What an exchange can actually restrict
An exchange holds the keys to its customers' balances. That means it can suspend withdrawals from an account, and in doing so hold value in place while it or law enforcement looks at the matter.
It cannot touch a self-custody wallet. Nothing sits between a private key and the network, so if the funds have left a service there is nothing for anyone to freeze until they arrive at another one.
Separately, a small number of token issuers can restrict specific addresses holding their token. This is unusual, generally happens at the request of law enforcement, and is never something to count on.
Why the first hours decide it
Funds deposited to an exchange by a fraud operation are typically converted or withdrawn quickly. A restriction placed on an empty account achieves nothing.
This is the single strongest argument for reporting immediately rather than waiting until you understand what happened. You do not need a completed investigation to tell an exchange that a specific deposit was the product of fraud — you need the transaction hash and the date.
What to send an exchange
- The transaction hash of each payment, and the receiving address.
- The date, time and amount of each transfer.
- Your Action Fraud crime reference number, if you already have one — get one the same day if not.
- A short factual account of what happened, without speculation about who is responsible.
- Your own contact details and, where relevant, your account identifiers with that exchange.
What an exchange will not do
- Tell you who owns the account. Identity records go to law enforcement under lawful process, not to victims.
- Return funds on your say-so. A restriction is temporary; a return usually requires a police request or a court order.
- Keep a hold in place indefinitely without legal backing.
- Act on a report sent to an unofficial channel. Use the exchange's published support or law-enforcement route only.
How a trace helps here
In many cases the victim does not know which exchange received the funds, because there were several hops in between. Establishing that endpoint — and being able to evidence the path to it with hashes — is exactly what a trace produces.
It also matters for credibility. A compliance team receiving a structured, verifiable path can check it in minutes. A long narrative with no hashes usually cannot be actioned at all.
If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.
Common questions
- Can Binance, Coinbase or Kraken freeze stolen crypto?
- Major exchanges can restrict a customer account holding identifiable proceeds, and do so where a credible report arrives in time. None of them will reverse a transfer or disclose account holder details to a victim.
- How fast do I need to report to the exchange?
- The same day, ideally within hours. Funds are usually converted or withdrawn quickly, and a restriction only works on a balance that is still there.
- Can USDT be frozen?
- The issuer is technically able to restrict specific addresses holding its token, and has done so at the request of law enforcement. It is not a service available on request and should never be assumed.
- The exchange replied that it cannot help. Is that the end?
- Not necessarily. A generic first reply is common. A documented trace attached to a crime reference, submitted through the correct channel, is treated differently from an unevidenced report.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the onchain data supports a traceable case.
Key terms in this guide
Plain-English definitions from the Wallsec glossary.