DefCrypt — Chainalysis flagged a wallet: what to do next
When an email or account banner mentions Chainalysis, KYT, or high-risk exposure, the exchange usually means vendor screening of an incoming or outgoing transfer against attribution data. Chainalysis public materials separate address screening from transaction monitoring and describe direct and indirect exposure to sanctioned and other high-risk entities. Alert thresholds are set by the platform, not by a magic number copied from a chat.
There is no on-chain control to delete a flag. Transaction history only grows. The label lives in vendor data and in the exchange case: a new TxID, a mixer "cleanup", or a message that you are an honest user will not rewrite it. A public checker and the instance the exchange actually uses often disagree, so a "green" screenshot does not cancel an internal alert.
This is a different problem from checking a wallet for AML risk in order to read a score. Here the flag already sits on a deposit, withdrawal, or account, and the task is an appeal package rather than an indicator color. For background on risk sources in coin history, see what dirty crypto means.
A realistic goal is to give the reviewer a chain from your amount to a documented source and the relevant hops, not to litigate the vendor as if it were a court. What usually helps: a table of major inflows with TxID, network, and counterparty; SoF evidence for those rows; a map of direct versus indirect exposure (depth, share, date); and a short note on how you received the funds (P2P, OTC, or another exchange) without drama.
The package cannot erase a historical hop, force Chainalysis to drop a category on someone else's address, turn a direct sanctions match into "nothing happened", or set a deadline for lifting the hold. Direct contact with a designated address and an indirect hop through a large exchange are different stories; both can raise an alert, but they are explained differently.
Task
Realistic outcome
Delete a flag from the blockchain
No — that field does not exist
Show an indirect hop and its share
Yes — with counterparties and dates
Close an origin-of-funds request
Yes — if amounts match the documents
Guaranteed lift of the restriction
No — the platform decides
A chain analysis is an attachment to the case, not a verdict of innocence. File composition is covered in documents for a crypto exchange AML check; tracing hops is a blockchain analytics task, not a screenshot from a free checker.
- Save the notice text, account status, case number, and the TxID of the disputed transfer.
- Write down what the exchange actually said: risk category, counterparty, deposit, or withdrawal. Answer that wording, not someone else's template.
- Build one package: an amount table, SoF for each row, a hop map, and no seed phrase or extra passports.
- Submit the complete package through the official account channel; keep a copy and the submission date.
- Do not open a second "unfreeze it now" ticket while the first package is still incomplete.
While the restriction affects withdrawals, keep the exchange account unfreezing route and a success-fee assessment in view. The outcome is not guaranteed: platform policies and vendor label updates diverge. Resubmitting the same folder three days later without new facts rarely moves the case.
- Do not "wash" the history through a mixer or an informal intermediary; for AML that is a new risk source, not flag removal.
- Do not attach someone else's statements or edited PDFs.
- Do not move the remainder to a second account or change location through a VPN during the review.
- Do not enter a seed phrase, keys, or 2FA codes into a "Chainalysis removal" service.
Telling support that you are "not connected to Chainalysis" does not close the question: the vendor is the platform's tool, and the dispute is about your chain and documents. If the letter explicitly cites sanctions or stolen funds, do not send a large new deposit on a hunch. A calm package that matches the request is stronger than a stream of threats in the support chat.