If an exchange froze your crypto, your first job is to figure out which of the three freeze types you are in, an AML risk hold, a verification demand, or a legal seizure, because each one has a different owner, a different fix, and a different realistic timeline, and most instant swap holds do get resolved. Get the diagnosis wrong and you will spend weeks arguing with the wrong people about the wrong thing.
Search this problem and page one is Reddit panic threads and help center stubs that say "contact support" in four hundred words. Neither tells you what to do at hour one, day three, or week six. This article does. Quick disclosure: we run CoinVast, an instant swap exchange built around screening deposits before they are sent, precisely so this situation cannot happen on our platform. That gives us a horse in this race. It also means we have read more frozen funds complaint threads than any sane person should. Read our take with both in mind.
One more thing up front. A freeze is usually not theft. It feels like theft, and occasionally becomes theft in slow motion, but in most documented cases the money eventually moves. Your job is to make it move sooner, in your direction, without giving up more than you have to.
First, diagnose: the three freeze types
Everything downstream depends on this. Here is the sorting table.
| AML risk hold | Verification demand | Legal seizure | |
|---|---|---|---|
| Who ordered it | The service's automated risk system, sometimes its upstream liquidity provider | The service's compliance team | A court, regulator, or law enforcement agency |
| What they say | "Under review", "on hold", often nothing at all | "Please complete verification", a document upload link | A case number, a legal order reference, or lawyerly silence |
| What resolves it | Time, a clean review, or documents; sometimes a refund to source | Documents that satisfy the request | The legal process itself, possibly a lawyer |
| Realistic timeline | Days to months; complaint logs document holds running weeks to months | Days to weeks after documents, per user reports | Months to years |
| Your leverage | Moderate: policy, public pressure, regulators | Moderate: same, plus the documents themselves | Low: a legal matter, not a support ticket |
Sources: ChangeNOW published KYC/AML pages, kycnot.me service reports, and BestChange complaint logs, read June 2026; timeline ranges reflect user reports from 2024 to 2026, not any service's stated policy.
Type 1: the AML risk hold
The most common freeze on instant swap services. You sent your deposit, the service ran your coins through chain analysis after they arrived, and the risk score came back ugly. Nobody at the company necessarily looked at your case yet. An algorithm put your money in a bucket.
Who ordered it: the service itself, through an automated system. Sometimes the freeze actually originates one layer up, at the liquidity provider executing the other side of the swap, so the service you used may genuinely not control the timeline. The criteria are deliberately secret: ChangeNOW's own FAQ, read June 2026, says its hold criteria cannot be made public because people would game them.
What they can legally do: quite a lot, in most jurisdictions. Terms of service almost always reserve the right to hold flagged transactions pending review, and risk based AML programs are exactly what regulators demand. The hold itself is usually lawful. Whether it is handled honestly is a separate question.
What resolves it: one of three outcomes. The review clears and the swap completes. It escalates into a verification demand (type 2). Or the deposit is refunded to the sending address minus network fees. ChangeNOW's KYC FAQ promises that refund within 24 hours of a verification refusal; the BestChange complaint log we read in June 2026 includes users still waiting months later, one told to wait what they described as an indefinite number of days. Both facts are real. Plan for the second one.
Type 2: the verification demand
The hold has a face now. Someone is asking for your passport, a selfie, proof of address, often proof of where the coins came from. This is the pattern the privacy community calls shotgun KYC, and we wrote a full explainer on what shotgun KYC is and why services do it. This article is about what to do once it has already happened to you.
Who ordered it: the service's compliance function, under its own AML policy. No government agent asked for your selfie. The service decided your risk score requires identity resolution before it releases funds.
What they can legally do: hold the funds while the request stands, in most jurisdictions. What they generally cannot do is keep your money forever with no process, though "cannot" and "will not" are different words, and enforcing anything against an offshore swap service is genuinely hard.
What resolves it: documents, mostly. The honest, unpopular fact is that most verification holds release after the user hands over what was asked; user reports from 2024 to 2026 suggest days to a few weeks for straightforward cases, longer when source of funds gets involved. Refusing is a legitimate choice, treated seriously in Step 4, but refusal usually converts the situation into a long wait for a refund, not a faster release.
Type 3: the legal seizure
Rare, and different in kind. A court order, a regulator's freezing order, or a law enforcement request has attached to your funds, usually because your coins passed through an address connected to an investigation. When German police seized the eXch exchange in April 2025, per BleepingComputer's reporting, plenty of bystanders learned that funds which had merely touched that platform could get flagged elsewhere afterward.
Who ordered it: the state, not the service. The exchange is complying, and often legally barred from telling you much.
