Someone has gained access to my crypto exchange account. What should I do?

Hackers can empty your cryptocurrency exchange account if they gain access to your password or login details. This most often happens through phishing links (fake websites), messages, or malware that secretly steals data. GetBlock AML Research publishes a step-by-step guide on what to do if your exchange wallet is hacked.

Sometimes attackers guess weak passwords, use old data leaks, or perform a “SIM swap” — when they intercept your phone number to bypass two-factor authentication (2FA). Once they gain access, they withdraw money to anonymous wallets and then cover their tracks by running the funds through special services or exchanges.

When a person logs in and sees their money is gone, it’s a real shock. In the world of cryptocurrencies, losing funds from an exchange is considered the worst-case scenario. At this point, it’s not the time to blame yourself — you need to act quickly and calmly.

Freeze and protect all access points

To prevent hackers from logging back into your account, you need to block all means of access to it.

• First, change your password — be sure to do this from a device that is not infected with viruses.
• Cancel all API keys — these are special “keys” that trading bots and third-party applications use to connect to the exchange.
• Disable linked wallets or third-party services, if any.
• Enable or update two-factor authentication (2FA).
• Write to the exchange’s official support using verified contacts — not random links. Scammers often pose as support to steal additional data.

Gather evidence and record what happened

Once you have secured your account, you need to record all the details of the incident.

• Take screenshots of suspicious transactions, addresses where your money went, and correspondence with support.
• Download the history of all transactions: deposits, withdrawals, and logins.
• Save emails and text messages related to login attempts, password changes, or withdrawals.

All this data will help you and investigators reconstruct the chain of events leading up to the fraud. The documents will be useful when communicating with the exchange, contacting the police, or filing insurance claims. The more accurately you record everything, the higher the chance of tracking down the stolen funds and proving your case.

Report the incident to the exchange and submit an official report

Notify the exchange about the incident as soon as possible. Attach all evidence: dates, amounts, screenshots, transaction numbers.

If you don’t get a response for a long time, escalate the issue through official social media channels or higher levels of support. Ask them to temporarily block your account and help track the stolen funds.

Also, file a report with the appropriate government agencies:

• in the US — the Internet Crime Complaint Center (IC3);
• in the UK — Action Fraud;
• in other countries — similar cyber police departments.

The sooner you report the incident, the higher the chance of recovering at least some of the funds.

Start tracking the stolen funds (if possible)

After notifying the exchange and the police, you can try to track the path of the stolen money. To do this, use special tools that show the movement of funds in the blockchain. In some cases, you can see where the funds went — to an exchange, to a service for hiding traces, to another wallet, etc.

Pass on all the data you find to the exchange and law enforcement agencies — this helps to coordinate the search more quickly. Even if you can’t get your money back right away, accurate tracking increases the chances of freezing the funds in the future.

Protect other accounts and devices

Once the immediate threat has been stopped:

• Run a full antivirus scan on all devices.
• Find out if your data has ever been leaked (using services such as Have I Been Pwned).
• Change your passwords everywhere — email, social media, exchanges — using different and complex options.
• Transfer your remaining funds to more secure storage, such as hardware wallets.
• Alert the community and monitor the movement of funds
• Report what happened to your crypto communities — sometimes, users can help track down the hacker’s wallet.

Share:

• wallet addresses,
• links to suspicious transactions,
• details of the incident.

Many exchanges monitor such signals and can freeze funds if notified in time. You can also set up automatic notifications to track the movement of stolen funds in real time. This will help you promptly report new movements to investigators or the exchange.

Collective monitoring often helps to detect malicious activity more quickly and prevent further abuse.