The first 24 hours after a freeze, hour by hour

The first hours after a freeze decide how hard the whole case will be. People in panic do things that then take weeks to unwind, and I have seen strong cases crippled before lunch on day one. This lesson is a protocol of calm actions laid out hour by hour. The full deadline tables, the letter itself and the twelve killer mistakes each have their own lesson in this track; today's job is narrower and more urgent: get through day one without losing anything.

Before hour zero: the prohibitions

I start with what not to do, because this is where the most is lost.

• Do not spam tickets. Ten submissions in an hour do not speed up review; they drop your priority and tag the account as aggressive. One structured package in the right channel works.
• Do not split or hide. Rushing the remainder out in small amounts or through swaps looks like covering tracks and worsens every later conversation.
• Do not invent a story. Fitting your explanation to what you think the exchange wants creates contradictions that surface later and sink you. Truth backed by documents is stronger.
• Do not pay "unlockers". Anyone promising a guaranteed unfreeze for an upfront percentage is a fraud. The decision always rests with compliance, and nobody sells it.

Hours 0 to 1: stop and capture

Your only job in the first hour is preservation. While access still exists, save what will be hard to retrieve later.

• Screenshot the exact status and the full text of the exchange message. The literal wording of the grounds is the starting point of the entire strategy.
• Record the amount, asset and network of the blocked funds.
• Note every reference number and ticket ID.

Do not reply to anything yet. An answer written in the first hour is written by adrenaline.

Hours 1 to 2: classify the grounds

Read the message again, slowly, and classify it. Is it a document request under enhanced due diligence. A risk flag on an incoming transfer. A counterparty complaint. A demand for video verification. A law-enforcement hold. The last case is fundamentally different: the exchange is an executor, not the initiator, and the track is legal, run through a lawyer in the initiating country. One more special case: a Binance security suspension often lifts by itself within 24 to 48 hours, and firing escalations into that window only adds noise. Correct classification in hour two saves weeks of pushing on the wrong door.

Hours 2 to 4: export everything

While your account still shows data, export it: trade history, deposit and withdrawal records, statements for recent months, TxIDs and addresses connected to the freeze. Accounts under review sometimes lose export functions or access entirely, and the evidence you need most lives exactly in the history you can still download. Save raw files, not screenshots, wherever the platform allows.

Hours 4 to 5: screen the addresses

Run your own addresses and the relevant counterparty addresses through the checker. A red result changes the scenario radically: a sanctions trace in your flow is one strategy, a clean picture with a far-hop flag is another. This half hour of screening tells you which case you are actually in. Remember the base rate that keeps me humble: 57 percent of addresses people brought to our checker were already blacklisted. Find out now, not in the reviewer's reply.

Hours 5 to 6: form the trigger hypothesis

Drawing on the triggers lesson, write down what probably fired: a large withdrawal after silence, an inflow from a dubious counterparty, a P2P complaint, a geo change. The hypothesis dictates the evidence. A package aimed at the wrong trigger is effort spent making the case look unprepared.

Hours 6 to 8: find your clock

Now, and not before, establish the deadline you are on. The asymmetry is brutal: no exchange publishes the maximum length of its own review, but your submission windows are hard. By public references: Bybit gives about 72 hours to submit documents at withdrawal verification, after which the request auto-rejects. Bitget allows around 18 calendar days for EDD. OKX takes documents no older than three months and reviews in one to two business days. MEXC declares up to 30 days and documented cases run for months. The full table with the planning method is the deadlines lesson; tonight you only need one number: the date your window closes. Write it where you cannot miss it.

The rest of day one: plan, do not fire

With the grounds classified, data exported, addresses screened and the clock found, draft the outline of your single complete package: which documents prove what, what is missing, how long the gaps take to fill. Do not submit anything partial tonight; partial submissions restart queues, and that mechanism has its own place in the mistakes lesson. If the case involves real money, this is also the evening to bring the facts to a free assessment: the earlier a second pair of eyes sees the classification, the cheaper every correction.

End of day one: the checklist

• Exact status and grounds captured verbatim, with screenshots.
• Amount, asset, network, tickets and references recorded.
• History, statements and TxIDs exported and saved as files.
• Own and counterparty addresses screened; results saved with dates.
• Grounds classified; LE-hold and security-suspension special cases ruled in or out.
• Trigger hypothesis written down.
• Submission deadline identified and written down.
• Package outline drafted; nothing partial sent.
• Zero angry messages sent all day.

If every box is ticked, day one is a success regardless of how frightening the freeze felt at breakfast.

Check yourself

• Task. Close this lesson and reproduce the day-one sequence from memory: the four prohibitions and the seven working phases in order.
• How to know you got it right. Your sequence starts with capture and ends with a plan, and nowhere in it does a reply to the exchange appear before classification. If you placed "write to support" in the first two hours, run the drill again; that ordering is the most common real-world failure.
• Task. Your exchange message mentions "withdrawal verification" and arrived 30 hours ago. Using the numbers in this lesson, state how much time you may have left and what that means for tonight.
• How to know you got it right. On a Bybit-style 72 hour window you may have roughly 42 hours: the package outline becomes tonight's work, and the complete submission tomorrow's, because missing that window is an auto-rejection no later brilliance can undo.