What they can legally do: hold the funds as long as the legal process runs. This is the one freeze type where support genuinely cannot help, because it is not their decision. What resolves it: the legal process. If the amount matters, you need a lawyer in the relevant jurisdiction, not a better worded ticket. More in Step 7.
Why freezes happen mechanically
Understanding the machine helps you argue with it. When your deposit lands, most custodial services run the sending address, and several hops of its history, through blockchain analytics tooling from vendors in the Chainalysis and Elliptic category. Those tools score exposure to the categories the industry treats as risky: mixers, darknet markets, ransomware clusters, stolen funds, gambling services, sanctioned entities. Each service sets its own threshold for what score triggers a hold.
Three things follow. First, you can be flagged for coins you received in good faith, because taint travels: a counterparty three hops upstream who once touched a mixer can be enough. Second, scores change over time. An address that was clean when you received from it can be reclassified after a hack or seizure gets attributed, which is how people get frozen over months old history. Third, sanctions screening is the hard floor. A direct match against a government sanctions list is the one case where essentially every service, ours included, must hold and report rather than refund. That is law, not policy.
The deeper problem is sequencing. Post deposit screening means the service takes custody first and asks questions second, which converts every false positive into a hostage situation. We cover reducing your exposure to this whole class of problem in how to use a no KYC exchange safely. Now, back to the mess you are already in.
The playbook
Work these in order. Steps 1 to 3 apply to every freeze type. Step 4 is the fork in the road. Steps 5 to 8 are escalation.
Step 1: Stop, and screenshot everything
Before you send a single angry message, preserve the record. Screenshot the order page with the order ID and status. Save the deposit address, your sending address, your payout address, and every transaction hash. Note timestamps in UTC. Export every chat and email with support, including the automated ones. Save the terms of service and AML policy pages as PDFs today, because policies get edited.
Every escalation route in this playbook runs on documentation. The person with a tidy evidence file gets taken seriously; the person with "they stole my money, trust me" does not. Ten minutes now buys you leverage for months.
Step 2: Read the service's published policy
Actually read it. Find the AML or KYC section and answer four questions: what triggers a hold, whether verification is required for refunds, how long they may hold funds, and what happens if you refuse documents. Then find any published promise, like ChangeNOW's stated 24 hour refund after a verification refusal, per its FAQ as read in June 2026.
A published promise the service is breaking is your best ammunition. "Your own FAQ says refunds within 24 hours; it has been 19 days; here is my order ID" beats any amount of outrage, and it is exactly the discrepancy regulators and review platforms respond to.
Step 3: Respond once, precisely, in writing
Send one message through the official support channel. Include the order ID, the deposit tx hash, the date and time, a one line description of the swap, and a direct question: "Please state which review this transaction is under, what specifically is required to release it, and your expected timeline." Restate your refund address if you have one on file.
Then stop. No daily follow ups, no five parallel tickets, no rage posting before their answer arrives. Duplicate tickets slow queues, and an early meltdown in writing will be quoted back at you later. You are building a paper trail in which you are the reasonable party and they are the vague one. One precise message, then a deadline in your own calendar: no substantive reply in five business days means escalate.
Step 4: Decide the ID question honestly
If this is a verification demand, you face the real decision: hand over documents or refuse. Neither answer is wrong. Here is what each buys you.
Complying gets you, in most documented cases, your funds. Verification holds mostly release after documents are accepted, at days to a few weeks for straightforward cases per user reports. If the amount is significant and the coins genuinely are yours with a boring history, documents are usually the shortest path. What complying does not get you: a guarantee, or your privacy back. Source of funds reviews can spiral into bank statements and screenshots of other accounts, and your documents now live forever on the servers of a company you already distrust, attached to your blockchain history. That trade is permanent. Price it that way.
Refusing gets you your privacy, and in the standard case an eventual refund to the sending address minus network fees, which is what published policies at most swap services provide. What refusing does not get you: speed. Refusals go to the back of the queue in practice, and the public record includes refunds that took months and refusals met with "a refund is not possible at the moment," per BestChange logs read June 2026. And if the freeze is a sanctions match or legal seizure, no decision of yours releases anything.
Rough rule: small amount and clean history, comply if you want it fast, or wait for the refund if privacy matters more. Large amount, get advice before sending anyone anything, because submitted documents are also evidence in any later dispute.
Step 5: Escalate inside the service
Deadline passed with no substantive answer? Reply inside the same ticket, restate the facts in three lines, and ask for escalation to a compliance officer by name or title. Then check whether the service answers its Trustpilot reviews; many do, and a factual public review with your order ID often produces a response in days where tickets produced weeks of silence. Keep it factual: what happened, dates, order ID, what you want. Embellishment gives them a reason to dismiss you.
