If you clicked a fake exchange link, stop using the page, preserve evidence, and move to a clean device. Open the exchange only through its official app or a bookmark, lock or freeze the account if that option exists, then change both your exchange and email passwords, end every active session, revoke unknown apps and API keys, replace exposed two-factor methods, and check withdrawal controls. A password change by itself is not enough if an attacker still controls your email, a logged-in session, an API credential, or an approved withdrawal address.
Do this first: contain the phishing incident
Time matters, but rushing on the compromised page can give an attacker another code or approval. Treat the page, message, and any support contact connected to it as hostile.
As an Amazon Associate I earn from qualifying purchases.
- Stop interacting with the page. Do not enter another password, one-time code, recovery phrase, identity document, or payment detail. Do not click additional buttons or download software it offers.
- Preserve evidence. Save the message, sender address, complete URL, screenshots, timestamps, browser notifications, and any exchange or bank alerts. Do not forward the phishing message in a way that could trigger its links.
- Move to a trusted device. Use a device you believe is clean and updated. If the device used for phishing downloaded an application, browser extension, or remote-access tool, disconnect it from the network and stop using it for account recovery until it has been checked.
- Open the exchange through a known-good route. Launch the official mobile app or type a previously saved bookmark yourself. Do not use a search-ad advertisement, a link in the original message, or a support link sent by an alleged agent.
- Lock the account if available. Use the exchange’s emergency account lock or freeze before changing settings when that feature is offered. Coinbase’s official guidance summarizes the priority as “Lock first, ask later.”
If you cannot sign in, use only the recovery and support path published inside the official app or on the exchange’s known domain. A legitimate representative will not ask for your password, one-time code, remote-access permission, or a cryptocurrency transfer.
Recommended Free Tools
Why changing the password alone can leave you exposed
Phishing can expose more than a password. An attacker may already have a valid browser session, an approved device, an API key, access to the email account that receives resets, a changed recovery phone number, or a withdrawal address added to the account. Those footholds can survive a password reset and let the attacker act while you believe the incident is over.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Email control: The registered email can be used to request a username, reset the exchange password, approve withdrawals, or intercept security notices.
- Active sessions: A stolen session token may remain valid after you change a password unless you explicitly sign out other devices.
- Applications and API keys: An unknown application or API credential can trade or move assets according to its permissions without using your new password.
- Recovery methods: A changed phone number, recovery address, or remembered device can provide a second route back into the account.
- Withdrawal settings: An unfamiliar address or modified allowlist can redirect funds after you have completed the visible login steps.
Containment therefore means resetting the credentials and removing every persistence mechanism you can see, not merely replacing one string of characters.
Secure the exchange account from a clean device
Change the exchange password
- Open the official app or bookmarked exchange domain on the clean device.
- Go to the account security or password section and set a long, random, unique password.
- Do not reuse the old password on the exchange, email, or any other service. If the old password was reused, change those accounts too, starting with email.
- Store the new password in a reputable password manager rather than in a browser note, email draft, or plain-text file.
The U.S. Federal Trade Commission’s hacked-account guidance likewise starts with changing the password to one that is difficult to guess. A password manager can generate a different credential for every service, which prevents a later breach at another site from supplying the exchange password.
End every other session and remove devices
Find the exchange’s list of logged-in sessions, trusted devices, or recent sign-ins. Sign out everywhere, then review the list again. Remove any device, browser, location, or login time you do not recognize. The FTC’s recovery instruction is direct: “Sign out of all devices.”
Some exchanges distinguish between ending sessions and deleting a remembered device. Perform both actions when both controls exist. Re-authenticate only on the clean device after the session reset, and record the date and time so a later unfamiliar login is easier to identify.
Revoke applications and API keys
Open the connected applications, API-management, and developer-access pages. Delete unknown entries and disable credentials you no longer need. For every legitimate key, inspect its permissions. A trading-only key should not have withdrawal permission; if the exchange allows granular scopes, remove withdrawal and transfer rights unless a specific workflow requires them.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you cannot determine whether a key is legitimate, revoke it and create a replacement later through the official interface. Never paste an API secret into a phishing form or send it to support.
Secure the email account before finishing recovery
Exchange security depends on the email account attached to it. Kraken warns that someone who controls that address may request the username, reset the password, and approve withdrawals. Complete email cleanup before assuming the exchange recovery is finished.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Change the email password to a new, unique value that has never been used on the exchange or elsewhere.
- End email sessions and remove unfamiliar phones, browsers, mail clients, and authorized devices.
- Inspect forwarding rules and filters. Delete rules that forward exchange messages, mark security notices as read, archive them, or redirect them to an unfamiliar folder or address.
- Check recovery addresses and phone numbers. Remove changes you did not make and restore your own verified recovery methods.
- Review delegated access and connected applications. Revoke unknown mail apps, calendar integrations, and OAuth grants.
- Search mail for security events. Look for password resets, new-device alerts, withdrawal confirmations, address changes, and support conversations that you did not initiate.
After the cleanup, change the exchange password again if the email account was accessible to the attacker while you were performing the first reset. This prevents a captured reset message or an old mail session from being useful.
Replace exposed two-factor authentication
If you typed a one-time code into the phishing site, assume that factor was exposed. Replace it rather than merely turning it back on. Also replace any factor displayed or approved during the incident, including push prompts that you accepted unexpectedly.
| Method | Phishing resistance | Recovery and backup considerations | Practical use |
|---|---|---|---|
| Passkey or FIDO hardware security key | Strongest option among the listed methods because the credential is bound to the legitimate site or app and is not typed into a fake page. | Register more than one key or an approved backup method. Keep a spare in a safe place and confirm the exchange and email service both support the method. | Use as the primary factor for the exchange and its email account whenever supported. Coinbase says hardware keys are best and specifically recommends a YubiKey or similar key. |
| Authenticator-app TOTP | Stronger than SMS, but a code can still be relayed if entered on a convincing fake page. | Save the service’s recovery codes offline and protect the authenticator backup. Re-enroll after exposure instead of continuing to use the old secret. | Use when a passkey or hardware key is unavailable. Confirm that the new enrollment appears only in the official account settings. |
| SMS code | Weakest of these options because a SIM swap or number takeover can divert messages, and codes can be phished. | Recovery depends on control of the phone number and carrier account. Ask the carrier to protect the number with an account PIN where available. | Keep only as a fallback when the exchange offers no stronger method. Do not treat receipt of an SMS as proof that a login is legitimate. |
Enroll the strongest factor the platform supports on both the exchange and the email account. Coinbase’s published guidance says to use the strongest available 2FA, ideally a YubiKey or similar hardware security key. A factor that protects only the exchange is less useful if an attacker can still reset it through an unprotected email account.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Audit withdrawals, trading, and account permissions
Once credentials and sessions are contained, inspect every control that can move money or authorize activity. Capture screenshots of suspicious changes before removing them if you may need them for support.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Recent deposits and withdrawals: Match every transaction with your own records. Treat an unfamiliar pending transaction as urgent; contact official support immediately rather than waiting for settlement.
- Withdrawal addresses and allowlists: Delete unknown addresses and check whether a new address was added or an existing one was modified. If the exchange offers a withdrawal allowlist, enable it after removing unauthorized entries.
- Trading permissions: Review open orders, recurring purchases, leverage or margin settings, and any unfamiliar trades. Cancel orders you did not place through the official interface.
- Transaction and withdrawal 2FA: Confirm that sensitive actions require the strongest available factor, not only an email link or SMS.
- API permissions: Recheck the API list after changing the password and ending sessions. Delete keys created during the incident.
- Profile and recovery data: Verify the name, phone number, email address, security questions, and identity-verification details shown in the official account.
If assets have moved without your authorization, tell the exchange’s official security or account-recovery team immediately. Include the preserved timestamps, transaction identifiers, destination addresses, and screenshots. Do not pay anyone who promises to “recover” funds in exchange for an upfront cryptocurrency transfer; that is a common follow-on scam.
Use the exchange’s emergency and support channels safely
When to lock or freeze
Use an emergency lock as soon as you believe the attacker has a live session, knows a password, received a code, changed recovery data, or initiated a transaction. A lock can stop additional activity while support verifies ownership. It may also pause legitimate withdrawals, so keep your evidence and be ready to complete the exchange’s identity checks through its official process.
How to contact support
Navigate to support from the official app or by manually entering the exchange’s known domain. Do not use a phone number or direct-message account supplied by the phisher. Real support staff do not need your password, 2FA code, private recovery material, remote-control access, or a transfer of cryptocurrency to “secure” an account.
Give support a concise incident timeline:
- When you opened the message and the exact domain or URL.
- What information you entered, including whether a password, TOTP code, SMS code, or approval prompt was exposed.
- Which device and browser you used.
- Any sign-in, profile-change, API, address, trading, deposit, or withdrawal alert.
- The containment steps already completed and any transaction identifiers.
