Free tools Windows power users keep installed
One-click scans. No signup required.
Act as though both your email and exchange account could be at risk, but do not assume that exposed data means your funds were accessed. Contact the exchange through its verified app or website immediately and request an account restriction or freeze. If you can still sign in, enable any available withdrawal lock before changing the exchange password, then secure the email account used for password resets and alerts. Use a trusted, updated device, replace reused passwords, enable the strongest supported multi-factor authentication (MFA), revoke unfamiliar sessions and recovery methods, and preserve evidence. Never give passwords, MFA codes, seed phrases or API secrets to unsolicited “support” or recovery services.
First, determine what may have happened
A breach can expose contact information, identity data or old passwords without giving an attacker access to your exchange. It can also involve a compromised email account, an active exchange session, a SIM-swap event, malware on your device or an unauthorized withdrawal. Your first response should cover the dangerous possibilities while you verify what actually occurred.
As an Amazon Associate I earn from qualifying purchases.
- Data exposure only: You received a breach notice, but there is no sign of an account login, password reset, security-setting change or transaction you do not recognize.
- Email compromise: Someone may be reading exchange alerts, hiding them with forwarding rules or using password-reset links.
- Exchange-account compromise: You see an unknown device, IP address, contact change, API key, withdrawal address, login or transaction.
- Device or phone compromise: Malware, a keylogger or a SIM swap may let an attacker capture new credentials or MFA codes.
Check the exchange’s official incident notice and your account activity, but do not wait for perfect certainty before asking the exchange to restrict activity. Blockchain transfers are often irreversible, so speed matters when a withdrawal may be in progress.
Use official support and stop withdrawals first
Open the exchange’s official mobile app or type its known website address yourself. Do not use a telephone number, link or “support” account supplied by an unsolicited caller, text, email or social-media message. Tell support that you suspect unauthorized access and ask what immediate restriction is available, including a full freeze, withdrawal suspension or security hold. Kraken’s compromised-account guidance says, “If you believe your account has been compromised, contact us immediately.”
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you still have access, use a withdrawal lock before making other changes when the platform offers one. Bitvavo documents a crypto withdrawal lock for this purpose. A lock can buy time, but it is not a universal feature and may not stop every action, such as trades, fiat withdrawals or changes made through an already-authorized session. Ask support exactly what the restriction covers and how long it lasts.
Keep the support case number and the time you contacted the exchange. Ask how to report unauthorized transactions, whether the exchange can invalidate sessions or API credentials, and which evidence it needs. Do not close the account or delete messages until support tells you that doing so will not interfere with its investigation.
Secure the email account that controls resets
Your email account is part of exchange security. Password-reset links, login alerts and withdrawal warnings may all arrive there. An attacker who controls email can search old messages for exchange names, create a reset request and hide the resulting alerts.
- Use a trusted device. If the computer or phone you normally use may contain malware, start with another updated device that you control. Do not change important credentials on a machine you suspect is recording keystrokes.
- Change the email password. Create a long, unique password that has never been used for the exchange or any other service. Change it anywhere the same password was reused.
- Turn on the strongest MFA available. Prefer a passkey or compatible hardware security key when your email provider and exchange support it. Otherwise use the most resistant MFA method offered; do not treat SMS as equivalent to a phishing-resistant method.
- Review active sessions and devices. Sign out of every device, browser session and mail application you do not recognize. If the provider offers “sign out everywhere,” use it after changing the password.
- Check recovery controls. Inspect recovery email addresses, phone numbers, authenticator apps, passkeys, security keys and backup codes. Remove unknown methods and replace compromised ones.
- Inspect forwarding and inbox rules. Delete rules that forward mail externally, mark security alerts as read, move them to obscure folders or automatically delete them. Review filters, delegates and connected applications as well.
- Search for evidence. Look for password-reset requests, exchange login alerts, new-device notices and messages you did not send. Preserve copies before deleting anything.
After securing email, monitor it for new reset requests. A sudden flood of messages can be an attempt to hide a critical alert, while a missing alert can indicate that a forwarding or deletion rule remains active.
