How to Freeze Stolen Crypto: Exchange Holds, Stablecoin Freezes, and Evidence Needed

You can watch stolen crypto move in real time and still be unable to stop it. The trail can be completely clear, and tracing gives an investigator none of the things that would actually halt the funds: no private key, no custody, no exchange control, no issuer control, no court authority. A freeze only becomes possible when the funds reach an actionable point — somewhere a real party controls the asset or the account holding it. The most important question after tracing stolen crypto is not "where is it?" but "who controls the asset at that point and what evidence will they require before acting?"

This article covers that stage: what can be frozen, who can do it, what a freeze request must contain, and what happens afterwards.

First, Identify What Can Actually Be Frozen

Control, not visibility, determines what is possible:

• Funds at a centralized exchange — the exchange or custodian can act, and what it can restrict is the account balance, withdrawals, deposits, or internal account access.
• USDT or USDC at a self-custody address — the stablecoin issuer can act where its token controls allow it, restricting transferability of that issuer's token at that address.
• BTC or native ETH at a self-custody address — usually no third party can act, and nothing can be restricted directly until the funds reach an intermediary.
• Assets subject to legal process — a court or law enforcement can act, together with the relevant custodian or issuer, over assets covered by the applicable legal authority.
• An AML risk score alone — nobody acts automatically, and nothing is restricted.

An AML alert or tracing report can support a freeze request, but it does not itself freeze any wallet or asset. AML risk scores can support an investigation, but they do not give an analytics provider technical or legal power to freeze somebody else's cryptocurrency.

For the underlying question of which parties hold which powers, see our guide on who can actually freeze crypto and why.

Step 1 — Trace the Funds to an Actionable Endpoint

The objective here is narrow: establish the original theft transaction, the addresses the funds moved through, any visible swaps or bridges, the destination service, the asset and network, how much is still traceable, and whether what remains sits at an exchange, a custodian, or an issuer-freezable stablecoin address.

Attribution alone is not enough. By the time an exchange is identified, the funds may already have passed through it, been credited internally, withdrawn again, split across several accounts, or swapped into something else. Exchange attribution is only useful if the funds are still actionable there.

Tracing stolen cryptocurrency does not freeze it; a freeze requires an exchange, custodian, token issuer, or legally authorised actor that controls the relevant asset or account. If the endpoint is not yet established, start there — AMLBot's AI Tracer can trace stolen crypto and identify where the funds went, building the transaction path, surfacing possible exchange endpoints, and producing a PDF report usable as starting evidence. Tracing identifies the path; the exchange, issuer, or legal authority makes the restriction decision.

Step 2 — Build an Evidence Package Before Requesting a Freeze

A useful crypto freeze request should connect the original theft transaction to the current asset location using transaction hashes, wallet addresses, amounts, timestamps, and a clear fund-flow explanation. Four parts do that work.

Incident Summary

State plainly who the victim is, what happened, when the theft was discovered, which asset was lost, the original amount, the original wallet or account, and why the transfer was unauthorised. A compliance team needs the sequence in under a minute — a multi-page emotional account delays review rather than strengthening it.

Transaction Evidence

Include the transaction hash, originating address, destination address, blockchain and network, asset, amount, timestamp, the relevant subsequent transactions, and the exchange or service endpoint identified. These are the identifiers law enforcement asks for first: the FBI's guidance to crypto fraud victims prioritises wallet addresses, the cryptocurrency type and amount, date and time, and the transaction ID.

Fund-Flow Explanation

Twenty transaction hashes in a list is not an explanation. What a reviewer needs is the chain: victim wallet → attacker wallet → intermediate wallets → bridge or swap → the exchange or issuer-freezable address.

Separate what you observed on-chain from what you concluded analytically, and say where attribution is uncertain. Presenting an assumption as established fact is the fastest way to lose a compliance team that will check it.

Supporting Evidence

Depending on the case: exchange account statements, wallet history, screenshots, data on the fraudulent platform, scam communications, any relevant invoice or agreement, proof the victim controlled the original account, a police report or reference, and the investigation report.

Victims should never provide a seed phrase or private key as evidence for a crypto freeze request. No exchange, investigator, or police force needs them to process a freeze. Anyone asking for them is not helping you. On what to keep from the outset, see what evidence to preserve immediately after crypto theft.

If the Funds Reached a Centralized Exchange

What an Exchange Can Actually Do

An exchange can hold credited funds, suspend withdrawals, restrict account activity, investigate the deposit, preserve its internal records, and cooperate with law enforcement.

What it generally cannot do is freeze the sender's external self-custody wallet. A centralized exchange can restrict funds held within its own custody, but that does not normally freeze the attacker's external self-custody wallet. The restriction is custodial and internal to its own system.

