DefCrypt — Exchanger Hold for a High-Risk Transaction: What It Means

33 words

defcrypt.com

Onix is used here as an example of a class: a fiat/crypto exchanger, not a large centralized-exchange account. Statuses such as "under review," "high risk," or "suspicious transaction" usually mean automated screening saw a link in the address history that the venue treats as elevated — a mixer, a scam cluster, a sanctions list, a tainted chain. That is not a description of one exchanger's internal policy: the analytics vendor, threshold, and timeline are specific to the venue.

Separate three scenes. A pause on one exchanger trade is not the same as a full-account freeze on a large exchange. It is also not the same as a cash desk disappearing after a "review." While the venue answers through an official channel and asks for documents, the situation is closer to a manual risk review. If the channel goes silent and someone asks for an extra payment to "unfreeze" to a personal card, that is a different scenario. The broader hold checklist is in frozen crypto: what to do.

The label does not mean your coins are a different type of asset. The venue is usually looking at the route: who sent them, which addresses they passed through, and whether those paths touch known clusters. The logic is similar to a Dangerous transaction tag in an exchange ticket, except the entry point is an exchanger cash desk rather than a withdrawal from a KYC account.

  1. Save the TxID, network, amount, time, in-app status, and a screenshot of the label as one package, not ten forwards in a chat.
  2. Open one coherent ticket through the venue's official channel; parallel duplicates usually confuse the review rather than speed it up.
  3. Ask for a written reason if you do not have one: which side of the transfer and which type of review.
  4. Prepare SoF calmly: where the asset came from, through which exchange or P2P, without extra passports "just in case."
  5. Do not pay a person in direct messages for "acceleration," even if they claim to be support.
  6. Do not send a second transfer "to test" while the first is on hold.

Documents matter when the venue actually asked for them, or when you are assembling a typical SoF package in advance. The contents are close to an exchange file: a statement, purchase history, a contract if the transfer was a payment. There is no universal list of "what works at Onix." If you need to review the address itself before the next transfer, see checking a wallet for AML risk.

At a large exchange, manual review is usually formal: a ticket, a document list, a separate risk team. At an exchanger the channel may be shorter: chat, email, a status in the cabinet. That does not make the pause unlawful, and it does not make it a scam by itself. FATF describes a risk-based approach to virtual assets as an obligation of the provider to assess risk, not as your personal SLA.

Scenario

What it resembles

Trade pause plus an official document request

Manual risk review at an exchanger

Full-account freeze at a large exchange

A separate AML/KYC/SoF track

Silence, new payment details, a "withdrawal tax"

More likely a scheme than compliance

If the cash desk stops answering, changes payment details, or asks for a new deposit "to close the review," preserve the correspondence and TxID and do not send more funds. That is no longer an argument with risk control; it is a question of whether the venue still exists. While the dialogue stays on an official channel, keep one package and one ticket — the restriction route is exchange account unfreezing. Examples without promised outcomes are in case studies.

Do not feed a follow-on scam: after a pause, supposed staff often write offering to clear the flag for crypto. A legitimate risk review does not take a side commission in direct messages. The outcome is not guaranteed: the venue may credit the trade, return funds to the sender, ask for more documents, or refuse.