Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Act quickly, but do not assume a reported breach means your funds were taken. First determine whether only personal data or credentials were exposed, or whether someone actually entered your email or exchange account. Contact the exchange through its verified app or website, ask it to restrict or freeze the account, secure the email account used for resets, change reused credentials, revoke unfamiliar access, and preserve evidence. Treat every unsolicited “recovery” message as a possible second scam.
What to do first: contain access before investigating
A breach notification can describe many different events: a vendor database may have exposed your name and email address, a password may have appeared in a stolen credential set, or an attacker may have used your email to reset an exchange password. Those situations require different responses, but you should begin containment immediately while checking the exchange’s official incident notice and your account activity.
1. Contact the exchange through an official channel
Open the exchange’s mobile app or type its known website address yourself. Do not use a phone number, email address, or link supplied by an unexpected caller, text message, social-media direct message, or “support” email. Tell the exchange that you suspect an account compromise and ask what restriction or freeze it can place on the account and how to report unauthorized activity.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Kraken’s compromised-account guidance says, “If you believe your account has been compromised, contact us immediately.” The Singapore Police Force similarly advises contacting both the email provider and the cryptocurrency exchange to secure or freeze accounts where possible. Contacting support should not wait until you have completed every other step.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
2. Use a withdrawal lock if the exchange offers one
If you can still sign in safely, look for a withdrawal lock or equivalent restriction and enable it before changing less urgent settings. Bitvavo specifically advises enabling its crypto withdrawal lock when account access remains. A lock may delay legitimate transfers, but it can provide time to remove an intruder’s access. Feature names, waiting periods, and availability differ by platform, so follow the exchange’s current instructions.
3. Decide whether there is evidence of actual access
Check for password-reset notices, new-device alerts, changed contact details, unfamiliar logins, API activity, and transactions you did not authorize. If you find an unknown withdrawal or cannot sign in, tell support that immediately and ask for the exchange’s unauthorized-transaction procedure. If you find only an exposure notice and no account activity, still harden the account; do not describe the incident to yourself as a confirmed theft without evidence.
Secure the email account that controls resets
Your email account is part of exchange security. It may receive password-reset links, withdrawal warnings, device approvals, and support correspondence. An attacker who controls it can hide alerts, intercept resets, or search old messages for exchange details even when the exchange itself has not yet been entered.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Change the email password and turn on strong MFA
- Use a trusted, updated device and change the email password to a long, unique password that has never been used elsewhere.
- Enable the strongest multifactor authentication (MFA) your provider supports. A hardware security key can be a strong sign-in option when both the email provider and exchange support compatible keys; verify compatibility before buying one.
- Sign out sessions you do not recognize and remove unknown devices, app passwords, connected applications, recovery email addresses, phone numbers, and authentication methods.
Changing a password alone is not enough if an attacker added a recovery method or retained an active session. Record the recovery settings you recognize before deleting anything, because removing a legitimate method can make your own recovery harder.
Inspect forwarding and inbox rules
Open the provider’s rules, filters, forwarding, delegation, and “send mail as” settings. Delete unfamiliar rules that archive, forward, mark as read, or move security messages away from the inbox. The Singapore Police Force warns that attackers may search email for exchange use, add rules to hide messages, and exploit reset flows.
Search for signs of reset activity
Search the mailbox for exchange security alerts, password-reset requests, new-device approvals, address-book changes, and support conversations you did not initiate. Do not click a reset link in an unexpected message. Instead, open the exchange through its verified app or manually entered website address and check the account there.
Harden the exchange account itself
After securing email access, change the exchange password to another unique password. Do not reuse the new email password. Then review every control that can authorize a sign-in, recover the account, create an API connection, or send funds.
Free tools Windows power users keep installed
One-click scans. No signup required.
Replace the password and strengthen MFA
- Change the exchange password from a trusted device. If the exchange offers a password-reset flow instead of an in-account change, start it only from the official app or site.
- Enable the strongest sign-in MFA the exchange supports. Prefer a phishing-resistant security key or passkey when available; otherwise use the strongest supported authenticator-based method rather than relying on a reused password alone.
- Save recovery codes offline in a secure place. Never store them in an exposed mailbox or send them to a person claiming to be support.
