First, establish that the address is really an exchange deposit
Not every address that receives your funds belongs to a service. Deposit addresses usually show a distinctive pattern: value arrives from many unrelated sources and is swept onwards to a single consolidation address shortly afterwards, often on a schedule. A self-hosted wallet does not behave like this.
Getting this wrong wastes weeks. Identifying the terminal point correctly, with the hashes that support it, is the part of the work a written trace exists to do.
What to include in the request
- Your name and contact details, and a clear statement that you are the victim of a fraud, not a counterparty in a dispute.
- The crime reference number from Action Fraud, or Police Scotland if you are in Scotland.
- The transaction hashes showing funds leaving your control, in order, with dates and times in UTC.
- The deposit address you believe is held with them, and the hop-by-hop path from your address to it.
- The network and asset — for example USDT on Tron, or ETH on Ethereum — since teams route requests by chain.
- A short factual narrative, ideally under a page, with the detail moved to an annexe.
Where to send it
Most major exchanges publish a law enforcement or compliance contact route separate from ordinary customer support. Use it. A general support ticket is triaged by staff who cannot see account-level information and cannot escalate a freeze.
Send it in writing and keep the acknowledgement. If a police officer is handling your report, ask that the same material is sent through their channel too — a request that arrives from both sides is treated more seriously than either alone.
What an exchange can and cannot do
- Can: restrict an account internally while it reviews, flag the address, and preserve records.
- Can: respond to a properly issued law enforcement request or court order with account information.
- Cannot: hand you the account holder's identity because you asked.
- Cannot: send you the balance without a legal direction to do so — a return normally follows a court order or a police process.
- Cannot: act at all if the funds have already been withdrawn onward.
Timing is the whole game
Funds that arrive at an exchange are often converted and withdrawn within hours. That is why the sequence matters: report first so a crime reference exists, notify the exchange as soon as a credible endpoint is identified, and let the detailed evidence follow. Waiting until a full report is polished can cost the case.
If the answer is no
A refusal, or silence, is not the end. Documented refusals are themselves useful — they show a solicitor and the police that the ordinary route was tried. Where the amount justifies it, a civil claim with a freezing injunction can compel disclosure that a voluntary request cannot.
If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.
Common questions
- Can Wallsec contact the exchange for me?
- Only with your instruction. We do not contact third parties on your behalf unless you ask us to. In most cases the strongest approach is a written evidence pack that you, your solicitor or the police submit.
- Do exchanges charge for this?
- Regulated exchanges do not charge victims to review a fraud report. Anyone asking you for a fee to unlock, release or process funds should be treated as a second fraud attempt.
- How likely is a freeze?
- It depends entirely on speed and on whether the funds were still at the service when the request landed. No firm can promise it, and any that does is telling you something it cannot know.
- How long does an exchange take to respond to a fraud report?
- Acknowledgement is often automatic and immediate. A substantive answer usually takes days to weeks, and account-level action generally follows police or court process rather than the victim's own message.
- Can Binance, Coinbase or Kraken return my money directly to me?
- Not on request. A regulated exchange can restrict an account and preserve records, but releasing a balance to someone other than the account holder normally requires a court order or a law enforcement direction.
- What if the stolen funds went to a wallet, not an exchange?
- There is nobody to write to. The address is monitored instead, and a request is made only if and when the funds move to a service that can act. That is a waiting position, not a dead end.
- Do I need a solicitor to ask an exchange to freeze an account?
- Not to make the initial report. A solicitor becomes relevant if you need disclosure, a freezing injunction, or a civil claim, which is normally where the amount justifies the cost.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the onchain data supports a traceable case.
Key terms in this guide
Plain-English definitions from the Wallsec glossary.