Will this checklist guarantee that an exchange freezes funds?
No. The checklist improves the quality of the handoff, but each venue applies its own legal, operational, and jurisdictional review before taking action.
RESOURCE
Incident response resource
Prepare the minimum evidence package an exchange or venue needs before it can review a freeze request.Exchange Freeze Checklist
This page is designed for the first hours of a live blockchain incident. It does not guarantee that a venue will freeze funds, but it does clarify the evidence packet that usually needs to exist before an exchange, OTC desk, or payment platform can route the request internally.
Run this checklist deliberately
01
Confirm the use case
Use this asset when the immediate job is a practical checklist for theft, fraud, and unauthorized-transfer matters where counsel, investigators, or operators need to preserve time and avoid sending an incomplete request.
02
Collect the handoff evidence
Have Wallet addresses and transaction hashes, Asset, chain, amount, and timestamp, Receiving exchange or service touchpoint, and any supporting venue or case references, ready before you start.
03
Move to analyst support when needed
Escalate once the checklist points toward tracing, decisioning, chronology building, or report drafting that needs direct review.
What this checklist is for
A practical checklist for theft, fraud, and unauthorized-transfer matters where counsel, investigators, or operators need to preserve time and avoid sending an incomplete request.
Use this when
Funds have already moved to a centralized exchange, OTC desk, broker, or identifiable service.
You need to coordinate a preservation or freeze request quickly without losing chronology or wallet references.
The case still needs formal tracing, but you need the first outbound request to be coherent now.
Frequently asked questions
When should this move from checklist use into a full incident-response engagement?
Move into a full engagement when the path is unclear, multiple hops or venues are involved, or the matter needs analyst-led chronology, exchange escalation support, or evidence-grade reporting.
What is the most common failure in exchange freeze requests?
The request often arrives without a coherent chronology, consistent wallet labels, or a clear statement of what the exchange is being asked to review, which forces the venue to restart triage internally.
Checklist step 01
Capture the core incident record
Record the victim wallet, compromised wallet, or originating account exactly as used onchain.
Preserve the transaction hash, asset, chain, timestamp, and amount for the transfer you want reviewed.
Write a two- or three-sentence incident summary that explains what happened without speculation.
Checklist step 02
Map the exchange touchpoint
Identify the receiving deposit address, memo/tag, and any intermediate wallet or bridge used immediately before the venue touchpoint.
Preserve screenshots or explorer links that show the path into the exchange-facing wallet.
If multiple hops exist, provide the shortest defensible chronology rather than a raw dump of unrelated transactions.
Checklist step 03
Prepare the request packet
State the urgency, the reason for review, and the specific wallet or transaction set the venue should examine.
Include legal or investigative point-of-contact details so the exchange can route the matter without a second lookup.
Attach supporting evidence such as police report references, case numbers, or counsel details when they already exist.
Checklist step 04
Keep the handoff reviewable
Use consistent wallet labels across every attachment, screenshot, and written summary.
Separate confirmed facts from assumptions or unverified counterparties.
Track what was sent, to whom, and when, so follow-up requests do not restart the case from zero.