Subtitle: How platforms can strike a balance between cooperating with law enforcement, protecting users and managing risk
Binance recently disclosed an interesting set of figures: in 2025, Binance handled 72,632 law enforcement requests; in the first half of 2026, it had already handled 36,235; and cumulatively it has handled 313,653 law enforcement requests.
Many people's first reaction on seeing these figures is: Binance is now very cooperative with judicial authorities.
But from the perspective of platform operations, what these figures really show is something else: law enforcement requests are no longer an exceptional event that crypto platforms encounter only occasionally; they are becoming part of platforms' day-to-day operations.
Leading exchanges have the capacity to build large compliance teams; Binance says its compliance-related staff number nearly 1,500, about a quarter of its total workforce. The problem is that the vast majority of crypto platforms do not have such a team structure. For swap platforms, cross-chain aggregators, DEX front ends, wallet service providers, TRON energy rental platforms and OTC tool platforms, once they receive an email from a judicial authority, a court document, a freeze request or a data request, they often face a practical internal question: who exactly should respond to this? Customer service? Risk management? Technical staff for investigation? Legal for assessment? Or the founder personally?
This is a long-neglected piece of compliance back-office infrastructure in the crypto industry: Law Enforcement Request Response, that is, the mechanism for responding to law enforcement requests.
I. Law enforcement requests do not only go to exchanges
In the past, whenever people mentioned judicial assistance in crypto, their first thought was exchanges. Indeed, centralized exchanges are the most typical targets of law enforcement requests. They hold user KYC, deposit and withdrawal records, account balances, trading orders, login IPs and device information, and they also have the ability to freeze accounts and control assets.
But today, the targets of law enforcement requests are far from limited to exchanges:
| Platform type | Content that may be requested | Risks on the platform side |
|---|---|---|
| Swap / instant exchange platform | Exchange orders, deposit addresses, withdrawal addresses, order status, suspension of incomplete transactions | Whether funds can still be placed on hold, whether order information is excessively disclosed |
| Cross-chain aggregator | Routing paths, bridges, DEXs, liquidity sources, counterparties, API call records | Cannot freeze funds but is expected to freeze funds, making it easy to misjudge the boundaries of responsibility |
| DEX front end | Wallet connection records, access logs, risk-control interceptions, address blocking records | The boundary between the protocol being uncontrollable and the front end being controllable is unclear |
| Wallet / RPC / API service providers | IP, device, request time, interface call records, address interaction records | Higher pressure regarding data protection and cross-border disclosure |
| TRON energy platform | energy rental orders, payment addresses, energy recipient addresses, API order records | may readily be mistaken as assets that can be frozen or recovered |
| stablecoin-related service providers | address freezing, blacklisting, asset preservation, subsequent judicial handling | highest level of asset control responsibility and legal document requirements |
In other words, as long as a platform holds off-chain information, service access points, order records, routing records, or some degree of control capability, it may become the subject of law enforcement requests.
II. The real risk for platforms is not "whether to cooperate," but "how to cooperate"
Many platforms still understand law enforcement requests at a rather crude level: when judicial authorities come, we cooperate; is there a risk if we don't cooperate?
In practice, however, the greater risk is often not "failure to cooperate," but "erroneous cooperation."
Typical risks of erroneous cooperation
- Phishing by impersonated law enforcement agencies leading to mistaken disclosure of user data
- The requesting entity lacks proper authority or credentials, yet the platform replies directly
- The scope of the request is overly broad, and the platform discloses excessively
- A freeze was warranted but not implemented, and the assets were quickly transferred out
- A freeze was imposed when it should not have been, giving rise to user claims
Typical risks arising from the absence of internal mechanisms
- No log preservation, resulting in the loss of key evidence
- Customer service, risk management, technology and legal teams each handle matters separately
- Conflicting requests from multiple jurisdictions make it impossible to determine the applicable rules
- No ledger, making post-event audit and review impossible
- Not knowing what one can provide and what one cannot provide
The first category of risk is impersonation of law enforcement authorities. In the crypto industry, forged judicial authority email addresses, impersonation of overseas regulators, and phishing requests sent by persons posing as courts or lawyers are not uncommon. If a platform lacks an entity verification mechanism, it may hand user data, transaction records and even risk management information to fraudsters.
The second category of risk is excessive disclosure. Some requests target only a single address or a single order, but because the platform lacks awareness of data minimization, it directly provides account information, associated addresses and user communication records beyond the requested scope, thereby giving rise to privacy and data protection risks.
The third category of risk is erroneous freezing. Failure to place assets on hold promptly when a freeze is warranted allows assets to flow out quickly; conversely, hastily freezing assets when a freeze is not warranted may trigger user complaints, claims, and even reputational risk for the platform.
The fourth category of risk is loss of evidence. A platform may clearly have retained IP addresses, device logs, order logs, and API request records, but because it has no internal log preservation mechanism, by the time a formal law enforcement request arrives, the data has already been overwritten or deleted.
