arrangements, and listed management authority, upgrade control, governance token concentration, infrastructure influence and other judgment factors. The report provides an analytical framework under international standards, and specific obligations still need to be returned to local laws. For cross-chain protocols and aggregation applications, what services the operator actually provides and what links it controls are usually more descriptive than the name "decentralization."
Step 2: Map the on-chain address to the specific transaction
After finding the subject that may accept the request, the next step is to map the fund path on the chain to the other party's account, order and business record. The address label can only indicate the tracking direction; only when it falls to a specific transaction can it be easier for the relevant operators to judge whether the funds are still under control and what room for disposal is available at this stage.
When the victim platform or its authorized agent makes a request for assistance in investigation, it can try to explain the case, the blockchain involved, transaction hash, currency, amount, time, relevant addresses, and the connection between these clues and the recipient's business. The service provider receiving the request can verify the identity of the requesting party, the source of the material and its transaction relationship according to its own process. The step at which the transaction is executed is an important clue to determine the disposal space.
For services that collect payment first and then redeem and pay, different control statuses exist: not yet exchanged, exchange completed but not paid yet, and payment completed. For cross-chain or aggregation services, operators can check source chain transactions, exchange requests, target chain addresses and execution status based on the information they legally possess. The specific content that needs to be verified should be determined based on the business structure, legally held information and applicable requirements.
Once external clues are mapped to actual accounts, the custodian exchange may take measures with authority and basis. According to Elliptic’s disclosure, in 2023, Binance and Huobi froze accounts containing approximately US$1.4 million in crypto assets based on the intelligence provided by them. The relevant funds came from the previous Harmony Horizon cross-chain bridge attack. The key to this case being established is that the external tracking results correspond to the accounts controlled by the exchange. Whether other platforms or protocols can take similar measures depends on their respective authority, evidence and applicable procedures.
Step 3: Select appropriate measures according to transaction stage
When clues are mapped to specific transactions, the question shifts from "what was found" to "what else can be done now?" Restricting entrances, suspending exchanges, suspending payments and restricting transfers from escrow accounts have different objects, sources of authority and scope of influence. Operators need to make judgments between the urgency of continued capital flow, the credibility of existing materials and the rights of normal traders.
When unsettled assets are still under the control of the service provider, the service provider can evaluate the feasibility of suspending the exchange or suspending payment based on applicable laws, contractual arrangements, technical capabilities and the impact on relevant users. The transaction has not yet been completed and does not automatically generate freezing or return obligations, but it may leave time for temporary verification. When custodial exchanges face related accounts, they also need to review the specific basis, scope and continuing conditions for restricting transfers.
Operators of cross-chain protocols and aggregation applications should first sort out which links they control. If it only manages the front-end interface, measures can usually only be applied to that entrance; if it also controls transaction forwarding or execution permissions, there may be other room for intervention. When it comes to contract suspension or upgrade, multi-signing, governance procedures and the impact on other users will also affect whether the measures are feasible.
Entry restrictions can reduce the risk of continued exploitation of a specific service, and their actual effectiveness depends on the service architecture and other access paths. If users can still call contracts through other entrances or directly, the role of limiting a single front end will be limited.
OKX’s announcement on March 17, 2025 provides a real-life example. OKX said that after discovering that Lazarus was trying to abuse its DeFi services, it communicated with regulatory agencies and proactively suspended the DEX aggregation service and upgraded preventive measures. The announcement also stated that the aggregator connects the liquidity of multiple protocols and does not itself custody customer assets. This case illustrates that non-managed services can also adjust the products and portals they control. Whether funds in the underlying protocol can be frozen still depends on the actual structure and control authority.
When relevant operators take temporary measures, they can also simultaneously consider the scope of application, review nodes, lifting conditions and record retention. For legally binding law enforcement or judicial orders that apply to this party, they should be handled in accordance with their validity and scope; if there are doubts about the scope of execution or technical feasibility, you can explain and seek clarification through the corresponding procedures. Even if the funds have been transferred out, legally retained account, order, login and communication records may continue to assist subsequent recovery.
