DefCrypt — Freezing Stolen Crypto on an Exchange: Requests and Evidence

A freeze request asks a centralized exchange to temporarily restrict withdrawals or internal movement of funds that, according to your account of events, originated in a theft. It does not reverse a blockchain transfer; that transaction is already recorded on-chain. The request concerns the platform's decision to hold assets in its custodial deposit system while it conducts a review.

A request is most relevant if the transaction chain ends, or is still ending, at an exchange address and the assets have not yet been withdrawn. If the funds have already moved through a mixer, OTC transaction, split into multiple transfers, or crossed to another network, you can still submit the request, but the prospects may be more limited. See how to trace a USDT transaction for signs that an address may be an exchange deposit; mapping the hops falls within blockchain analytics.

Do not confuse two scenarios. If your exchange account and withdrawals have been restricted, follow the exchange account unfreezing route. If assets were stolen from your wallet and reached someone else's deposit, the objective is to request a freeze of the recipient's deposit, not to "unfreeze my withdrawal."

1. Record the outgoing TxIDs, networks, amounts, your source address, recipient and intermediate addresses, and UTC timestamps. Keep explorer screenshots and a written list.
2. Briefly describe how the theft occurred, such as phishing, a malicious token approval, a leaked seed phrase, or social engineering.
3. State what you have already done to protect remaining assets, such as creating a new wallet, revoking permissions, or changing 2FA.
4. Find the official support or security channel for the destination exchange, not a supposed manager from a chat.
5. Submit one coherent package containing the transaction evidence and a request to consider freezing the stolen assets in the deposit.
6. Retain the ticket or case ID and submission date.

Evidence for an exchange consists of the transaction trail and proof of control over the source address under the platform's procedure—not your seed phrase. Do not include private keys, a recovery phrase, or 2FA codes in a ticket. A prompt and precise package may give the risk team more opportunity to review the deposit before withdrawal, but the decision remains with the exchange.

If you have not yet mapped the chain to an exchange, first close the security gap in your wallet and preserve the TxIDs. Emergency response may help during the limited response window. A public, preliminary trace to a likely deposit can begin with tracing USDT; attribution and a documented report for the exchange fall within blockchain analytics.

Many exchanges request or consider a fraud or theft report and, where applicable, a police report number or report through a specialist channel. See filing a police report for crypto theft for the evidence package. A report is not a "freeze button"; it is an additional basis on which the platform can assess the request.

Prepare the same factual package: TxIDs, addresses, amounts, dates, a description of the circumstances, and screenshots of exchange correspondence. For the first-day steps specific to USDT, see what to do if USDT was stolen. FBI IC3 materials provide a useful reference for the contents of a complaint; confirm the local reporting procedure where you are located.

• Do not prepay a "freeze guarantor."
• Do not share a seed phrase with someone claiming to have contacts in the risk team.
• Do not give a person found through an advertisement remote access to your wallet.
• Legitimate requests go through official exchange and law-enforcement channels, not an advertising chat.

Objective

Realistic expectation

Hold a deposit at an exchange

May be possible while the assets remain in the platform's accounts

A rapid response "required by law"

There is often no victim-friendly response deadline

Full recovery of stolen assets

A separate process; not guaranteed

A freeze after withdrawal, a mixer, or OTC

The window may already have closed

The exchange may freeze all or part of the assets, reject the request, ask for more documents, or take longer to respond than you would prefer. The manual-review queue, jurisdiction, completeness of the package, and whether the assets have moved onward matter more than the tone of the message.

Even after a successful freeze, recovery is a separate process involving the platform's internal investigation, possible law-enforcement coordination, and exchange policy. Do not assume the assets will be released and returned within 24 hours. The immediate objective is to keep them at the exchange while the facts are reviewed, not to reverse the blockchain.

If the issue is now "my account is restricted" rather than "someone else's deposit received stolen assets," see exchange account unfreezing. The transaction map to a possible intervention point falls within blockchain analytics, and the urgent post-theft window falls within emergency response.