What to do when the email linked to your exchange account is compromised

A strange login alert, a password reset you did not request, or simply being unable to sign in to your email can all signal the same problem: someone else may control the inbox linked to your exchange account. Because email is often the channel for security codes, login notices and reset links, an attacker who holds it is one step closer to your funds. The response that works best is calm, quick and ordered. You want to regain control of the email first, then lock down each exchange, then check for damage and document everything. This guide sets out that sequence for users of Binance, OKX, Bybit and Bitget. The exact menus and recovery forms differ between platforms, so use each official help centre for the details.

Regain control of the inbox first

Use your email provider's official recovery process to reset the password, ideally from a device you trust that has not shown signs of malware. Once inside, change the password to something long and unique, sign out of all other sessions and review the recovery phone number and backup email. Check filters and forwarding rules carefully, because attackers sometimes add a rule that quietly forwards or deletes messages from exchanges. Turn on two-step verification with an authenticator app if it was not already active.

Lock down each exchange account

Sign in to each exchange you use and change the password straight away. Review two-step verification settings and make sure the authenticator or passkey listed is yours. Look at the device and session list and remove anything unfamiliar. If the platform offers a way to temporarily freeze or disable the account, consider using it while you investigate; it is easier to unlock later than to recover stolen funds. If you cannot sign in at all, start the official recovery flow from the login screen rather than searching for help elsewhere.

Check for signs of damage

Review recent withdrawals, changes to the withdrawal address list, newly created API keys and any alterations to the anti-phishing code. Each of these can indicate that the attacker reached beyond the inbox. Note anything unusual with timestamps and transaction IDs. Do not delete suspicious emails from your inbox, since they may be useful evidence. If you find unauthorised activity, report it to the exchange immediately through official in-app support, giving a clear timeline of what you noticed and when.

Prevent a repeat

After the immediate crisis, consider moving your exchange accounts to a dedicated email used for nothing else. Keep backup codes on paper at home, avoid SMS as your only second factor, and learn to recognise phishing messages that imitate both email providers and exchanges. Scan your devices with reputable security software. Finally, update your recovery notes with the date of the incident, the case numbers you received and the changes you made. If funds were lost, also report the matter to the appropriate authorities in Nigeria.

Risk boundary: Nigeria Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Reset the compromised email password through the provider's official recovery process from a trusted device.
• Remove unknown sessions, forwarding rules and filters from the inbox and enable authenticator-based two-step verification.
• Change every exchange password at once and review authenticators, sessions, API keys and withdrawal addresses.
• Use the exchange's temporary freeze option if available while you investigate unusual account activity.
• Report unauthorised activity through official in-app support with a clear timeline and transaction IDs.