If the service maintains a presence on Bitcointalk or Reddit, a calm post with the same facts belongs there too. The pattern in documented disputes, including the Bitcointalk thread alleging roughly $440,000 held by ChangeNOW, is that public, specific, documented complaints get official replies. Vague fury gets nothing.
Step 6: Escalate outside the service
Still stuck? Three external channels, in rising order of effort.
First, the regulator where the service is registered. Find the legal entity and jurisdiction in its terms, then file with that jurisdiction's financial regulator or ombudsman. Even where the regulator will not act for a foreign customer, a regulator reference number changes the tone of your next support message. EU entities answer to national supervisors under MiCA now that the July 2026 transition deadline has passed; entities elsewhere answer to whatever licenses their terms actually name.
Second, consumer protection bodies in your own country, plus a police fraud report if the service has stopped responding entirely. The report number is also frequently required for the legal routes in Step 7.
Third, the documentation venues the industry actually watches. kycnot.me accepts service reports, and BestChange maintains complaint logs that exchanges monitor because their listing depends on it. Filing there is not venting; it is how the next person finds out, and services know it. kycnot.me scored ChangeNOW 5 out of 10 with a mid flow KYC warning as of our June 2026 read, and that score exists because users filed reports.
Step 7: Law enforcement and legal routes for large amounts
There is no universal threshold, but fees for a cross border funds recovery start in the thousands, so below roughly five figures the math rarely works, and above it the math changes fast.
What a lawyer actually does: identifies the legal entity behind the website, sends a formal demand letter that support cannot triage into a queue, and, where the amount justifies it, pursues the entity in its home jurisdiction. Demand letters alone resolve a surprising share of these disputes, because a hold that was cheap while you were a ticket becomes expensive once you are a docket.
If the freeze is a genuine legal seizure, skip everything above and start here. Ask the service in writing for the case reference and the agency involved; they may refuse, but a written refusal is itself useful to your lawyer. Do not expect the funds soon. Court attached crypto moves on court time, months to years, and no support ticket changes that.
Step 8: Know when to write it off, and what to change
There is a point where the honest move is to stop spending hours chasing hundreds. If the amount is small, the service is silent, the regulator shrugged and months have passed, write it off. File the kycnot.me report and the review so the record exists, take the tax loss where your jurisdiction allows it, and stop letting a swap service rent space in your head. Then change your setup so it cannot recur. That is the prevention section below, and it is the only part of this story you fully control.
What they can and cannot demand
Jurisdictions differ, terms differ, and none of this is legal advice, but the broad lines run like this.
What they generally can do: hold a flagged transaction while a review runs, request identity documents under a risk based AML program, request source of funds information, refund to the sending address minus network fees instead of completing the swap, and refuse you service going forward. If you agreed to terms saying "verification at our sole discretion," and nearly all of them say that, the discretion is real.
What they generally cannot do: keep your funds permanently with no process in most jurisdictions, invent conditions their own published policy does not contain, or demand anything unrelated to AML, like a fee to "unfreeze" your money. That last one is a scam signal, full stop. Legitimate compliance holds never ask you to send more crypto to release the first batch. Anyone requesting an unfreezing fee or a "verification wallet" deposit is stealing from you, and often it is not even the exchange but an impersonator who found your complaint post. Only communicate through official channels.
The gray zone is time. Very few jurisdictions impose a hard deadline on how long a private service may review a transaction, which is exactly why documented holds stretch from weeks to months, and why your leverage comes from public pressure and regulators rather than from a statute with a countdown clock.
Realistic expectations, stated plainly
Three sentences worth internalizing. Most verification holds release after documents: invasive, annoying, but functional, per the bulk of user reports from 2024 to 2026. Refusing documents is legitimate and usually ends in a refund to the sending address, but on the service's timeline, not yours, and the complaint record shows that timeline running weeks to months. Funds seized under a legal order are a legal matter from day one, and no volume of tickets, reviews, or Reddit posts moves a court.
If someone promises you a guaranteed recovery, they are selling something. Usually the recovery scam that follows the freeze.
Prevention: never be in this thread again
Every item here costs less than one frozen swap.
Send a test amount first. Before any meaningful swap on a service you have not used, run a small one end to end. It proves the pipeline and costs a few dollars in fees. Our roundup of the best no KYC exchanges in 2026 notes which services carry documented hold histories.
Prefer services that screen before the deposit. This is our model, so weigh the bias, but the logic is structural: CoinVast screens the deposit and payout addresses when the order is created, before you send anything. Pass means the swap runs and is final; fail means coins auto return minus the network fee, no documents, with a sanctions match as the single legally required exception. A service that decides before it holds your money cannot hold your money while it decides. The CoinVast vs ChangeNOW comparison walks the freeze problem with sources, including the parts where ChangeNOW wins.
