The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Act in this order: contact the exchange through its verified app or website and request an account restriction or withdrawal freeze, secure the email account used for password resets, change exposed or reused passwords, enable the strongest available multi-factor authentication (MFA), revoke unfamiliar access, and preserve evidence. A breach notification does not by itself prove that anyone entered your account or moved funds, but the risk is time-sensitive.
Separate a data exposure from an account takeover. If a service says your personal information or password database was exposed, monitor the account and change reused credentials. If you see an unfamiliar login, password-reset message, recovery change, API key, withdrawal address or transaction, treat the exchange account and its linked email as compromised and follow every step below.
As an Amazon Associate I earn from qualifying purchases.
First, determine what may have happened
Read the exchange, email provider or other service’s notice in its official app or by typing its web address yourself. Do not rely on a link in an unexpected text, email or phone call. Look for the incident date, affected data and whether the provider says passwords, authentication data or account access were involved.
Possible exposure without account access
Names, email addresses, phone numbers or old password hashes can be exposed without an attacker signing in. Even so, immediately change any password that was reused elsewhere, turn on MFA and watch for password-reset and login alerts. A leaked email address can make convincing impersonation attempts easier.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Signs of an account takeover
Escalate to an active compromise if you find an unknown session or device, a changed phone number or recovery method, an unfamiliar MFA method, an email-forwarding rule, an API key, a new withdrawal address, a security notification you did not trigger, or a transaction you do not recognize. Do not wait for certainty before contacting the exchange.
1. Contact the exchange and restrict activity immediately
Use the exchange’s verified mobile app or navigate to its website by entering the address yourself. Start an incident or compromised-account report and ask support to secure the account, disable suspicious sessions and restrict or freeze withdrawals. The Singapore Police Force advises contacting both the email provider and the cryptocurrency exchange promptly where an account may be compromised. Kraken Support likewise says, “If you believe your account has been compromised, contact us immediately.”
Tell support whether you can still sign in, whether your email account may also be exposed, and the exact activity you do not recognize. Follow the exchange’s instructions even if you have already changed a password; support may be able to place a manual hold or begin a specialized recovery process that you cannot start from the settings page.
If you still have access, activate a withdrawal lock or equivalent restriction before changing other settings if the exchange offers one. Bitvavo documents a crypto-withdrawal lock for this situation. Names, waiting periods and availability differ by platform, so do not assume that a control shown in one exchange exists in another.
Never use a support number supplied by an unsolicited caller, social-media message or pop-up. Open a new support ticket from the official account or app, and save the ticket number.
2. Secure the email account that controls resets
Your email account is part of the exchange’s security perimeter: it can receive password-reset links, device approvals and withdrawal alerts. Secure it before relying on email to recover the exchange account.
- Change the email password. Use a long, unique password that has never been used for the exchange or another service. If the old password was reused, change every account that used it, beginning with financial accounts.
- Turn on MFA. Prefer a phishing-resistant passkey or hardware security key when both your email provider and exchange support it. Otherwise use the strongest non-SMS option available, such as an authenticator application. SMS is better than no MFA but can be exposed in a SIM-swap attack.
- Review active sessions and devices. Sign out anything you do not recognize and remove old sessions. Check the date, location and device details rather than assuming a familiar device name is legitimate.
- Inspect recovery information. Verify recovery addresses, phone numbers, backup codes and authenticator devices. Remove additions you did not make, then generate new backup codes and store them offline.
- Check rules and forwarding. Attackers can create filters that archive or forward exchange messages so you do not see password resets or withdrawal alerts. Delete unfamiliar rules, forwarding addresses, delegates and automatic replies.
- Search for security messages. Look for password resets, new-device notices, MFA changes and exchange alerts that you did not initiate. Record their timestamps and do not click links in the messages; use the official account interface instead.
