Stolen funds moving across a blockchain can be traced almost immediately. Doing anything about them involves legal processes designed for a world where money moved between institutions on paper.
Tracing and acting are separate problems
Public chains make the flow of funds visible, so analysts can follow a path through many addresses within a short period.
Recovering anything requires reaching a point where the funds interact with an identifiable business, since addresses themselves cannot be compelled to do anything.
That point is usually an exchange, and whether it can act depends on where it is incorporated and what process is served on it.
Authority stops at borders
An order from one country's courts has no direct effect on a business operating elsewhere, regardless of who the victims were.
Obtaining effect abroad generally requires a formal request through mutual legal assistance arrangements, which are slow by design because they involve two legal systems reviewing the same matter.
Timescales measured in months are ordinary, while funds move between jurisdictions in minutes.
By the time a request is answered, the funds have usually passed through several further hops, and the investigation has to begin again at whatever business now holds them.
Definitions differ between jurisdictions
Cooperation frequently requires that the conduct be an offence in both countries, and classifications of digital assets vary enough that this is not automatic.
Where an activity is regulated in one place and unregulated in another, a request may fail on the threshold question before any facts are considered.
Some jurisdictions have limited capacity to respond to such requests at all, which produces gaps that are well understood by those exploiting them.
Structure obscures who is responsible
Businesses are often incorporated in one place, operated from another and serving customers in many, which raises the preliminary question of who has authority before anything else can proceed.
Layered corporate structures extend that stage considerably, and each additional entity adds another set of requests to be made.
Establishing which court has jurisdiction can therefore take longer than establishing what happened, even where the movement of funds was never in any doubt.
Where the process does work
Where funds arrive at a cooperative exchange quickly, freezing can happen fast, because a business can act on its own terms of service before any court order arrives.
Coordination between agencies has improved, and industry participants increasingly share information about flows associated with known incidents.
The structural asymmetry remains: value moves at the speed of a network while authority moves at the speed of institutions, and no amount of improved tracing changes that.