Do not disable MFA because it makes withdrawals or support interactions slower. That friction is part of the protection, especially while the incident is being investigated.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Revoke unfamiliar sessions and trusted devices
Open the exchange’s security, devices, or sessions page. Sign out every session, device, browser, or location you cannot identify. If the platform provides “sign out all” or “revoke all sessions,” use it and then sign in again on your trusted device. Review the phone number, recovery email, trusted devices, passkeys, and other authentication methods; remove anything you did not add.
Kraken’s account-compromise guidance describes reviewing these controls, but labels and availability vary across exchanges. If a control is missing, ask official support whether it can invalidate sessions or reset authentication on the account.
Review API keys and withdrawal controls
Open the API-management page and list every key. Delete unknown keys and any key you no longer need. Check permissions before retaining a legitimate key: a trading-only key should not have withdrawal permission. If the exchange supports withdrawal-address allowlists, remove unfamiliar addresses and confirm the lock or delay applied to newly added addresses.
Review recent withdrawal addresses, address-book changes, transaction history, and security logs. A familiar coin or amount does not make a transaction legitimate; compare the destination, timestamp, device, and IP information with your own activity.
Check devices before entering new credentials
An infected computer or phone can capture a new password or MFA code immediately. Use a device you trust, with its operating system, browser, exchange app, and security software fully updated. Kraken recommends scanning potentially affected devices for malware or keyloggers and updating them as part of compromised-account remediation.
Run a practical device check
- Install operating-system and browser updates from the built-in update mechanism.
- Remove unknown browser extensions, remote-access tools, and recently installed applications.
- Run the device’s reputable malware scan, then restart and scan again if the tool requests it.
- Check whether your mobile carrier account shows an unexpected SIM change or replacement. If it does, contact the carrier through its official channel and secure the number.
- Change passwords again from a clean device if a scan finds malware or if you cannot establish that the original device is safe.
A scan is a secondary safeguard, not proof that a device is clean. If the exchange tells you that a device is compromised, follow its official remediation instructions and avoid using that device for account recovery until it is repaired or replaced.
Review activity and identify what changed
Once access is contained, inspect the exchange’s security log, account profile, and transaction history in a deliberate order. Save evidence before deleting settings or closing the account.
Check these records
- Sign-ins, IP addresses, device names, browser sessions, and timestamps.
- Password, email, phone-number, recovery, MFA, passkey, and trusted-device changes.
- API-key creation, permission changes, and last-use times.
- New withdrawal addresses, address-book edits, withdrawal requests, and completed transfers.
- Deposits, trades, conversions, staking or lending actions, and support messages you did not initiate.
Mark each event as recognized, uncertain, or unauthorized. Do not assume that an unfamiliar IP proves an attacker—mobile networks and VPNs can make locations look different—but treat an unfamiliar device combined with a security change or withdrawal as urgent evidence for support.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Preserve evidence and report the incident
Make a timeline while details are fresh. Record when you received a breach notice, when you first saw an alert, the last legitimate sign-in, every unrecognized action, and when you contacted support. Keep transaction IDs, asset and amount, destination address, date and time with time zone, device details, IP information shown by the exchange, and support case numbers.
Save screenshots safely
Capture the relevant security-log entries, account changes, emails, text messages, and transaction pages. Preserve the original messages where possible, including headers or metadata supplied by the provider. Store copies in a location that the suspected attacker cannot alter. Do not post seed phrases, full API secrets, passwords, MFA codes, or identity documents publicly while seeking help.
Coinbase asks affected users to provide incident details and screenshots. OKX lists timelines, messages, device information, transaction details, and, in some cases, police or SIM-swap records. Requirements differ, so ask your own exchange which records it needs and whether it has a reporting deadline.
Recommended Free Tools
Understand deadlines and irreversibility
Exchange-specific claim rules are not universal. For example, OKX’s Shield guidance says a formal claim must be made within 72 hours of the last unauthorized transaction and supporting information must be submitted within seven days of that formal claim. Those are current instructions for that voluntary program, not a general rule for exchanges or a promise of reimbursement.
Crypto transfers are often difficult or impossible to reverse once confirmed. Report promptly to the exchange, your local police or cybercrime reporting channel, and any relevant financial regulator where appropriate. A report cannot guarantee recovery, but delayed reporting can remove options and make evidence harder to trace.
