Hacked Crypto Moved to an Overseas Exchange: Freeze Requests and Preparing a Criminal Complaint
- 1. What a Binance Address Label Does and Does Not Confirm
- 2. Victim Reports and Official Freeze Requests
- 3. Organizing Evidence Before Reporting
- 4. Initial Response Procedures
- ① Preventing Further Losses and Preserving Records
- ② Preparing the Exchange Report and Police Report in Parallel
- ③ Checking for Missing Transactions and Inconsistencies
- ④ Tracking the Status of Official Requests and Follow-Up Procedures
- 5. Tracing Versus Recovery
- 6. Frequently Asked Questions (FAQ)
- Q1. Should I contact customer support before filing a police report?
- Q2. Can I identify the counterparty from a Binance deposit screen?
- Q3. Is the response different for a scam in which I sent the coins myself?
- Q4. Can I seek advice on a loss that occurred long ago?
- Linking Evidence and Procedures for Coins Moved to Overseas Exchanges
This article explains the TXIDs, wallet ownership records, and police report materials to prepare when you find signs that hacked crypto has flowed into Binance, and the difference between a customer support report and an official freeze request.
1. What a Binance Address Label Does and Does Not Confirm
Exchange labels on blockchain explorers are a clue for examining the flow of funds. However, a label alone does not establish the ultimate beneficiary or the actual account holder.
First, confirm how the transactions starting from the victim's wallet connect to the transactions arriving at the address believed to belong to the exchange. Even tokens with the same name may be on different networks or contracts, and swaps, bridges, or split transfers may have occurred along the way.
It is advisable to record confirmed transaction history separately from inferences. Rather than asserting that "this address is definitely the offender's account," present the confirmed TXIDs, transaction times, explorer links, and the grounds for identifying the address as an exchange address.
FBI IC3 — Guidance on Reporting Cryptocurrency Crimes
2. Victim Reports and Official Freeze Requests
Binance's official guidance instructs users whose stolen assets were moved to a Binance account to submit the circumstances of the loss, transaction records, related TXIDs, and police report materials to customer support.
It also explains that Binance cannot unilaterally freeze user assets without an official freeze order from the appropriate law enforcement agency or a competent court. A victim's report to customer support does not by itself replace an official freeze order.
Binance — What to Do If Stolen Assets Were Transferred to Binance
| Party | Role in Preparation and Review | Points to Distinguish |
|---|---|---|
| Victim | Submits the circumstances of the loss and wallet and transaction evidence | Filing a report alone does not guarantee a freeze or return |
| Lawyer | Connects the complaint with evidence and reviews necessary investigative steps | Has no authority to look up exchange account information or force a freeze |
| Law enforcement and courts | Review lawful procedures based on relevance and necessity | Need to confirm how Korean procedures are handled on overseas platforms |
| Exchange | Reviews reported materials and lawful official requests | Actual measures may vary by exchange policy, jurisdiction, and available records |
In Korean criminal proceedings, seizures and searches are also carried out in accordance with statutory requirements and procedures. In cases involving overseas exchanges, the location of assets and records, the party that should receive a request, and local procedures may all become issues.
Therefore, rather than assuming that "filing a complaint in Korea will automatically freeze the overseas account," you should confirm case by case what additional materials and requests are needed.
Korea Law Information Center — Criminal Procedure Act Article 215 (Korean)
3. Organizing Evidence Before Reporting
| Material | What to Confirm |
|---|---|
| Circumstances of the incident | Date the loss was discovered, estimated time of occurrence, and the grounds for concluding that you did not authorize the transfer |
| Wallet use and ownership records | Wallet usage history, deposit and withdrawal records, account screens, and other materials showing legitimate use |
| Original transaction data | Victim wallet and recipient addresses, network, token contract, quantity, TXIDs, and explorer links |
| Summary of fund movements | A table separating the movement steps you confirmed from those not yet confirmed |
| Exchange inquiries | Ticket numbers, materials submitted, requests made, and original replies |
| Reports and complaints | Filing numbers, the investigating agency, and the facts and evidence list submitted |
Rather than collecting only screenshots, it is better to keep original files and exported transaction histories together. If time zones differ, the same transaction may be mistaken for different incidents, so indicate whether times are in Korea time or UTC.
Never send your wallet recovery phrase, private keys, or passwords as consultation materials. Materials needed to explain ownership must be distinguished from secret information that allows someone to dispose of the assets directly. Be careful of impersonators who ask for remote access or wallet connections.
4. Initial Response Procedures
① Preventing Further Losses and Preserving Records
Stop using suspicious links and dApps and check how to protect any remaining assets. Do not delete related messages, app usage records, or transaction histories, and avoid hastily resetting your devices.
② Preparing the Exchange Report and Police Report in Parallel
Submit the confirmed transfer records and circumstances of the loss to the exchange and keep the ticket number. In a police report or criminal complaint, go beyond simply stating that the coins disappeared and organize how the loss occurred and what investigative steps are needed.
③ Checking for Missing Transactions and Inconsistencies
Compare the quantities, addresses, and times submitted to customer support with those in the complaint materials. If you discover further movements, it helps to manage supplementary materials by linking them to the existing ticket and case numbers.
④ Tracking the Status of Official Requests and Follow-Up Procedures
Preservation of records, confirmation of account information, restrictions on disposal, and return of assets may each require a different legal basis. Review the next steps while confirming what the case officer and the exchange actually requested and replied.
5. Tracing Versus Recovery
Confirming the movement of funds is not the same as determining legal rights and obtaining a return. The response depends on whether the assets still remain, whether the related account can be identified, and whether the necessary legal measures are available.
When assessing the possibility of recovery, review the basis and limits of the tracing results, the need for cooperation from investigators and the exchange, and the expected costs. It is important not to decide on a course of action based solely on guaranteed recovery promises or requests for secret information.
6. Frequently Asked Questions (FAQ)
Q1. Should I contact customer support before filing a police report?
You can prepare both a report to the exchange and a police report. However, you should not assume that a customer support inquiry completes the official freeze procedure. Check the additional materials you are asked to provide and the follow-up procedures by investigators separately.
Q2. Can I identify the counterparty from a Binance deposit screen?
It cannot be assumed that a victim can obtain the account holder's personal information directly. Binance states that it cooperates directly with law enforcement and keeps related information confidential. Confirmation of account information should be reviewed in connection with lawful investigative procedures.
Q3. Is the response different for a scam in which I sent the coins myself?
The circumstances of the case and the legal explanation to be submitted differ. Even if you transferred the coins voluntarily, the facts, such as whether there was deception, must be reviewed. The hacking report checklist in this article should not be applied unchanged to every fraud case.
Q4. Can I seek advice on a loss that occurred long ago?
It can be reviewed based on existing reports and the materials currently available. However, difficulties in obtaining records over time and further movement of assets must be taken into account, and the visibility of past transactions does not guarantee that recovery is currently possible.
Linking Evidence and Procedures for Coins Moved to Overseas Exchanges
If you have found signs that funds flowed into an exchange, the priority is to organize the circumstances of the loss and the transfer records into a single flow, rather than reaching conclusions from an address label or a single screenshot.
Preparing exchange inquiry records and police report materials together helps distinguish the facts confirmed so far, the evidence still lacking, and the procedures to review next.
DECENT Law Firm reviews transaction records and reports after a wallet hack and supports the legal response required for the case.
