Trace exactly what was accessed before moving anything else.
What to do
- Check the exchange / wallet activity log for unauthorised logins, withdrawals and API calls
- Note every receiving address used in the unauthorised transactions
- Look for changed withdrawal addresses, new whitelists, or new API keys
- Check the linked email for any 2FA-disable or whitelist-change confirmations
- Save txids and screenshots — you will need them for exchange tracing and law enforcement
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers