Somebody got into my exchange or email account
Fix it in the order the attacker used: the phone number, then the email, then the platform. The other order rarely holds.
- If your phone lost service, call the carrier from another line A sudden loss of signal with no explanation is a port-out until proven otherwise, and that hour is the whole window. Ask for the number to be restored and a port-out lock added.
- Secure the email account before the exchange Change the password, sign out all sessions, remove the phone number from recovery, and check forwarding rules and filters — a rule quietly forwarding or deleting the platform's warnings is standard practice and survives a password change.
- Then the platform: password, sessions, second factor Change the password, terminate every active session, and remove any second factor you do not recognise. Add an authenticator app or a hardware key in place of SMS.
- Delete API keys you did not create An API key keeps working after a password change and is how withdrawals continue from an account that "was recovered". This is the step people miss.
- Freeze withdrawals if the platform offers it Many have a lock, a whitelist or a support channel that can suspend withdrawals immediately. Say clearly that a takeover is in progress — that phrase routes the ticket differently.
- Then every other account sharing that password Reused passwords from old breaches are how it usually starts. The email is the one that must be unique.
What is recoverable here
More than in most of these pages. Custodial platforms have logs, holds and staff, and an account regained within an hour is often intact. Speed genuinely changes the outcome — which is not true of an on-chain theft.
What to expect from support
Identity verification, a freeze, and an investigation measured in days. Some platforms reimburse where their own control failed; most do not where the credentials were the user's. Keep the ticket number and every timestamp.
The prevention that would have stopped it
A hardware key or passkey on the email account, and the phone number removed from every recovery path. Account takeover sets out why the chain runs through the carrier and the mailbox rather than the exchange.
Anyone who contacts you offering to recover this is the next thief
It follows losses within days, sometimes hours, and it copies the names of real firms, regulators and police units. Nobody legitimate finds you first. How the recovery scam works →
Last checked 19 Oct 2026. This page is procedure, not legal advice — what a report achieves depends on where you live.