"Your account has been restricted. We are unable to provide further information." The message looks like every other compliance hold — and most of the time it is one: the exchange's own monitoring raised a flag, it wants documents, and the way out runs through its compliance desk. This article is about the other case — the one where the exchange did not decide anything, because a police unit, a prosecutor, a court or a financial-intelligence unit asked it to hold the funds. That is an investigation, not a review, and it is the world we work in.
Two freezes, one message — and only one of them is ours
An exchange often does not say which of two very different things has happened, and the two usually need different responses.
The first is an internal compliance hold. The exchange's monitoring flagged a deposit, a pattern, a threshold or a counterparty; it is obliged by its licence to stop and look; the decision to lift the hold belongs to the exchange and is made on documents. Nobody outside the exchange has asked for anything. This is the common case, and it is handled through the exchange's own channel — the guide linked above sets out what a complete answer looks like.
The second is a freeze at the request of an authority. An authority wrote to the exchange and asked it to hold specific funds or a specific account, almost always because those funds are linked to a fraud report somewhere — a theft, a scam, a hack — and the account holding them is either the thief's, or one or two hops downstream of the thief's. Here the exchange is typically not the only decision-maker. It is acting on a request, and documents sent to the exchange alone are unlikely to lift the hold; any release may depend on the authority that asked, on legal process and on the exchange's own procedures.
The practical difference is the whole point of this article. In the first case, the way out runs through the compliance desk. In the second, it typically runs through the requesting authority, and the exchange's support team may be able to do little beyond confirming that a request exists — sometimes not even that.
How a law-enforcement freeze comes to exist
It helps to see the freeze from the other end, because in our own cases that is the end we work from. A victim reports a theft. Within hours the stolen transactions are traced across the chains they crossed and flagged to the screening providers that exchanges read — in our process, within four hours of intake. When the trace reaches an exchange, law enforcement may submit a freeze request to it, supported by investigation materials such as our investigation report. That request is what freezes the balance: a victim who asks the exchange directly is typically turned down and referred to the police. In our cases an exchange has typically acted on such a request in two to four days. A police report or other formal law-enforcement documentation may support a longer-term or more formal freeze, depending on the exchange and jurisdiction; where that happens, the funds are held under an authority's instruction rather than the exchange's discretion. These stages are not a fixed sequence: they can run in parallel, and they depend on the exchange and the jurisdiction. The stages, and the typical timings for each, are set out on our recovery process page and the figures page.
So a law-enforcement freeze on an exchange account is, seen from the victim's side, the case working. Seen from the account holder's side it is a locked balance with no explanation. Both are looking at the same instruction.
How to tell which freeze you have
The exchange rarely says it outright. The wording and the timing can offer hints, but none of them is proof on its own.
They ask you for documents. Source-of-funds statements, a description of your activity, an explanation of a specific transaction. That usually points to an internal review — the exchange is trying to decide, and it wants material to decide on. Answer it properly, through the exchange's own channel; that is not a matter for an investigation firm.
They ask for nothing and say nothing. The account is locked, tickets get a template reply, and no document request arrives. That silence can be a sign of an external request — the exchange may have been asked not to discuss it — but silence or the absence of a document request does not by itself prove a law-enforcement freeze.
Only part of the balance is frozen. Authorities ask for specific amounts or specific inbound transactions. An exchange's own hold usually covers the whole account.
The freeze followed a deposit from somewhere else. If you received funds from a counterparty — an OTC trade, a P2P deal, a payment from a client — and the freeze landed within days, the incoming funds are a likely trigger. Someone may have reported them stolen.
The freeze followed a theft you reported to the police. If you are the victim and the exchange froze the recipient's account at the request of law enforcement, that is not your account being frozen at all — that is the freeze working, and what follows is a legal step, not a support ticket.
If you are the victim: what the freeze does and does not mean
A freeze stops the funds. It does not return them. Those are two separate events with two separate clocks, and the distance between them is the most misrepresented thing in this industry. In our cases a freeze at an exchange has taken two to four days from the request, and a return from an exchange, typically on a court decision, six to nine months. Stablecoins frozen by their issuer follow a separate process with its own timeline. Anyone who quotes the first clock as if it were the second is describing something that does not happen.
What the freeze buys you is time and a fixed target. The money is no longer moving, the account holding it is identified, and the file — the trace, the hashes, the freeze confirmation — becomes the basis for the police report and for the legal step that follows. The legal step is carried out by partner law firms in the jurisdiction of the authority; we do not practise law, and we say which part is whose.
If you are the recipient: an innocent account in someone else's case
This is the case that generates the most panic, and the most damage. A merchant paid by a customer, a desk that filled a large order, a trader who took the other side of a P2P deal: the funds arrived from someone else, that someone else was one or more hops away from a theft, and the freeze landed on the address where the funds became reachable — yours. The authority does not know whether you are a launderer or a shopkeeper. It has stopped the funds and is waiting to find out.
