How fast you react after an exchange account gets hacked determines how much of your assets you can recover. This article gives you a 5-step emergency playbook. The bottom line up front: the faster you respond, the better — respond within 1 hour and you can typically recover 50-80% of assets; within 24 hours, 30-50%; beyond 24 hours, recovery drops below 10%. Any delay can turn into a permanent loss. For your everyday primary/backup account setup, register your primary account through Binance Official Site, install the Official Binance App on Android, and if you're on iPhone, see the iOS install guide for switching to an overseas Apple ID.

Step 1: Freeze Your Account Immediately (< 5 minutes)

The very first move once you discover your account has been compromised.

Signs your account may have been hacked:

Immediate freeze actions:

1A. If you can still log in:

1. Change your login password immediately (use a strong password, 16+ characters)
2. Update your 2FA settings (re-bind Google Authenticator)
3. Force logout on all devices
4. Revoke every API key
5. Check your withdrawal whitelist and remove any suspicious addresses
6. Contact customer support to request an "emergency freeze" on your account

1B. If you can no longer log in:

1. Immediately email support from your registered email address
2. Subject line: "Account Hacked - Emergency Freeze Request"
3. Include: your username + KYC name + registration date + a request for an emergency freeze
4. At the same time, submit a report through the app's "Can't log in" channel
5. Support typically responds within 30 minutes to 2 hours

Emergency freeze channels at major exchanges:

Q: How long does it take an exchange to freeze a hacked account?

Typical response times at major exchanges:

Once frozen:

Response time is a race against the clock — the hacker may still be moving your assets while you wait.

Step 2: Revoke Every API Key (< 10 minutes)

API keys are one of the most common entry points for a hack.

The risk with API keys:

Steps to take:

1. Log into your account (or go through the emergency freeze process)
2. Go to the "API Management" page
3. Delete every API key (even ones you believe you created yourself)
4. If you need to create a new one:
   - Restrict it with an IP whitelist
   - Disable "withdrawal permission" (keep only "read" + "trade")
   - Set an expiration date

Principles for secure API key configuration:

A real case:

In 2024, an employee at a quant trading team accidentally pushed an API key to a public GitHub repository. A hacker found it within 15 minutes and used it to drain $800,000 USDT from the team's exchange account. The root cause wasn't a failure at the exchange — it was the leaked API key.

Q: How do API keys typically leak?

Common paths:

  1. Public GitHub repos: a developer accidentally commits the key in code and pushes it
  2. Third-party quant platforms (like 3Commas, Cryptohopper) suffering a data breach
  3. A local config file being read by malware
  4. Screenshots shared without blurring the key
  5. Configs pasted into chat apps (WeChat/Telegram)

Prevention: API keys should never enter a Git repository — use .gitignore to exclude config files.

Step 3: Contact the Platform's Risk Control Team (< 30 minutes)

What risk control can do:

Contact channels:

Exchange Risk control contact channel
Binance In-app support → "Select issue: Account hacked" → auto-routes to risk control
OKX In-app support → "Account security issue" → routes to risk control
Bybit In-app support → "Account hacked" → routes to risk control
Coinbase Website appeal form → "Unauthorized Activity"
Kraken support@kraken.com → "Account Compromised"

Information to give risk control:

How risk control typically handles it:

  1. Verify your identity (via email/video call)
  2. Pull backend logs to confirm the hack
  3. Freeze the account + trace the flow of funds
  4. Give you feedback within 24-72 hours

Q: Will risk control compensate me for the stolen funds?

Usually not:

Scenarios where compensation does happen:

For an ordinary user whose password was phished, the platform has no obligation to compensate you.

