It's a matter of suspicion rather than actual certainty, and they can't get that without investigation, which didn't happen.
And because they can't prove that an intra-site transfer is sent for the purpose of crypto trading, they simply close the account, knowing that you also can't do anything...