Crypto Exchange Account Frozen: Security Holds, Compliance Reviews and What to Do

A “frozen crypto exchange account” can describe several different restrictions.

Your login may be blocked while the account remains intact. Trading may still work while withdrawals are disabled. One asset or network may be restricted while the rest of the account functions normally. In more serious cases, the exchange may restrict the account because of a compliance review, sanctions screening, law-enforcement request or other legal obligation.

Those situations require different responses.

The first step is therefore not to create another account, use a VPN or repeatedly contact support.

It is to determine:

what is restricted → why it may be restricted → who controls the next action → what evidence is required

A clean evidence trail is especially important when the restriction involves identity, source of funds, account security or legal review.

The short answer

If your crypto exchange account is frozen:

1. Confirm that you are using the genuine exchange website or app.
2. Identify exactly which functions are restricted.
3. Secure your email and account if compromise is possible.
4. Save the restriction notice, balances, transaction records and timestamps.
5. Read the stated reason and the relevant account terms.
6. Respond to KYC or source-of-funds requests through the official secure portal only.
7. Keep one evidence-complete support case.
8. Do not create duplicate accounts or falsify your location.
9. Do not pay an unofficial “unlock,” “tax,” “verification” or recovery fee.
10. If the case does not progress, escalate to the legal entity's formal complaint process and the regulator or authority that actually applies.

If a transaction has already left the account, preserve its blockchain hash and destination separately.

First identify what “frozen” means

An exchange can restrict several functions independently.

The phrase account frozen should therefore be treated as a symptom, not a diagnosis.

1. Confirm the exchange itself is genuine

Before sending documents or contacting support, verify that the platform is the real exchange.

This matters because fake trading platforms often display a “frozen” account and then demand another payment before allowing withdrawal.

Verify:

• Exact domain
• Official mobile app
• App publisher
• Legal entity
• Regulatory record where relevant
• Support channel
• Account agreement

Do not trust a support link received through:

• Telegram
• WhatsApp
• Discord
• SMS
• An unsolicited email
• A social-media direct message
• A search advertisement

If the platform cannot be independently connected to a real company, first investigate whether the “account freeze” is actually part of a fake-exchange scam.

See:

How to Spot a Fake Crypto Exchange: 12 Red Flags and Verification Checks

2. Record the exact scope of the restriction

Open the account through a verified domain or official app.

Record:

Exchange:
Account identifier:
Date restriction first appeared:
Time zone:
Exact error / notice:
Login available: Yes / No
Spot trading available: Yes / No
Derivatives available: Yes / No
Crypto deposits available: Yes / No
Crypto withdrawals available: Yes / No
Fiat deposits available: Yes / No
Fiat withdrawals available: Yes / No
Restricted asset / network:
Case number:
Published end time, if any:

Take screenshots, but hide:

• Passwords
• Authentication codes
• Full identity-document numbers
• QR codes containing sensitive data
• API secrets
• Recovery codes

Check whether open positions remain active

A withdrawal freeze does not necessarily stop trading or derivatives exposure.

If leveraged positions remain open, the account can continue gaining or losing value while the user is unable to move assets.

Record:

• Open positions
• Entry prices
• Margin
• Liquidation prices
• Open orders
• Account equity

Do not assume that “frozen withdrawals” means the rest of the account is economically frozen.

3. Check for a timed security hold

Some account restrictions are temporary security controls.

They can appear after:

• Password reset
• 2FA reset
• Passkey change
• New-device login
• Email change
• Phone-number change
• Withdrawal-address change
• Account recovery

An exchange may impose a cooling-off period after a sensitive security event.

The useful distinction is:

Timed security hold
vs
indefinite review

If the exchange states that withdrawals will be disabled until a specific time, preserve that notice.

Do not try to bypass the hold by creating another account or changing location.

If the stated period expires and the restriction remains, update the existing support case with the original notice and the actual expiry time.

4. Rule out account takeover

If the freeze was unexpected, check whether the account may have been compromised.

Warning signs include:

• Unknown login
• Password reset you did not request
• New device
• Changed email or phone number
• Disabled 2FA
• New withdrawal address
• Unknown API key
• Unfamiliar trade
• Unknown withdrawal

Secure the email account first

The email account often controls exchange password resets and security notifications.

If an attacker controls email, restoring the exchange account alone may not be enough.

Check:

• Email password
• Active sessions
• Forwarding rules
• Recovery email
• Recovery phone
• App passwords
• Connected applications
• Multi-factor authentication

Use a unique password and revoke unknown sessions.

