Free tools Windows power users keep installed
One-click scans. No signup required.
If cryptocurrency was withdrawn from your exchange account without your permission, act in this order: stop communicating with the suspected thief, lock the account through the exchange’s official app or website, secure your email and devices, preserve transaction evidence, contact genuine exchange support, and file reports. Do not send more money, share a password or one-time code, or move funds because an unsolicited caller tells you to.
Recovery is uncertain. Confirmed blockchain transfers are generally irreversible, and an exchange can freeze assets only through its own procedures or appropriate legal process. Fast, well-documented reporting gives investigators and the exchange the best chance to flag the transaction.
As an Amazon Associate I earn from qualifying purchases.
First, determine what happened
An “account hack” can mean several different events. An unauthorized withdrawal is a transaction you did not approve. A scammer may instead persuade you to approve a transfer, reveal a one-time code, install remote-access software, or move coins to a so-called safe wallet. That distinction matters because some reimbursement programs cover unauthorized withdrawals but exclude transfers you authorized after being deceived.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Check the exchange’s activity and withdrawal history from a device you trust. Note whether the transaction is pending or confirmed, which asset was sent, and whether unfamiliar logins, devices, API calls, or address-book entries appear. Do not click a link in an email, text, advertisement, or caller’s message to perform this check.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Do these things immediately
1. End contact with the suspected thief
Stop replying, stop sending money, and do not warn the person that you are reporting them. The FBI specifically advises victims not to notify suspected criminals of the FBI’s involvement. If someone called or messaged claiming to be exchange staff, hang up and navigate to the exchange independently through a bookmark you created previously or the official app.
2. Lock or restrict the exchange account
Use the exchange’s current security or account-lock feature. For example, Coinbase’s official security-lock procedure signs out devices and pauses trading and transfers while still allowing balance, transaction, activity review, and support contact. Other exchanges use different labels and controls, so follow the current help instructions for your named exchange.
A lock is not proof that funds can be recovered. It is containment: it can prevent another withdrawal while you investigate. If you cannot find the control, contact support only through the exchange’s independently verified website or app.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
3. Secure the email account and every device
- Change the password for the email account associated with the exchange, then change that email account’s two-factor authentication (2FA). An attacker who controls email can reset the exchange account again.
- Reset the exchange password to a unique password that is not used anywhere else.
- Sign out unfamiliar sessions and remove unknown devices, browser sessions, connected applications, and API keys.
- Remove unfamiliar withdrawal addresses and address-book entries. Create new sign-in 2FA credentials; phishing-resistant methods such as a passkey or hardware security key are preferable where supported.
- Scan computers and phones for malware or keyloggers with reputable security software, install operating-system updates, and avoid signing in from a device you suspect is infected until it has been checked.
Kraken’s compromised-account checklist likewise calls for removing unknown withdrawal addresses and API keys and creating new sign-in 2FA. The exact menu names vary by exchange.
4. Preserve evidence before deleting anything
Save screenshots and, if possible, export account records before you remove messages or reset devices. Record:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Asset, amount, network, and transaction hash
- Sending and receiving wallet addresses
- Date and time, including your time zone
- Exchange name, account email, user ID, and relevant case numbers
- Login, session, device, and IP information shown by the exchange
- Emails, texts, chat transcripts, caller numbers, usernames, domains, links, and social-media profiles
- Any one-time codes, 2FA prompts, recovery-code requests, or software-installation instructions
Do not delay a report because one field is missing. FBI Internet Crime Complaint Center (IC3) guidance says to report even when some transaction information is unavailable.
5. Contact genuine exchange support
Open a support case from the official app or by typing the exchange’s known domain yourself. Ask for an account-takeover investigation, preservation of logs, review of withdrawals and API activity, and any available freeze, flag, or recall process. Supply the transaction hash and receiving address immediately.
Do not assume the exchange can reverse a transfer. The FBI says exchanges freeze accounts only under their internal processes or legal process. A recipient account may be outside the exchange’s control, in another country, or already emptied.
Report the theft to the right authorities
FBI Internet Crime Complaint Center
Submit a report at www.ic3.gov. The FBI’s guidance states: “If you believe you or someone you know may be a victim of a cryptocurrency scam, immediately submit a report to the FBI Internet Crime Complaint Center (IC3) at www.ic3.gov or contact your local FBI Field Office and provide as much transaction information as possible.” Include the addresses, hash, dates, exchange records, communications, and the amount and asset involved.
Other U.S. reporting routes
The Federal Trade Commission accepts consumer-fraud reports at ReportFraud.ftc.gov. Depending on the facts, you can also submit a complaint to the Commodity Futures Trading Commission at CFTC.gov/complaint or to the Securities and Exchange Commission at SEC.gov/tcr. A local police report or an FBI field-office contact may be appropriate for your jurisdiction, especially for a substantial loss or an identifiable suspect.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
These reports document the crime and help agencies connect cases; filing does not guarantee that funds will be returned.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRecognize and block the second scam
After a theft, victims are often targeted by impostors claiming they can “secure” or recover the account. The FBI warns that callers and messages may impersonate exchange employees, create urgency, request login or identity information, and send malicious links. Kraken warns that impersonators may ask for 2FA codes, request software installation, or instruct you to move crypto to a “safe” wallet.
The FBI’s 2024 warning is direct: “If you receive a call or message indicating any kind of account problem or compromise, do not respond, even if it appears official and indicates you must act immediately.” Navigate to the exchange yourself. Never disclose a password, recovery phrase, private key, one-time code, or approval prompt to a person who contacted you unexpectedly.