Step 4: Trace the Funds On-Chain (< 2 hours)

If the funds have already moved on-chain:

Once assets move on-chain, they can be tracked in real time. On-chain tracing tools:

1. Etherscan / Solscan / BSCScan

2. Chainalysis Reactor (professional tool)

3. Arkham Intelligence (semi-professional)

4. SlowMist MistTrack

How to handle each key destination node:

Fund destination How to handle it
Funds moved to a CEX like Binance/OKX Contact that CEX's risk control team immediately to freeze it
Funds entered a mixer (Tornado Cash / Railgun) Almost impossible to recover
Funds bridged to another chain Keep tracing on the new chain
Funds moved to an OTC exchange Contact the OTC service provider

A real case:

In 2024, a user's Binance account was hacked for $50,000 USDT, and the hacker withdrew it onto the ETH chain. The user immediately contacted Binance's risk control team and a Chainalysis team. On-chain analysis showed the funds moved to an OKX account 30 minutes later; Binance's risk control team immediately contacted OKX's risk control to freeze it. In the end, 80% of the assets were recovered.

Q: Once a hacker moves money into Tornado Cash, can it still be recovered?

Tornado Cash is a mixer, and recovery is theoretically impossible:

That said:

Ordinary users should act to stop the bleeding before funds get mixed.

Step 5: File a Police Report + Legal Options (< 24 hours)

Why file a police report:

Reporting channels:

Mainland China:

Outside China:

Materials needed for a report:

How hard legal action is:

Q: Will the police actually do anything if I report it?

They'll open a case, but the depth of the actual investigation is limited:

The real value of filing a report:

  1. Creates evidence you can use for exchange appeals
  2. Helps stop the same hacker from targeting others (they may stop once law enforcement is watching)
  3. Psychological closure (talking it through beats bottling it up)

Protecting What's Left After a Hack

Move any remaining assets right away:

If your account is frozen but still has some assets left:

Why you shouldn't keep using a hacked account:

Security Upgrades After a Hack

Upgrade the security on every related account:

1. Strong passwords + a password manager

2. Hardware 2FA (YubiKey)

3. Anti-phishing code

4. Withdrawal whitelist

5. API key management

6. A dedicated email

Q: Can I keep using crypto after being hacked once?

Yes, but your security awareness has to level up:

Many users quit crypto entirely after getting hacked, but learning to use it safely matters more than giving up.

How to Handle Different Scenarios

Scenario 1: Password phished

Scenario 2: API key stolen

Scenario 3: Email hacked, exchange account compromised as a result

Scenario 4: Phone stolen along with Google Authenticator

Scenario 5: Phone number SIM-swapped

Frequently Asked Questions

Q: How long does it take to get money back after a hack?

Rough timeline:

Q: Can I sue the exchange after being hacked?

Usually you won't win:

Comparable domestic cases:

Q: Can I buy insurance to protect against being hacked?

DeFi insurance:

CEX insurance:

Homeowner's/renter's crypto insurance:

Q: Can I still trust that exchange after being hacked?

It depends on the root cause:

The major exchanges (Binance, OKX, Coinbase, etc.) are generally secure overall — most of the problems come from users themselves.

Q: Can I re-register with the same email?

Yes. There's nothing wrong with reusing the email itself (unless the email was also hacked):

If your email itself was hacked, you must switch to a new one.

Q: What if the hacker moved the assets to Binance?

Contact Binance's risk control team right away:

  1. Provide your police report + the on-chain transaction hash
  2. Binance's risk control team pulls up the hacker's account
  3. They freeze that account
  4. They cooperate with the police investigation

Major exchanges like Binance tend to cooperate well with accounts flagged in a case, but speed of response is what matters most (< 24 hours).

Q: How do I cope emotionally after being hacked?

Being hacked is a traumatic event, and common reactions include:

Suggestions:

Q: Can I file a report anonymously?

In some countries, yes:

But reporting under your real name generally leads to deeper follow-up — don't sacrifice the depth of the investigation just to stay anonymous.

Data Sources

Risk disclaimer: This article is an independent third-party summary and does not constitute investment or legal advice. Preventing account theft is 100 times more valuable than responding to it after the fact. All data is as of April 2026.