What to Send to the Exchange

Keep the package tight: a subject line identifying this as stolen or fraudulent crypto, victim identity and contact details, the transaction IDs, the receiving deposit address, the network and asset, the amount, the timestamp, a concise fund-flow map, evidence of loss, a police or case reference if you have one, and investigator contact details if authorised.

Send it only through official exchange support, compliance, or law-enforcement channels. Messaging unverified Telegram "support" accounts is how victims get defrauded a second time.

Temporary Hold vs Longer-Term Restriction

An exchange may apply an internal review or temporary hold under its own policy. Disclosing KYC data, holding funds for an extended period, seizing them, transferring them to authorities, or returning them usually requires formal law-enforcement, court, or other valid legal process, depending on the jurisdiction and the exchange's policy.

There is no universal rule that an exchange must freeze for a set number of days. An exchange may be able to preserve stolen funds quickly, but keeping, disclosing, seizing, or returning them is a separate legal process.

If the Stolen Funds Are USDT or USDC

Why Stablecoins Are Different

Some centrally issued stablecoins have issuer-controlled address restriction mechanisms, which makes them the one asset class where a self-custody address can be reached.

Both major issuers confirm this. Circle's USDC terms state that addresses can be blocked and USDC frozen where a valid government authority requires it. Tether describes ongoing cooperation with law enforcement on freeze actions, and in April 2026 it supported the freeze of more than $344 million in USDT across two Tron addresses in coordination with OFAC and US authorities.

That capability is not a guarantee. Not all stablecoins can be frozen, and not all freeze requests are accepted. USDT or USDC may be technically freezeable at the token level because the issuer maintains address-restriction capabilities, but a freeze is not automatic and does not itself return assets to the victim.

A Stablecoin Freeze Is Not a Blockchain Reversal

The transaction has already happened and stays on-chain. An issuer freeze makes the token balance non-transferable under the issuer's own mechanism. It does not rewrite the earlier transaction, return coins to the victim, establish who owns them, or complete any legal process. Circle states that an on-chain USDC transfer is irreversible and that blocklisting is a separate control.

What Happens After a Stablecoin Freeze?

The sequence runs: freeze → legal validation and investigation → seizure or forfeiture process where applicable → possible return.

A US case shows how separate those steps are. Two Tron addresses holding roughly 200,000 USDT were frozen by Tether at law enforcement's request; the tokens were reissued to a law-enforcement-controlled wallet, and the government then brought a civil forfeiture action to resolve ownership. The freeze came first and settled nothing.

AMLBot's cases follow the same shape — how 650,000 USDT was frozen after a real theft investigation shows monitoring, a portion blocked at an exchange, a police report, a structured evidence package, and a Tether freeze covering the full amount, with the return still proceeding through law enforcement. In a $270,000 Ledger theft, the same combination reached a Tether freeze on most of the funds, with OSINT identifying the attacker once tracing hit its limit.

For the wider pattern of issuer behaviour, see AMLBot's analysis of USDT and USDC freeze activity.

Step 3 — Involve Law Enforcement Early Enough to Preserve the Freeze

Law enforcement is often what converts a temporary hold into something durable. Its role here covers a formal request to the exchange, KYC and account disclosure, escalation of an issuer freeze, a seizure warrant, a preservation request, cross-border coordination, and the forfeiture or restitution process.

The FBI tells victims to report without waiting and to supply the exact transaction identifiers, and warns against anyone claiming they can recover funds for you — recovery scams target victims twice.

A police report number alone does not guarantee a freeze, and some platforms may review or temporarily hold funds on credible evidence under their own policies. But the absence of a formal case reference sharply limits what any third party can do next. A police report can support exchange or issuer escalation, but the exact legal process required for a hold, seizure, disclosure, or return depends on the platform and jurisdiction. On sequencing, see when to involve law enforcement in a crypto recovery case.

Timing Matters, but Accuracy Matters Too

Funds move fast, and there is no honest version of "you have 24 hours" or "the first 48 hours guarantee recovery." Those numbers are marketing.

The fastest freeze request is not necessarily the strongest one; accurate endpoint attribution and a clear evidence package are essential because a mistaken attribution can waste the limited time available. A request naming the wrong exchange costs days you cannot get back.

A good response does both at once: trace quickly, preserve evidence, confirm the correct endpoint, contact the official channel, start the law-enforcement process, and keep monitoring for further movement.

What If the First Freeze Attempt Fails?

