In a pig butchering case I handled last year, the victim lost $340,000 in USDT. The scammer's wallet address was identified, and blockchain forensics traced the funds to a Binance deposit address. But the trail stopped there. We knew the scammer had a Binance account, but we did not know who they were. Binance, like all cryptocurrency exchanges, will not voluntarily disclose customer information to a private party. To identify the scammer, we needed a legal tool that would compel Binance to hand over the account holder's name, email address, phone number, and KYC documents. That tool was a Norwich Pharmacal order.
The Norwich Pharmacal order is one of the most powerful legal instruments available for crypto fraud recovery. It allows a victim to compel a third party — typically a cryptocurrency exchange, an internet service provider, or a bank — to disclose information about an unknown wrongdoer. Without this order, the victim is stuck: they know where the money went, but they cannot find out who received it.
In this article, I explain what a Norwich Pharmacal order is, how it works in crypto fraud cases, the jurisdictions where it is available, and the practical steps for obtaining one. If you are pursuing crypto fraud recovery and have traced funds to an exchange but cannot identify the account holder, this is the legal tool you need.
What is a Norwich Pharmacal order?
The Norwich Pharmacal order takes its name from a 1974 House of Lords case, Norwich Pharmacal Co. v. Customs and Excise Commissioners. In that case, the Norwich Pharmacal Company had been innocently involved in a customs fraud (its chemicals were used by the fraudsters), and it sought to compel the customs authority to disclose the identities of the fraudsters. The House of Lords held that where a third party has been innocently involved in a wrongdoer's tort, the third party can be compelled to disclose the wrongdoer's identity.
The principle has since been expanded significantly. Today, Norwich Pharmacal orders are used in a wide range of cases — intellectual property, fraud, defamation, and, increasingly, cryptocurrency fraud. The order is particularly well-suited to crypto cases because cryptocurrency transactions are pseudonymous: the blockchain records the wallet address but not the name of the person controlling it. The identity of the wallet holder is known only to the exchange where the wallet is hosted (or, in the case of self-custody wallets, to no one).
A Norwich Pharmacal order is typically obtained without notice to the wrongdoer (ex parte) — because if the wrongdoer were notified, they might attempt to destroy evidence or move the funds. The order is served directly on the third party (the exchange), which must then produce the requested information within a specified timeframe.
The legal requirements for a Norwich Pharmacal order
To obtain a Norwich Pharmacal order, the applicant must satisfy four requirements:
- A wrong has been committed: The applicant must show that a tort or other wrong has been committed. In crypto fraud cases, this is typically conversion (the tort of wrongful deprivation of property) or fraud. The applicant does not need to identify the wrongdoer — that is the whole point of the order — but must show that a wrong has occurred.
- The respondent was involved in the wrong: The third party (the exchange, ISP, or bank) must have been innocently involved in the wrong. "Innocently involved" means that the third party facilitated the wrong without knowing it was doing so. A cryptocurrency exchange that received a deposit from a scammer's wallet is innocently involved — it provided the infrastructure (the deposit address) that the scammer used to receive funds.
- The respondent has the information: The third party must have information that would help identify the wrongdoer. An exchange has the account holder's name, email, phone number, KYC documents, and IP address. An ISP has the subscriber's name and address associated with an IP address. A bank has the account holder's identity and transaction history.
- The order is necessary: The applicant must show that the order is necessary — that is, that there is no other way to obtain the information. In crypto cases, this is usually straightforward: the blockchain is pseudonymous, and the only way to identify a wallet holder is through the exchange or service they used.
The court also considers whether the order is proportionate — whether the benefit to the applicant outweighs the cost and intrusion to the third party and the wrongdoer's privacy rights. In cases involving significant financial loss, courts generally find that the order is proportionate.
