You attempted a withdrawal and it was blocked without explanation, or received a message from an exchange's compliance team asking about the origin of specific funds. The balance is visible but inaccessible. In most cases like this, the cause traces back to a single source: the Chainalysis risk score assigned to your wallet address. Understanding how that score is generated, and what the exchange actually sees when it reviews your account, is the starting point for resolving the situation.

What Chainalysis Is and How the Risk Score Works

Chainalysis is a US-based blockchain analytics company whose two core products, Reactor and KYT (Know Your Transaction), are used by the majority of major centralized exchanges worldwide. Every time funds move into or out of your account on a supported platform, the exchange queries Chainalysis and receives a risk score for each address involved in the transaction.

The scoring system assigns a number between 0 and 100 to every crypto address, across several distinct risk categories: scam exposure, darknet market activity, stolen funds, sanctions exposure, and mixer or tumbler usage. These categories are not mutually exclusive, and an address can carry partial exposure across more than one of them simultaneously. A score above 70 is classified as high risk and typically triggers an automatic compliance review, with withdrawals frozen pending investigation. On platforms including Binance, Bybit, Coinbase, Kraken, and OKX, this happens automatically, without a human being making the initial decision.

Why an Innocent Wallet Gets Flagged

The most common source of confusion is indirect exposure. Chainalysis does not only analyze the address you transacted with directly. It traces the entire graph of prior transactions associated with that address, going back several hops, and propagates a share of any risk found further up the chain to every address that subsequently received those funds.

In practical terms: you received funds from address B, which at some earlier point received funds from address C, which had a documented interaction with a sanctioned service or a mixing protocol. Your address never touched that service, but because the funds traveled through the chain, your address inherits a portion of the risk score. This is what analysts call indirect exposure, and it is the most frequent cause of what users experience as unfair or unexplained AML flags. The exchange's compliance system does not see the full story; it sees a score above a threshold and follows a protocol.

P2P trading is a particularly common entry point for this problem. When you receive crypto from a counterparty through a peer-to-peer transaction, you have no visibility into where those funds came from before they reached the counterparty's wallet. If the counterparty had previously used a flagged service, the risk travels with the funds when they arrive in your account. This does not mean you did anything wrong. It means the documentation required to explain your situation to the exchange's compliance team needs to account for that chain explicitly.

How Exchanges Act on High Risk Scores

When Chainalysis returns a high risk score on an address associated with your account, the exchange's compliance system sees the numeric score and the risk category, not the underlying transaction history or the specific path the funds traveled. The compliance team has a legal obligation to investigate and, in most jurisdictions, a legal obligation not to release funds until that investigation concludes.

The practical consequence is that the exchange freezes withdrawals and requests additional information, typically framed as an enhanced KYC review or a Source of Funds request. In cases where the risk score is very high, or where the risk category involves sanctions exposure, the account may be restricted more broadly, with both deposits and withdrawals suspended. The timeline for resolution depends almost entirely on the quality and completeness of the documentation submitted in response, not on the exchange's goodwill.

Steps to Resolve an AML Flag

Step 1: Before submitting anything, run your wallet address through an independent AML checker such as AMLBot or Crystal Expert. This gives you the same category-level information the exchange is working from, including which specific risk category triggered the flag and approximately how strong the exposure is. Going into the appeal process without knowing what was flagged is the single most common reason appeals fail or are delayed by weeks of follow-up requests.

Step 2: Prepare a Source of Funds package that documents the legitimate origin of every significant incoming transaction in your account history. This is not a single document. It is a structured collection of bank statements, transaction records from other platforms, exchange histories, and any other evidence that creates a traceable line from a verifiable origin to the funds that arrived in your flagged wallet. The package should be organized chronologically and address the specific transactions the exchange is asking about, not your account history in general.

Step 3: Prepare a transaction chain analysis that shows the exact path the flagged funds traveled from their origin to your address. This is different from the Source of Funds package. Where the Source of Funds explains the legitimate origin of the money, the chain analysis shows the on-chain path and demonstrates the distance between your address and whatever flagged entity Chainalysis identified. If the flagged entity is three hops removed from your address and all intermediate transactions were between addresses you have no connection to, that needs to be documented explicitly.

Step 4: Submit the complete package to the exchange's compliance team through the official channel indicated in their communication. Generic appeals that simply assert innocence without engaging with the specific risk flag are rarely successful. The compliance team needs material they can use to document their investigation and justify releasing the funds to their own regulators. Your submission needs to give them that material, not ask them to take your word for it.

Step 5: If the initial appeal is rejected without a substantive explanation, request escalation to a senior compliance officer and submit a written request identifying the specific reasons the previous response was inadequate. Exchanges are required under most AML frameworks to provide a reasoned response to appeals, and escalation is a legitimate part of the process.

Wallet flagged by Chainalysis?

We analyze the risk score, prepare the Source of Funds package, and manage the appeal. Free initial consultation.

Message on Telegram

The indirect exposure trap

The most common cause of AML flags among users who have done nothing wrong is receiving funds from a counterparty who used a sanctioned or high-risk service at some earlier point in their transaction history. The funds passed through your wallet legitimately, but the risk score traveled with them. A professional blockchain analysis can document exactly what happened and prepare a response that directly addresses what the exchange's compliance system flagged.

When Professional Help Makes Sense

The self-service path through an exchange's compliance process works when the flag is straightforward, the documentation is readily available, and the exchange's response makes clear what is being requested. It stops working in several specific situations: when the flagged entity in your transaction chain is a Garantex address or another OFAC-sanctioned service, when the case spans multiple jurisdictions or involves assets across several platforms, when a previous appeal was rejected without an explanation that allows you to correct the deficiency, or when the amount frozen is large enough that the cost of a prolonged delay justifies professional involvement.

KarCrypto approaches these cases using professional Chainalysis Reactor access, the same tool the exchanges themselves use. We analyze the complete risk profile of the flagged address, identify exactly which category triggered the flag and how distant the exposure is, and prepare a compliance package structured for the specific exchange's compliance team. We have handled AML flag cases across Binance, Bybit, Coinbase, Kraken, and OKX. The initial consultation is free. Reach us on Telegram @KarCryptoSupport and describe your situation before any engagement begins.

"A Chainalysis flag is not a finding of wrongdoing. It is a signal that requires an explanation. The right documentation, submitted correctly, resolves the vast majority of cases."