Preserve unauthorized transaction evidence

If funds were transferred out, record:

Asset
Amount
Network
Transaction hash
Destination address
Timestamp
Withdrawal ID

A confirmed blockchain transfer normally cannot simply be reversed at protocol level.

However, accurate transaction data is important for:

• Exchange investigations
• Receiving-service investigations
• Law enforcement
• Blockchain tracing

Do not delete the compromised account history after recovering access.

5. Read the exchange's stated reason

Account restrictions can arise from several broad categories.

Security

Examples:

• Credential compromise
• Unusual device
• Withdrawal-address change
• Account recovery

Identity / KYC

Examples:

• Expired identification
• Identity mismatch
• Address verification
• Duplicate-account issue
• Incomplete verification

Enhanced due diligence / source of funds

Examples:

• Large deposits
• Unusual transaction patterns
• Rapid movement through multiple wallets
• Source-of-funds review
• Source-of-wealth review
• Transaction-purpose questions

Sanctions or financial-crime controls

Examples:

• Sanctioned person or jurisdiction exposure
• Transactions connected to blocked addresses
• High-risk counterparties
• Fraud indicators
• Suspicious transaction review

Location or product eligibility

Examples:

• User resides in a prohibited jurisdiction
• Product unavailable in user's state or country
• Access through unsupported entity
• Location information conflicts with KYC data

Legal or law-enforcement process

Examples:

• Court order
• Government request
• Asset seizure
• Legally required blocking action

These categories can overlap.

A compliance trigger does not by itself establish that the customer committed wrongdoing.

The exchange may also be unable to disclose every detail of an active financial-crime or law-enforcement review.

6. Sanctions-related freezes require a different response

Sanctions controls can create restrictions that ordinary customer support cannot simply override.

In the United States, the Office of Foreign Assets Control applies sanctions obligations to virtual-currency transactions as well as fiat transactions.

OFAC states that US persons, including virtual-currency exchanges and wallet providers, are generally prohibited from engaging in or facilitating prohibited transactions involving blocked persons.

OFAC also requires blocked virtual currency to be reported under applicable rules.

That means a sanctions-related restriction can be materially different from:

• Routine KYC
• Security cooling-off period
• Wallet maintenance
• Customer-service delay

Do not attempt to evade a sanctions restriction

Do not:

• Create another account
• Use another person's identity
• Move through a different entity to avoid screening
• Falsify residence
• Use a VPN to conceal a prohibited location
• Ask support to bypass a legal block

If the restriction appears to involve sanctions, use the formal compliance and legal process applicable to the account and jurisdiction.

Official references:

• OFAC — Questions on Virtual Currency
• OFAC — Sanctions Compliance Guidance for the Virtual Currency Industry

7. Prepare KYC or source-of-funds evidence carefully

If the exchange requests enhanced verification, provide the requested material through the official secure portal.

Common evidence can include:

• Bank statements
• Payslips
• Tax records
• Sale agreements
• Business income records
• Exchange statements
• Wallet histories
• Transaction hashes
• Mining records
• Evidence of token sales
• Documentation for inherited or gifted assets

The goal is usually to create a traceable explanation of:

Where the funds came from
        ↓
How they entered crypto
        ↓
Which wallets / exchanges they passed through
        ↓
Why they entered the current account

Build a chronology

A useful explanation can look like:

2026-04-02
Salary credited to Bank Account A

2026-04-05
€8,000 transferred from Bank Account A to Exchange B

2026-04-05
Purchased 0.XX BTC

2026-05-17
BTC withdrawn to self-custody wallet 1...

2026-08-10
BTC deposited to current exchange for spot trading
TXID: ...

Amounts and dates should match the records.

Avoid guessing.

Contradictory explanations can make a review harder.

Never send private keys

A legitimate exchange does not need:

• Seed phrase
• Private key
• Wallet recovery phrase
• Full authentication secret

to verify source of funds.

Wallet ownership can sometimes be demonstrated through transaction history or other supported verification methods without giving anyone the credentials required to spend the assets.

8. Keep one evidence-complete support case

Use the help center reached from the exchange's verified website or app.