Jurisdictions where Norwich Pharmacal orders are available
Norwich Pharmacal orders are available in common law jurisdictions, particularly:
United Kingdom
The UK is the home of the Norwich Pharmacal order and the jurisdiction where it is most well-established. The English courts have issued Norwich Pharmacal orders against cryptocurrency exchanges in several cases, establishing that exchanges can be compelled to disclose customer information. The UK courts have jurisdiction over any exchange that has a sufficient connection to the UK — typically, this means the exchange has UK customers or operates through a UK entity.
For exchanges that are not based in the UK, the English court can still issue a Norwich Pharmacal order, but enforcement depends on the exchange's willingness to comply. Major exchanges (Binance, Coinbase, Kraken) typically have UK entities or UK-facing operations and will comply with English court orders. Smaller exchanges, particularly those in non-cooperative jurisdictions, may not comply.
Hong Kong
Hong Kong, as a common law jurisdiction, recognizes Norwich Pharmacal orders. Hong Kong courts have issued Norwich Pharmacal orders against cryptocurrency exchanges, and the jurisdiction is particularly useful for obtaining information from Asia-based exchanges. Hong Kong also has a robust legal system with English-language proceedings, making it accessible for international applicants.
Hong Kong is an attractive jurisdiction for Norwich Pharmacal orders because many crypto exchanges have Hong Kong entities or operations. Binance, for example, has had a Hong Kong presence, and several smaller exchanges are Hong Kong-registered. A Hong Kong Norwich Pharmacal order can be an effective tool for obtaining information from these exchanges.
Singapore
Singapore also recognizes Norwich Pharmacal orders and has a well-developed legal framework for crypto litigation. Singapore courts have issued Norwich Pharmacal orders against cryptocurrency exchanges, and the jurisdiction is particularly useful for obtaining information from Singapore-based exchanges and service providers. Singapore is also home to several crypto exchanges and service providers, making it a natural jurisdiction for Norwich Pharmacal applications.
Singapore's legal system is based on English common law, and the courts are experienced in complex commercial litigation. The International Commercial Court (SICC) provides a specialized forum for international commercial disputes, including crypto cases. Singapore is often the preferred jurisdiction for crypto litigation in Asia.
Other jurisdictions
Other common law jurisdictions that recognize Norwich Pharmacal or equivalent orders include the British Virgin Islands (where Tether's parent company is incorporated), the Isle of Man, and Gibraltar (where several crypto exchanges are registered). Civil law jurisdictions (Switzerland, Germany, France) do not have a direct equivalent of the Norwich Pharmacal order, but they have other legal instruments (such as the Swiss Art. 263 CPC, which allows courts to order third parties to disclose information) that serve a similar function.
The Norwich Pharmacal process in crypto cases
The process for obtaining and enforcing a Norwich Pharmacal order in a crypto case follows these steps:
Step 1: Tracing
Before applying for a Norwich Pharmacal order, you must trace the stolen funds to a specific exchange or service provider. This requires blockchain forensics — using tools like Chainalysis, TRM Labs, or Elliptic to follow the funds from the victim's wallet to the scammer's deposit address on the exchange. See our chainhopping article for the tracing methodology.
The tracing must identify the specific deposit address used by the scammer. The exchange can then match this deposit address to its internal records and identify the account holder. Without a specific deposit address, the exchange cannot identify the relevant account.
Step 2: Filing the application
The application is filed ex parte (without notice to the wrongdoer) in the appropriate court. The application must include:
- An affidavit from the victim describing the fraud and the loss
- A blockchain forensics report tracing the funds to the exchange
- Legal submissions establishing the four requirements (wrong, involvement, information, necessity)
- A draft of the proposed order specifying what information the exchange must disclose
The application is typically heard within 24-72 hours of filing, depending on the court's schedule. In urgent cases, the court can hear the application on the same day.
Step 3: Service on the exchange
Once the court grants the order, it is served on the exchange. The order specifies what information the exchange must disclose and the deadline for disclosure (typically 7-14 days). The exchange must comply with the order or face contempt of court proceedings.