Step 4: Integrate temporary restrictions into the formal return process
Funding was temporarily halted, just gaining a processing window. Whether the assets can be returned in the end depends on who the assets belong to, what can be delivered, to whom they should be delivered, and according to what procedures they should be delivered. After being exchanged and changing hands many times, the counterparty to the transaction may provide its own basis for legal transactions and asset acquisition; after the funds enter the exchange's capital pool, the pursuing party may need to further prove the connection between the controlled assets and the original stolen funds.
Temporary restrictions on transfer and final return often correspond to different conditions and certification requirements. Entities that only manage the front end and do not control related assets may provide assistance mainly with legally held records; entities that master customer information or order information also need to consider the recipients, scope of disclosure, confidentiality obligations, and personal information protection requirements when disclosing to the outside.
Judicial measures also require the pursuing party to prepare evidence and procedures. In the 2023 judgment in the UK Piroozzadeh case, the victim obtained a temporary property injunction without notifying Binance. The court later revoked the injunction because the applicant did not fully and fairly present the case. The judgment discussed the exchange’s possible bona fide defense of paid acquisition, as well as issues such as how to identify and implement preservation of funds after they are mixed into the fund pool. This case dealt with an application for a temporary injunction, and there was no final judgment on the ownership of the assets. However, the pursuing party was reminded that in order for the on-chain tracking results to be converted into judicial measures, corresponding evidence and procedural requirements need to be met.
Public rules for exchange services can also reflect this distinction. ChangeNOW's public investigation instructions require the requesting party to provide information on the case, transactions, address lists and law enforcement procedures; Article 6.11 of its terms of service also states that depending on the time of receipt of the report, the platform may not block the transaction until the exchange is completed, and the assets that can be returned at this time may be the converted currency. Under this provision, return requires an express request from law enforcement authorities. This is the processing mechanism publicly disclosed by ChangeNOW. How other service providers handle it still depends on applicable laws, contractual arrangements, asset status and specific procedures.
What do different participants do in the first place?
When the previous analysis is put into practice, the biggest fear is that "everyone is willing to help, but they don't know who should send the next email, what needs to be attached, and who will hand it over to judge after receiving it." The flow of funds does not wait for all parties to slowly become familiar with the process. Combined with the permissions of different roles, the following matters can be used as a reference when initiating disposal.
For the victim platform or project party: You can prioritize fixing the event timeline, sorting out transaction hashes, involved addresses, currencies, amounts and on-chain paths, and preparing ownership, reporting and authorization materials. It is best for external assisted investigations to be issued from a unified window, clearly stating what you want the other party to verify, the extent to which existing clues support it, and how the follow-up formal procedures are being advanced.
For operators of exchanges, exchange services, etc.: After receiving clues, they can first check the associated accounts, orders and transaction stages, and save KYC, login, equipment, communication and operation records, and then business, technical, compliance and legal personnel will evaluate the measures that can be taken based on their own authority. Matters that have not yet been confirmed can be stated as still being verified; measures that have been taken and their limitations can also be reported to the requesting party within the scope of communication permitted by law.
For cross-chain protocols, aggregators and related operators: You can distinguish smart contracts, front-ends, routing, APIs, upgrade permissions and governance mechanisms as soon as possible, and confirm which links are actually controlled by you. When it is planned to adjust the entrance, suspend services, or initiate multi-signature or governance procedures, other access paths, normal user impacts and recovery conditions should also be evaluated, and the facts and permissions descriptions based on the decision should be retained.
For lawyers and on-chain investigation teams: The focus of the work is to organize the on-chain paths into factual drafts that can be understood by the platform, law enforcement agencies and courts, and map each request to the specific subject, authority and procedure. When multiple jurisdictions or service providers are involved, material delivery and action sequences must be designed to avoid clues remaining in the address list, and to avoid temporary restrictions being disconnected from subsequent preservation, disclosure, and return.
