What to Do If Your Exchange Is Hacked or Freezes Withdrawals

By Gurjeet Singh, developer of CoinPriceAlert · Published 5 August 2026 · 8 min read

Three different emergencies that look the same

A missing balance on an exchange can mean three very different things, and the first steps are different for each. The exchange itself may have been hacked or become insolvent, in which case everyone's funds are affected and the problem is getting out, or getting in line. Your own account may have been taken over through a stolen password, a SIM swap or a phishing page, in which case the exchange is fine and the attacker is you, as far as it can tell. Or an API key you gave to a bot or tool may have been used to trade your balance away, which leaves your login untouched.

Look at what you can see before acting. If the exchange's status page, official social accounts or app show withdrawals suspended for everyone, it is the first case. If you received login or withdrawal emails you did not trigger, it is the second. If the history shows a burst of trades in small coins you never touched and no withdrawals at all, it is almost always the third.

If the exchange is failing: withdraw while you can

If withdrawals are still open, withdraw. Do not wait for an official statement: by the time an exchange confirms a problem, withdrawals are usually already suspended, and historically the gap between the first credible rumours and the freeze has been hours rather than days. Being early and wrong costs a network fee. Being late and right can cost everything on the platform.

Send funds to a wallet you control, not to another exchange you have not checked, and send a small test transaction first if the network is congested or the address is new. Use the exchange's official app or a bookmarked address rather than a link from social media, because every crisis brings a wave of fake "withdrawal portals" built to catch people in a hurry.

If the exchange announces a hack but says customer funds are covered, read the statement closely. "Covered" can mean an insurance fund, a promise from the owners or a plan to be announced later, and the practical difference between them is large. Withdrawing what you do not need to trade is still the lower-risk choice until withdrawals have run normally for some time.

If your own account was taken over: the first hour

Start with the things that let the attacker keep acting. Delete every API key on the account, because a key keeps working after you change the password. Change the password from a device you trust, sign out of all other sessions and devices, and replace the two-factor method if there is any chance it was compromised. If the exchange offers a self-service option to freeze or disable the account, use it; it can be lifted later.

Then check what the attacker may have changed to come back: the withdrawal address whitelist, the email and phone number on file, the anti-phishing code and any sub-accounts. An unfamiliar address added to the whitelist is the most urgent thing to report.

Secure the email account next. Most account takeovers go through the inbox, because that is where password resets and withdrawal confirmations are sent. Change its password, turn on an authenticator app or a hardware security key, and look for forwarding rules or filters you did not create, which attackers add to hide the exchange's warning emails from you.

If your phone number suddenly lost service before the incident, call your carrier from another phone. Losing signal without explanation is the classic sign of a SIM swap, where someone moves your number to their SIM to receive your text-message codes.

If an API key was used: why nothing was withdrawn

This is the case people search for most and understand least. A key with trading permission but no withdrawal right cannot send your coins out, and on Binance a key cannot withdraw at all without an IP whitelist. It can still move the value out. The attacker buys a thinly traded coin cheaply in their own account, then uses your key to buy it from them at many times the price. Your balance becomes theirs through a string of ordinary trades.

Binance's own security guidance describes this: a compromised key can be used to pair trade assets with small trading volume and slowly siphon funds. In the largest known case, a trading-bot service confirmed in December 2022 that users' API keys had been disclosed, after months of users reporting trades they never placed on major exchanges. Deleting the keys is the step that stops it; changing the password does not.

Our full guide to how API-key drains work, and how to set keys up so a leak costs little, is linked under Related terms below.

Document everything before you touch anything else

Take screenshots of balances, open orders, trade history and withdrawal history, with visible timestamps, and export CSVs if the exchange allows it. Note order IDs, transaction hashes for any withdrawals, and the exact time you noticed. Save every email from the exchange in the relevant window, including ones you did not trigger.

This record matters in every scenario. For an account takeover or API drain, support will ask for it. For an insolvent exchange, claims in any bankruptcy or recovery process are made from records, and the exchange's own interface may disappear without warning. For tax, a loss you cannot evidence is a loss you may not be able to claim.

Reporting it, and the scams that follow

Contact support only through the exchange's official app or website. Attackers watch social media for people complaining about lost funds and reply as "support" from look-alike accounts; a genuine exchange will not ask you to move funds to verify your identity, share your screen or give remote access to your computer.

Report theft to the police as well, even if recovery is unlikely. A report number is often needed by exchanges, insurers and tax authorities, and large incidents are pieced together from many individual reports.

Then expect the second wave. Every hack and every exchange failure is followed by "fund recovery" services promising to trace and return stolen crypto for an upfront fee or a percentage. They are scams without exception. Nobody outside the exchange or law enforcement can reverse trades or freeze another person's wallet, and paying one adds a second loss to the first.

Why reimbursement is uncertain

After an exchange-level hack, large platforms have sometimes covered losses from their own reserves or insurance funds, and sometimes paid in part or over time. After an insolvency, recovery depends on the legal process and can take years. After an account takeover or API-key drain, the exchange will usually treat the activity as yours, because it was done with your valid credentials, unless it can see a failure on its own side.

None of that is a reason not to report. It is a reason to act as if the money on an exchange is only as safe as the exchange, and to size what you keep there accordingly.

The structural lesson

Coins on an exchange are an entry in that company's database and a claim against a business that may fail. That is acceptable for what you are actively trading and has repeatedly proven unacceptable for savings. Keep the rest in a wallet you control, with the recovery phrase written down offline.

Reduce what can be used against you on the exchange: an authenticator app or security key instead of SMS codes, a withdrawal address whitelist, an anti-phishing code, as few API keys as possible with IP restrictions and no withdrawal rights, and a separate email address used only for the exchange.

And keep monitoring separate from access. Watching prices needs public data, not a login or a key: a price alert app like CoinPriceAlert never asks for an exchange API key, wallet connection or recovery phrase, so there is nothing in it that could trade or withdraw.

CoinPriceAlert

Never miss a move in the markets you follow

Pick a price or a percentage, choose push, Telegram or email, and let it watch around the clock while quiet hours keep the night to yourself.

• Fires about a second after the price hits
• Runs on our servers, so it reaches you with the app closed
• Free for 3 alerts — no card, no account

Download the app for real-time notifications

Frequently asked questions

Price alerts that never need an exchange key or wallet access: crypto price alerts, or every market and alert type. Choosing an app? How the alert apps compare, from their own pricing pages.

Related terms

• exchange API key drains — how a key without withdrawal rights still empties an account
• two-factor authentication — why an authenticator app beats SMS codes
• hot vs cold wallets — where to keep what you are not trading
• token approvals — when the drain is in your own wallet, not on an exchange

Sources

• Binance Blog: How to use an API key securely, 5 tips from Binance
• 3Commas: Notice on API data disclosure incident (29 Dec 2022)

Keep reading