For exchanges in the same jurisdiction as the court, service is straightforward. For exchanges in other jurisdictions, the order must be served through international legal channels (such as the Hague Service Convention), which can add several weeks to the process. Some exchanges have designated agents for service of process in multiple jurisdictions, which speeds up the process.
Step 4: Disclosure
The exchange produces the requested information. This typically includes:
- The account holder's name and date of birth
- The email address and phone number associated with the account
- KYC documents (passport, proof of address)
- The IP address used to access the account
- Transaction history (deposits, withdrawals, trades)
- Any linked accounts (if the scammer used multiple accounts on the same exchange)
Once the scammer's identity is revealed, the victim can pursue further legal action — civil claims for conversion or fraud, or criminal prosecution through law enforcement. The identity disclosure also enables the victim to seek a freezing order (Mareva injunction) on the scammer's assets, preventing them from dissipating the stolen funds.
Case study: using a Norwich Pharmacal order to identify a scammer
In the case I mentioned at the beginning of this article, the victim lost $340,000 in USDT to a pig butchering scam. We traced the USDT through two wallet hops to a Binance deposit address. We then filed a Norwich Pharmacal application in the English High Court, naming Binance as the respondent. The application included:
- A sworn affidavit from the victim describing the scam (how she met the scammer on a dating app, how he convinced her to invest in a fake trading platform, and how she transferred USDT to the scammer's wallet)
- A blockchain forensics report from TRM Labs tracing the USDT from the victim's wallet to the Binance deposit address
- Legal submissions arguing that Binance was innocently involved in the fraud (by providing the deposit address that the scammer used to receive funds)
The court granted the order within 48 hours. The order was served on Binance's UK entity, which acknowledged receipt and began processing the request. Within 12 business days, Binance produced the account holder's information: a Chinese national with a passport from Fujian province, who had registered the Binance account using a phone number from Singapore and an email address that was also used on two social media platforms. The IP address was in Dubai.
With the scammer's identity, we were able to file a civil claim for conversion in the English court and obtain a worldwide freezing order on the scammer's assets. We also referred the case to the UK's National Crime Agency (NCA), which opened a criminal investigation. The victim ultimately recovered approximately 60% of the stolen funds through a combination of the freezing order (which prevented the scammer from moving the remaining funds on Binance) and a settlement negotiated through legal counsel.
Without the Norwich Pharmacal order, the scammer would have remained anonymous, and no recovery would have been possible. The order was the key that unlocked the entire recovery process.
The case also illustrates the importance of coordination between different legal tools. The Norwich Pharmacal order alone did not recover the funds — it only identified the scammer. The actual recovery required a worldwide freezing order (to prevent the scammer from moving the remaining funds), a civil claim for conversion (to establish legal liability), and negotiations through legal counsel (to reach a settlement). The Norwich Pharmacal order was the first domino, but the entire sequence of legal actions was needed to achieve recovery.
In another case, we used a Norwich Pharmacal order to identify a scammer who had used a non-custodial swap service (Changelly) to convert stolen Bitcoin to Ethereum. The swap service had recorded the scammer's IP address and the destination Ethereum address. With the IP address, we obtained a second Norwich Pharmacal order against the ISP (an internet service provider in Turkey), which disclosed the subscriber's name and physical address. The scammer turned out to be a resident of Istanbul who had defrauded multiple victims across Europe. The information was shared with Turkish law enforcement, who arrested the scammer and seized assets. This case shows how Norwich Pharmacal orders can be chained — each order produces information that leads to the next order, building a picture of the scammer's identity and operations.
Limitations and challenges
While Norwich Pharmacal orders are powerful, they have limitations:
- Jurisdictional reach: The order is only effective against exchanges that have a presence in the jurisdiction where the order is issued. An order from the English court has no direct effect on an exchange in the Seychelles or Vanuatu. International legal assistance is needed, which adds time and complexity.