A complete case should include:

Account identifier:
Restriction first appeared:
Exact restriction:
Affected functions:
Affected assets:
Recent relevant transactions:
Documents already submitted:
Transaction hashes:
Previous case number:
Requested outcome:

Possible requested outcomes include:

• Restore account access
• Restore crypto withdrawals
• Restore fiat withdrawals
• Confirm documents were received
• Explain which verification item remains incomplete
• Close the account and return eligible assets
• Provide the formal complaint route

Ask for a milestone, not a vague promise

Useful questions include:

• Have all requested documents been received?
• Is another document required?
• Is the restriction security-related, compliance-related or legal?
• Is the restriction account-wide or asset-specific?
• Is there a next review stage?
• What formal complaint route applies?

Support may not be able to provide a guaranteed resolution date.

That is different from providing no traceable case status at all.

9. Do not open duplicate accounts to bypass the review

Opening another account can create additional problems.

Possible consequences include:

• Duplicate-account detection
• KYC mismatch
• Terms-of-use violation
• Additional compliance review
• Confusion about beneficial ownership
• New withdrawal restrictions

The same applies to using:

• False address
• VPN to disguise residence
• Another person's identity
• Another person's bank account

If the problem concerns country eligibility, disclose the true residence and ask for the permitted account-closure or asset-withdrawal process.

10. Protect the balance while the case is open

If trading remains available, avoid assuming that more trading will “unlock” the account.

A frozen withdrawal can coexist with active market exposure.

Adding risk can create:

• Trading losses
• Liquidation
• Funding costs
• Tax consequences
• Additional compliance questions

Record balances periodically

Save snapshots of:

• Asset balances
• Fiat balances
• Open positions
• Withdrawal status
• Account notices

If the exchange announces:

• Delisting
• Token migration
• Network shutdown
• Contract migration

while the account is restricted, add that issue to the existing case.

Ask how the exchange will handle the affected asset while you cannot act.

11. An “unlock fee” is a major fake-platform warning sign

A real exchange may charge published transaction or service fees.

That is different from a person demanding an extra crypto transfer to release an account balance.

Treat these as serious warning signs:

• “Pay tax before withdrawal”
• “Add funds to increase account credibility”
• “Pay a credit-score fee”
• “Deposit 10% to verify liquidity”
• “Pay AML clearance”
• “Pay a security deposit”
• “Upgrade to VIP before withdrawal”
• “Send crypto to unlock compliance review”

US investor-protection agencies warn that fake crypto investment platforms may display apparent profits and then demand additional fees or taxes before users can withdraw.

The FTC similarly warns that scam investment websites may prevent withdrawals unless users pay high additional fees.

Official references:

• SEC Investor.gov — Crypto Scams
• FTC — What To Know About Cryptocurrency and Scams

If an account freeze appears only after an attempted withdrawal and every new payment creates another requirement, investigate whether the platform itself is fake.

12. Distinguish a real compliance hold from a fake-platform trap

A polished dashboard does not make a platform genuine.

Identity must be verified separately from the account-freeze explanation.

13. Check whether the issue is broader than your account

Some apparent account problems are actually exchange-wide operational events.

Check for:

• Withdrawal suspension
• Service outage
• Wallet maintenance
• Security incident
• Network disruption
• Regulatory action
• Licence suspension
• Delisting

Cexvia Risk Radar tracks validated exchange events including withdrawal suspensions, service outages, security incidents and regulatory changes.

Check Cexvia Risk Radar

If hundreds of users are affected by a documented withdrawal outage, the diagnostic path differs from a single account undergoing source-of-funds review.

Do not assume either scenario without evidence.

14. Identify the legal entity before escalation

Global crypto exchanges often operate through multiple companies.

The brand name alone does not identify:

• Your contracting company
• Your regulator
• Governing law
• Complaint process
• Jurisdiction
• Product provider

Find the company in:

• User agreement
• Terms of service
• Legal page
• Account-opening documents
• Fiat payment instructions

Record:

Legal entity:
Company number:
Registered address:
Regulator:
Regulatory reference:
Governing law:
Formal complaint channel:

Cexvia exchange profiles map available legal-entity and regulatory evidence for covered exchanges.

Browse Cexvia Exchange Risk Profiles

For regulatory records:

Explore Cexvia Regulatory Atlas

15. Escalate through the formal complaint path

If ordinary support is not moving the case forward, prepare a concise formal complaint.

Include:

Account

• Account identifier
• Legal entity

Restriction

• Date restriction began
• Exact functions affected
• Current status

Financial impact

• Assets restricted
• Amounts
• Open positions where relevant

Evidence

• Notices
• Transaction hashes
• Bank records
• Documents submitted
• Support correspondence

Timeline

List key dates in order.

