When deposits, withdrawals, or even complete exchange access are suddenly restricted after a crypto scam, it's understandably worrying. However, account suspensions can have very different causes – from security alerts and missing KYC documents to verification of recipient wallets and anti-money laundering measures. The crucial thing now is not to act hastily, but to narrow down the cause, secure evidence, and respond systematically.

 

In short
A restricted cryptocurrency exchange does not automatically mean that a customer is under investigation or that their funds are lost. Exchanges restrict functions for security, compliance, or anti-money laundering reasons – often precisely because withdrawals were intended for suspicious wallets after a fraud. At the same time, a suspicious activity report can prevent the exchange from openly discussing the background of the case. Therefore, complete documentation, truthful and objective communication, and – in cases of contact with authorities or larger sums of money – legal advice are crucial.

A case from our practice – Markus B. – first defrauded, then banned from the cryptocurrency exchange

August 12
Markus B. becomes aware of an alleged investment platform through a social media ad. An "account manager" assists him by phone and WhatsApp.
August 15
He transfers 8,000 euros from his bank account to a regular cryptocurrency exchange, buys USDT and sends the tokens to a wallet address specified by the platform.
August / September
Further payments follow. In total, Markus invests 42,000 euros. The alleged trading platform shows him an account balance of more than 95,000 euros.
September 21
When Markus requested a payout, he was allegedly required to pass a "liquidity check" and transfer another 10,000 euros via his cryptocurrency exchange.
September 22
Shortly after the next deposit attempt, Markus is no longer able to withdraw any cryptocurrencies. The exchange requests additional information about the source of funds and the purpose of the transactions.
September 23
Markus repeatedly attempts to initiate the payout via other wallet addresses. The restriction remains in place.
September 24
Support simply states that the account is being reviewed. No specific reason is given.
September 26
Markus also received a request to submit bank statements, proof of origin, and information about the recipient wallets. He now fears that his funds are lost.

What this case shows:


In such a case, two processes must be strictly separated: the fraud perpetrated by the alleged investment platform and the subsequent restrictions imposed by the legitimate cryptocurrency exchange. The exchange does not necessarily have to be part of the fraud. It may react precisely because its systems have detected unusual transactions or risky recipient addresses.
Two aspects of the process are typical: The "liquidity check" is a well-known withdrawal trap – reputable providers do not require any additional payment before disbursing funds. A block at this point can actually prevent further funds from flowing to the perpetrators. Attempts to circumvent the restriction via other wallet addresses, as seen here on September 23, are ineffective: From the exchange's perspective, they can actually increase the risk.

Why does a cryptocurrency exchange block or restrict an account?

A restriction can affect individual functions – such as withdrawals, deposits, or trading – or all account access. The actual reason cannot be deduced from the block alone. Typical categories include:

 

Security alarm
Typical indicators: Unusual login, new device, password change, suspicious API usage, or possible unauthorized access.
Sensible first reaction: Secure access, change password, check 2FA, monitor devices and sessions.

KYC/Identity Verification
Typical indications: ID, proof of address or re-verification is required.
Sensible first reaction: Submit documents only via the official stock exchange channel and observe the deadlines.

Source of Funds / Source of Wealth
Typical indications: Proof of the origin of the deposited funds or the economic background is requested.
Sensible first reaction: Organize and compile bank statements, proof of income or sales, and transaction history.

Checking the recipient's wallet
Typical clues: The exchange asks whether the destination address belongs to or is controlled by the customer.
Sensible first reaction: Answer truthfully – even if the address was provided by a third party.

Suspicious wallet or transaction references
Typical warning signs: Payments to or receipts from addresses associated with fraud or other risks.
Sensible first reaction: No attempts to circumvent the rules; document wallets and transaction hashes and explain them objectively.

Bank chargeback / Payment problem
Typical signs: Card payment or bank transfer was reversed or rejected.
Sensible first reaction: Contact the bank and stock exchange separately and secure payment receipts.

Money laundering/compliance check
Typical signs: The stock exchange remains vague about details, requests documents, or holds back certain transactions.
Sensible first reaction: Do not speculate, do not open new accounts, secure documents and seek legal advice if necessary.