- Cost: Obtaining a Norwich Pharmacal order requires legal counsel and (typically) a blockchain forensics report. The cost ranges from $15,000 to $50,000, depending on the complexity of the case and the jurisdiction.
- Time: While the order can be obtained quickly (24-72 hours), the exchange's compliance takes 7-14 days (or longer for international exchanges). By the time the identity is disclosed, the scammer may have already moved the funds.
- False identities: Some scammers use stolen identities to register exchange accounts. The KYC documents on file may not be the scammer's real identity. This is particularly common in cases involving North Korean hacking groups and organized crime syndicates.
- Self-custody wallets: If the funds are in a self-custody wallet (not on an exchange), there is no third party to serve with a Norwich Pharmacal order. The identity of the wallet holder cannot be obtained through this legal tool.
Despite these limitations, the Norwich Pharmacal order remains one of the most effective tools for identifying anonymous crypto scammers. In our practice, it is the primary method for bridging the gap between blockchain forensics (which identifies where the funds went) and legal action (which requires knowing who the wrongdoer is).
Norwich Pharmacal orders and privacy concerns
Norwich Pharmacal orders involve the disclosure of personal information by a third party without the account holder's consent. This raises privacy concerns, particularly under data protection laws like the EU's GDPR and the UK's Data Protection Act. Courts balance the applicant's right to identify the wrongdoer against the account holder's right to privacy.
In practice, courts have generally found that the need to identify a fraudster outweighs the privacy interests of the account holder, particularly when the financial loss is significant. However, courts impose safeguards: the disclosed information can only be used for the purpose of the legal proceedings (not published or shared with third parties), and the exchange is typically given the opportunity to notify the account holder (though this is often delayed to prevent the account holder from moving funds before a freezing order is obtained).
The interaction between Norwich Pharmacal orders and data protection law is an evolving area. As data protection enforcement increases, courts may become more cautious about granting orders that require the disclosure of personal data. However, in cases of clear fraud with significant financial loss, the balance continues to favor disclosure.
Alternatives to Norwich Pharmacal orders
In jurisdictions that do not recognize Norwich Pharmacal orders (civil law jurisdictions), there are alternative legal tools:
- Switzerland: Article 263 of the Swiss Civil Procedure Code allows a court to order a third party to disclose information in certain circumstances. The requirements are similar to Norwich Pharmacal: the applicant must show a legitimate interest, the third party must have the information, and the information must be necessary for the applicant's legal claim.
- United States: US courts can issue subpoenas under Rule 45 of the Federal Rules of Civil Procedure, which compel third parties to produce documents and testimony. In crypto cases, a subpoena can be served on an exchange to produce account records. The subpoena can be obtained before a lawsuit is filed (through a pre-suit discovery proceeding in some states) or after filing.
- European Union: The EU's Evidence Regulation (Regulation 1206/2001) allows courts in one EU member state to request evidence (including the disclosure of information by third parties) from courts in another member state. This can be used to obtain information from exchanges based in other EU countries.
While these alternatives exist, the Norwich Pharmacal order remains the most streamlined and effective tool for obtaining identity disclosure in crypto fraud cases. Its ex parte nature (no notice to the wrongdoer) and its specific focus on identity disclosure make it uniquely suited to crypto fraud cases, where speed and secrecy are essential.
The bottom line
The Norwich Pharmacal order is the primary legal tool for identifying anonymous crypto scammers. By compelling exchanges, ISPs, and banks to disclose customer information, it bridges the gap between blockchain forensics (which identifies where the funds went) and legal action (which requires knowing who the wrongdoer is). The order is available in the UK, Hong Kong, Singapore, and other common law jurisdictions, with similar tools available in civil law jurisdictions.
If you have traced stolen cryptocurrency to an exchange but cannot identify the account holder, contact us. We can file a Norwich Pharmacal application (or an equivalent in your jurisdiction) to compel the exchange to disclose the scammer's identity, enabling you to pursue civil claims and coordinate with law enforcement.