Many attempts do, for reasons that have nothing to do with how the request was written. The funds had already left. The exchange attribution was wrong. The service is non-custodial. The evidence was insufficient. The platform requires an official request. There is a jurisdiction mismatch. The asset is not technically freezeable. The flow became uncertain, or the amount was split. Or the exchange or issuer simply decided not to act.

What works from there: keep monitoring, trace the next hop, update the evidence package, identify the new service endpoint, update law enforcement, and preserve all correspondence. When a freeze attempt fails because funds have moved, continued monitoring can identify the next exchange, custodian, or other actionable endpoint.

What does not work: mass-emailing exchanges unconnected to the case, or publicly accusing the owner of an identified account. Both damage the case. On the realistic limits, see when stolen crypto cannot realistically be recovered.

From Freeze to Recovery: What Happens Next

Six distinct stages sit between finding the funds and getting them back:

• Trace — identify movement and endpoints. Controlled by the investigator or analytics provider.
• Flag or notice — alert the relevant platform or authority. Controlled by the victim, investigator, or compliance team.
• Temporary hold — restrict funds internally. Controlled by the exchange or custodian.
• Token freeze — restrict an issuer-controlled token. Controlled by the stablecoin issuer.
• Seizure — place assets under formal legal control. Controlled by law enforcement or a court.
• Forfeiture or restitution — resolve ownership claims so assets may be returned. Controlled by the legal process.

A successful freeze preserves an opportunity for recovery; it is not itself the recovery. A successful crypto freeze preserves the possibility of recovery; it is not the same as seizure, forfeiture, or restitution.

Conclusion

Freezing stolen crypto is not one action and not one request. It is a chain of evidence, tracing, platform or issuer control, and legal escalation.

The sequence that works: trace → verify the endpoint → build the evidence → notify the right actor → preserve the funds → formalise through law enforcement and legal process → pursue recovery.

If you still need to identify the endpoint, start with tracing and trace where stolen crypto went; if the funds have reached an actionable exchange or the case needs coordinated freeze and law-enforcement support, request professional investigation and recovery support.

FAQ

Can Stolen Cryptocurrency Be Frozen?

Sometimes. It depends on where the assets are: at a centralized exchange or custodian, at an issuer-freezable stablecoin address, in a self-custody wallet with no central controller, or in a service already under legal control. There is no universal freeze covering all crypto.

Can a Crypto Exchange Freeze Stolen Funds?

Yes, potentially. An exchange can restrict assets and accounts within its own custody, including holding a credited deposit and suspending withdrawals. It cannot generally freeze an unrelated external self-custody wallet. Longer holds, disclosure, seizure, or return may require law-enforcement or court process.

What Evidence Do I Need to Ask an Exchange to Freeze Stolen Crypto?

Transaction IDs, the originating and destination addresses, the asset and network, the amount, timestamps, a clear fund-flow explanation, evidence of the loss, the identified exchange endpoint, and a police reference where available. Never include a private key or seed phrase.

Can Tether Freeze Stolen USDT?

Tether has the technical capability to freeze USDT addresses and publicly cooperates with law enforcement in appropriate cases. A freeze is not guaranteed, a victim cannot compel Tether to act, evidence quality and official process matter, and a freeze is not the same as getting funds returned.

Can Circle Freeze Stolen USDC?

Circle can block addresses and freeze USDC in the circumstances described in its terms and where required by a valid government authority. That is not automatic for every theft claim, and blocking an address does not reverse the original on-chain transfer or return the tokens.

Can Bitcoin or Ethereum in a Self-Custody Wallet Be Frozen?

Generally no. No central issuer or custodian can freeze ordinary BTC or native ETH held at a self-custody address. The opportunity usually appears only if the funds later reach an exchange, custodian, or another controllable intermediary able to act on them.

Is a Police Report Required to Freeze Stolen Crypto?

Not always, but it matters. Some exchanges may review or temporarily restrict funds on credible evidence under their own policies. Formal law-enforcement or court process is often needed for account disclosure, longer holds, seizure, or return.

Does Freezing Stolen Crypto Mean I Will Get It Back?

No. A freeze preserves the asset and stops it moving. Recovery can still require seizure, a determination of ownership, a forfeiture process, a court order, or a restitution procedure — steps that run on legal timelines rather than the platform's.

How Fast Should I Act After Stolen Crypto Reaches an Exchange?

As quickly as possible, because funds can move again — but no deadline guarantees anything. Priority order: verify the endpoint, preserve evidence, submit an accurate request through an official channel, start official reporting, and keep monitoring.

Can a Blockchain Analytics Company Freeze Stolen Crypto?

No, not by virtue of analytics alone. An analytics provider can trace, attribute, document, monitor, and prepare evidence. The freeze is executed by an exchange, custodian, token issuer, or legally authorised actor with control over the asset.