Official measure
Typical signs: Account is frozen without further questions, support cites legal reasons.
Sensible first reaction: Have a lawyer clarify whether a seizure or arrest has occurred; do not attempt to circumvent it yourself.

 

1. Security reasons: The block can protect the account.

Cryptocurrency exchanges may restrict features if a potential security incident is detected. Kraken, for example, lists potential security issues, suspected malicious activity against the account, withdrawals to wallets associated with prohibited, illegal, or fraudulent activities, and chargebacks of recent payments as possible reasons for restrictions in its help section. This is one example of published exchange practice; other providers use their own criteria and processes.

Especially after an investment scam, a security problem is not unlikely: perpetrators often gain remote access to the computer, "help" with setting up the stock market account, or request login credentials. Therefore:

  • Do not click on unknown links in emails or messenger messages.
  • Log in only via the stock exchange's official website or app.
  • Check and, if necessary, renew your password and two-factor authentication – also for the associated email account.
  • Control open sessions and unknown devices.
  • Check API keys and disable unnecessary access.
  • Remove remote maintenance programs such as AnyDesk or TeamViewer if they were installed at the request of the perpetrators, and refrain from conducting any further financial transactions if malware is suspected before the device has been checked.

2. KYC, source of funds and recipient wallets: Why the exchange requires proof

The general transitional period for the European Crypto Markets Regulation (MiCAR) expired no later than July 1, 2026; some member states had shortened its duration or not applied it at all. Providers offering cryptocurrency services in the EU therefore generally require authorization under MiCAR and are subject to anti-money laundering due diligence obligations. These include identity checks and – depending on the risk, transaction, and business relationship – additional information regarding the purpose of the transactions or the origin of the assets.

In addition, there is an obligation that many affected parties are unaware of: According to Article 14(5) of the EU Money Transfer Regulation for crypto assets (Regulation (EU) 2023/1113, "Travel Rule"), when a withdrawal exceeding €1,000 is made to a self-hosted address, the exchange must take appropriate measures to determine whether that address belongs to or is controlled by the customer. The same applies to incoming payments from such addresses, according to Article 16(2). Therefore, a question about the "recipient wallets," as Markus received, is not harassment but can be part of this verification process.

 

Warning: Do not use a fake wallet explanation
Scammers often instruct their victims to confirm to the exchange that the destination address is "their own wallet" or to declare the payment as a "private investment." Anyone who follows this advice is giving the exchange false information and significantly complicating their case as a victim later on. The correct response is: The address was provided by the alleged platform; it does not belong to me.

 

A request for information about the "source of funds" or "source of wealth" is therefore not automatically an accusation. It can be part of a routine or risk-based review. It becomes problematic primarily when the transaction history does not match the customer's statements or when payments have been made to suspicious wallets.

 

Practice
Anyone who has fallen victim to fraud should not try to retrospectively explain away the transactions in a more favorable light. What is crucial is a complete, chronological, and verifiable account: Which deposit came from where? When were which cryptocurrencies purchased? Which wallet were they sent to? What instructions were given by the supposed broker?

3. Money laundering checks: Why the stock exchange might not explain everything

According to Section 43 Paragraph 1 of the German Money Laundering Act (GwG), obliged entities – including cryptocurrency service providers – must immediately report any matter to the Financial Intelligence Unit (FIU) if there are indications that assets originate from a criminal offense or are related to money laundering or terrorist financing. This obligation applies regardless of the transaction amount. Exchanges located in another EU member state report to their respective FIUs; the national rules are based on the same EU Money Laundering Directive and stipulate comparable obligations.

A reported transaction may, in principle, only be executed pursuant to Section 46 Paragraph 1 of the German Money Laundering Act (GwG) if the Financial Intelligence Unit (FIU) or the public prosecutor's office has given its consent, or if the third working day after the report was submitted has passed without the execution being prohibited. The FIU may also prohibit a transaction pursuant to Section 40 of the GwG; this immediate measure ends after a maximum of one month. At the same time, Section 47 of the GwG generally prohibits the obliged entity from informing the customer that a suspicious activity report is intended or has been submitted, or that an investigation is therefore underway.

 

Therefore important
If an exchange, when asked, only refers generally to an "audit" or "compliance check," this does not prove an FIU report. Conversely, a brief or evasive answer does not necessarily mean that only a technical error occurred. And a suspicious activity report is not an accusation: it only indicates that the exchange has noticed something unusual.