How exchange responses differ
Do not assume that a setting described by one platform exists under the same name—or at all—on another. Compare the response available on your exchange across these practical axes:
| Control or question | Why it matters | What to ask the exchange |
|---|---|---|
| Freeze or withdrawal restriction | Stops or delays outbound transfers while access is investigated. | Can support freeze the account, disable withdrawals, or apply a temporary lock? |
| Sessions and trusted devices | An attacker may remain signed in after a password change. | How do I revoke individual sessions, all sessions, and trusted devices? |
| Recovery and MFA methods | Unfamiliar email, phone, passkey, or authenticator can restore access. | Which recovery methods were changed, and how can they be reset? |
| API keys | A key can trade or, if permitted, withdraw without a normal web login. | Where are keys listed, what permissions do they have, and how are they revoked? |
| Withdrawal addresses | An added address can redirect future transfers. | Can unknown addresses be removed, and is there a holding period for new ones? |
| Evidence and reporting | Complete records help the fraud team investigate quickly. | Which screenshots, IDs, device records, and deadlines apply? |
| MFA choices | Some methods resist phishing better than others. | Does the platform support passkeys or hardware security keys, and for which actions? |
Kraken, Bitvavo, Coinbase, and OKX publish different procedures and controls. Use their current support documentation only as a guide to the controls that platform actually exposes, then confirm details with official support.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallProtect yourself from impostor support and recovery scams
A public breach can trigger a second wave of fraud. Scammers may claim to be exchange employees, police officers, blockchain investigators, or “recovery” specialists. They may know your email address, account name, approximate loss, or a transaction ID taken from public posts.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Never disclose these secrets
- Exchange or email passwords.
- One-time MFA codes, approval prompts, recovery codes, or passkeys.
- Seed phrases or private keys.
- API keys, API secrets, or full identity documents sent through an unverified channel.
- Remote-control access to your computer or phone.
Coinbase states: “Coinbase will never ask for passwords or 2FA codes, or ask you to transfer money to a new address over the phone or via text.” Treat any request for those actions as fraudulent, regardless of how convincing the caller sounds.
Reject advance-fee recovery promises
The SEC’s Investor.gov alert warns about recovery scams that demand an advance fee before supposedly returning lost funds. Do not transfer crypto, pay a “tax,” buy a gift card, or send money to a new address because an unsolicited person promises recovery. Verify support by leaving the conversation and opening the exchange’s official app or website yourself.
If an unauthorized withdrawal occurred
Tell the exchange’s fraud or security team exactly which transfer was unauthorized and provide the transaction ID, asset, amount, destination, timestamp, and the moment you noticed it. Ask whether the destination can be flagged, whether a pending transfer can still be stopped, and which law-enforcement or regulator reports the exchange expects.
Secure email, exchange access, and devices before continuing lengthy conversations. An attacker who still controls one of those layers can cancel your password change, hide support replies, or initiate another withdrawal. Do not promise yourself that a support ticket means the funds are frozen; ask for the current status and record the case number.
After containment: monitor and rebuild trust
For the following weeks, review email security alerts, exchange sessions, API activity, recovery settings, and transaction history at regular intervals. Keep withdrawal notifications enabled and investigate every unexpected approval request. If the breach exposed a password that you used on other services, change it everywhere it was reused and enable MFA on those services too.
Keep the incident timeline, support correspondence, screenshots, and official notices together. Update the record when support responds or a transaction status changes. If you close the exchange account, first export the records support or law enforcement may need and confirm that no pending transaction or dispute will be lost.
A concise decision checklist
- Only a data exposure is reported: secure email, replace reused passwords, enable strong MFA, and monitor for reset or login alerts.
- Email or exchange access is suspected: contact both providers immediately, request a freeze or restriction, revoke sessions and recovery methods, and inspect rules, logs, API keys, and withdrawals.
- An unauthorized transfer is visible: preserve the transaction evidence, report it through official support without delay, and make any required police or regulator report.
- Someone offers recovery for a fee: stop communicating through that channel and verify support independently; never share secrets or transfer funds.
The reliable response is layered: contain withdrawals, secure the email account that can reset access, replace credentials and authentication methods, inspect devices and logs, preserve evidence, and communicate only through channels you verify yourself. The exact controls and any claim program depend on the exchange and your jurisdiction, so confirm the current procedure directly with the platform.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
