Messages such as “Account Restricted”, “Withdrawals Suspended”, or “Account Under Review” often appear without warning: the user cannot withdraw cryptocurrency, complete an operation, or regain full account access. The situation feels especially serious when a substantial balance is held on the exchange.
A restriction alone does not always mean confiscation or permanent loss of assets. The exchange may be running a security review, re-identification, Enhanced Due Diligence, or AML analysis of fund origin. At the same time, inaccurate explanations, inconsistent documents, and chaotic support correspondence can make the situation substantially worse.
Below we explain why crypto exchanges block accounts, which documents they may request, and how to correctly evidence the lawful origin of digital assets.
Why a crypto exchange may block an account or withdrawals
Binance, Bybit, OKX, and other centralised platforms are custodial services: they control access to assets on the account and apply their own KYC, AML, and transaction-monitoring procedures. The reason for a restriction depends on the user’s activity and the level of risk identified.
1 Repeat KYC verification. The exchange may ask you to reconfirm identity, residential address, or document validity. This can follow document expiry, a change of country of stay, a login from a new device, or updated internal compliance requirements.
2 Enhanced Due Diligence. EDD is applied when the platform needs a deeper understanding of the user’s identity, activity, source of funds, and the economic substance of operations. Starting EDD does not mean the user has already been found involved in a violation.
3 Need to confirm Source of Funds or Source of Wealth. Source of Funds explains the origin of specific funds deposited to the exchange. Source of Wealth shows how the user’s overall capital was formed: salary, business, investments, asset sales, inheritance, or another lawful source.
4 Incoming funds from a high-risk counterparty. The sender address or related transactions may be flagged by analytics as linked to fraud, theft, phishing, darknet activity, a mixer, a sanctioned service, or another elevated-risk source.
5 Atypical transactional activity. A review may be triggered by a sharp rise in turnover, a large one-off deposit, frequent use of bridges and DEXs, many external counterparties, or operations that do not match the user’s previously declared profile.
6 Use of the account by third parties. Sharing access, receiving other people’s funds, managing client assets through a personal account, or using another person’s payment details can raise questions about the true asset owner and the purpose of operations.
7 A request from a law-enforcement or other competent authority. If a restriction is tied to an official investigation, support may not disclose every detail. Ordinary KYC may then be insufficient — you need to establish the legal basis, jurisdiction, and the body that initiated the freeze.
Important: different exchanges and AML providers may score the same address differently. A risk score is not universal proof of unlawful origin, but it can justify an additional review.
Get a consultation
A quick case assessment — no obligation
What to do after a freeze: documents and proper communication
After a restriction appears, avoid panic and do not try to circumvent the review. First document the circumstances and understand exactly what information the compliance team is requesting.
1 Preserve the exchange’s notices. Save screenshots of the restriction, emails, ticket numbers, the date the issue appeared, and the wording of the request. Separately record the account UID, balance, and operation status if the interface remains accessible.
2 Do not create conflicting tickets. A flood of simultaneous requests does not speed up the review. If different messages describe different circumstances of how funds were obtained, that can raise further questions about credibility.
3 Build a complete chronology. Record when and from whom assets were received, which addresses they passed through, where swaps occurred, and when funds arrived in the restricted account. For each operation note the date, network, asset, amount, address, and TxID.
4 Prepare Source of Funds evidence. Document type depends on the actual source of assets. This may include bank statements, income certificates, contracts, tax filings, trading history, proof of crypto purchases, P2P orders, or statements from other platforms.
5 Explain ownership of external wallets. If funds passed through personal non-custodial addresses, show that you controlled those wallets. Exchange withdrawal history, message signing, wallet technical data, or other control evidence may be used.
6 Conduct blockchain analysis. A single blockchain-explorer screenshot is often insufficient. Establish the asset source, follow the transaction chain, identify exchanges, exchangers, bridges, and other services, and check addresses for public or otherwise available risk labels.
7 Submit one structured explanation. The response should answer the exchange’s question, include a clear chronology, and reference supporting documents. Do not overload compliance with files unrelated to the origin of the specific assets.
What not to do: do not forge statements or contracts, do not conceal transactions, do not create a new account to bypass the restriction, and do not hand access to third-party “intermediaries”. Offers to unblock an account for an upfront fee through personal contacts at the exchange are often a separate fraud scheme.
If the exchange reports a law-enforcement request, separate the compliance review from the legal restriction. Establish which authority initiated the freeze, under which proceeding, and what appeal or evidence process applies in that jurisdiction.
Learn more
We’ll outline the next steps for your case
How ProDefence helps unlock funds on a crypto exchange
In complex cases, a passport and a short note saying “these are my funds” are not enough. You need to evidence asset origin, ownership, and the economic substance of transactions technically and with documents.
1 We analyse the reason for the restriction. ProDefence specialists review exchange notices, support history, the type of review requested, and possible AML triggers.
2 We run a blockchain investigation. We establish deposit sources, asset movement across networks, and interaction with exchanges, DEXs, bridges, and other services. We also check the transaction chain against public and available private risk labels.
3 We build an SOF profile of the funds. We align blockchain transactions with contracts, bank operations, P2P orders, trading history, and other documents. This shows not a single transfer, but a coherent history of how the assets were formed.
4 We prepare a structured compliance response. We produce a chronology, transaction table, explanation of operation purpose, and evidence list. Documents are submitted consistently, without contradictions or unsupported claims.
5 We support follow-up communication. If the exchange asks further questions, we analyse them and help prepare a precise answer. Where a legal freeze exists, counsel and specialists in the relevant jurisdiction may be involved.
The final decision to restore access or allow withdrawals rests with the crypto exchange or competent authority. Professional support does not guarantee automatic unblocking, but it helps eliminate errors, substantiate facts, and present the position in a format compliance can work with.
Submit a request
Confidential reply as soon as possible
Conclusion
A blocked Binance, Bybit, or OKX account needs evidence work, not emotional correspondence. Establish the reason for the restriction, analyse asset movement, evidence Source of Funds, and give the exchange a coherent explanation.
The sooner transaction history and supporting documents are gathered, the lower the risk of losing key data or giving compliance inconsistent information.
AML analysis and crypto asset unblocking
Has an exchange blocked your account or suspended withdrawals?
Send ProDefence specialists the exchange notice, available TxIDs, and a brief description of how the assets originated. We will analyse the situation, identify possible AML triggers, and propose a justified action plan.
Blockchain analytics, SOF profiling, and support for exchange communication.
