Every week, someone transfers USDT from Binance or Bybit to a wallet they have used dozens of times before, and the transfer goes through without a problem. Then one day the same transfer lands and the exchange freezes the deposit for “security review.” The difference was not the exchange. It was the wallet’s history, which had quietly picked up a contaminated UTXO or an address linkage somewhere along the way. Understanding how exchanges actually screen deposits is the difference between a 48-hour delay and a frozen account with a compliance case number.
Screening starts before your deposit confirms
Large exchanges run deposit screening through vendors like Chainalysis, TRM Labs and Elliptic. The vendor indexes every transaction on every major chain and assigns risk categories to addresses: darknet market, ransomware, scam, sanctioned entity, mixer, gambling, peer-to-peer exchange with weak KYC. When your deposit arrives, the exchange queries the sending address and sometimes the two or three hops behind it.
The score that matters is not binary. Most vendors output a risk percentage per category, and each exchange sets its own thresholds. A practical consequence: the same wallet can deposit fine on one exchange and trigger a hold on another, because the thresholds differ. Arguing “it worked last week” is irrelevant to the compliance team; they changed nothing, your wallet’s exposure did.
The three outcomes of a flagged deposit
Hold and review. The most common outcome for moderate scores. Funds sit in a pending state, withdrawals from your account are sometimes disabled, and you get a request for a source-of-funds letter. Timeline: typically 3 to 14 business days.
Return to sender. For scores below the freeze threshold but above the comfort threshold, some exchanges will return the deposit to the originating address and close the matter. This is the best bad outcome. It usually requires you to confirm the originating wallet is still under your control.
Freeze and escalate. For high-confidence matches against sanctioned entities, ransomware clusters or active law-enforcement requests, the exchange freezes the funds, disables the account, and in many jurisdictions files a suspicious activity report. At this point customer support is no longer the audience; the file has moved to legal and compliance, and in some cases the funds are subject to a freezing order that the exchange cannot lift even if it wanted to.
What a source-of-funds letter actually needs
When the exchange asks for evidence, vague answers extend the timeline. Effective submissions include: the withdrawal history from the originating exchange showing the funds came from your own verified account; bank statements linking your fiat deposits to that account; invoices or contracts if the USDT was payment for services; and a short written timeline that maps each hop. If the contamination entered through a peer-to-peer purchase, say so plainly and provide the trade records, the counterparty’s advertisement ID and chat logs. Compliance officers see concealment attempts constantly; a documented P2P purchase from a stranger reads far better than a disguised one.
Why “just send it through a mixer” makes everything worse
Mixers and privacy tools are treated as high-risk categories by every major vendor. Running flagged funds through a mixer does not clean them; it upgrades the risk classification from “possible incidental exposure” to “deliberate obfuscation,” which is exactly the pattern screening is designed to catch. Post-Tornado Cash sanctions, several exchanges treat any mixer proximity as an automatic freeze, with no source-of-funds cure. If funds are already tainted, the path to recovery runs through documentation and legal process, not through hiding the trail.
Practical hygiene that prevents the freeze
Segregate roles. Use one wallet for exchange deposits and withdrawals, a separate one for DeFi, and never receive peer-to-peer payments directly into the wallet you use to fund exchanges. P2P is the single most common contamination route, because you cannot choose which coins a stranger sends you.
Check before you send. Free and paid lookup tools will show whether an address carries vendor flags, and checking a receiving address before a large transfer takes two minutes. For a deeper treatment of how these flags get applied, see our article on how Chainalysis, TRM Labs and Elliptic decide to flag a wallet.
Keep records as you go. Screenshot trade confirmations, keep CSV exports of withdrawal history from every exchange you use, and store invoices. People who recover frozen funds fastest are, without exception, people who can reconstruct the money trail in an afternoon. For the mechanics of what a freeze looks like on Tron specifically, where most USDT circulates, read what the freeze smart contract actually does.
When to bring in a lawyer
If the exchange has issued a formal freeze tied to a case number, mentioned law enforcement, or stopped responding for more than 30 days, the matter has left customer-support territory. A regulatory or criminal-defense practitioner can send a formal information request, which exchanges answer differently than they answer customers. Bring the lawyer the same file you would bring compliance: the full timeline, the wallet transaction history, source documents and your correspondence log. Legal letters do not unfreeze funds by themselves, but they establish a paper trail that matters enormously if the case ends up before a regulator or a court.
The uncomfortable summary: screening is automated, thresholds are opaque, and the burden of proof lands on you. Build the paper trail before you need it, keep dirty and clean flows in separate wallets, and treat any P2P receipt as potentially contaminated until proven otherwise.