The fifth category of risk is multi-jurisdictional conflict. The request comes from Country A, the platform entity is in Country B, the user is in Country C, and the servers are in Country D. If a platform handles matters simply on the logic of "whoever sends the email is the one to be obeyed," it can easily fall into compliance conflicts.
Therefore, responding to law enforcement requests is not a customer-service ticket, nor is it a simple reply to a lawyer's letter. It is a systematic undertaking that combines law, compliance, data, technology, risk management, and operations.
III. Different platforms require different response SOPs
Different types of crypto platforms have entirely different boundaries of capability when facing law enforcement requests. A platform cannot use a single template to respond to all requests. The mature approach is first to identify its own role in the chain of the case: Am I an asset control point, an account control point, an entry point, or a clue control point?
| Platform role | Typical entities | Matters that can be responded to | Boundaries |
|---|---|---|---|
| Asset control point | CEXs, custodial wallets, stablecoin issuers, instant exchange platforms with uncompleted orders | Account freezing, order holds, address freezing, asset preservation | Requires a strict legal basis, approval and record-keeping |
| Account control points | Exchanges, OTC tools, payment channels, certain Swap platforms | KYC, account information, orders, deposits and withdrawals, login information | The scope of data disclosure must be controlled |
| Entry-point control points | DEX front ends, cross-chain aggregators, wallets, RPC, NFT marketplaces | Access restrictions, address blocking, wallet connection logs, API records | Generally does not control on-chain protocol assets |
| Clue control points | Tron energy platforms, on-chain analytics services, Telegram bot services, API service providers | Orders, addresses, call records, resource delegation records, payment leads | Mainly used to reconstruct the path and identify infrastructure |
Centralized exchanges and custodial platforms can usually provide KYC, account, transaction, order, deposit and withdrawal, balance, login device, IP and other information, and may also execute account freezes, asset preservation or cooperate with restitution. These platforms therefore carry the highest risk and should be subject to the highest response standards.
For swap and instant exchange platforms, the key lies in order status. If an order has not yet been completed, the platform may still have room to suspend it, place it on hold, re-verify KYC, or await further documents from law enforcement authorities. Once an order is completed and funds are withdrawn, the platform can usually only provide the order chain, deposit addresses, withdrawal addresses, time, amount and information on its cooperating liquidity providers.
Cross-chain aggregators generally do not directly custody assets, but they know how funds are routed: through which chain, which bridge, which DEX, which liquidity source and which partner. Their assistance value lies not in freezing but in reconstructing the path.
DEX and DeFi front ends cannot control on-chain protocol assets, but they can conduct address screening, risk interception and access restrictions at the front-end level, and may also retain logs such as wallet connections, IP, device, browser and interaction time.
Tron energy platforms are more particular. Energy is not the asset itself, and energy already consumed cannot be recovered. However, energy rental records can reveal the infrastructure behind illicit and grey-market addresses: who paid, who placed the order, to which address resources were delegated, and whether services were provided in bulk to multiple wallets involved in the case.
Stablecoin issuers, by contrast, are important nodes for on-chain asset control. For centralized stablecoins, platforms may face not ordinary data requests but potentially high-risk requests such as address freezing, blacklisting, asset preservation and judicial disposal.
IV. What a mature law enforcement request response mechanism should include
If a crypto platform is to handle law enforcement requests professionally, it needs to establish at least the following mechanisms.
| Module | What the platform should do | Core value |
|---|---|---|
| Intake channel | Establish a dedicated law enforcement email, form, or back-end intake channel | Avoid requests being scattered across customer service, Telegram, business email, and founders' direct messages |
| Entity verification | Verify the law enforcement agency's identity, official email, case number, authorization documents, court order, or freeze order | Reduce the risk of impersonation of authorities and phishing |
| Request classification | Distinguish among data requests, log preservation, account freezing, order holds, address blocking, asset return, and emergency requests | Avoid handling all issues with a single type of action |
| Jurisdictional assessment | Determine the source of the request, the platform entity, the user's location, the server location, and cross-border data transfer restrictions | Handling conflicts across multiple jurisdictions |
| Data minimization | Disclose data only within a lawful, necessary and proportionate scope | Reduce privacy and data protection risks |
| Technical evidence-gathering checklist | Specify fields such as UID, order number, TXID, IP, device, API key, wallet address, risk-control tags and customer service records | Ensure the technical team knows what to search for, how to search and how long to retain it |
| Freeze and hold decisions | Specify the conditions, duration, approvers, notification rules and arrangements for extending a temporary hold | Avoid failure to place assets on hold promptly when a freeze is warranted, or erroneous freezing |
| Documentation and archiving | Establish a request register recording the source, basis, content disclosed, operational records, follow-up communications and closing time | facilitate auditing, retrospective review and transparency disclosure |
What platforms truly need is not to engage lawyers on an ad hoc basis to "review an email", but a Law Enforcement Request Desk that can operate over the long term.