Lock down the exchange account
Replace the exchange password
Change the exchange password from the trusted device, even if you have not confirmed a login. Use a unique password stored in a reputable password manager. Do not reuse the new email password. If the exchange will not let you change credentials because of a security hold, follow its official recovery process rather than repeatedly guessing.
Strengthen MFA and recovery methods
Enable the strongest sign-in and withdrawal authentication the exchange supports. Review authenticator applications, passkeys, security keys, backup codes, phone numbers and recovery contacts. Regenerate backup codes if they may have been seen, and remove any authenticator or key you did not enroll. A hardware security key is an optional strong path, but confirm compatibility with both the exchange and your email provider before buying one.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Revoke sessions, devices and trusted access
Open the security page and list active sessions, trusted browsers, remembered devices and third-party applications. Sign out or revoke anything unfamiliar, including a session that appears to be in your own city but uses an unknown browser or time. If the exchange offers a global sign-out, use it and sign in again only after the password and MFA changes are complete.
Review phone and recovery changes
Check whether the phone number, recovery email, identity details or authentication method changed. An attacker may add a method without removing yours, so compare every entry with your own records. Contact your mobile carrier if you suspect a SIM swap and ask it to secure the number and account; do not rely on SMS recovery until the carrier confirms control.
Check API keys, withdrawal controls and account activity
Exchange settings differ, so use the labels shown by your platform rather than assuming every control exists.
- API keys: List every key, its creation date and permissions. Revoke unknown keys immediately. Delete keys you no longer use, and avoid leaving trading, transfer or withdrawal permissions enabled when they are unnecessary.
- Withdrawal addresses and allowlists: Remove unfamiliar addresses if the exchange permits it. Find out whether a new-address hold or allowlist can prevent immediate withdrawals.
- Security logs: Review login times, IP addresses, devices, password changes, MFA changes, API events, address additions and contact edits. An unfamiliar IP is a lead, not proof by itself, because mobile networks and virtual private networks can alter locations.
- Transaction history: Check deposits, trades, conversions, fiat transfers and crypto withdrawals. Record asset, amount, destination address, transaction ID, timestamp and the status shown by the exchange.
- Open orders and permissions: Cancel orders or automated strategies you did not create. Check subaccounts and delegated access if the platform supports them.
If you find an unauthorized withdrawal, report it to the exchange immediately with the transaction ID. Ask whether the destination exchange or service can be contacted and whether any internal hold is still possible. Do not send a second “test” transfer and do not assume that a pending status guarantees reversal.
Check and remediate your devices
Credential changes are safer after you rule out a keylogger or remote-access tool. Update the operating system, browser, exchange app and security software on every device used for the account. Run a malware scan and review recently installed applications, browser extensions and remote-access utilities. Kraken recommends scanning potentially affected devices and updating them as part of compromised-account remediation.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →If a scan finds malware, disconnect the device from the network while preserving information needed for an investigation. Change passwords again from a clean device after remediation. Do not enter seed phrases or private keys into a website or “verification” tool offered by someone claiming to help.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Preserve evidence and report the incident
Create a timeline while events are fresh. Record when you received a breach notice, when you first noticed an unfamiliar alert or transaction, every action you took, and each exchange or email-provider case number.
- Save screenshots of login alerts, security settings, forwarding rules, support chats and transaction pages.
- Record transaction IDs, destination addresses, amounts, currencies, timestamps and the exchange status.
- Note device models, operating-system versions, browser versions, phone-number changes and unfamiliar IP information shown by the service.
- Keep copies of suspicious emails, texts, caller numbers and social-media messages, including their headers where available.
- Write down when you contacted the exchange, email provider, mobile carrier, bank and law-enforcement agency.
Coinbase asks affected users for incident details and screenshots; OKX lists timelines, messages, device information and transaction details, and may request police or SIM-swap records. Those requirements belong to the named programs, not to every exchange. Follow your platform’s current support instructions and any applicable local reporting route. Exchange claim windows and legal remedies vary by country and service.
