Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →If you clicked a fake exchange link, assume the attacker may have your password, one-time code, session cookie, email access, or withdrawal settings. Stop using the phishing page, preserve evidence, lock the exchange account from a clean device if that option exists, then secure your email, replace exposed authentication factors, revoke access, and inspect every money-movement control.
The sequence matters: changing only the exchange password can leave an attacker signed in through an existing session, an API key, a compromised mailbox, or a changed withdrawal address. The steps below apply to accounts at exchanges such as Binance, Coinbase, Kraken, and similar platforms, although menu names and recovery options differ.
As an Amazon Associate I earn from qualifying purchases.
What to do in the first 15 minutes
1. Stop interacting with the phishing page
Close the tab and do not enter another password, verification code, recovery phrase, payment detail, or identity document. Do not click follow-up links in the same message. If the page asked you to install software, browser extensions, or a remote-access tool, disconnect that device from the internet and use a different, trusted device for account recovery.
Keep the original email, text, direct message, or advertisement. Record the complete URL, sender address or account, the time you clicked, the fields you entered, screenshots of the page, and any exchange alerts or transaction notifications. Do not forward the message in a way that could execute its links; save it as evidence instead.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
2. Open the exchange only through a trusted route
Use the exchange’s official mobile app downloaded from the device’s normal app store, or type a known address yourself or use a bookmark you created before the incident. Do not use a search advertisement or a link supplied by someone claiming to be support. If the exchange offers an account-lock, freeze, or disable function, use it immediately. Coinbase summarizes this priority as “Lock first, ask later.”
A lock is containment, not recovery. It may stop withdrawals while support investigates, but it does not automatically remove an attacker’s sessions, API keys, email access, or changed recovery details.
3. Contact official support about any unauthorized activity
Use the support channel published inside the official app or on the exchange’s genuine website. Report the phishing event, the time it occurred, the account identifier, and every unfamiliar deposit, withdrawal, trade, address, API key, device, or security-notification change. Ask whether the exchange can freeze withdrawals, reverse a pending transfer, or preserve account logs. Cryptocurrency transfers can be irreversible, so speed matters.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteAn alleged support agent should never receive your password, one-time code, recovery phrase, private key, remote-access permission, or a request to send cryptocurrency to “secure” funds. Anyone asking for those things is treating you as a second target.
Change credentials from a clean device
Change the exchange password
On a device that was not exposed to the phishing page, create a long, random, unique password for the exchange. A password manager can generate and store it. Do not modify the old password by adding a number or symbol, and do not reuse it on email, cloud storage, banking, or another exchange. The Federal Trade Commission’s hacked-account guidance is direct: change the account password and make it hard to guess.
If the exchange will not let you change the password because the account is locked, follow its official recovery flow and tell support that the credential was exposed. Do not repeatedly guess passwords; failed attempts can trigger additional locks and create confusion for the support team.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Change the registered email password
Secure the mailbox that receives exchange messages before relying on it for account recovery. Use a new password that is not shared with the exchange. If the phishing page captured your email password, assume the attacker can read reset messages and security alerts until you replace it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAfter changing it, sign out of other email sessions, remove unfamiliar devices and third-party applications, and replace any exposed email two-factor method. Keep the exchange and email credentials separate so one stolen password cannot unlock both systems.
Revoke every untrusted session, device, application, and API key
Open the exchange’s security, devices, sessions, applications, or API-management area. Sign out of all sessions, including ones that look familiar if you cannot verify them. The FTC specifically advises users of compromised accounts to “Sign out of all devices.”
Remove unfamiliar phones, browsers, connected applications, and address-book permissions. Delete every API key you do not recognize and recreate legitimate keys with the smallest possible permissions. A trading key should not have withdrawal permission. If the exchange cannot show a key’s origin or last use, revoke it and create a replacement only after the account is secure.
Secure the email channel attackers use to reset accounts
Email is part of exchange security, not a separate housekeeping task. Kraken warns that someone controlling the registered email may be able to request the username, reset the exchange password, and approve withdrawals. Coinbase also provides controls for removing unauthorized applications, sessions, and devices.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Inspect mailbox settings
- Delete forwarding addresses you did not add.
- Remove filters or rules that automatically archive, delete, mark as read, or forward exchange messages.
