All cases
Case / Bybit · AML

Recovered access to ETH isolated by Bybit after an AML flag

The incoming deposit passed through a wallet with a bad AML history — Bybit isolated the assets with the Abnormal Asset Origin status. We proved the flagged address is not linked to the client and restored access.

Anonymized case. A similar situation does not mean the same outcome or timeline.

01 / Situation

What happened

SituationBybit · ETH

The transfer passed an address carrying an AML flag — Bybit isolated the client's assets pending origin review.

28.19 ETHWithdrawal closedDay 0
How it looked

The deposit looked ordinary: a familiar sender, an expected amount. But one address in the chain carried an AML flag — the risk system set Abnormal Asset Origin and closed withdrawal.

Key circumstance

The client did not and could not know about the flag: the transit address was not his and played no part in the deal.

bybit.com · Funding Account · Pending Assets
Bybit dashboard: Pending Assets tab with isolated ETH
02 / Case facts

Initial data

Platform and asset
Bybit · incoming ETH

The deposit is isolated with the Abnormal Asset Origin status — assets visible on balance, withdrawal impossible.

28.19 ETH · withdrawal closed
The exchange's stance
Isolation pending review

Assets of “abnormal origin” are blocked pending review; which operation raised the question, the exchange does not disclose.

cause not named
Case materials
Evidence base

Transaction history, transfer chain tracing, a blockchain forensics report, documents on the source of funds.

sent to compliance
03 / Process

Case workflow

Case workflow19 days to result
Stage 01Review

Identified the isolation trigger: the flag sat not on the client's wallet or the sender's, but on an intermediate address.

Stage 02Strategy

A position built on separated roles: the client is a bona fide recipient, the flagged address merely a transit link.

Stage 03Evidence

Independent blockchain forensics confirmed: no link between the client and the flagged address. The package was extended with source-of-funds documents.

Stage 04Filing and follow-up

The position was framed to Bybit's compliance rules; we closed the exchange's follow-ups to the decision.

The team spoke to the exchange for the clientStages 01–04 closed
04 / Result

How it ended

The exchange's decision

Bybit lifted the isolation — access to assets restored, withdrawal reopened.

19days from engagement
to isolation lifted
Unlocked
01 · Trigger

The trigger pinpointed: where exactly in the chain the flag arose.

02 · Tracing

Independent tracing that separated the client from the flagged address.

03 · Package

A package assembled to the compliance rulebook — not support tickets in circles.

A similar situation does not mean the same outcome — the result depends on case details and the platform's decision. Client data is never disclosed.

05 / More cases

More from practice

Case pages are added as they are publishedAll cases
06 / Apply

Tell us what happened

Describe your situation — we study the case, ask clarifying questions and, before any work, say if we take it and on what terms.

We reply within 60 minutes during work hours
Prefer no forms?Describe your situation directly Message on Telegram
Reply within 60 minutes during work hours
Review my case