Tainted bitcoin and ether: how flagged coins freeze your exchange account

Uncensorable on-chain, frozen at the gate

Bitcoin and Ethereum have no issuer and no blacklist function: your coins cannot be locked in your own wallet the way blacklisted USDT can. What happens instead is that compliance tooling from Chainalysis, Elliptic and TRM Labs scores the history of every deposit an exchange receives — and when your coins' past touches something flagged, the deposit lands and immediately freezes, usually with a vague "security review" notice.

How taint scoring works

Analytics providers cluster addresses into real-world entities and label the bad ones: darknet markets, ransomware wallets, hacked-exchange proceeds, sanctioned mixers, scam networks. Your deposit is then scored on exposure — what share of its value traces back to labelled sources and how many hops away. The key points for your case:

• Hops decay but do not erase. Coins two or three hops from a hack can still score high if the value flowed through cleanly traceable paths.
• Mixers are a flag in themselves. Coins that passed through Tornado Cash or a CoinJoin service score high regardless of underlying origin.
• Providers disagree. The same coins can pass one exchange's screening and freeze at another — a freeze is a risk score, not a finding of fact.
• Dust is noise. Anyone can send tainted satoshis to your address (a dusting attack). Receiving unsolicited dust creates no liability and competent compliance teams know it; if dust triggered your freeze, saying exactly that — and not consolidating dust into your spends — usually resolves it.

When the deposit freezes: the good-faith recipient position

A taint freeze is an accusation against the coins, not against you. Your job is to show you acquired them in good faith and for value: you did not know, and had no reason to know, about the earlier history. That defence is built from documents — who you got the coins from, what you paid or delivered in return, and every record of the transaction (P2P chat and order ID, invoice, OTC contract, the counterparty's details). Package it the way we describe in the source of funds guide: one coherent file with an unbroken chronology beats weeks of ticket ping-pong. If the platform confirms the freeze comes from a law enforcement request rather than its own screening, switch to the externally ordered freeze procedure — and if you are in fact the victim whose stolen coins were traced, the same analytics trail supports a recovery claim instead.

Before you deposit: five minutes of prevention

1. Screen large inbound transfers before accepting them — several reputable AML-check tools will score an address or a transaction for a small fee.
2. Document every off-exchange acquisition at the time it happens, not two years later when a compliance officer asks.
3. Avoid mixers entirely if you ever intend to touch a regulated platform — privacy is lawful, but the score does not care.
4. Do not consolidate unknown small deposits into your main UTXOs.
5. Deposit through the same account and route you can document, so the paper trail matches the chain trail.

The freezes I see most are not criminals caught red-handed — they are ordinary P2P buyers who took coins two hops downstream from a hack they had never heard of. What separates a three-week release from a six-month standoff is nearly always the same thing: whether the client can produce contemporaneous records of how they got the coins. I have yet to see a well-documented good-faith file fail outright; I have seen plenty of genuine cases stall for lack of one.

Mark Eichorn · Managing Partner