CoinFeeHub reference
If your exchange account is compromised: the first hour
Lock the account first, then secure your email and passwords from a clean device, then report. Freezing the account stops further withdrawals; nothing reliably reverses an on-chain transfer that has already confirmed. On a wallet-based exchange there is no account to freeze: move what is left to a new wallet and revoke approvals. If you only clicked a suspicious link and see no unknown logins or withdrawals, start with steps 2 and 3; freeze as soon as you see either.
Step 1: freeze the account (minutes 0–5)
If you can still sign in safely, delete API keys first (one minute), then freeze. After a freeze, finish the remaining steps with the exchange’s support.
| Exchange | Self-service lock | What it does | Official page |
|---|---|---|---|
| Binance | Disable account (Security → Account Management) | Blocks access to protect assets when you see suspicious activity | Binance FAQ (updated 2025-11-24) |
| Bybit | Deactivate account | Blocks login; stolen assets are reported separately | Deactivate (updated 2026-03-04) · Report stolen assets |
| OKX | Freeze account (web or app) | Blocks login; you can unfreeze later after verification | OKX help (updated 2026-08-25) |
| Gate | No self-service freeze found on the pages checked | Contact support in the app; withdrawals pause 24 hours after any security-setting change | Gate Help Center · 24-hour block |
| BingX | Account locking (listed in the safety guide) | Locks the account from the security settings | BingX safety guide |
| MAX | No self-service freeze found on the pages checked | Contact MAX support | MAX support |
| Hyperliquid · Aster | None — wallet-based | Treat the wallet as burned and move remaining funds to a new wallet | Hyperliquid docs |
Steps 2–6: the rest of the hour
2. Secure email and passwords from a clean device (minutes 5–20)
Use a device you trust, not the one that clicked the link. Change the email password first (it resets everything else), then the exchange password, then re-set 2FA with an authenticator app or passkey.
3. Revoke API keys, sessions and devices (minutes 20–25)
Delete every API key you did not just create, sign out all sessions and remove unknown devices. On a wallet, revoke token approvals — Hyperliquid’s docs point to revoke.cash.
4. Contact support only through verified channels
Use in-app chat or a contact you have checked with an official tool such as Binance Verify. Anyone who contacts you first and asks you to move funds to a “safe” wallet is the attacker; Coinbase says it never asks for passwords, 2FA codes or transfers to a new address.
5. Record evidence
Save transaction hashes, receiving addresses, times (with time zone), screenshots of login alerts and every message from the attacker.
6. Report
- United States: FBI IC3.
- Taiwan: the 165 anti-fraud hotline or 165.npa.gov.tw, and your local police station.
- Elsewhere: local police, then the exchange’s stolen-asset report with the police reference.
What exchanges will and won’t do
| Situation | What has happened in practice | Source |
|---|---|---|
| Exchange-side hack | Some exchanges covered balances from reserves: Bybit (1:1 backing, 2025), Bitget (Protection Fund, 2026). This is the exchange’s decision, not insurance | Bybit 2025-03-03; Bitget 2026-09-26 |
| Your account taken over | Generally treated as your loss. Coinbase’s 2025 reimbursement covered customers tricked by attackers using data leaked from Coinbase itself | Coinbase 2025-05-15 |
| Wallet-based exchange | No one can reverse a signed transaction; Hyperliquid’s guidance is to move funds and revoke approvals | Hyperliquid docs |
| Stablecoin freezes | Issuers sometimes freeze stolen tokens: about $1.1M was frozen in the Bitget case | The Hacker News 2026-10-01 (secondary) |
Common questions
Can the exchange reverse a withdrawal?
Not once it is confirmed on-chain. A freeze stops further withdrawals; a report can help if funds reach another exchange or a stablecoin issuer that freezes them.
Should I pay a “fund recovery” service?
CoinFeeHub’s editorial view: treat any paid recovery offer that contacts you after a theft as a likely second scam, and report it.
Will reporting get my money back?
Not necessarily. Reports support investigations and freezes; keep your evidence and reference numbers.
How do I avoid this next time?
Use the 15-minute setup and learn the six takeover patterns.
Sources and editorial notes
Sources checked 2026-10-07. The order and timings of the steps are CoinFeeHub editorial guidance; exchange procedures come from their official help pages.
- Binance · How to disable your account · updated 2025-11-24
- Binance · Official verification
- Bybit · Deactivate your account · updated 2026-03-04; Report stolen assets
- OKX · Freeze your account · updated 2026-08-25
- Gate · Help Center; 24-hour withdrawal block
- BingX · Safety user guide
- MAX · Support
- Hyperliquid · “I got scammed/hacked”
- Coinbase · Standing up to extortionists · 2025-05-15
- Bybit · Security incident timeline · 2025-03-03
- Bitget · Withdrawals resume in phases · 2026-09-26
- The Hacker News · Bitget confirms third-party zero-day · 2026-10-01 (secondary)
- FBI IC3 · Taiwan 165 anti-fraud
Change note
2026-10-07 · Page created with per-exchange freeze links and a six-step first hour.