TL;DR — Accepting crypto from someone you do not know can freeze your funds — at the exchange when you deposit, or on-chain if a stablecoin issuer blacklists the address. Screen before you accept, not after.
Most guides about frozen crypto start after the freeze. This one starts before it, because the window where you can actually do something is the thirty seconds before you agree to receive a payment.
Getting paid in crypto by a stranger is the single most common way an ordinary holder inherits a problem. The seller does nothing wrong. The buyer pays with value that carries history. The freeze arrives later, at the point where the funds try to become money — often weeks after the trade, when the connection between the payment and the consequence is no longer obvious to anyone involved.
Two kinds of freeze, and only one is reversible by arguing
They get talked about as one thing and they are not.
An exchange hold is a business decision by a regulated venue. Your funds sit on their side of the wall while a compliance reviewer decides. It is frustrating and it is usually resolvable with documentation, because a human is making a judgement and you can give that human evidence.
An issuer freeze is enforced in the token contract itself. Circle and Tether can blacklist an address, after which the tokens are immobile no matter who holds the keys or which venue is involved. There is no ticket queue and, in practice, very little appeal path. This is rarer and far worse.
The second kind is why stablecoins deserve separate thought. USDC and USDT feel like cash and ship with a kill switch, and the switch is operated by a company responding to law enforcement, not by a process you are party to.
How does a payment from a stranger become your problem?
The value arrives carrying its history, and that history becomes yours the moment it lands.
A P2P buyer who paid you with proceeds of fraud. A client who funded an invoice from a wallet with mixer contact. A trading counterparty two hops from a hacked bridge. None of them told you, and most of them did not know either. The chain remembers regardless.
Screening does not ask whether you were complicit. It asks what the address touched. So the exposure attaches to your wallet with the payment, and it surfaces the next time you deal with anyone who screens — which is every exchange, and increasingly every DeFi front end.
Worse, the bank leg can go too. If you sold crypto for a bank transfer and the buyer paid you with money from a compromised account, the bank reverses it and your account can be frozen while they investigate. That is a separate system, a separate freeze, and the crypto side being clean does not help you.
Where the risk is highest
- P2P trading. The classic case. You are transacting with a stranger for value, with no intermediary doing diligence for you. The buyer-side checklist covers the other direction of the same trade.
- Freelance and contract work. Getting paid in crypto by a client you met online is the same exposure wearing a professional coat — hence the freelancer payment checklist.
- Payroll in crypto. Paying a team introduces the reverse risk: your outbound addresses become part of their history, and their exposure can reflect back. The contractor payroll checklist covers both sides.
- OTC deals. Larger amounts, less structure, counterparties who are frequently intermediaries themselves.
- Refunds and reversals. Someone returning funds to you may not return the same funds they received.
What screening before you accept actually tells you
Ask for the sending address before the trade, not the transaction hash after it. That single change is the whole practice, and it is the part people skip because it feels awkward to ask.
A check on that address answers three things. Whether it is directly flagged — on a sanctions list, in a threat corpus, attributed to a known scam cluster. Whether its counterparties are, and how close. And whether the wallet's shape is consistent with what the person told you: a "personal wallet" with thousands of transactions and exchange-like behaviour is worth a second question.
What it cannot tell you is who controls it. Screening evaluates history, never identity — a clean address proves nothing about the person offering it, which is why screening and ownership verification are different checks.
A pre-deposit check is free and takes seconds. Against a frozen deposit that takes weeks to argue, the asymmetry is not close.
Preparing for the deposit itself
Even with clean counterparties, the deposit is the moment of maximum exposure, because it is when a regulated venue evaluates everything at once. Two habits make it go smoothly.
Keep records as you go. The invoice, the chat, the contract, the transaction hash. Assembling a source-of-funds story is easy while you still have account access and hard afterwards — and a source-of-funds letter written in advance is a far better document than one written under pressure.
Do not structure your deposits. Splitting a sum into pieces below a reporting threshold is detected, is old, and converts a documentation question into a conduct one. The full sequence is in the cashing-out checklist, and screening your deposits in advance covers the preventive side.
One more assumption worth dropping: a no-KYC venue is not a workaround. The funds still carry their history, and they still meet a regulated party eventually — a no-KYC exchange can flag your wallet too.
What the exchange sees when your deposit lands
It helps to know what is on the other side of the screen, because it explains why some deposits clear instantly and others do not.
The venue resolves your sending address and walks its transaction graph outward. It checks that address and its counterparties against sanctions lists and attributed clusters, applies a decay so that distant contact counts for less than direct contact, and weighs the value involved against the total. Then it compares the result against a threshold its compliance function set and has to justify to a regulator.
Three things follow from that, and each one is worth internalising.
The threshold is theirs, not a law. Two venues screening the same wallet can reach different answers, both defensibly. "The other exchange accepted it" is true and irrelevant.
They see further than a free check does. Deeper graph analysis costs money and they are paying for it. A clean result on your side and a hold on theirs is usually a difference of depth rather than a contradiction — which is useful information in itself, because it tells you the exposure is distant rather than absent.