Requested outcome

Be specific:

• Complete the review
• Confirm missing documentation
• Restore eligible withdrawals
• Close the account and return eligible assets
• Provide the legal basis or complaint stage where disclosure is permitted

A regulator or dispute body is more likely to understand a structured chronology than a long collection of disconnected screenshots.

16. When regulatory escalation may be relevant

If the account is with a regulated entity, determine whether the regulator:

• Accepts complaints
• Accepts conduct reports
• Provides dispute guidance
• Refers consumers to an ombudsman or alternative dispute mechanism

The regulator may not adjudicate an individual compensation claim.

Its role depends on the jurisdiction and legal framework.

The important point is to contact the authority connected to the actual contracting entity, not a regulator associated with another affiliate of the same brand.

For example:

Exchange brand
        ↓
EU entity
        ↓
EU regulator

is different from:

Exchange brand
        ↓
offshore entity
        ↓
different regulator / legal route

A licence held by one group company does not automatically create a complaint route for every account worldwide.

17. Court orders and law-enforcement freezes can outlast exchange review

Some restrictions are imposed because the exchange has received or is responding to a legally binding request.

Examples can include:

• Court orders
• Asset-preservation orders
• Law-enforcement requests
• Sanctions blocking
• Fraud investigations

In such cases, frontline support may have limited authority to release the account or disclose details.

The next step may depend on:

• Which authority issued the request
• Which jurisdiction applies
• Whether the customer has a legal right to challenge or seek information
• Whether legal counsel is appropriate

Do not attempt to defeat a legal hold by moving through another account or identity.

If the amount is material or the legal basis is disputed, jurisdiction-specific legal advice may be appropriate.

18. How long can a crypto exchange account remain frozen?

There is no universal timeframe.

Different restrictions can operate on very different timelines.

A more useful measure than elapsed time alone is case progression.

Signs of a traceable review include:

• Documents acknowledged
• Specific follow-up questions
• Case number
• Formal complaint route
• Identifiable legal entity
• Current stage communicated where possible

Repeated generic demands for more payments are not evidence of a legitimate compliance review.

Cexvia account-freeze decision tree

Account restricted
        │
        ├── Is the platform genuine?
        │       │
        │       ├── No / uncertain
        │       │      → Verify domain, entity and regulatory record
        │       │      → Stop additional payments
        │       │
        │       └── Yes
        │
        ├── Account compromise suspected?
        │       │
        │       ├── Yes
        │       │      → Secure email and exchange account
        │       │      → Preserve unauthorized TXIDs
        │       │
        │       └── No
        │
        ├── Exchange-wide outage / withdrawal suspension?
        │       │
        │       ├── Yes
        │       │      → Follow official status + Risk Radar
        │       │
        │       └── No
        │
        ├── Timed security hold?
        │       │
        │       ├── Yes
        │       │      → Preserve notice and wait for stated control to expire
        │       │
        │       └── No
        │
        ├── KYC / EDD / source-of-funds review?
        │       │
        │       ├── Yes
        │       │      → Provide requested evidence through secure portal
        │       │
        │       └── No / unclear
        │
        ├── Sanctions / legal hold indicated?
        │       │
        │       ├── Yes
        │       │      → Use formal compliance / legal route
        │       │
        │       └── No
        │
        └── No progress
                → Identify contracting entity
                → Submit formal complaint
                → Use relevant regulator / dispute / legal route

A practical frozen-account evidence checklist

Before escalating, preserve:

Account evidence

• [ ] Exchange name
• [ ] Account identifier
• [ ] Legal entity
• [ ] Current balances
• [ ] Open positions
• [ ] Restriction notice
• [ ] Restriction start date and time zone

Transaction evidence

• [ ] Deposit records
• [ ] Withdrawal records
• [ ] Transaction hashes
• [ ] Bank transfer records
• [ ] Relevant wallet addresses

Verification evidence

• [ ] KYC requests
• [ ] Documents submitted
• [ ] Source-of-funds explanation
• [ ] Submission timestamps

Support evidence

• [ ] Ticket number
• [ ] Complete support history
• [ ] Formal complaint
• [ ] Exchange responses

Security evidence

• [ ] Login history
• [ ] Device history
• [ ] Security-change notifications
• [ ] Unauthorized transactions, if any

Store copies outside the exchange account.

Frequently asked questions

Why did my crypto exchange freeze my account?

Possible reasons include a security hold, identity verification, source-of-funds review, sanctions screening, fraud investigation, jurisdiction restriction, terms-of-use issue or legal request.

