Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If cryptocurrency was withdrawn from your exchange account without your permission, act in this order: stop communicating with anyone who contacted you, lock the account through the exchange’s official app or website, secure the email account and devices connected to it, preserve transaction evidence, contact genuine exchange support, and report the theft. Do not send more money, reveal passwords or one-time codes, or pay a recovery service that promises guaranteed results.
Take these steps immediately
Speed matters because an exchange may be able to flag activity or preserve records, but a confirmed blockchain transfer is usually irreversible. Use a device you trust if possible. Do not follow a link, phone number, or social-media account supplied by a caller or message claiming to represent the exchange.
1. End contact with the suspected thief
Stop replying, stop sending money, and do not warn the person that you are reporting the incident. The FBI specifically warns that an urgent message about an account problem may be an impersonation attempt. Navigate to the exchange independently by typing its known domain or opening its official app.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. Lock or restrict the exchange account
Use the exchange’s current security or account-compromise procedure. A typical lock can sign out active devices and pause trading and transfers while still allowing you to review balances, transactions, and support messages. Menus and capabilities differ by exchange, so follow the named exchange’s current instructions rather than a generic online guide.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Secure the email account and every connected device
- Change the password for the email account used by the exchange and reset that account’s two-factor authentication.
- Reset the exchange password to a unique value that has not been used elsewhere.
- Remove unfamiliar sessions, devices, connected applications, withdrawal addresses, and API keys.
- Create new sign-in two-factor authentication, preferably a phishing-resistant passkey or hardware security key when the exchange supports it.
- Update the operating system and run a reputable malware scan if the device may have been exposed to a keylogger or remote-access tool.
If you cannot trust the device, perform password changes from a clean device and tell the exchange that the original device may be compromised.
Preserve evidence before deleting or resetting anything
Capture screenshots and download available account records before removing messages, sessions, or applications. Keep an unedited copy in a secure location. Record:
- Asset, quantity, and approximate value at the time of withdrawal.
- Transaction hash or blockchain explorer reference.
- Sending and receiving wallet addresses and the network used.
- Date and time, including time zone, and the exchange account email.
- Withdrawal and API activity, device and session history, and any displayed IP information.
- Emails, text messages, chat logs, caller numbers, usernames, domains, links, and the exact wording of requests.
- Any one-time codes or two-factor prompts involved. Do not send active codes to anyone; preserve only the record of what happened.
The FBI Internet Crime Complaint Center (IC3) asks victims to report even when some transaction information is unavailable. Missing a wallet address should not delay a report.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Contact the exchange through a genuine channel
After locking the account, open support from the exchange’s official app or type the official domain yourself. Do not rely on a search-ad phone number or a number supplied by a caller. Ask support to open an account-takeover investigation and to preserve relevant records.
| Request | Why it matters | What to expect |
|---|---|---|
| Review of withdrawals and API activity | Shows whether the transfer came from a logged-in session, API key, or other access path. | Support may ask for identity verification, timestamps, device details, and transaction hashes. |
| Account and recipient flag or freeze | Could give the exchange a chance to stop an uncompleted withdrawal or identify a receiving account. | A freeze is not automatic. Exchanges act under their internal procedures or, in some cases, legal process. |
| Preservation of logs | Session, IP, device, and communications records can help investigators. | State the suspected loss date and request preservation in the first ticket. |
| Reimbursement-program review | Some exchanges publish limited protection programs with strict eligibility rules. | Ask for the current terms, regional availability, claim deadline, and exclusions in writing. |
Give support a concise chronology: when you last had control, when the withdrawal appeared, what alerts you received, and what containment steps you have taken. Keep the case number and every reply.
Report the theft to the right authorities
FBI Internet Crime Complaint Center
Submit a report at www.ic3.gov and include the transaction hash, wallet addresses, amounts, dates, exchange name, account identifiers, and scam communications. The FBI’s guidance says: “If you believe you or someone you know may be a victim of a cryptocurrency scam, immediately submit a report to the FBI Internet Crime Complaint Center (IC3) at www.ic3.gov or contact your local FBI Field Office and provide as much transaction information as possible.” Filing a report does not guarantee a freeze or recovery.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Other U.S. reporting routes
- Use ReportFraud.ftc.gov for consumer fraud.
- Use CFTC.gov/complaint when the matter involves commodities, derivatives, or a related investment scheme.
- Use SEC.gov/tcr when the facts may involve securities or an investment offering.
- Consider a local police report or an FBI field office when appropriate for your jurisdiction and loss.
Report to the exchange as well as authorities. These routes serve different purposes and do not replace one another.
Watch for the recovery scam that often follows
Once a theft is reported, impersonators may claim to be exchange employees, investigators, lawyers, or blockchain specialists. They create urgency, request login details or identity documents, ask for a one-time code, tell you to install software, or instruct you to move funds to a “safe” wallet.
- End the call or conversation and contact the exchange from its app or independently entered domain.