Ask support to confirm whether the account is locked, all sessions are invalidated, API keys are disabled, withdrawals are restricted, and recovery details are being reviewed. Keep the ticket number and communicate only through the verified case.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Branch your response to what the phishing page captured
You entered only your email address
Change the email password if it was exposed, enable a stronger factor on email, and watch for targeted reset messages. The address alone may not grant access, but it gives an attacker a precise target for convincing follow-up messages.
You entered the exchange password
Follow the full containment sequence: lock the exchange, change exchange and email passwords, end all sessions, revoke applications and API keys, replace 2FA, and audit withdrawals and addresses. Assume the attacker may have logged in even if no alert appeared.
You entered a one-time code or approved a prompt
Assume the attacker used or can reuse the authorization immediately. Lock the account, invalidate every session, replace the factor, and inspect all money-movement settings. Do not continue using the old authenticator enrollment or phone-based factor as if it were safe.
You installed software or a browser extension
Stop using that device for account recovery. Disconnect it from the network if practical, remove the suspicious software only after preserving evidence, and obtain professional malware assistance if you cannot verify that it is clean. Complete password and 2FA changes from a separate trusted device because malware may capture new credentials.
Free tools Windows power users keep installed
One-click scans. No signup required.
You see an unauthorized transfer
Lock the account and contact official exchange support immediately with the transaction details. Continue the email, session, API, and 2FA cleanup while the case is open. Do not delete evidence or engage with anyone who contacts you claiming to be a recovery specialist.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Make the account harder to phish again
After the incident is contained, add controls that reduce the chance that a single deceptive page can repeat it.
- Use a dedicated exchange email address that is not posted publicly or used for newsletters and social accounts.
- Prefer passkeys or hardware security keys for both the exchange and email. Register a spare key and store it separately from the primary key.
- Enable withdrawal allowlisting where offered. Add or change addresses only from a clean device and follow any waiting period deliberately.
- Turn on an exchange anti-phishing code if the platform supports one. A genuine exchange email should display the private code you configured; a message without it deserves extra scrutiny.
- Use a password manager to generate unique credentials and to help detect look-alike domains. Never type a password into a page reached from an unsolicited message.
- Keep software and browsers updated and remove extensions you do not need, especially those with broad page-reading permissions.
- Set transaction notifications for logins, profile changes, API creation, address changes, and withdrawals. Alerts are useful only if you read them and act through the official app.
Security controls to compare across exchanges
Feature names differ, so compare the controls rather than assuming that every exchange provides the same protection.
| Control area | Questions to answer in the official security settings | What a stronger implementation looks like |
|---|---|---|
| Session and device visibility | Can you see location, time, browser, and device? Can you end all sessions at once? | Detailed history, one-click global sign-out, and separate removal of trusted devices. |
| Withdrawal allowlisting | Can withdrawals go only to approved addresses? Is there a delay after adding one? | Allowlist enforcement with a cooling-off period and alerts for every change. |
| Transaction 2FA | Are withdrawals and security changes protected separately from ordinary login? | A phishing-resistant factor required for withdrawals, address changes, and API creation. |
| API permission granularity | Can keys be limited to reading or trading without withdrawal rights? | Separate scopes, visible last-used information, IP restrictions where available, and easy revocation. |
| Emergency lock | Can you freeze trading or withdrawals without waiting for support? | An immediate in-app lock plus a clearly documented official recovery route. |
| Support escalation | Is there a verified security case process and a way to provide transaction identifiers? | Support reached through the official app or domain, with case tracking and clear identity-verification steps. |
Monitor the account after recovery
Keep the incident open in your mind for several days rather than assuming that a quiet first hour means the attacker is gone. Review sign-in alerts, email rules, connected applications, API keys, withdrawal addresses, open orders, and transaction history at regular intervals. Watch the email account as closely as the exchange: a new forwarding rule or reset notice can reopen the attack.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesRecord the final state of the account after cleanup: the new email and exchange passwords are unique, all old sessions are ended, unknown devices and applications are removed, exposed factors are replaced, recovery details are correct, and withdrawals are restricted by the strongest available controls. Keep the evidence and support case information in a secure location in case a later alert connects to the same incident.
The essential rule
Assume a phishing attack is an account-takeover attempt, not merely a bad password event. Stop the interaction, lock the account, secure email, rotate credentials and second factors, revoke every unrecognized session and API path, inspect money movement, and use only verified support channels. That sequence closes the alternate routes an attacker can exploit after the obvious password has been changed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
