Changelly is a non-custodial swap service — it doesn't hold funds in accounts like a traditional exchange. This makes phishing on Changelly different from exchange phishing. The attacker doesn't steal your Changelly account credentials — they steal your wallet credentials and then use Changelly to swap the stolen funds before cashing out at an exchange. However, Changelly uses SumSub for KYC, has a 24-hour refund window for law enforcement, and can blacklist addresses. If the swap is still pending, we can reverse it.
Phishing on Changelly is fundamentally different from exchange phishing. Changelly is a non-custodial swap service — it doesn't hold your funds in an account. The attacker cannot "phish your Changelly account" because there's no account to phish in the traditional sense. Instead, phishing attacks involving Changelly work in two ways:
Scenario 1 — Wallet phishing then Changelly swap: The attacker phishes your non-custodial wallet (MetaMask, Trust Wallet) through a fake wallet login page or malicious browser extension. Once they control your wallet, they swap the stolen funds through Changelly (BTC to ETH, ETH to XRP, etc.) to break the transaction trail before sending to a centralized exchange for cash-out. Changelly is the intermediary — not the endpoint.
Scenario 2 — Fake Changelly website: The attacker creates a fake Changelly website — changelly-swap.net, changelly-exchange-secure.com — that looks like Changelly but steals funds directly. The victim sends crypto to the fake "swap" address, expecting to receive swapped coins. Instead, the funds go directly to the attacker. This is not technically "phishing" in the traditional sense — it's a fake platform masquerading as Changelly.
The 24-hour refund window: Changelly has a policy allowing law enforcement to request a refund of pending swaps within 24 hours. If the scammer's swap is still processing (which can take 10-30 minutes for most swaps, longer for large amounts), Changelly can reverse the swap and return funds to the sender. This is the fastest recovery path in crypto fraud — but it only works if the swap is still pending when we file the request. This is why for Changelly cases, speed is absolutely critical.
Compliance structure: Changelly's compliance team uses SumSub for KYC verification. They process legal requests through email. Changelly has a 24-hour refund window for law enforcement — if funds are in a pending swap, law enforcement can request a refund to the sender. Response times: 3-7 business days for legal requests. Changelly is more responsive than MEXC or Gate.io but less transparent than Kraken.
Freeze capability: Changelly can't "freeze" an account (non-custodial model) but can: (1) refund pending swaps within 24 hours of law enforcement request — the fastest recovery path, (2) blacklist blockchain addresses — preventing them from using Changelly in the future, (3) share KYC information collected on flagged transactions, and (4) share IP addresses collected during swaps. If the swap is complete and funds have left Changelly, we trace to the destination exchange and freeze there.
KYC and IP disclosure: Changelly uses SumSub for KYC on flagged transactions. Not all swaps require KYC — lower-value swaps may be anonymous. However, for higher-value or suspicious swaps, KYC is triggered: government ID, selfie. Changelly also collects IP addresses during swaps. Through legal process, we can obtain both the KYC and the IP address — the IP can help identify the scammer's physical location.
A client's MetaMask wallet was compromised through a malicious browser extension. The attacker transferred 1.5 BTC (~€90,000) from the client's wallet to an external address, then initiated a Changelly swap: BTC to ETH. The swap was still processing when the client contacted us — 45 minutes after the attack.
The 24-hour reversal: We filed an emergency refund request with Changelly's compliance team immediately. Because the swap was still pending (Changelly was waiting for blockchain confirmations), Changelly was able to reverse the swap and return the 1.5 BTC to the client's wallet within 24 hours. This was possible because: (1) the client contacted us within 45 minutes, (2) the swap was still processing, and (3) Changelly has a law enforcement refund policy for pending swaps.
Outcome: 100% recovery (€90,000 of €90,000). This is the best-case scenario — it only works if the swap is still pending. If the client had waited even 30 more minutes, the swap would have completed and the funds would have been sent to an ETH address, making recovery significantly harder.
Details anonymized to protect client confidentiality. Swiss professional secrecy applies.
Was your wallet compromised (not a Changelly account)? Changelly is non-custodial — the attacker likely compromised your wallet, not Changelly. See our wallet hack involving Changelly page for the full recovery process.
Warning: After losing crypto, fake "recovery services" will contact you. Read our recovery scam warning before engaging anyone.
Yes. Changelly doesn't hold funds in accounts, but they can: (1) refund pending swaps within 24 hours of a law enforcement request — the fastest recovery path in crypto fraud, (2) blacklist blockchain addresses, (3) share KYC information collected on flagged transactions, and (4) share IP addresses collected during swaps. If the swap is complete, we trace to the destination exchange and freeze there. Changelly's cooperation in sharing destination addresses and IP data has been valuable in multiple cases.
Changelly has a policy allowing law enforcement to request a refund of pending swaps within 24 hours. If the scammer's swap is still processing (waiting for blockchain confirmations), Changelly can reverse the swap and return funds to the sender. This is the fastest recovery path in crypto fraud — we've achieved 100% recovery in cases where the client contacted us while the swap was still pending. Time is measured in minutes, not hours.
Yes. Changelly collects IP addresses during swaps. Through legal process, we can obtain the IP address associated with the scammer's swap. This can help identify the scammer's physical location — useful for law enforcement coordination. The IP address is particularly valuable when the swap didn't trigger KYC (lower-value swaps may be anonymous), as the IP is still collected regardless of KYC status.
Yes. Changelly uses SumSub for identity verification. KYC is triggered for higher-value or suspicious transactions. If the scammer completed KYC, their identity (government ID, selfie) is on file. If the swap was below the KYC threshold, no identity was collected — but the sending and receiving addresses are still traceable on-chain, and the IP address was still collected.
Yes. Changelly can blacklist specific blockchain addresses, preventing them from using the service in the future. If the scammer tries to use Changelly again with the same address, the swap will be blocked. We also request blacklisting as a preventive measure — even if the initial swap completed, blacklisting prevents future use.
Changelly is non-custodial — there's no "account" to freeze. Instead, recovery relies on: (1) the 24-hour pending swap refund (fastest path, 100% recovery if swap is still processing), (2) tracing the destination address after the swap completes, (3) obtaining KYC and IP data from Changelly, and (4) freezing at the destination exchange. Exchange phishing recovery is about freezing the attacker's exchange account. Changelly phishing recovery is about reversing the swap or tracing through it. The 24-hour refund window makes Changelly the best platform for fast recovery — if you contact us while the swap is still processing.
If the swap is still processing, we may be able to reverse it within 24 hours. Contact us immediately. Include the swap ID, sending address, receiving address, and amount. We respond within 6 hours — but for Changelly, faster is better.