The Singapore Police Force has warned that attackers may search a compromised mailbox for exchange accounts, add rules to hide messages and use reset flows. Removing those changes closes a route back into the exchange.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Change exchange credentials and remove unauthorized access
Use a trusted, updated device. If you suspect the computer or phone you normally use has malware or a keylogger, secure the email from another clean device first and ask the exchange for its official recovery procedure.
- Reset the exchange password. Create a password unique to that exchange. Do not copy the email password or a password from a password manager entry that may have been exposed.
- Enable the strongest supported MFA. A hardware security key is an optional high-assurance sign-in method where the exchange and email provider support compatible keys. Passkeys and authenticator applications may also be available. Enroll a second, safely stored method only if the exchange’s recovery design makes that necessary.
- End unknown sessions. Review trusted devices, active sessions, recent sign-ins and remembered browsers. Sign out or revoke every entry you cannot explain, then sign in again only on devices you trust.
- Verify contact and recovery settings. Check the account email, phone number, recovery contacts, MFA devices and backup codes. Replace anything changed without your permission.
- Review API access. List API keys, creation dates, permissions and recent use. Revoke unknown keys and recreate legitimate keys with the minimum permissions required. A trading key should not have withdrawal permission unless there is a specific, understood need.
- Review saved withdrawal destinations. Remove unfamiliar addresses or address-book entries if the exchange allows it. If an address cannot be removed immediately, tell support and request a withdrawal restriction.
Kraken’s compromised-account guidance describes these types of password, device, session, API and recovery controls, but the labels and exact sequence vary by exchange.
4. Check the device and the account’s security history
Make the device trustworthy
Update the operating system, browser, exchange app and security software. Run a reputable malware and keylogger scan on computers and phones that were used to sign in. A scan is a secondary precaution, not proof that a device is clean; if suspicious behavior remains, stop using it for financial accounts and follow the exchange’s device-remediation instructions.
Review logs and account changes
In the exchange’s security or activity area, inspect sign-ins, IP addresses, devices, password changes, MFA changes, API activity, address-book edits and withdrawal attempts. Compare timestamps with your own actions. Save screenshots before entries disappear or the account is locked.
Check transactions and balances
Export or record transaction history, including asset, amount, destination, network, time and transaction ID. Check open orders, conversions, staking or lending actions and any linked bank or card activity. An unfamiliar login with no financial action is still evidence of unauthorized access and should be reported.
5. Preserve evidence and report it through the right channels
Create a simple timeline in UTC or clearly label your local time zone. Include when you learned of the breach, when each alert arrived, when you noticed an unfamiliar action, when you changed credentials and when you contacted support.
- Save screenshots of breach notices, login alerts, security settings, withdrawal requests, balances and support conversations.
- Record transaction IDs, wallet addresses, blockchain network, amounts, timestamps, device information and suspicious IP addresses shown by the exchange.
- Keep the support ticket number, names or identifiers of support agents and every requested document.
- Do not edit screenshots or delete messages; preserve original files and note any redactions made for privacy.
Coinbase asks affected users for incident details and screenshots. OKX lists timelines, messages, device information and transaction details and may request police or SIM-swap records. Those requirements are program-specific, so follow your own exchange’s current instructions rather than assuming another exchange’s checklist or deadline applies.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Report suspected theft to the appropriate law-enforcement or cybercrime reporting service in your country. An exchange may ask for a police report, but reporting does not guarantee that a blockchain transaction can be reversed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
6. If funds or assets moved without permission
Tell the exchange in the first incident report that the transaction was unauthorized, provide the transaction ID and request a withdrawal freeze, account lock and investigation. Do not send a second transaction to “reverse” or “verify” the first one. Blockchain transfers are generally difficult or impossible to reverse once broadcast, so speed improves the chance that an exchange can stop a pending withdrawal or identify a connected account.