V. Why this work is suitable for outsourcing
For many small and medium-sized crypto platforms, building a complete in-house law enforcement request response team is not realistic.
Request volumes may be unstable. There may be none for several months at a time, yet once hacker, fraud, money laundering, illegal payment-settlement schemes or online gambling fund flows emerge, requests may erupt in concentrated bursts within a short period.
The capabilities required for the role are also highly composite. Handling law enforcement requests requires knowledge of the law as well as on-chain transactions, platform operations, data protection, freeze logic, cross-border communication and regulatory positions. It is very difficult for a single customer service representative, a single legal officer or a single technical staff member to cover this independently.
More importantly, responding to law enforcement requests is not a "matter of attitude" but a "professional exercise". Responding too early, too late, with too little, with too much or incorrectly may all give rise to risk.
The practical pressures of building in-house
- Unstable request volumes mean low utilization of a dedicated team
- Difficult to concentrate legal, technical, risk management and data protection capabilities
- Multiple languages, multiple jurisdictions and multiple platform rules exist simultaneously
- Lack of reusable templates and case experience
The practical value of an outsourcing mechanism
- Standardize initial request screening, legal assessment and response drafting
- Help customer service, technical, risk management and legal teams establish collaborative interfaces
- Build up records, templates, SOPs and materials for transparency reports
- Allow the platform to retain final decision-making authority while obtaining professional support
Therefore, for platforms, outsourcing this work to a professional team familiar with crypto business and law-enforcement request processes is not about shifting responsibility away, but about establishing an external compliance back office.
The platform still retains final decision-making authority, but the external team can help the platform complete initial request screening, legal assessment, material verification, internal evidence-collection guidance, response drafting, records management and process optimization. This is particularly relevant in practice for entities such as exchanges, Swap, cross-chain aggregators, DEX front ends and TRON energy platforms.
VI. What Mankun Can Provide to Platforms
With respect to responding to law-enforcement requests for crypto platforms, Mankun can provide a set of platform-side outsourcing services.
| Service module | Specific content |
|---|---|
| Outsourcing of law-enforcement request response | Assist platforms in receiving, conducting initial screening of, classifying, grading, recording and responding to law enforcement requests |
| SOP development | Establish processes for receiving, verifying, approving, evidence collection, disclosure and archiving of law enforcement requests |
| Review of and responses to requests in Chinese and English | Handle law enforcement requests in Chinese and English, and assist in drafting standardized responses and requirements for supplementary materials |
| Verification of requesting entities and documents | Conduct preliminary verification of law enforcement agency identity, official email addresses, authorization documents, court orders, freeze orders and the basis for emergency requests |
| Classification and handling of requests | Distinguish among requests for data production, account freezes, order holds, log preservation, address blocking, asset return and other requests |
| Review of the list of disclosable data | Help platforms clarify what data they hold, how long it is retained and under what conditions it may be disclosed |
| Design of internal collaboration mechanisms | Establish response interfaces and responsibility boundaries among technology, risk management, customer service and legal teams |
| Drafting of policy documents | Draft privacy policies, terms of service, law enforcement request guidelines and internal platform handling manuals |
| Emergency response mechanisms | Design processes for emergency freezing, order holds, log preservation, escalation approvals and subsequent supplementary submissions |
| Localization support for PRC requests | Assist overseas platforms in understanding and handling requests from PRC law enforcement authorities, including document formats and communication context |
| Registers and transparency disclosure | Assist in establishing law enforcement request registers, statistical methodologies and materials for annual transparency reports |
| Training and drills | Provide internal training and simulated request drills for customer service, risk management, technology and management personnel |
It should be emphasized that lawyers are not law enforcement authorities and cannot make final asset-disposition decisions on behalf of platforms. Mankun provides external legal compliance and process-response support to help platforms handle law enforcement requests within a lawful, prudent and auditable framework.
The core value of this service is not to have platforms 'unconditionally cooperate with all requests,' but to help platforms establish a judgment mechanism: which requests should be cooperated with, which requests require supplementary materials, which requests should be refused, and which requests must be escalated for handling immediately.
Conclusion: Responding to law enforcement requests is becoming foundational infrastructure for crypto platforms
The crypto industry has historically placed great emphasis on token listings, liquidity, risk management, KYC, and AML, yet has often overlooked an increasingly practical question: when a platform receives a law enforcement request, who makes the judgment? Who responds? Who keeps the record? Who bears the consequences?
As crypto asset cases increase, law enforcement agencies, regulators, courts, victims' lawyers, and on-chain analytics firms will increasingly frequently reach out to various platforms. Exchanges will be approached, Swaps will be approached, cross-chain aggregators will be approached, DEX front-ends will be approached, wallets and RPCs will be approached, and TRON energy platforms will also be approached.
For crypto platforms, responding to law enforcement requests is no longer a marginal matter but compliance infrastructure. Those who can handle such requests more professionally will be better able to maintain a balance among regulatory requirements, user rights and interests, and platform operations.