Always set a refund address, with an address you control and will still control in six months. Most refund horror stories get materially worse when the refund path itself is broken.
Keep tainted history away from custodial services. Coins that recently touched a mixer, a gambling site, or a freshly seized platform are exactly what post deposit scoring flags. Keep clean and complicated funds in separate wallets, and route anything complicated through venues that never take custody. Whether any of this carries legal risk for you depends on where you live; our piece on whether no KYC exchanges are legal covers that side.
And minimize custody time everywhere. The freeze window is exactly as long as someone else holds your coins. Swap, withdraw, done.
Which route should you take?
The decision, compressed:
Comply with the document request if the amount matters, the coins are legitimately yours with boring history, and speed beats privacy. Statistically the shortest path.
Refuse and wait for the refund if the privacy cost is unacceptable and you can tolerate weeks to months. Say the refusal explicitly in writing and restate your refund address.
Escalate publicly and to regulators if the service breaks its own published timelines or goes silent. Do it with documents, not adjectives.
Hire a lawyer at five figures, or immediately if there is any sign of a court order or law enforcement involvement.
Write it off if the amount is small and every channel has gone quiet, then fix your setup so the next swap cannot be taken hostage in the first place.
Frequently Asked Questions
Can an exchange legally keep my money?
It can usually hold your money during a review, and in most jurisdictions it almost never gets to keep it outright with no process. Terms of service at most swap services allow holds on flagged transactions, and regulators broadly accept risk based AML holds. Permanent confiscation by the service itself, outside a sanctions match or a legal order, is not something published policies claim, and it is where regulators and lawyers come in.
How long do crypto AML holds usually last?
There is no statutory clock, so it varies wildly. Straightforward verification cases in user reports from 2024 to 2026 run days to a few weeks after documents are submitted, while refusals and disputed cases documented on BestChange and kycnot.me stretch from weeks to months. Legal seizures run on court time, meaning months to years.
ChangeNOW froze my funds, what should I do?
Preserve the order ID, tx hashes, and chat logs first, then read ChangeNOW's published KYC FAQ and AML terms so you know exactly what it promises, including its stated refund within 24 hours after a verification refusal, per the FAQ as read in June 2026. Send one precise support message with your order ID and a direct question about status and timeline. If the published timeline passes, escalate with a factual Trustpilot review and reports to kycnot.me and BestChange, since ChangeNOW replies to most public complaints.
Should I send my ID to get my frozen crypto back?
If the amount matters, the coins are legitimately yours, and speed matters more than privacy, complying is statistically the fastest route, since most verification holds release after documents are accepted. The cost is permanent: your identity gets attached to your chain history on the servers of a company you are already in a dispute with. For large amounts, consider legal advice before submitting anything.
What happens if I refuse to verify?
The standard published outcome is a refund of your deposit to the sending address, minus network fees, instead of the swap completing. In practice the wait is the cost: complaint logs from 2024 to 2026 document refund waits running weeks to months after a refusal. Refusal does not release funds held under a sanctions match or a legal order, which no user decision can release.
Can I get frozen crypto back without a lawyer?
Often, yes. Most AML holds and verification demands resolve through documents, patience, or public and regulatory pressure, none of which require counsel. A lawyer becomes worth the fees when the amount reaches roughly five figures, when the service has gone fully silent, or when there is any sign of a court order or law enforcement seizure.
Why did my crypto swap get stuck on verification?
Because the service screened your deposit after it arrived and the automated risk score crossed its threshold. Tools from the Chainalysis and Elliptic category score a sending address and several hops of its history for exposure to mixers, stolen funds, darknet markets, gambling, and sanctioned entities, so taint from counterparties you never met can trigger a flag. The criteria are deliberately secret at most services, which is why you find out only after they hold your coins.
How do I avoid frozen funds on instant swap exchanges?
Test every new service with a small swap first, always set a refund address you control, and keep coins with complicated history away from custodial platforms. Structurally, prefer services that screen before the deposit rather than after, so a failed check means your coins never left your wallet instead of sitting in limbo. Two minutes checking a service's record on kycnot.me and BestChange filters out most repeat offenders.
The last word
A frozen swap is a solvable problem more often than the panic threads suggest: diagnose the freeze type, build the paper trail, make one precise demand, then escalate on a schedule instead of an emotion. It should also be a lesson about sequencing, because every hold in this article happened after someone's coins arrived at a service that checks second and asks first. We built CoinVast to run that order in reverse: no account, screening before you send, a flat 2% spread printed on the quote, and a swap that either runs to completion or never starts. We are young, we are not the cheapest number on every pair, and you should read how we handle the edge cases before trusting us with anything. But nobody who follows this playbook should ever need it twice.