Freeze Circumvention Techniques and Countermeasures
checklist
Core idea
Once an order names specific addresses and specific assets, the counter-move is to change one of those two things. Every technique below is a way of arriving at value that the order does not literally describe, which is why the countermeasure is usually broader drafting rather than better watching.
Components
| Evasion technique | How you detect it | Countermeasure |
|---|---|---|
| Dusting the frozen address | Monitoring for small-value transfers in | Supplemental orders using “tainted proceeds” language rather than fixed balances |
| Moving to an alternative fork | Cross-chain analytics | Expand the freeze to cover fork-based assets explicitly |
| Converting to a wrapped token | Bridge monitoring | Notify the wrapping issuer, file secondary freeze actions |
| Asserting a good faith purchaser claim | Transaction pattern analysis | Pre-emptive notice to major exchanges, so no downstream buyer can claim ignorance |
| Hiding in a DeFi liquidity pool | Protocol-specific monitoring | Pool-based tracing, plus outreach to protocol governance |
| Migrating to a hardware wallet | Address clustering | Expand the order, notify law enforcement |
Why dusting works as an attack: an order pinned to a balance or a specific set of inputs can be muddied by pushing unrelated value in, creating an argument about which coins the order actually bites on. Drafting against proceeds rather than against a snapshot balance is the defence.
Why pre-emptive notice matters: the good faith purchaser argument only works if the buyer genuinely did not know. Putting the major venues on notice early removes that defence from everyone downstream, which is worth more than catching the transfer after it happens.
Stay ready to respond: keep decision trees for the common scenarios, hold a rapid response capability for the duration of the watch, keep template supplemental filings for emerging techniques, and establish an accelerated route back to the court for urgent modifications.
When to use
From the moment a freeze lands, and again whenever drafting or renewing an order.
Avoid when
Do not read the countermeasure column as something an analyst executes alone. Detection is the analyst’s job; every countermeasure here runs through counsel.
Related
Post-Seizure Monitoring Periods by Asset Type · Freezable vs Non-Freezable Crypto Assets · Chain Hopping / Cross-Chain Bridging · Cross-Chain Obfuscation Categories · Compelling VASP Disclosure: The Legal-Process Ladder · The Six-Step Crypto Recovery Framework