Be especially skeptical of anyone demanding an upfront fee, promising a guaranteed recovery, or claiming special access to blockchain investigators. The FBI says recovery-company claims may themselves be another scam. No legitimate helper needs your recovery phrase or asks you to transfer coins to prove ownership.
Can an exchange freeze stolen cryptocurrency?
Sometimes, but there is no universal freeze power or deadline. An exchange may flag a deposit, restrict a recipient account, or preserve records when its monitoring systems detect suspicious activity. It may also act after receiving valid legal process. Whether it can do so depends on where the assets went, whether the receiving service is the same exchange, internal policy, and how quickly you report.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
When contacting support, ask four specific questions:
| Question | Why it matters |
|---|---|
| How quickly can the account be locked? | Immediate containment can stop additional withdrawals. |
| What evidence is required? | A hash, addresses, timestamps, and session records help the investigation start without back-and-forth. |
| Can the recipient address or account be flagged or frozen? | Recipient control depends on whether the address belongs to a service the exchange can identify and restrict. |
| Is there a documented reimbursement program? | Eligibility, deadlines, geography, authentication requirements, and exclusions determine whether a claim is possible. |
What recovery can realistically mean
Blockchain finality
Once a cryptocurrency transfer is confirmed on-chain, it is usually irreversible. The FTC states that cryptocurrency held in accounts is not insured by a government like U.S. dollars deposited into an FDIC-insured bank account. If coins went to a self-custody wallet, a wrong address, or an exchange that fails, there may be no institution able to reverse the transaction.
Exchange investigation or legal action
A freeze, seizure, or return can still happen in limited cases when an exchange identifies the recipient, acts under its internal rules, or receives appropriate legal process. Treat that as a possibility, not a promise. Do not pay a third party who guarantees a result.
One limited reimbursement example
Coinbase says eligible Coinbase One members in supported regions may qualify for reimbursement for an unauthorized crypto withdrawal when requirements are met, including use of a passkey or security key. The program excludes transactions the customer authorized after being deceived, and claims must be submitted within 45 days of the suspected loss date. Terms, regions, and eligibility can change, so check the current program terms directly before relying on it.
Recommended Free Tools
The distinction between an unauthorized withdrawal and a transfer you approved after a scam is therefore essential when describing the incident to support or investigators. Be accurate; do not label an authorized transaction as unauthorized.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Should you move the cryptocurrency that remains?
Do not move funds because an unsolicited caller, text, or pop-up says your account is compromised. That instruction is a common impersonation tactic. First lock the account, secure the email, remove unknown sessions and API keys, and confirm that your device is clean.
After containment, ask the exchange’s verified support team what restrictions apply and document the advice. If you decide to transfer remaining assets, do so only from a trusted, updated device to an address you independently verified. A transfer made in haste can create a second, irreversible loss, and moving funds does not repair a compromised email or device.
Strengthen the account after containment
Passwords, sessions, and access
- Use a unique, long exchange password and a separate unique email password.
- Review active sessions and connected applications on a regular schedule, not only after an incident.
- Rotate every API key you do not recognize; disable trading and withdrawal permissions for keys that do not need them.
- Keep withdrawal-address allowlists and notifications enabled when the exchange offers them.
Choose stronger authentication
| Authentication choice | Phishing resistance | Recovery and compatibility considerations |
|---|---|---|
| Passkey | Generally high because it is bound to the website or app rather than a reusable code. | Requires a compatible phone, computer, browser, and exchange; account-recovery options differ. |
| Hardware security key | High when the exchange supports the relevant standard and the key is used for sign-in. | Buy a genuine key from a reputable seller, keep a registered backup, and verify device and exchange compatibility before purchase. |
| Authenticator-app code | Stronger than SMS but still vulnerable if a code is phished in real time. | Protect backup codes and plan how you will regain access if the phone is lost. |
| SMS code | Lower, because phone-number takeover and message interception are possible. | May be the only option on some services; use a stronger method when available. |
Enable withdrawal confirmations, login alerts, address allowlists, and transaction limits where available. Keep recovery codes offline and never store a seed phrase in cloud notes, email, screenshots, or a password shared with another person.
How widespread is cryptocurrency fraud?
The FBI’s IC3 report released in 2024 recorded $5.6 billion in reported cryptocurrency-fraud losses during 2023. That is a broad reported-fraud total, not the amount lost by an individual exchange-account victim. A 2023 FBI public-service announcement reported more than $2.5 billion in cryptocurrency investment-fraud losses in 2022; that figure covers investment fraud specifically and should not be treated as all crypto theft.
These totals illustrate why official reporting and evidence preservation matter, but they do not predict whether a particular transfer will be recovered.
Quick Recap
A practical incident checklist
- Stop contact with the suspected thief; send no additional money.
- Open the exchange independently and lock or restrict the account.
- Change email and exchange passwords, reset 2FA, sign out sessions, and remove unknown devices, addresses, applications, and API keys.
- Scan and update devices before using them for further account work.
- Save hashes, wallet addresses, amounts, times, screenshots, messages, caller details, and session information.
- Open a genuine exchange-support case and request investigation, log preservation, and any available freeze or flag.
- Submit an IC3 report and use FTC, CFTC, SEC, local police, or FBI field-office channels as applicable.
- Ignore recovery guarantees, upfront-fee demands, “safe wallet” instructions, and requests for passwords, seed phrases, or one-time codes.
- After containment, adopt unique passwords, phishing-resistant 2FA, address controls, API restrictions, and regular session reviews.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