Go to the authority, with counsel. Find out which body made the request and what case it belongs to. This is legal work in the authority's jurisdiction, not a support conversation, and the exchange will not do it for you. If you are an innocent recipient, the route is to establish that in front of the body that asked for the freeze.
Bring the trace, not a story. Your bank statements say nothing about where that USDT was two hops before it reached you. What answers the question is a reconstruction of the funds' path — the addresses, the services they passed through, the point at which they became yours — set out so an investigator or a court can read it. That is the work described on the crypto tracing page, and it is the document your lawyer will work from.
Show what you knew and when. Who the counterparty was, what the deal was, what check you ran before accepting the funds. A business that screened the incoming address at the time and logged it is in a fundamentally different position from one that accepted a six-figure transfer from anyone. Screening of that kind is what AMLOfficer, which was founded by StarCompliance, offers as a service — the tool for it is AMLOfficer's AML check — and the moment to run it is before the deposit, not after the freeze.
The mistakes that turn a freeze into a case against you
Most of the damage in these situations is self-inflicted, and it follows a pattern.
Opening a second account. The new account is linked to the first within hours — same documents, same device, same funding source — and the exchange now has a user who tried to route around a hold. That is a ban, and it is in the terms you agreed to.
Moving the remaining balance in a hurry. If withdrawals still work partially, people drain what they can to another exchange or a personal wallet. From the outside this looks exactly like what a launderer does when a freeze is coming, and the second venue's monitoring will often catch the inbound transfer and freeze that too. You now have two frozen accounts and a transaction history that supports the suspicion.
Buying a "verified" explanation. There is a market of sellers offering fabricated statements and pre-written source-of-funds letters. Submitting one in an authority's case converts an innocent recipient into a defendant, and the document stays in the file.
Paying someone who promises to "get the account unblocked". No outside party can compel an exchange to release a hold, and nobody can compel an authority to withdraw a request. Anyone who guarantees an unblock is selling nothing or selling something illegal. The verification checklist we publish for recovery firms applies to them too.
Why these freezes are becoming routine
Account restrictions at exchanges are becoming more common, and it is not because exchanges have become arbitrary. Tracing has become fast enough that a theft reported with the hashes on day one reaches a party who can act within the first days. Law-enforcement requests have become routine rather than exceptional — Tether alone reported in April 2026 that it works with more than 340 law-enforcement agencies in 65 countries, and the exchanges sit one step downstream of the same kind of requests. Licensing regimes in the EU, the UAE and elsewhere make an exchange liable for what it lets through.
Where we come in, and where we do not
We are a blockchain investigation and asset recovery firm. What we do in these situations is establish, on-chain, where funds came from and where they went: a documented trace that an authority or a court can read and act on. For a victim of theft, that trace is what the freeze request and the police report are built on. For a recipient caught in someone else's case, it is what shows the funds' real origin and your distance from it. What we do not do is promise that any exchange or any authority will release anything — they decide — and we do not handle the ordinary compliance hold, where the exchange itself is asking for your documents. The limits of what any firm can promise are on the verification page.
If the funds are traceable and the loss is significant, send us the transaction hashes: the assessment is free, and we aim to respond within two business hours, including when the answer is that there is nothing to pursue. Write through the contact page or message @StarCompliance on Telegram.
Questions people ask when an authority has frozen the account
How long does a freeze at an authority's request last?
Its duration depends on the authority and the jurisdiction: some provisional holds have a statutory time limit, others last until the authority or a court lifts them. If no document request has arrived, that silence is one sign — not proof — that the hold came from outside the exchange.
Can the exchange keep my funds permanently?
Not on its own decision. An exchange can hold a balance while an authority's request is in force, and confiscation is a court matter. What does happen in practice is an indefinite hold because nobody on your side has approached the authority that requested it.
I received the funds from a client. Why is it my problem?
Because the flag travels with the funds, not with the intent. If your client's payment came from a scam victim's wallet two hops earlier, your account is where the money became reachable. Showing who the client is, what they paid for and that you screened them is what moves you from "suspect" to "innocent recipient" in the file.
Should I hire a lawyer?
For a freeze on an authority's request — yes, in the authority's jurisdiction, and the lawyer will need the on-chain trace to work from. For an internal compliance review with a document request — usually not; answer it well through the exchange's own channel. We do not practise law; legal steps in our own cases are carried out by partner firms in the relevant jurisdiction.
My account was frozen because of a theft I reported to the police. Is that normal?
If the frozen account is the recipient's, yes — that is the freeze you asked for. If it is your own account, ask the exchange which transactions the hold covers and give it the police reference from your report; that reference is part of the file in our cases too.
Does a police freeze mean the exchange will close my account?
Not by itself. While the request is in force the exchange holds the balance; when the authority lifts it, the account normally returns to its previous state. An exchange may separately decide that your risk profile no longer fits and off-board you with the balance returned, which is a commercial decision, not part of the investigation.
