A client logged into her Binance account and found it frozen. The reason: she had received 0.5 BTC from an address she did not recognize. She had not sold anything, had not expected any payment, and had no idea who sent the Bitcoin. But the Bitcoin arrived at her Binance deposit address, and Binance's AML system flagged it because the sending address was connected to a known scam operation. The client was innocent — she had not solicited the payment and had no connection to the sender — but her account was frozen nonetheless. This scenario, known as "unsolicited deposit fraud" or "dusting attack freeze," is a growing problem that catches innocent users in the AML net.

In this article, I have explained why exchanges freeze accounts after unsolicited deposits, the different types of unsolicited deposit scenarios (dusting attacks, address poisoning, deliberate framing), how to prove your innocence through structured evidence and documentation, and how to submit a compliance request that gets results. By following the structured approach described here, you can navigate the AML system's presumption of guilt and demonstrate your innocence effectively. This is one of the most frustrating scenarios for innocent users — you did nothing wrong, yet your account is frozen and you cannot access your funds. But there is a process for resolving it, and with the right approach, most unsolicited deposit freezes are resolved within 2-4 weeks.

Why exchanges freeze accounts after unsolicited deposits

When you receive cryptocurrency from an unknown address, the exchange's AML system screens the sending address using blockchain analytics tools (see our AML scoring article for how this works). If the sending address is flagged — connected to a scam, a mixer, a sanctioned entity, or other illicit activity — the exchange freezes your account. The reasoning from the exchange's perspective is:

The exchange cannot distinguish between an innocent user who received an unsolicited deposit and a money launderer who is using the account to receive illicit funds. From the exchange's perspective, the safest action is to freeze the account and ask the user to explain the deposit. This is frustrating for innocent users, but it is a standard AML practice that exchanges are required to implement under regulatory frameworks like MiCA (EU), FCA guidance (UK), and FinCEN requirements (US).

The dusting attack variant

In some cases, the unsolicited deposit is part of a dusting attack — a scammer sends small amounts of cryptocurrency to many addresses to deanonymize them or to taint them. See our dusting attacks article for details on how these attacks work. If your address receives dust from a flagged address, your exchange account may be frozen — even though you had nothing to do with the dusting attack and did not even know the deposit occurred.

Dusting attack freezes are particularly common on Ethereum, where gas fees are low enough that sending small amounts to many addresses is economically feasible. If you hold ETH or ERC-20 tokens on an exchange and your address receives dust from a flagged address, the exchange may freeze your account. The dust is typically worth less than $1, but the AML flag it triggers can freeze your entire account — which may hold hundreds of thousands of dollars in cryptocurrency.

The dusting attack scenario is particularly unfair because you cannot prevent it. Anyone can send cryptocurrency to any public address — there is no way to reject an incoming transaction on a blockchain. The scammer does not need your permission, your cooperation, or even your knowledge. They simply send a small amount from a flagged address to your deposit address, and the AML system does the rest.

The address poisoning variant

Another variant is address poisoning — a scammer generates a vanity address that looks similar to your usual exchange deposit address and sends a small transaction from it to your wallet. When you later copy an address from your transaction history, you may copy the poisoned address instead of the real one, and send funds to the scammer. See our address poisoning article for details. In this scenario, the freeze may be triggered not by the incoming transaction but by your outgoing transaction to the poisoned address — the exchange's AML system flags the destination address as suspicious, and your account is frozen pending review.

The deliberate framing variant

In some cases, the unsolicited deposit is not a random attack but a deliberate attempt to frame you. This happens in disputes — for example, in a divorce or business conflict, one party may send tainted cryptocurrency to the other's exchange deposit address to trigger a freeze. The frozen account creates financial pressure and may be used as leverage in the dispute. While this is relatively rare, it does happen, and it is important to be aware of the possibility — particularly if the unsolicited deposit occurs during a legal dispute.

How to prove you are innocent

To get your account unfrozen after an unsolicited deposit, you need to prove four things: (1) you did not solicit the deposit, (2) you do not know the sender, (3) you have no connection to the illicit activity associated with the sending address, and (4) the deposit was unsolicited and unexpected. Here is how to prove each of these:

1. Provide a written statement that the deposit was unsolicited

Submit a formal written statement to the exchange's compliance team stating that you did not solicit the deposit, do not know the sender, and have no connection to the sending address. Be specific and factual: "On [date], I received [amount] of [cryptocurrency] from address [address] at my [Exchange] deposit address [address]. I did not solicit this deposit, I do not know the sender, I have no connection to this address, and I do not know why this deposit was sent to me. I believe this deposit was unsolicited."

The statement should be signed and dated. If you are submitting it through legal counsel, the statement should be in the form of a formal declaration or affidavit — this carries more weight than an informal email.

2. Provide your transaction history

Provide your transaction history for the deposit address, showing that you have no prior transactions with the sending address. This demonstrates that the deposit was a one-time, unsolicited event — not part of an ongoing relationship with the sender. If the deposit address is a unique address generated by the exchange for your account, the exchange already has this data — but providing it yourself shows that you have nothing to hide and makes it easier for the compliance team to verify.

3. Offer to return the funds

Offer to return the unsolicited deposit to the sending address (or to have the exchange reverse the deposit). This demonstrates good faith and shows that you are not trying to keep funds that you did not earn. Most exchanges will accept this offer and reverse the deposit, which resolves the AML flag. The exchange returns the funds to the sending address (or to a burn address, if the sending address is flagged) and unfreezes your account.

The offer to return the funds is often the key to resolving the freeze. Exchanges are cautious about users who want to keep unsolicited deposits from flagged addresses — this is a common money laundering pattern. But users who offer to return the funds are clearly not money launderers — they are innocent victims of an unsolicited deposit.

