Cryptoassets
Blockchain and Digital Assets

Matt Green
April 2026

This article was written by Matt Green, Partner and Head of Blockchain and Digital Assets, and was published on Thomson Reuters Regulatory Intelligence on 28 April, 2026. Subscription may be required to view.

You can read the full article as published on Thomson Reuters below.

This article details the recovery of Monero (XMR), a notoriously difficult-to-trace privacy coin, following a fraud. The Monero was ultimately recovered through coordinated legal, investigative and law enforcement action.

The author’s client received a call from an individual purporting to represent a cryptocurrency exchange. During the call, the fraudster asserted that the client’s exchange account had been compromised and urgently instructed the client to transfer assets to a trust wallet as a protective measure. 

The fraudsters were in possession of the client’s personal and account details, likely obtained via data breaches. This gave the scam credibility and induced the client to act quickly. 

As a result, the client transferred significant holdings of bitcoin and ether to the fraudster. These were subsequently routed through a series of exchanges and converted into other digital assets, including Monero.

Tracing, initial exchange engagement 

A forensic blockchain investigation traced asset movements to the exchanges FixedFloat, HitBTC and ChangeNOW, where the bitcoin and ether had been converted into other currencies. 

Letters were urgently sent to those exchanges to confirm receipt of the criminal proceeds and to provide instructions on what to do next. The responses varied: some exchanges failed to respond, while others confirmed that certain funds had already been dissipated. 

Importantly, some of the assets had been converted into Monero and remained identifiable at ChangeNOW, which then froze what it had and confirmed compliance with the requests made in the letters.

Law enforcement involvement, freezing order 

With assistance from the Metropolitan Police cryptocurrency investigations team, and relying on blockchain forensics, an application was made to Westminster Magistrates’ Court for a crypto wallet freezing order. 

The court granted a freezing order under section 303Z37(2) of the Proceeds of Crime Act 2002, formally freezing the Monero held at ChangeNOW for an initial period of six months. This step was critical in preserving the remaining assets while further recovery steps were pursued. 

Order to release cryptoassets 

Upon expiry of the six-month freezing period, an application was made for a declaration that the Monero belonged and was deliverable to the clients.

The Court granted a cryptoasset release order for Monero assets pursuant to sections 303Z50(4) and (5), and 303Z51(4) and (5) of the Proceeds of Crime Act 2002. Service of the order on ChangeNOW was effected by the Metropolitan Police.

Custody, attribution and transfer

Given the technical complexity of sending Monero, which is designed to evade tracing, specialist asset custody and attribution support was required. 

Asset Reality, which seizes, manages and disposes of traditional and digital assets, was instructed to receive, attribute and manage the Monero. To mitigate attribution risk, an initial test transfer was conducted. Asset Reality required specialist knowledge to identify which Monero assets were sent by ChangeNOW, which is highly uncommon. The remaining balance was subsequently transferred once verification was complete. 

Outcome 

Once the Monero was in Asset Reality’s custody, it was able to locate an approved buyer for onward handling and sale. The client then received fiat currency into his personal account. This marked the successful recovery phase of assets that had initially appeared, by design, almost impossible to recover. 

Legal, practical takeaways 

This matter illustrates several important points for practitioners and victims of cryptoasset fraud: 

  • Recoveries remain possible, even where assets are converted into privacy coins.
  • The use of Monero or a similar, privacy-focused cryptocurrency does not render recovery efforts futile when timely tracing, freezing and expert handling are deployed. 
  • Law enforcement engagement is increasingly effective and proactive.
  • The involvement of specialist police crypto teams can be decisive, particularly in securing freezing and release orders under the Proceeds of Crime Act 2002. 

This case demonstrates the practical effectiveness of combining civil recovery mechanisms under the Proceeds of Crime Act 2002 with technical blockchain expertise and law enforcement support. It provides a clear example that even in cases involving Monero, the legal system has viable tools to preserve and recover misappropriated cryptoassets when action is taken promptly and collaboratively.