- Never disclose a password, recovery phrase, private key, one-time code, or approval prompt.
- Do not install remote-access software at a caller’s request.
- Reject any demand for an upfront fee, tax, deposit, or “release charge.”
- Be skeptical of anyone promising guaranteed recovery. The FBI warns that recovery-company claims can themselves be another scam.
A legitimate investigator will not need control of your account to accept a report. Keep the original scammer’s details as evidence, but do not continue the conversation.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Can an exchange freeze stolen cryptocurrency?
Possibly, but there is no universal freeze button and no guaranteed deadline. An exchange may be able to pause an internal transfer, flag a recipient account, or act after receiving valid legal process. Once an on-chain transfer is confirmed, it is generally irreversible, and an exchange may not control the receiving wallet or another platform.
Cryptocurrency held in an exchange account is not government-insured like U.S. dollars in an FDIC-insured bank account. The FTC states that cryptocurrency in accounts does not have that type of government insurance. Treat any balance shown after a theft as uncertain until the exchange confirms what remains available.
Recommended Free Tools
What recovery can realistically mean
“Recovery” may mean an exchange stops a pending withdrawal, identifies a linked account, returns funds under a specific protection program, or helps law enforcement pursue assets. It does not mean that a confirmed transfer will automatically be reversed. Do not promise yourself or anyone else a particular outcome based only on a report number.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Limited example: Coinbase Account Protection
Coinbase says eligible Coinbase One members in supported regions may qualify for reimbursement for an unauthorized crypto withdrawal when the program’s requirements are met. The published example includes use of a passkey or security key, excludes transactions the customer authorized after being deceived, and requires a claim within 45 days of the suspected loss date. Eligibility, regional availability, terms, and exclusions can change, so check Coinbase’s current Account Protection terms directly. This is a limited program, not general insurance for all exchange losses.
Unauthorized withdrawal versus authorized deception
Tell the exchange exactly what happened. A withdrawal made by an intruder is different from a transfer you approved after someone deceived you. Protection programs may cover the former while excluding the latter. Do not describe an authorized transfer as an unauthorized login; inaccurate information can damage an investigation or claim.
Should you move the cryptocurrency that remains?
First lock the account, secure the email, and verify that your device is clean. Never move remaining coins because an unsolicited caller says the account is compromised. After containment, ask the exchange’s verified support team whether it recommends disabling withdrawals, rotating keys, or transferring assets to a newly created wallet. If a transfer is appropriate, use a wallet whose recovery phrase has never been shared and confirm the destination address independently. A move can protect remaining funds from a live intruder, but it can also create a new loss if the device, destination, or recovery phrase is compromised.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rebuild security after containment
- Use a unique, long exchange password and a separate, well-secured email password.
- Prefer a passkey or hardware security key for sign-in when supported. Buy a physical security key only after checking compatibility with the exchange and your devices.
- Review active sessions and connected applications regularly; revoke anything unfamiliar.
- Delete old withdrawal addresses and recreate only those you can verify.
- Rotate every API key and restrict permissions to the minimum required. Disable trading or withdrawal permissions when they are unnecessary.
- Keep the operating system, browser, password manager, and security software updated.
- Use reputable malware-scanning software if compromise is possible, and follow the exchange’s current security instructions.
Authentication choices: what to use next
| Method | Phishing resistance | Recovery considerations | Compatibility |
|---|---|---|---|
| Passkey | High when implemented by the exchange and device. | Keep an approved backup method and understand the exchange’s account-recovery process. | Requires exchange and device support; check before enabling. |
| Hardware security key | High because the physical key is required for sign-in. | Register a spare key and store it safely; losing every registered key can complicate recovery. | Check the exchange, browser, phone, and computer requirements. |
| Existing two-factor method | Protection varies by method and can be weaker against convincing phishing. | Reset it after a compromise and remove old devices or sessions. | Usually available, but exact methods differ by exchange. |
Whichever method you choose, protect the email account that controls exchange recovery. Strong exchange authentication cannot compensate for an email account that an attacker still controls.
Common mistakes and the safer alternative
- Calling a number from a search ad: open the official app or type the exchange domain yourself.
- Deleting messages immediately: preserve screenshots, headers, links, and usernames first.
- Sending a “verification” payment: legitimate support does not require crypto to unlock an account.
- Sharing a one-time code: treat every unsolicited code request as a takeover attempt.
- Assuming a report guarantees reimbursement: ask the exchange about its actual freeze and protection rules.
- Leaving API keys and sessions active: revoke unfamiliar access and rotate keys during containment.
How widespread are reported crypto losses?
The FBI IC3 reported $5.6 billion in cryptocurrency-fraud losses in 2023 in its 2024 report release. That figure covers reported cryptocurrency fraud broadly; it is not an estimate of losses from one exchange-account theft. An earlier 2023 FBI public-service announcement reported more than $2.5 billion in cryptocurrency investment-fraud losses for 2022, a narrower category that should not be presented as all crypto theft.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
