Account hack

Exchange account hacked and funds withdrawn: what to do now

Someone logged into your Binance, Bybit, OKX or other exchange account and withdrew your crypto. The transfer on the blockchain cannot be undone, but the exchange holds most of the evidence — login records, IP addresses, devices, the destination address — and the stolen funds often pass through other platforms that can freeze them. Here is what to do in the first hours, what to ask the exchange for, when the exchange is actually responsible, and how to turn all of it into a police report and a claim.

Updated 17 October 2026 · about 9 minutes to read

The first hour: lock everything down

Assume the attacker still has access — to the exchange account, to your email, possibly to your phone number. Work from a device you trust.

1. Freeze the exchange account. Many exchanges have a “disable account” or “lock account” option in the security settings or the app. If you cannot log in, open a ticket or live chat through the official website or app and write clearly: “My account was compromised, funds were withdrawn without my authorisation, please freeze the account and block all withdrawals.” Save the ticket number.
2. Take back your email first. Change the email password, sign out all sessions, check forwarding rules and filters (attackers often add a rule that hides exchange notifications), and remove recovery phones or addresses you do not recognise.
3. Change the exchange password and reset two-factor authentication. Use an authenticator app or a hardware key, not SMS. If the attacker changed the 2FA, go through the exchange’s recovery procedure via official channels only.
4. Check API keys. Delete every API key you did not create, and preferably all of them. A key with trading or withdrawal permissions lets someone act without logging in.
5. Check the withdrawal whitelist and saved addresses. Remove anything you did not add, and note those addresses — they are evidence. Turn the whitelist on if it was off.
6. Log out all devices and look for unknown sub-accounts or linked cards.
7. If your phone suddenly lost signal, call your mobile operator at once: it may be a SIM swap. Get the number back and ask the operator, in writing, when and where the SIM was reissued.

Work out how they got in

It matters for the claim. Common routes:

• Phishing. A fake login page, often reached from an advert or a message about a “suspicious login”, captured your password and 2FA code in real time.
• Malware. A cracked program, a browser extension or a “trading bot” stole saved passwords and session cookies. Session theft can bypass 2FA entirely.
• SIM swap. The attacker took over your phone number and received SMS codes.
• Leaked or reused password combined with weak or SMS-only 2FA.
• API key leak from a third-party bot or tool you connected.
• Something on the exchange side: a withdrawal that went through without the security checks your settings required, a recovery granted to someone else, or a data leak.

What to request from the exchange

The exchange has records you cannot get anywhere else. Ask for them in writing, in the ticket, and keep the request polite and specific:

• login history for the relevant period: dates and times, IP addresses, device and browser data, location estimates;
• a list of security changes: password, email, 2FA, phone, API keys, whitelist entries, anti-phishing code — with times and IPs;
• every withdrawal and transfer: amount, asset, network, destination address, transaction hash (TXID), and internal transfers to other accounts on the same exchange;
• whether the destination address belongs to another account on the same exchange — if so, ask them to freeze that account and preserve its data for law enforcement;
• confirmation that the account is frozen and that the logs will be preserved.

Exchanges often refuse to give IP data or third-party information directly to a customer, and will give it only to the police or under a court order. That is normal. Ask anyway: the request to preserve data matters most. In the EU and the UK, data protection law gives you a right of access to personal data the company holds about you, which can cover your own login records.

Export what you can see yourself: transaction history, the security log, and the original notification emails about logins and withdrawals.

Is the exchange responsible?

Honestly: often not, and sometimes yes. Exchange terms usually say the customer is responsible for keeping credentials and devices secure. If the attacker logged in with your correct password and 2FA code obtained by phishing or malware, the exchange will normally say that, from its side, the owner logged in.

A claim against the exchange becomes realistic when there is something the exchange did or failed to do:

• the withdrawal passed without a check your settings required — no 2FA prompt, no email confirmation, or a newly whitelisted address used immediately despite the platform’s own waiting period;
• you asked for a freeze and withdrawals continued afterwards;
• support reset your 2FA or email for someone else without proper verification;
• an obvious pattern its risk systems should have flagged — new device, new country, whole balance out in minutes — weaker alone, but it adds weight;
• a security incident or leak on the exchange side.

If the number was taken over through a SIM swap, part of the responsibility may lie with the mobile operator that reissued the SIM. That is a separate claim that depends on local law.

Report to the police

A police report is needed in almost every scenario: exchanges and other platforms disclose account holder data to law enforcement, not to victims, and a report with a reference number makes your freeze requests to other platforms more credible. Include the TXIDs, destination addresses, the exchange’s ticket number and the login records you have. See how to report crypto theft to the police, and use the templates for the written statement.

Follow the withdrawal

Stolen funds rarely stay at the first address. They are usually split, swapped and moved towards a place where they can be cashed out — often another exchange. Those exchanges and stablecoin issuers can sometimes freeze funds that reach them, but they act on clear requests with evidence, ideally backed by a police reference, and speed matters.

• Open the TXID in a block explorer for the right network and note where the funds went next.
• If they reached a known exchange, write to its compliance or law enforcement contact with the TXIDs and your police reference, and ask for a freeze and data preservation.
• If the theft was in USDT or USDC, the issuer can in some cases freeze tokens at a specific address — usually on a request from law enforcement.

Whether a trace is still worth doing depends on the amount, the time passed and the route. Our short test on whether funds can be traced and frozen gives an honest first answer, and the first 48 hours guide explains the timeline in detail.

Formal complaint and claim against the exchange

If you see grounds for the exchange’s responsibility, build the case in steps:

1. Formal complaint. Not the chat: a written complaint through the exchange’s official complaints procedure, with a timeline, the security failure you rely on, the amounts and what you ask for. Ask for a final answer within a reasonable period.
2. Regulator or ombudsman. If the exchange entity serving you is licensed in your country or region, its regulator may have a complaint route. Check in the terms which group company your contract is with.
3. Court or arbitration. The terms usually name the governing law and the forum, sometimes arbitration abroad. Whether that clause binds you as a consumer depends on your country. See how a claim against an exchange works.

If the exchange blocks your account during its own review after the hack, that is a separate problem with its own procedure — see when an exchange freezes your account.

If the amount is significant or you think the exchange failed to apply its own security checks, it is worth having the file reviewed. Describe what happened and we will tell you plainly, free of charge, whether there is a realistic route — against the exchange, through a freeze downstream, or neither.