If your exchange is hacked
What to do in the first hour after an exchange reports a hack or stops withdrawals — and the mistakes that cost people more than the hack.
In the first hour
- Do not deposit anything more, and cancel automatic deposits or buys.
- Take screenshots of your balances, open orders and recent history, with the date visible.
- Read only the exchange’s own status page and its verified accounts. Save the announcement.
- Change your exchange password and turn on an authenticator app if you have not already.
- If withdrawals still work and you want out, withdraw to a wallet you control — first a small test amount.
What not to do
- Do not answer anyone offering to “recover” funds. Hacks bring a wave of recovery scams.
- Do not share your seed phrase, 2FA codes or screen with “support” that contacted you first.
- Do not move funds through a link from a message, even one that looks official.
Afterwards
- Check whether the exchange refunds users and from which fund — each exchange’s page here shows what is on record.
- Keep your records for tax and for any claim. In an insolvency, the claim process can take years.
- Keep only what you trade on an exchange; hold the rest in self-custody.