The exact reason should be determined from the account notice and formal support process rather than assumed.

Can a crypto exchange legally freeze an account?

Crypto exchanges can have contractual and legal obligations allowing or requiring restrictions in certain circumstances, including security, compliance, sanctions, fraud and legal processes.

Whether a particular restriction is lawful depends on the legal entity, contract, jurisdiction and facts.

What documents are needed for a source-of-funds review?

The exchange may request documents such as bank statements, payslips, tax records, sale agreements, exchange statements or wallet transaction history.

Provide only what is requested through the secure official portal.

Should I open another exchange account to bypass the freeze?

Do not create a duplicate account to evade the existing restriction.

It may violate account rules and complicate identity or compliance review.

Should I use a VPN if my country is restricted?

No.

Using false location information can create additional account and compliance problems.

Provide your true residence and ask the exchange for the permitted closure or withdrawal process.

Can a recovery agent unlock a frozen exchange account?

An outside recovery agent generally cannot override a genuine exchange's security, compliance or legal controls.

Be especially cautious if someone contacts you first and asks for an upfront fee.

Why is the exchange asking where my crypto came from?

The exchange may be conducting source-of-funds or enhanced due-diligence checks.

A useful response connects the origin of the funds to bank, exchange and blockchain records with consistent dates and amounts.

Should I pay tax to unlock my frozen crypto account?

Do not send an additional payment to a personal wallet, unofficial support contact or unknown third party merely because they claim it is required to unlock the account.

Additional fee and tax demands are common on fake crypto investment platforms.

Verify the platform and any genuine legal obligation independently.

Can OFAC sanctions freeze cryptocurrency?

US sanctions obligations apply to virtual currency as well as traditional fiat transactions.

OFAC states that blocked virtual currency is subject to applicable blocking and reporting requirements.

How long does a crypto compliance review take?

There is no universal duration.

The relevant question is whether the review has a traceable status, acknowledged evidence and a legitimate complaint path.

Security cooling-off periods can be short; complex compliance or legal reviews can take materially longer.

What if the exchange never responds?

Identify the legal entity in the account agreement and use its formal complaint process.

If the entity is regulated, determine the complaint or reporting mechanism available through the relevant regulator or dispute body.

For significant legal or financial disputes, jurisdiction-specific professional advice may be appropriate.

Conclusion

A frozen crypto exchange account should be treated as a restriction diagnosis problem, not as one generic customer-support issue.

Start with:

platform identity → restriction scope → account security → exchange-wide status → KYC / compliance reason → legal entity → formal escalation

If the problem is a routine security hold, the relevant control may simply need to expire.

If it is a source-of-funds review, the solution is a consistent evidence chain.

If it is a sanctions or legal restriction, ordinary customer support may not have the authority to release the account.

And if the platform demands repeated additional payments before allowing withdrawal, verify whether the exchange itself is genuine before sending anything else.

Cexvia separates these cases because individual account restrictions, exchange-wide operational incidents and fake-platform withdrawal traps are different forms of risk and require different evidence.

For related checks:

• [Cexvia Exchange Risk Profiles](/exchanges)
• [Cexvia Risk Radar](/risk-alerts)
• [Cexvia Regulatory Atlas](/regulators)
• [Cexvia Exchange Safety Checklist](/exchange-safety-checklist)
• [Cexvia Methodology](/methodology)

Primary sources and Cexvia resources

• OFAC — Questions on Virtual Currency
• OFAC — Sanctions Compliance Guidance for the Virtual Currency Industry
• OFAC — FAQ 1021: Virtual Currency and Blocked Persons
• FinCEN — Advisory on Illicit Activity Involving Convertible Virtual Currency
• SEC Investor.gov — Crypto Scams
• SEC Investor.gov — Advance Fee Fraud
• FTC — What To Know About Cryptocurrency and Scams
• FTC — Crypto Recovery Scam Warning
• Cexvia — Exchange Risk Profiles
• Cexvia — Risk Radar
• Cexvia — Regulatory Atlas
• Cexvia — Exchange Safety Checklist
• Cexvia — Methodology

*Cexvia evaluates centralized exchanges using publicly verifiable evidence across regulatory standing, corporate transparency, asset and solvency transparency, security history, and operations and user protection. Individual account restrictions are not automatically treated as exchange-wide risk events. Ratings are evidence-based assessments, not guarantees of safety or recommendations to deposit or trade.*