How major exchanges differ
No exchange exposes identical controls. Before relying on a setting, confirm its name, scope and activation delay in the current help center or with verified support.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute| Exchange or program | Documented response or control | Important limitation |
|---|---|---|
| Kraken | Immediate support escalation; compromised-account guidance covering password reset, email protection, device scanning, session review, API keys and authentication controls. | Exact security features and recovery outcomes depend on the account and current platform implementation. |
| Bitvavo | Crypto withdrawal lock, email hardening, security-setting and log review, and contact with its fraud team. | A withdrawal lock may not cover every account action; verify what it blocks and for how long. |
| Coinbase | Incident-report submission, evidence preservation guidance and explicit anti-impersonation warnings. | Reporting an incident does not itself guarantee reimbursement or reversal. |
| OKX Shield | A voluntary, discretionary goodwill program with eligibility conditions, device-health requirements, a passkey, large-withdrawal and web-withdrawal protections, and MFA for supported activities. | It is not insurance or a guarantee. OKX’s current instructions require a formal claim within 72 hours of the last unauthorized transaction and supporting information within seven days after that formal claim. |
The OKX deadlines are specific to OKX Shield. Do not apply 72 hours or seven days to another exchange, and do not describe Shield as guaranteed recovery.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Do not lose money to “recovery” impostors
A breach creates a second target: the worried account holder. Criminals may impersonate an exchange employee, police officer, wallet investigator or lawyer and demand an advance fee, a transfer to a “secure” address or a code to verify ownership. The SEC’s April 23, 2026 investor alert warns about advance-fee recovery scams.
Use only contact details obtained independently from the exchange’s official app or website. Coinbase states: “Coinbase will never ask for passwords or 2FA codes, or ask you to transfer money to a new address over the phone or via text.” Treat any request for a password, MFA code, seed phrase, private key or API secret as fraudulent. Never install remote-control software at an unsolicited caller’s direction.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
What to do when funds were actually withdrawn
- Keep the account restricted and do not continue trading while the exchange investigates.
- Send support the exact asset, amount, destination address, transaction ID, timestamp and screenshots.
- Ask whether the transaction is pending, whether the receiving service can be notified and whether any internal freeze is possible.
- Secure email, phone service and devices before attempting further recovery actions.
- Report the incident to the appropriate law-enforcement or cybercrime channel in your country, retaining the report number for the exchange.
Do not promise yourself that a blockchain transfer can be reversed. Recovery depends on timing, the receiving service, the asset and applicable law; an exchange’s investigation or goodwill program is not a guarantee.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Monitor the account after the emergency
For the next several weeks, review exchange security logs, email forwarding rules, recovery methods, API keys and transaction history at regular intervals. Watch for password-reset attempts, new-device alerts, SIM changes and small test withdrawals. Keep MFA backup codes offline, limit API permissions and remove integrations you no longer need. If the exchange confirms that the incident involved only personal data, remain alert for targeted phishing: exposed details can make a fake support message look convincing even when the account itself was never accessed.
Frequently Asked Questions
Can someone use my email address to get into my crypto exchange account?
An email address alone is not normally enough, but access to the mailbox can enable password resets, expose security alerts and allow an attacker to hide warnings. Secure the mailbox, recovery methods and exchange account immediately.
Should I change my exchange password before contacting support?
Contact the exchange first and request a restriction or freeze. If you still have access, enable an available withdrawal lock, then change credentials from a trusted device unless support directs you to use a different recovery process.
Is a withdrawal lock available on every exchange?
No. Withdrawal locks, address allowlists, session controls and API revocation vary by platform. Confirm the feature’s exact scope with the exchange.
Recommended Free Tools
Does an exchange have to reimburse stolen crypto?
There is no universal guarantee. Eligibility, evidence requirements, deadlines, local law and any goodwill program are specific to the exchange and incident.
What information should I never share with support?
Never share your password, MFA code, seed phrase, private key or API secret with unsolicited contacts. Verified support should not need those secrets.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