They also see your account. The deposit is evaluated in the context of your history, your stated occupation, your usual volumes. An amount that is unremarkable for one account is an outlier on another, and the outlier is what gets reviewed.
The checks worth running, in order
A short sequence covers almost every case. It takes a couple of minutes and it is the difference between knowing and hoping.
- Screen the counterparty's sending address before you agree. This is the only step that prevents the problem rather than explaining it afterwards. Everything below is damage control.
- Screen your own receiving wallet before a significant deposit. Exposure accumulates from inbound you may have forgotten. A wallet risk check tells you what a venue is about to see.
- Check the specific categories that matter for your situation. If the counterparty is unknown, scam-cluster exposure is the one to read first. If the funds came from a trading venue, sanctions matters more.
- Read the confidence, not just the score. A verdict resting on one distant, low-value hop is a different statement from one resting on a direct transfer, and a result that does not distinguish them is telling you less than it knows.
- Keep the evidence. Screenshot the result with its date. If a hold happens later, showing that you checked in good faith at the time is a genuinely useful document.
When the funds are already in your wallet
Suppose the payment landed and only then did you learn something was wrong with it. The order of operations matters.
- Stop. Do not deposit to an exchange, do not swap, do not move it to a fresh wallet. Every additional hop is permanent and the last one reads as obfuscation.
- Find out what is actually there. Screen the wallet and read the driving category and the distance. Direct contact with an attributed address and a distant indirect hit are different problems with different answers.
- Write down how it arrived, while you still remember it. Who, when, for what, with the hash.
- If you were defrauded, report it. A documented victim is in a materially better position than someone who quietly moved funds and explained later.
- Then decide about depositing. With immaterial exposure and good records, most deposits clear. With direct exposure, get advice appropriate to the category before you hand the funds to a venue that will hold them.
The refund trap
One pattern deserves naming on its own because it is deliberate, it is common in P2P, and it turns a cautious seller into a launderer without them noticing.
The buyer pays. Shortly afterwards something goes wrong — they overpaid, they changed their mind, the trade fell through — and they ask for a refund. To a different address than the one they paid from, because "that wallet is my exchange" or "I lost access".
If you comply, you have done something specific: you kept value with a history and sent back value without one. The tainted funds are now yours, the clean funds are theirs, and on-chain it looks exactly like a swap arranged for that purpose. You also cannot show the counterparty took their own money back, because the addresses do not match.
The rule that defeats it is simple and worth holding absolutely: a refund goes back to the address it came from, or it does not go. No exceptions for a plausible story. A legitimate counterparty can almost always receive at the sending address, and one who genuinely cannot can wait while you verify.
The same logic applies to overpayments, "test transactions" that need returning, and anyone who wants you to forward value onward to a third party. Forwarding is the mule pattern with better manners, and the people it recruits rarely realise until afterwards.
The protocol case, which catches people who did everything right
Not all inherited exposure comes from a counterparty. Receiving funds from a protocol that was later exploited is a case where you interacted with software, not a person, and the withdrawal you made in good faith was funded from a pool the attacker had drained.
There is nothing to screen in advance here — the exploit had not happened yet. What helps is noticing quickly, because the window between an incident and its attribution being widely distributed is when a deposit is most likely to sail through, and the window after it is when the same deposit gets held.
This is also the clearest illustration of why screening is not a one-time act. A wallet's result is a statement about the current labelled set, and that set grows. Checking before a significant deposit is worth doing even on a wallet you checked last month.
FAQ
Can Tether or Circle freeze my wallet without warning?
Yes. Blacklisting is a contract function the issuer controls, it takes effect immediately, and there is no requirement to notify you first or to hear you afterwards. It is normally exercised on law-enforcement request, and the criteria are not published.
If I get paid in ETH instead of USDT, am I safe from freezes?
Safe from an issuer freeze, because nobody controls ETH the way Circle controls USDC. Not safe from an exchange hold, which is about exposure rather than the asset. Many people learn only the first half of that and are surprised by the second.
The buyer seemed legitimate. Does that count for anything?
With a compliance reviewer, a little — a coherent story with documents is better than none. With an issuer freeze, nothing, because no human is weighing your account of events.
Should I ask a P2P counterparty for their address before trading?
Yes, and a legitimate counterparty will not mind. Refusal is itself informative. On a P2P platform this is often visible anyway once the trade opens, which is late but not too late.
What if I already spent the funds?
The history follows the value, so onward recipients can inherit the exposure. That is uncomfortable but it is not a reason to conceal it — a documented, explained chain is far more defensible than a wallet that went quiet after an inbound it cannot account for.
Does a small amount matter?
Proportion is one of the two variables that decide materiality, so a tiny inbound into a substantial balance is usually noise. The exception is a direct sanctions hit, where value does not soften the finding at all.
How often should I screen a wallet I use for payments?
Before anything significant goes in or out, and after any inbound from someone new. Attribution improves over time, so a wallet that screened clean six months ago is not making a claim about today.
Disclaimer: This article is for educational and informational purposes only and is not legal, financial, tax, or compliance advice. Crypto carries risk; you act on this information at your own risk. Always do your own research and consult a qualified professional before making decisions. Views are the author's own and do not constitute financial, legal, or investment advice.