 

Anyone who not only used their own money but also received and forwarded other people's money at the perpetrators' instructions can themselves become a suspect in money laundering. We discuss this scenario in our article "Money Laundering Suspicion After Crypto Fraud: When the Victim Suddenly Becomes a Suspect.".

What those affected should do now, step by step

  1. Do not attempt any workarounds. Do not open a second account, do not use another person's identity, and do not keep trying new wallet addresses to bypass a ban.
  2. Break off contact with the perpetrators. Do not follow any further instructions from the "Account Manager" – including those regarding communication with the stock exchange.
  3. Secure official announcements. Save all emails, support tickets, in-app messages, and exchange status updates in full.
  4. Check account security. Check password, 2FA, devices, sessions, API key, email account and installed remote maintenance software.
  5. Export transaction history. Save deposits, purchases, sales, swaps and withdrawals as CSV/PDF files for as long as access is possible.
  6. Document wallet addresses and hashes. Don't just take screenshots, but also save complete addresses and transaction hashes.
  7. Prove the origin of the funds. Provide bank statements, salary or sales receipts, previous stock market transactions or other suitable documents in an organized manner.
  8. Secure fraudulent communication. Save chats (as export), emails, phone numbers, domains and instructions from the alleged broker.
  9. File a criminal complaint. Report the fraud to the police and note the case number – it will also help with the stock exchange and bank.
  10. Answer truthfully and without contradiction. Do not present assumptions as facts, do not give differing explanations in different tickets, and do not display destination addresses as your own wallet.
  11. Pay no "activation fee". A genuine stock market audit cannot be "resolved" by making a payment to a third-party wallet. Such demands are indicative of another recovery or support scam.
  12. Seek legal assistance if you have contact with authorities or substantial assets. When the police, public prosecutor's office or security measures become involved, the legal strategy should be reviewed by a lawyer specializing in this area.

What you can meaningfully tell the cryptocurrency exchange

A good response to the stock market is short, complete, and well-documented. It should include, in particular:

  • your own identity and account reference,
  • a brief, factual description of the fraud process,
  • the origin of the euro amounts used, with supporting documents,
  • the specific deposit and withdrawal details,
  • the affected cryptocurrencies, wallet addresses and transaction hashes,
  • the clear statement that the external addresses do not belong to the customer, but were provided by a supposed broker or platform,
  • Existing criminal charges or case numbers, insofar as disclosure is legally and strategically advisable,
  • the willingness to submit further evidence via the official support channel.

 

Not recommended
Multiple conflicting support requests, threats, the creation of numerous new support tickets, or the sending of sensitive documents to email addresses that do not clearly belong to the exchange. Especially after a scam, victims are often additionally contacted by fake "exchange employees" or recovery providers who promise a quick release for a fee.

If the investigation continues: complaint, data access, supervision

A compliance review can take weeks. If the stock exchange remains inactive even after all documents have been submitted, clients have several options:

  • Formal complaint: Authorized cryptocurrency service providers must, according to Article 71 of MiCAR, maintain effective and transparent procedures for the prompt and fair handling of customer complaints. A complaint submitted through this channel is documented and obligates the exchange to investigate – unlike a standard support ticket.
  • Data request: According to Article 15 of the GDPR, customers can request information about their personal data stored by the company. Depending on the data stored, this may include, for example, login times, IP addresses, or device information. This is particularly useful if unauthorized access is suspected.
  • Check eligibility: The ESMA interim MiCA register indicates whether and in which EU member state the stock exchange is authorized. The supervisory authority of that member state is responsible for oversight. Supervisory authorities do not decide individual disputes but can include complaints in their supervisory review.
  • Legal enforcement: Whether and when an exchange must release a blocked balance is a civil law matter that depends on the terms and conditions, the reason for the block, and any official measures. It should be handled by a lawyer.

When is an account freeze particularly critical?

  • Access to the account is completely blocked, and a higher asset value is listed on the stock exchange.
  • The stock exchange repeatedly requests information, even though extensive documentation has already been submitted.
  • At the same time, the bank contacts the customer regarding unusual transactions.
  • The police or public prosecutor's office will make contact.
  • There are indications that foreign funds have passed through one's own bank or stock exchange account.
  • Unknown third parties had access to the device, the email account, or the stock exchange.
  • False information has already been provided to the stock exchange on the instructions of the perpetrators.

