Agent Lane robot mascotAgent Lane
Menu

Guide

Crypto exchange account hacked? What to do, step by step

Short answer: Lock the account first, using the exchange’s own app or website. Then take back your email, change passwords from a clean device, replace your two-factor login, remove anything you don’t recognize, write down every transaction you didn’t make, and report it. Ignore anyone who offers to get your crypto back for a fee.

By Agent Lane Editorial · Page dated 3 November 2026

How do I know my exchange account was hacked?

The FTC lists the usual signs of a taken-over account: you can’t log in, you get a notice about a password or username change you didn’t make, or you see a login from a device or place that isn’t yours. If your exchange sends security alerts, also watch for emails about a new device, a new withdrawal address or a withdrawal you didn’t ask for.

Check by opening the exchange app or typing its address yourself, not by clicking a link in the alert. Fake “suspicious activity” messages are a common way thieves get in.

What should I do first?

  1. Lock the account. On Coinbase, go to Security and choose Lock Account. Coinbase says this signs you out on every device and stops trading, sending and account changes until you unlock it. On Kraken, fill in the Account Security & Sign-in Issues form and choose the option about suspicious activity. Other exchanges have similar options in their help center.
  2. Take back your email. Whoever controls your inbox can reset your exchange password. The FTC says to change the email password, sign out of all devices, turn on two-factor login, check that the recovery phone and email are yours, and delete forwarding rules you didn’t set up.
  3. Clean your device, then change passwords. The FTC and Kraken both say to run a security scan and update your device first, so a hidden program can’t watch you type the new password.
  4. Replace your two-factor login. Set it up fresh rather than keeping the old one. Kraken suggests passkeys where you can.
  5. Remove what you don’t recognize. Kraken says to check that your withdrawal addresses, API keys (connections for apps and bots) and devices are all familiar, and to delete any you don’t recognize.

What if I can’t sign in at all?

Contact the exchange through its official help center, reached by typing the address yourself. Coinbase’s “Can’t access your account?” page lists a 24/7 phone line for locking a compromised account. Kraken says not to wait until you’ve tried to fix it yourself, because a thief may have locked you out.

If your phone also lost service out of nowhere, someone may have moved your number to their SIM card. The FTC says to contact your mobile carrier right away to take back your number, then change your passwords and check your accounts.

How do I record what the hacker did?

While you can still see the account, write down every transaction you didn’t make: the date and time, amount, type of crypto, the address it went to and the transaction ID. Take screenshots of the activity page and of any alert emails. Coinbase asks you to gather these details before you contact its support team about an unauthorized transaction, and you will need them for a police or FBI report.

Can I get stolen crypto back?

Often not. The FTC says crypto payments typically can’t be reversed, and Kraken says it can’t reverse a crypto transaction or recover funds sent to someone else. Report it anyway: tell the exchange, file a report with your local police (Coinbase says it works with authorities on these cases), and report it to the FBI at ic3.gov and the FTC at ReportFraud.ftc.gov. If a bank card was linked to the account, call your bank too.

Who might contact me offering to get it back?

Scammers. Fake “recovery” firms and fake government agents target people who just lost money. The FBI logged 10,516 recovery-scam complaints in 2025 with $1.4 billion in reported losses. The FBI says its IC3 will never ask for payment to recover lost funds, never refers you to a company that charges, and has no social media accounts. Type www.ic3.gov into your browser yourself, because fake IC3 sites exist.

How do I stop it happening again?

Once you are back in, set up the protections that make a stolen password useless: app or security-key two-factor login, a PIN on your phone account, a withdrawal allowlist and an account lock. The full list is in how to lock down your crypto exchange account. If the thief got in through a fake login page, learn how to check a crypto website is real.

Sources

Checked 3 November 2026 on each organization’s own site.

Related guides

All guides