Discovering your Binance account has been hacked is an extremely stressful experience. Time is money — the faster you react, the more assets you can save. This article provides an emergency response plan that we recommend bookmarking for reference.
If you're considering registering for Binance, register a Binance account and set up security immediately. Getting the Binance APP allows faster access to account security features.
Immediate Actions (Every Second Counts)
Disable Your Account Immediately
If you can still log into Binance:
- Log into your Binance account
- Go to "Security Center"
- Find the "Disable Account" button
- Click to disable immediately
Once disabled, all account functions (including trading and withdrawals) stop, preventing the hacker from further operating your account.
If you cannot log in:
- Send an account freeze request to Binance via your registered email
- Simultaneously request emergency freeze through Binance's online customer support
- State that your account has been compromised
Change Your Password
If you can still log in, change your password immediately. Even if you've been logged out, go through the "Forgot Password" process to reset it as soon as possible, preventing the hacker from continuing to use the old password.
Check Email Security
Your email may also have been compromised (attackers often breach the email first, then the exchange account):
- Change your email password
- Check email login records
- Check for email forwarding rules (hackers may have set up forwarding to their own email)
- Enable 2FA on your email
Assess the Damage
After disabling the account, document the following information as thoroughly as possible:
Check Transaction History
- Review recent trading history
- Record all abnormal transactions you didn't make
- Take screenshots to preserve evidence
Check Withdrawal Records
- Look for any unauthorized withdrawal operations
- Record the destination addresses and amounts
- Screenshot all withdrawal records
Check Security Setting Changes
- Was 2FA changed?
- Was the email changed?
- Was the phone number changed?
- Were new API keys created?
- Was the withdrawal whitelist modified?
Contact Binance Support
Submit an Emergency Ticket
- Contact support through official Binance channels
- Select "Account Hacked" or "Security Issue" category
- Clearly describe the incident and anomalies you've found
- Provide your account UID and registered email
Information to Provide
- When you discovered the hack
- Detailed records of abnormal transactions and withdrawals
- The last time you used the account normally
- Possible causes (e.g., clicked a suspicious link)
- ID document used for KYC verification
Support Response Process
After receiving your report, Binance's security team will:
- Confirm account status and maintain the freeze
- Investigate abnormal activity
- Attempt to trace the stolen funds
- Help you restore account security
- Assess whether fund recovery is possible
Restoring Account Security
After confirming the account is secure, follow these steps to restore it:
Step 1: Full Security Reset
- Set a completely new strong password (never reuse any previous password)
- Re-bind Google Authenticator
- Update the linked email (if the original email is compromised)
- Update the linked phone number
Step 2: Review All Associated Settings
- Delete all API keys and recreate if needed
- Clear all authorized devices
- Reset the withdrawal whitelist
- Update the anti-phishing code
Step 3: Re-enable the Account
After confirming all security settings are complete, contact support to lift the account freeze.
Analyze the Root Cause
Identifying how the hack occurred is crucial — otherwise, even after recovery, you could be hacked again:
Common Causes
- Phishing attack: Entered credentials on a fake Binance website
- Malware: Computer or phone infected with a keylogger
- Email breach: Attacker gained email access and reset the Binance password
- Password leak: Same password used across multiple sites; one site's data breach triggered a chain reaction
- Social engineering: Tricked by a fake "support agent" or "friend" into sharing login info
- SIM swap: Phone number ported by someone through the carrier
Preventing Future Hacks
- Use a unique, strong password
- Enable all available security verifications
- Never share login credentials anywhere
- Use legitimate, up-to-date operating systems and browsers
- Regularly check computer and phone security status
- Never click suspicious links
About Recovering Stolen Funds
To be frank, the chances of recovering stolen cryptocurrency are low, but not impossible:
- If funds are still in the hacker's Binance account, Binance can freeze the counterparty's account
- If funds have been transferred to external addresses, recovery is very difficult
- File a report with local law enforcement and preserve all evidence
- Cooperate with Binance's security team investigation
Prevention is always better than cure. We urge all Binance users to take account security settings seriously and never leave things to chance.