4. Provide source of funds documentation for your other holdings

Provide documentation showing how you acquired the rest of the cryptocurrency in your account (exchange purchase records, mining records, payment for services). This demonstrates that your other holdings are legitimate and are not connected to the unsolicited deposit. See our source of funds guide for the specific documentation to provide.

5. Obtain an independent analytics report

An independent blockchain analytics report (from Chainalysis, TRM Labs, or another provider) can show that your address has no direct connection to the sending address (other than the single unsolicited deposit) and that your other transactions are not connected to illicit activity. This is the strongest evidence you can provide — it provides an objective, third-party assessment of the risk associated with your address.

How to submit the compliance request

Follow the structured compliance request process described in our compliance request article. The request should include all five components: clear subject line, factual summary, evidence, legal framing, and specific request with deadline. For an unsolicited deposit freeze, the request should specifically include:

Most exchanges will review the request within 7-15 business days. If the evidence is convincing, the exchange will unfreeze your account (after reversing the unsolicited deposit). If the exchange does not respond, escalate to the regulator — see our article on legal time limits.

Case study: the unsolicited 0.5 BTC

The client I described at the beginning of this article received 0.5 BTC from an unknown address. We prepared a compliance request that included: (1) a formal statement that the deposit was unsolicited, (2) the client's transaction history showing no prior transactions with the sending address, (3) an offer to return the 0.5 BTC to the sending address or to a burn address, (4) source of funds documentation for the client's other holdings (Coinbase purchase records showing the client had purchased Bitcoin legitimately over 2 years), and (5) a request for resolution within 15 business days.

Binance reviewed the request and confirmed that the deposit was unsolicited. They reversed the deposit (returned the 0.5 BTC to the sending address) and unfroze the account within 8 business days. The client lost the 0.5 BTC (which she never wanted in the first place) but regained access to her other holdings, which were worth significantly more.

The key to the resolution was the offer to return the funds. By offering to return the unsolicited deposit, the client demonstrated good faith and made it easy for the exchange to resolve the AML flag. If the client had insisted on keeping the deposit (perhaps arguing that it was a gift or that she had no obligation to return it), the exchange would have been more cautious and the freeze may have lasted longer — potentially months, while the compliance team investigated whether the client was a money mule.

This case also illustrates an important principle: in AML cases, the burden of proof is effectively on the user, not the exchange. The exchange has frozen your account based on an automated flag, and you must prove that the flag is a false positive. This is not fair — you are presumed guilty until proven innocent — but it is the reality of the AML framework. Understanding this reality and preparing your evidence accordingly is the key to a successful resolution. The compliance team is not your enemy — they are doing their job under regulatory pressure. But they are also not your advocate. You must advocate for yourself, with clear evidence, structured arguments, and a professional approach that makes it easy for them to verify your claims and unfreeze your account.

How to prevent unsolicited deposit freezes

While you cannot prevent someone from sending cryptocurrency to your deposit address (blockchain transactions are irreversible and cannot be rejected), you can take steps to reduce the risk of a freeze:

The broader problem: AML systems and innocent users

The unsolicited deposit freeze problem is part of a broader issue with AML systems: the burden of compliance falls disproportionately on innocent users. Money launderers and scammers know how the AML systems work and take steps to avoid detection — they use mixers, cross-chain bridges, and unregulated exchanges. Innocent users, on the other hand, do not know that receiving cryptocurrency from an unknown address can freeze their account, and they have no way to prevent it.

Regulatory frameworks like MiCA (EU) attempt to address this by requiring exchanges to provide a clear process for challenging freezes. See our MiCA article for the framework. But the fundamental problem remains: the AML system flags first and asks questions later, and the innocent user is left to prove their innocence. But until the AML systems become more sophisticated (able to distinguish between solicited and unsolicited deposits, for example), this problem will persist. In the meantime, the best defense is awareness: know that unsolicited deposits can trigger freezes, monitor your account for unexpected deposits, and act quickly if your account is frozen.

What to do if you are being deliberately framed

If you suspect that the unsolicited deposit was sent deliberately to frame you — particularly if you are in a legal dispute (divorce, business conflict) — take additional steps:

The bottom line

If your account is frozen after receiving cryptocurrency from an unknown sender, do not panic. The freeze is a standard AML response, and it is resolvable. Submit a structured compliance request stating that the deposit was unsolicited, provide your transaction history, offer to return the funds, and provide source of funds documentation for your other holdings. Most exchanges will unfreeze the account within 2-4 weeks. The key is to demonstrate good faith by offering to return the unsolicited funds, providing source of funds documentation for your other holdings, and obtaining an independent analytics report that shows your address has no connection to the illicit activity. See our compliance request article for the structured approach. The key is to demonstrate that you are an innocent user who received an unsolicited deposit — not a money launderer receiving illicit funds. This requires clear evidence, a structured compliance request, and often an independent analytics report that proves your address has no connection to the illicit activity that triggered the flag. With the right approach, most unsolicited deposit freezes are resolved within 2-4 weeks, and the account is fully restored without any loss of your legitimate holdings.

If your account has been frozen after an unsolicited deposit, contact us. We can prepare the compliance request, obtain an independent analytics report, and escalate to the regulator if necessary. We have resolved hundreds of unsolicited deposit freeze cases across all major exchanges, and we understand the specific evidence and arguments that each exchange's compliance team needs to see before they will unfreeze an account. The key is speed and structure — the longer your account remains frozen, the harder it becomes to resolve, so do not delay in seeking professional help if you are unable to resolve the freeze on your own.

N. Silinevics
Nils Silinevics Crypto Compliance Counsel · Former FIU Investigator · Valken Legal AG