What this tutorial says in five lines
- A regulated exchange is the only place in the chain where a lawful freeze can land.
- The window exists only while the funds sit on deposit, and it is measured in days.
- A generic support ticket will not do it. You need the compliance desk and a structured request.
- Cite the transaction hash, the receiving address, the amount and the date, in the first paragraph.
- Ask for written confirmation of receipt and a case reference on the day you send it.
Why this matters
Most victims who lose crypto to a traceable route send one generic support message, receive one generic reply, and conclude that nothing can be done. The conclusion is wrong, and the reason it is wrong is documentation rather than leverage: a covered institution has obligations, but only in response to a request that identifies specific funds. This tutorial is the request — what to send, who to send it to, and the structure that gets it routed to a human who can act.
Why the exchange is the only point that matters
On-chain, nobody has the power to reverse anything. Off-chain, a regulated exchange has both the power and the obligation: it holds customer funds, it applies identity checks, and it is subject to law-enforcement process.
This makes the exchange the single point in the entire chain where your documentation has a mechanism behind it. It also makes it the point with the shortest useful life, because funds rarely sit on deposit for long before being withdrawn again.
If your trace shows funds reaching an exchange deposit, treat that as the most urgent thing in your entire case — ahead of reports, ahead of paperwork, ahead of everything except a same-day card dispute.
The five elements of a request that gets routed
A support ticket that says "I was scammed, please help" is triaged as a general enquiry and closes. The same facts, structured as below, are triaged as a potential compliance matter and reach someone with authority.
The difference between the two is entirely in the first paragraph. Put the identifiers there.
| # | Element | Why it matters | How to phrase it |
|---|---|---|---|
| 1 | The identifiers, first | Routes it to compliance rather than general support | Transaction hash, receiving address, chain, exact amount, date and time in UTC |
| 2 | The relationship to you | Establishes you are the victim, not a third party | Your sending address and how the funds left your control |
| 3 | The preserved record | Shows you have evidence, which raises the priority | Attach the exported trace and the platform evidence |
| 4 | A specific request | A vague request cannot be actioned by anyone | Ask for a hold on the identified deposit pending review |
| 5 | A reference request | Without one, follow-up starts from zero each time | Ask for written confirmation of receipt and a case reference |
How long the window really is
The recoverable phase is not measured from your loss. It is measured from the moment the funds arrive at the exchange, and it ends when they are withdrawn, converted or moved to another account.
This is why the chart below is about elapsed time, not about the size of the loss.
What remains actionable as the deposit ages
Relative practical leverage to freeze the deposit, by elapsed time since arrival
Reading: The shape of this decline is the reason the freeze request comes before the paperwork. Every hour spent assembling a perfect report is an hour in which the deposit can be withdrawn.
Escalation, if the first reply is a template
A template reply is not a refusal. It is a routing outcome, and it can be corrected. These steps add roughly one or two days each and can be run in parallel.
Keep every reference number and every date. The escalation chain is itself evidence if you later need to show that you acted promptly.
- 01Reply on the same ticket and ask explicitly for the message to be forwarded to the compliance or fraud team, naming that team in the request.
- 02Send the same document to the exchange’s published compliance or law-enforcement contact address, if it differs from support.
- 03Include the police report number if you have filed one — institutions respond differently to a document with an official reference.
- 04Send a copy to the exchange’s regulator or the financial ombudsman in its jurisdiction, framed as a complaint about the handling of a fraud notification rather than about the fraud itself.
- 05Ask your own bank’s fraud team to contact the exchange directly. Institution-to-institution requests move faster than individual ones.
- 06Once you have a case reference, follow up in writing on a fixed schedule — weekly, with the reference in every message.
Never pay anyone who offers to "expedite" your freeze request. No legitimate intermediary charges for this, and the offer is a standard follow-up fraud.
What to do if the funds have already moved
This is the most common outcome, and it does not mean the documentation was wasted — it changes what the documentation is for.
Once funds leave the exchange, the freeze route closes for that deposit. What remains is the record, and the record is what makes everything else possible.
- 01File the card or bank dispute if any part of the loss was funded that way. This is often the strongest route and it is unrelated to the trace.
- 02File at IC3.gov with the identifiers, so that your case can be joined to others against the same addresses.
- 03File at ReportFraud.ftc.gov with the platform details, which feeds the systemic record.
- 04Request a police report, which some banks, insurers and civil processes require before they will act.
- 05Keep the trace. Funds do move back to exchanges, and a documented case with a case reference can be resubmitted later if the funds reappear.
- 06Watch for the recovery approach that follows, and refuse all of them.
The visual summary
Everything above, reduced to the four stages that matter for this topic. If you only look at one thing on this page, look at this.
Where this fits in the pattern
Before contact
Nothing has happened yet. This is when every tutorial here is most useful and costs you nothing but reading.
During the approach
The script is running. The verification tests in this tutorial are designed to be run here, neutrally, without confrontation.
At the money request
The decisive moment. Any request for funds, fees, taxes or unlock deposits is the end of the script, not a stage of it.
After a loss
Prevention is over; evidence work begins. Preserve, report, and never pay a second fee to recover the first.
Common questions
Generate the freeze request from one form
The Report Builder produces a formatted request to the exchange compliance desk, plus a complaint, a police statement and a demand letter from the same details.
Primary sources and further reading
- FBI IC3 — Cryptocurrency Fraud Reporting www.ic3.gov
- FTC — How to Report Fraud reportfraud.ftc.gov
- Chainalysis — Tracing Funds to Exchanges www.chainalysis.com
External links open in a new tab so you can verify the underlying material yourself. TrueMoneyTalk is not affiliated with these organisations.
Prevention only works if it reaches people before the contact does.
Disclaimer: this tutorial is general information, not legal, financial or recovery advice, and is not a substitute for advice from a licensed professional in your jurisdiction. Individual outcomes vary and are never guaranteed.