Secure the email, exchange and mobile-carrier accounts involved in the event. If you suspect a SIM swap, contact the carrier through its official channel, restore control of the number and add the carrier’s account PIN or port-out protection where available. Tell the exchange about the suspected SIM swap because it may affect the credibility of SMS-based recovery.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How exchange controls differ
Do not treat one platform’s settings as universal. Before an incident, identify where each service places its security log and support form. During an incident, compare the exchange’s actual controls against the following questions.
| Control to check | Why it matters | What varies by platform |
|---|---|---|
| Emergency freeze or withdrawal restriction | Can stop a pending withdrawal while support investigates. | Some exchanges provide a user-controlled lock; others require support. Lock duration and effects differ. |
| Session and trusted-device revocation | Removes an attacker who already authenticated. | Some show IP, browser and device history; others provide only a global sign-out. |
| API-key management | Prevents automated trading or withdrawal access left by an attacker. | Permissions, last-used data and deletion controls are not consistent. |
| Withdrawal-address controls | Can expose or block a newly added destination. | Address allowlists, cooling-off periods and deletion options vary. |
| MFA choices | Raises the barrier to password reuse and phishing. | Passkeys, hardware keys, authenticator apps and SMS are supported in different combinations. |
| Evidence and claim process | Determines how quickly support can identify the incident. | Required screenshots, identity checks, police reports and deadlines are exchange-specific. |
Kraken
Kraken’s compromised-account instructions emphasize immediate contact, password reset, device scanning and software updates, along with reviewing sessions, MFA and API access. Use its current support workflow for the exact recovery steps.
Bitvavo
Bitvavo documents a crypto-withdrawal lock and directs users to harden email, review exchange settings and logs, and contact its fraud team. Treat those instructions as Bitvavo-specific rather than a standard exchange feature.
Coinbase
Coinbase provides an incident-reporting process and asks for incident details and screenshots. Its official warning states: “Coinbase will never ask for passwords or 2FA codes, or ask you to transfer money to a new address over the phone or via text.” Apply that rule to anyone claiming to represent support.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
OKX
OKX’s Shield is a voluntary, discretionary goodwill program, not insurance and not a guarantee of reimbursement. Its current guidance describes eligibility and required protections, including a passkey, large-withdrawal and web-withdrawal safeguards, device health and MFA for supported activities. It gives participants 72 hours after the last unauthorized transaction to contact OKX and submit a formal claim, followed by seven days to provide requested supporting information. Those deadlines apply to that program only; they do not create a general rule for other exchanges.
How to avoid a second loss
Account-takeover victims are targeted by impostors who claim they can recover funds. Treat an unsolicited call, direct message or “case agent” as untrusted even if the person knows your name, balance or transaction ID.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Never disclose a password, MFA code, backup code, seed phrase, private key or API secret.
- Never install remote-control software at a stranger’s request.
- Never transfer crypto to a new address to “secure,” “verify” or “unlock” an account.
- Verify support by opening the exchange app or typing its official address yourself.
- Reject advance-fee recovery promises. The U.S. Securities and Exchange Commission warns that recovery scams commonly demand payment before supposedly returning lost assets.
Keep communication inside the official ticket whenever possible. If a genuine exchange needs identity documents, submit them only through the authenticated support flow and check the domain carefully.
What to do after the emergency
Once access is stable, keep MFA enabled, retain the new unique passwords in a reputable password manager, and review the exchange’s security log periodically. Remove unused API keys and devices, keep withdrawal restrictions or address allowlists enabled when practical, and store backup codes offline. Recheck the email account because an attacker may return months later using a forgotten forwarding rule or recovery method.
Review your other financial accounts for password reuse, unfamiliar sessions and changed recovery details. The same email address, phone number or password may connect the exchange incident to banking, payment or investment accounts. Notify those providers through their official channels if you find related activity.
There is no universal exchange rule requiring reimbursement after a breach, and a security incident does not establish that an exchange will recover stolen crypto. Your country, the platform’s terms, the type of transaction and the quality and timing of your evidence all matter. Prompt official reporting, strong authentication and a complete record give you the clearest path to an investigation while limiting further damage.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