- Check recovery email addresses and phone numbers; remove unknown entries and confirm that your own details still work.
- Review authorized applications, active sessions, and recent sign-in history.
- Search for exchange notices about password, email, two-factor, API, address-book, or withdrawal changes.
Attackers often create a quiet forwarding rule instead of changing the mailbox password. If you find one, assume messages may have been copied and repeat the exchange recovery steps after cleaning the mailbox.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Replace exposed two-factor authentication
If you typed a one-time code into the fake page, treat that factor as exposed. A code is valid only briefly, but an attacker may use it immediately to approve a login, register another factor, create a session, or alter withdrawal settings. Replace the factor rather than simply waiting for the code to expire.
| Second factor | Phishing resistance | Recovery and backup considerations | When to use it |
|---|---|---|---|
| Passkey or FIDO hardware security key | Strongest option listed here; the credential is bound to the legitimate site or app and is difficult to replay on a fake domain. | Plan a backup key or another documented recovery method. Confirm that both the exchange and your email provider support the factor. | Preferred for the exchange and email whenever supported. Coinbase says hardware keys are best and specifically recommends a YubiKey or similar key. |
| Authenticator-app TOTP | Stronger than SMS, but a code can still be phished in real time. | Store the app’s recovery information offline and verify that you can restore it before deleting the old factor. | Use when passkeys or hardware keys are unavailable. |
| SMS code | Weaker because phone-number takeover and SIM-swap attacks can redirect messages. | Recovery depends on control of the mobile number and the carrier account. | Fallback only when stronger methods are not supported. |
Set up a passkey or hardware key correctly
Register the passkey or security key only from the genuine exchange app or website after the account and email are clean. Add a second key and store it in a separate secure location if the platform permits multiple keys. Test a normal sign-in and a sensitive action, such as changing security settings, before ending the recovery session. Keep the key available for the email account too; protecting only the exchange leaves the reset channel vulnerable.
Use an authenticator app when a key is unavailable
Enroll a fresh TOTP secret rather than continuing to use one that was displayed or entered during the incident. Save recovery codes offline in a place that is not the same device as the authenticator. Never store a screenshot of the QR code in a cloud photo library or send it through email. A TOTP code is still phishable, so verify the domain and app before every login.
Treat SMS as a temporary fallback
If SMS is the only method the exchange accepts, strengthen the mobile account with a carrier PIN and remove unnecessary number-porting permissions. Move to a passkey, hardware key, or authenticator app as soon as the exchange supports one. Do not disable a stronger factor merely to make recovery easier.
Audit controls that can move your money
Review withdrawal addresses and allowlists
Open the withdrawal-address book or allowlist and compare every entry with records you recognize. Delete unfamiliar addresses and check whether an attacker changed labels, cooldowns, or the destination network. If the exchange supports withdrawal allowlisting, enable it after removing unauthorized entries. Allowlisting limits withdrawals to addresses you approve, although it may introduce a waiting period before a new address becomes usable.
Check transaction and trading protections
- Review all deposits, withdrawals, conversions, trades, and internal transfers since the phishing event.
- Turn on transaction or withdrawal 2FA if it is separate from login 2FA.
- Confirm that address-change alerts, withdrawal alerts, and login notifications go to the clean email or another trusted channel.
- Inspect open orders, recurring purchases, staking instructions, and permissions for third-party trading tools.
Capture transaction IDs, destination addresses, timestamps, and network names for anything unauthorized. Give those details to official support immediately; do not attempt a test transfer to an address supplied by a supposed investigator.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Restrict API permissions
API access can survive a password change. Delete unknown keys and review legitimate ones for read, trade, transfer, and withdrawal permissions. Use separate keys for separate purposes, disable withdrawal access whenever possible, and rotate keys after the incident. If you cannot explain why a key exists, revoke it.
Handle different phishing outcomes
You entered only your username or email
Continue with the full containment sequence. The information can help an attacker target your mailbox or impersonate support, even if no password was entered. Watch for password-reset messages and phone calls that use the incident as a pretext.
You entered the exchange password
Change both the exchange and email passwords from a clean device, then revoke sessions, applications, and API keys. Do not assume the attacker stopped when the page closed; they may already have created a persistent session or changed a withdrawal address.
