Exchange froze your funds: the first 24 hours
The first day after a freeze barely affects how fast you get unlocked — but it determines whether your case is still intact when it reaches review. Most of the irreversible damage is self-inflicted, and it happens in the first hours: panic tickets, a new account, invented explanations. Here is the order of operations — and the list of things you must not do.
First: what actually happened
A "freeze" is not one phenomenon but several different procedures with different routes. Step one is identifying your case from the letter or the account state:
Withdrawal suspended
The most common case: deposits and trading work, withdrawals don't. Usually an AML flag on a specific transaction or accumulated risk score. The route runs through Source of Funds and explaining where the money came from.
Account under review
Access is restricted fully or partially while the exchange "conducts a review". This can be a KYC re-request, an AML investigation, or a reaction to a counterparty complaint (typical for P2P — see triangulation).
Frozen on a law-enforcement request
The rarer and longest scenario: the exchange is executing an authority's request. The procedure is legal in nature, and the timeline is out of the exchange's hands.
If the letter mentions a specific transaction, save its TxID separately — it is the centre of your future explanation. If you hold USDT and suspect an issuer-level block, first check the address against Tether's contract blacklist: an exchange freeze and the USDT blacklist are two different problems with different routes.
Hours 0–2: preserve everything while you still have access
- Screenshot everything: balances, the restriction notice, dashboard banners — with date and URL visible.
- Export history: trades, deposits, withdrawals, P2P orders — to CSV if the exchange allows it. Once access is fully restricted, this gets much harder.
- Save the exchange's letter in full — headers, sender address, deadlines. Check your spam folder: compliance requests regularly sit there for weeks.
- Collect TxIDs of significant transactions from recent months — especially those preceding the freeze.
- If P2P is involved, save counterparty chats and payment confirmations. What exactly to keep — a separate checklist.
Hours 2–24: one careful step, not ten panicked ones
If the exchange asked a specific question (document request, source of funds) — don't answer "as fast as possible". A compliance request is not a support chat; it is a procedural document: your answer will be read as a statement, and contradictions between versions work against you. How a proper response is built — the breakdown and an open template.
If no question was asked (just "a review is in progress") — send one short request: the basis of the restriction, a reference number, the expected timeline. Politely, without threatening "lawyers and courts" — threats don't accelerate review, and tone is recorded in the case history.
What NOT to do in the first 24 hours
Don't open a new account. Exchanges link accounts by documents, devices and behaviour; ban evasion is the worst aggravation a case can get — it turns a "misunderstanding" into an "escape".
Don't invent explanations. Compliance sees your transaction graph and catches discrepancies easily. One exposed lie buries the entire case — even if the rest of the story is honest. Gaps in documents are better marked honestly than filled with fiction.
Don't pay "unlockers with a guarantee". Only the exchange's compliance department makes the decision; "insiders" don't exist. The second wave of fraud targets exactly people in panic — the tell is simple: guarantee + upfront payment = scam. Our own rules on this — How we work.
Don't storm support with tickets. Ten tickets don't create ten reviews — they create chaos in the case history. One ticket, one line of communication.
Don't "urgently" withdraw remainders via P2P. If partial access remains, a frantic exit through unusual routes is a classic risk pattern that adds a second flag to the first.
What comes next: honest timelines
A simple KYC re-request closes in days. An AML review with a Source-of-Funds request — weeks. Cases with a law-enforcement trail — months. Nobody outside the exchange's compliance controls these timelines — but the quality of your document package genuinely affects both the timeline and the outcome: a poor first answer spawns a second request, a second delay spawns a third.
Forensics becomes worth engaging when the cause of the flag is unclear or the amount justifies a full dossier: an independent report shows your transaction graph with the same methods the exchange uses — and your explanation stops being guesswork. How that works — our breakdown of exchange AML screening.
Bottom line
The first day is not about speed — it is about discipline: preserve the evidence, identify the restriction type, make one correct move and avoid five irreversible ones. Assess your scenario with the interactive case estimator or request a free assessment — we will answer honestly, including "you can handle this one yourself".