The sooner all parties work together on the same fact sheet, the easier it will be for verification, restriction, disclosure and return to flow. Relevant operators can also establish risk clue entrances and internal decision-making processes in normal times to clarify who receives requests, who determines transaction relevance, who evaluates legal basis, and under what circumstances it is necessary to escalate to management or an external professional team.
Whether to bear responsibility ultimately depends on specific evidence.
When collaboration is advanced, issues of responsibility are more easily discussed accurately. A slow response, a misjudgment of risk, continued violation of statutory anti-money laundering requirements, and knowingly helping to transfer criminal funds have different factual and legal evaluations. For protocols or applications, responsibilities also need to be assigned to specific operators or controllers; identities such as developers and governance participants are not sufficient in themselves to directly determine responsibilities.
At the regulatory level, we must first confirm whether the relevant entities are obligated entities under applicable laws, and then determine the specific customer due diligence, record keeping and reporting requirements. FATF's suspicious transaction reporting standards require countries to adopt legal requirements for financial institutions to promptly report to financial intelligence agencies when they suspect or have reasonable grounds to suspect that funds are the proceeds of crime. For virtual asset service providers subject to local laws, the reporting entities, triggering conditions and implementation methods are still subject to local regulations.
Submitting suspicious transaction reports to statutory authorities and disclosing customer information to the injured party are two different types of behavior, with different basis and boundaries. Reported information may also be subject to confidentiality restrictions. Whether the relevant operators can publicly state that they have reported or are under investigation needs to be judged in conjunction with applicable rules; for more serious accusations such as assisting money laundering, evidence must be provided to prove specific behaviors, subjective perceptions, and other elements required by local laws.
In 2025, German law enforcement agencies investigated the encrypted asset exchange service eXch, paying attention to both the flow of funds and the way the platform operates. Elliptic has tracked and found that some Bybit stolen ETH was converted into BTC through services such as eXch. Since then, the German Federal Criminal Police Office reported that law enforcement agencies seized eXch’s servers in Germany and crypto assets worth approximately 34 million euros at that time on April 30, 2025. The operators were suspected of commercial money laundering and operating an Internet criminal trading platform. The notice also mentioned that the service had promoted on the underground network that it did not take anti-money laundering measures and did not require users to verify their identities. Criminal charges must still be proven in accordance with legal requirements and evidence.
The inspiration brought by this case is very direct: investigative agencies will not only pay attention to where the funds pass, but also look at how the service solicits business, how to organize exchanges, and what actions are taken when facing risk clues. Operators keep necessary verification and decision-making records to help explain when risks were discovered, what authority they had at that time, and why certain measures were or were not taken. The scope and retention period of records should still comply with applicable regulations, and their probative role also needs to be evaluated in conjunction with other evidence.
Mankiw Lawyer Summary
After seeing many similar incidents, I feel more and more that the outcome of recovering stolen goods often depends on one very simple thing: whether all parties can put together authority, evidence and procedures in the shortest possible time. Public support can let people see the temperature of the industry; to truly stop assets, allow data to be investigated, and returns to be based on evidence, specific work is needed.
The most difficult part of this type of matter is usually to put together the on-chain path, account and order information, business control authority, legal basis and cross-border procedures into an enforceable recourse chain. The sooner on-chain investigations, platform compliance, technical personnel and lawyers collaborate around the same factual draft, the easier it will be for subsequent verification, restriction, disclosure, preservation and return. For institutions that have experienced abnormal asset transfers or may receive requests for assistance, completing authority sorting, evidence fixation, and response path design as early as possible can also reduce the risk of missing the disposal window.
What users entrust to the platform is assets and trust. The sign of the true maturity of the industry is that after every accident, public expressions of goodwill can be transformed into actions that are well-founded, enforceable, and can leave traces.
I hope to see less "again" in the future and more "recovered" supported by evidence.