You entered a one-time code or approved a push notification
Use the exchange lock immediately if available, report the event as an account takeover, and replace the exposed second factor. Inspect security settings and money movement before unlocking the account. A valid code may have authorized a sensitive action even if the fake page displayed an error afterward.
You installed remote-access software or a browser extension
Stop using that device for financial accounts. Disconnect it from the network, remove the unauthorized software only if you can do so safely, and run the device maker’s security checks or obtain professional help. Change exchange and email credentials from a different clean device, because malware may capture new passwords and codes.
Recommended Free Tools
You connected a wallet or signed a transaction
Separate exchange recovery from wallet recovery. Review the wallet’s approved token spenders and connected sites, revoke unfamiliar approvals using a trusted wallet interface, and move remaining assets only after confirming the destination and network. Never reveal a seed phrase or private key to exchange support or anyone claiming to reverse a transaction.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Use the exchange’s controls as a checklist
Names vary, but the following areas should exist somewhere under Security, Account, Privacy, or API settings. Work through each one rather than stopping after the password page.
| Control | What to verify | Desired result |
|---|---|---|
| Account lock or freeze | Whether withdrawals and trading can be halted instantly | Use during suspected takeover, then follow official reactivation steps. |
| Sessions and devices | Browser, phone, location, last-use time, and active status | Only devices you recognize remain signed in. |
| Connected applications | Apps, permissions, and authorization dates | Unknown applications are removed. |
| API management | Key owner, last use, IP restrictions, and transfer permissions | Unknown keys are deleted; legitimate keys have minimum permissions. |
| Withdrawal address book | Addresses, labels, networks, cooldowns, and allowlist status | Only verified destinations remain and allowlisting is enabled where available. |
| Authentication | Login, trading, withdrawal, and address-change requirements | Strongest available factor protects every sensitive action. |
| Notifications | Login, password, 2FA, API, address, and withdrawal alerts | Alerts reach a clean channel you monitor. |
Build durable protection after containment
Use a dedicated exchange email
Create an address used only for financial accounts and protect it with a passkey or hardware key. Do not publish it on social media or use it for newsletters. A dedicated address reduces the chance that a leaked mailing-list password becomes an exchange attack.
Use a password manager without sharing vault access
Generate a different password for every exchange, email account, and financial service. Protect the manager with a strong master password and its strongest supported second factor. Keep emergency recovery information offline and do not place it in the same mailbox that the exchange uses for resets.
Free tools Windows power users keep installed
One-click scans. No signup required.
Enable anti-phishing features
Some exchanges let you set a personal anti-phishing phrase or code that appears in legitimate emails. Choose a value that does not reveal personal information. If an email lacks the expected phrase, treat it as suspicious and open the app directly instead of clicking its links.
Keep withdrawal allowlisting and transaction checks enabled
Allowlisting adds friction, but that delay can give you time to spot an unauthorized change. Keep a written record of approved addresses, networks, and account ownership. Before every large transfer, verify the address on a separate trusted screen and confirm the network; a correct address on the wrong network can still cause loss.
Monitor the account after you regain access
For at least the next several weeks, review sign-in history, device lists, API activity, mailbox rules, withdrawal addresses, and transaction alerts on a regular schedule. Watch for password-reset emails, new-device notices, changes to recovery details, and small “test” withdrawals. Keep the evidence you collected and add new timestamps and transaction IDs to the same record.
If suspicious activity returns, lock the account again and contact official support through the published channel. Do not negotiate with the attacker, pay a recovery fee, or trust a social-media account that claims to be able to retrieve funds. Recovery services cannot legitimately need your password, 2FA code, seed phrase, or a transfer from you.
Why changing only the password fails
A password is one credential in a larger access chain. An attacker can remain effective through an existing browser session, an authorized application, an API key, a forwarding rule in your mailbox, a changed recovery phone number, or a withdrawal address added before you changed the password. That is why a complete response combines account lock, password replacement, email cleanup, session and API revocation, fresh authentication factors, and a transaction audit.
The safest habit after recovery is to reach the exchange through a saved bookmark or official app, verify every domain before entering a code, and treat unsolicited support messages as hostile. Coinbase’s security guidance recommends using the strongest 2FA the platform allows, ideally a YubiKey or similar hardware security key; the FTC’s guidance reinforces signing out everywhere after an account compromise.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