What role can blockchain forensics play?

Blockchain analysis cannot itself lift a stock market ban. However, it can significantly improve the technical evidence. After a fraud, it can document how funds were transferred from the customer's own stock market account, which intermediary wallets were involved, and whether further services or exchanges were subsequently accessed. This is particularly relevant to the question of whether a destination address belongs to the customer: If the funds flow immediately from there to addresses that also handle funds from other victims, this suggests a pooling structure by the perpetrators rather than the customer's own wallet.

For communication with a cryptocurrency exchange, lawyers, or investigative authorities, a structured forensic document may contain, in particular:

  • chronological transaction overview,
  • Allocation of inflows and outflows to specific transaction hashes,
  • Wallet and cluster references, as far as reliably ascertainable,
  • References to well-known exchanges, bridges, swaps or other services,
  • Matching perpetrator instructions with times and amounts on the blockchain,
  • Documentation of potential cash-out points and starting points for information requests.

 

Limits of forensics
A forensic analysis does not determine whether an exchange must release an account, whether a suspicious activity report has been filed, or whether a criminal allegation is justified. Similarly, the assignment of an address to a service is based on analytical tools and remains indicative until confirmed by the service. The analysis provides technical facts and correlations that can be used for further legal or regulatory evaluation.

Typical mistakes after a stock market ban

  • Panickingly trying out other wallets or opening new stock exchange accounts.
  • At the perpetrators' instructions, state that the destination address is your own wallet.
  • Do not share passwords or 2FA codes with alleged support staff.
  • Paying money to a wallet, supposedly to "unlock" the account or to pay a "tax".
  • Delete chats with the scammers, even though they explain the background of the transactions.
  • Only save screenshots and do not save full CSV exports or transaction hashes.
  • Claiming, without verification, that the stock exchange has "confiscated" the money or is part of the fraud.
  • To spontaneously provide extensive explanations during a simultaneous investigation, without knowing one's own status.

Practical checklist

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.

☐ Is it still possible to log in to the stock exchange?

☐ Which function is restricted: deposit, trading, withdrawal, or all access?

☐ What message or error message does the stock exchange display?

☐ What specific documents were requested?

☐ Are passwords, 2FA, email, and devices secure? Is remote maintenance software removed?

☐ Has the complete transaction history been exported?

☐ Are all wallet addresses and transaction hashes secure?

☐ Is the perpetrator's communication fully archived?

☐ Is the origin of the funds used verifiable?

☐ Were all the details provided to the stock exchange truthful?

☐ Is there already contact with the police, public prosecutor's office, or bank?

☐ Is there a case number or a criminal complaint?

☐ Is the stock exchange listed in the ESMA register, and has a formal complaint been considered?

☐ Was it examined whether a forensic reconstruction of the money flow would be useful?

Don't fight the ban – explain the facts clearly.

Having your account restricted at a cryptocurrency exchange after a fraud case is stressful. However, it doesn't necessarily mean your funds are lost or that you're facing criminal charges – in fact, at the right moment, it can even prevent further losses. The key is to distinguish between security issues, KYC and source of funds checks, verification of recipient wallets, and potential anti-money laundering measures.

Those who remain calm, break off contact with the perpetrators, fully secure all documents, and truthfully describe the payment method create the best foundation for further clarification. In complex fraud cases, blockchain forensic reconstruction can help to reliably establish the technical connections. However, legal questions, suspect status, or official actions should be assessed by a lawyer.

 

Crypto exchange restricted after fraud case?
We analyze wallets and transactions, reconstruct the payment path, and present the technical details in a structured format for further processing by lawyers or law enforcement agencies. A free initial assessment can clarify whether a more in-depth forensic analysis is advisable in your case.

Legal notice

This article is for general information purposes only and reflects the status of the cited sources as of October 2026. The case presented is based on a mandate from our practice; names and identifying details have been changed to protect the individuals involved. Crypto Investigation / Financial Forensics GmbH does not provide legal advice or criminal defense. For legal questions, official actions, or if you are a suspect, you should seek legal counsel.

Sources and legal bases


Get a free stock market lock-up assessment