Start by checking the right evidence for the account type: review sign-ins, sessions, withdrawals, and API keys on an exchange; review transactions, token approvals, and connected dapps in a self-custody wallet. If you find signs of active exchange access, use the exchange’s official lock or support channel. If your wallet’s recovery phrase or private key was exposed, treat it as compromised and move remaining assets to a new wallet created with a new phrase.
First, identify what kind of account you use
An exchange account and a self-custody wallet have different warning signs and different ways to contain a problem. With an exchange, the provider controls account access and may be able to pause activity. With a self-custody wallet, you control the keys; confirmed blockchain transfers generally cannot be reversed.
As an Amazon Associate I earn from qualifying purchases.
| What to compare | Centralized exchange account | Self-custody wallet |
|---|---|---|
| Who controls access | The exchange manages account access. | You control the private key or recovery phrase. |
| Evidence to inspect | Sign-ins, active sessions, devices, withdrawals, saved addresses, API keys, and security changes. | Transactions, destination addresses, dapps or contracts, token approvals, and recovery-phrase exposure. |
| Containment | Use the exchange’s official lock feature if available; contact support and secure account credentials. | Stop interacting with suspicious dapps, revoke risky approvals where possible, and move remaining assets to a new wallet if the secret phrase or key is exposed. |
| Reversibility | The provider may be able to investigate or restrict activity, but recovery is not assured. | Confirmed on-chain transfers are generally irreversible. |
How to check an exchange account
Open the account safely
Use the exchange’s official app or a web address you saved independently. Do not sign in through an unexpected email, text, social post, or search advertisement. Review account activity, sign-ins, active sessions, recognized devices, and security notifications. Coinbase says its account activity tools show active sessions and authorized devices, and advises removing access you do not recognize. Its guidance also recommends checking email forwarding rules, recovery addresses or phone numbers, and authorized devices because email access can enable account resets or approvals: Coinbase account-compromise guidance.
Look for changes you did not make
- Withdrawals, trades, or orders you do not recognize.
- New or changed withdrawal addresses.
- Unknown API keys or linked applications.
- Changes to passwords, two-factor authentication (2FA), recovery details, or other security settings.
An unfamiliar IP address or location by itself does not prove an intruder signed in. Compare it with your own travel, VPN use, mobile network, devices, and browsing before drawing a conclusion. API keys can expose or operate account functions depending on their permissions. Kraken advises removing unknown sessions, devices, withdrawal addresses, and API keys, and contacting its security team if activity is unfamiliar: Kraken account security tips and Kraken guidance on suspicious account activity.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
How to check a self-custody wallet
Inspect unexplained transactions
Compare the wallet’s activity with actions you remember taking. For each transaction you cannot explain, check its time, destination address, dapp or contract involved, and amount or value. Use the wallet’s activity view and an appropriate block explorer. MetaMask recommends checking these details in a block explorer and comparing them with a swap, deposit, contract interaction, or network fee you recognize: MetaMask guidance on identifying and reporting scams.
A successful transaction you did not authorize is a serious warning. However, a public blockchain address does not establish who controlled it or whether a real-world person authorized a transaction.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Check connected dapps and token approvals
A site connection may reveal your public address, while a signed token approval can give a contract continuing permission to move tokens. Review connected dapps and approvals, and revoke suspicious permissions using your wallet or a trusted chain-specific approval checker. A suspicious approval can indicate ongoing risk even if no unexplained transfer has appeared. Ethereum.org explains how to review and revoke approvals: Ethereum.org’s guide to revoking token access.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesDo not click links embedded in unknown NFTs or tokens, and do not sign a transaction you do not understand. Disconnecting a dapp or revoking an approval can limit future access, but cannot retrieve assets already transferred.
Rank #3
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
What to do if you find signs of compromise
If an exchange account may still be active
- Use the exchange’s official app or independently verified website to activate its lock or freeze feature, if one is available. Coinbase’s Security Lock signs out all devices and pauses trading, transfers, and account changes while allowing activity review and support contact: Coinbase Security Lock.
- Contact the exchange through its official support or security channel and report suspicious withdrawals or account changes. Exact controls vary by exchange and region, so follow the provider’s current official instructions.
- Change the exchange password and the password for the linked email account to unique values. Secure email recovery details and 2FA, since email can be used to reset exchange access.
- End unfamiliar sessions, remove unknown linked apps and API keys, and inspect withdrawal addresses. Reset sign-in 2FA if appropriate. Kraken’s compromise guidance describes these steps: Kraken account security tips.
If a recovery phrase or private key was exposed
Assume every account derived from that phrase or key is exposed. On a clean, trusted device, create a new wallet with a new recovery phrase and move any remaining assets to it. Do not continue using the old wallet or make it “safe” by importing the same phrase into another device. Review and revoke suspicious approvals where possible.
If a dapp or approval looks suspicious
Stop interacting with the site, disconnect it, and revoke suspicious approvals using your wallet or a trusted chain-specific approval checker. Revoking permission prevents future use of that approval; it does not recover assets already sent.
Rank #4
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
Secure devices and preserve evidence
Secure the email, cloud, phone, and devices linked to the account. Check email forwarding rules and recovery methods, update device software, and investigate suspicious downloads or remote-access tools. Kraken recommends device scans and email security measures in its compromise guidance; Coinbase notes that malware can steal credentials and sessions.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Keep transaction hashes, addresses, timestamps, screenshots, URLs, emails, and chat records. Contact the provider through its official support route, and report the incident to local law enforcement or a relevant regulator. Ethereum.org recommends documenting evidence and promptly contacting a centralized exchange if stolen funds appear to have reached it. Singapore Police also advises immediate platform contact and approval review: Singapore Police crypto-scam advice.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the evidence can—and cannot—tell you
Exchange logs can show account activity, sessions, and security changes, but a location or IP address alone may have an innocent explanation. Blockchain explorers show transaction data, including the time, addresses, and contract interactions; they do not prove a real-world identity or establish who authorized an action.
“Onchain transactions cannot be reversed,” Kraken says in its guidance on a compromised Kraken Wallet, last updated September 15, 2026: Kraken Wallet compromise guidance. A centralized exchange may be able to investigate or restrict a receiving account if funds reach its platform, but that is not a guaranteed recovery path. Ethereum.org warns that people who promise to recover funds for a fee are almost certainly running a second scam. Never give anyone your recovery phrase, private key, password, one-time code, or remote access to your device while seeking support or recovery.
Quick Recap
Reduce the chance of another compromise
- Use unique passwords for the exchange and its linked email account; a password manager can help keep them distinct.
- Use strong 2FA. Kraken recommends a hardware security key as an option for sign-in 2FA: Kraken sign-in 2FA options. A security key strengthens sign-in protection; it cannot inspect wallet transactions or recover transferred funds.
- Review exchange sessions, withdrawal addresses, linked apps, API keys, and wallet approvals periodically.
- Keep recovery phrases and private keys private; do not enter them into a website or give them to someone claiming to be support.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
