What to Do If Your Binance Account Is Hacked
You wake up to a "New Device Login" email from Binance, but you never performed that login — this means your account may have been compromised. Time is money, especially in the crypto world, where every minute of delay puts your assets at greater risk. This guide helps you take the fastest possible action to protect yourself. If you haven't set up comprehensive security measures yet, sign up for Binance right away and configure everything in the Security Center. Android users should make sure they're using the official app obtained from the Binance APK download page.
Step One: Freeze Your Account Immediately
The first thing to do when you detect suspicious activity is not to change your password — it's to freeze your account immediately. Once frozen, no one (including you) can withdraw, trade, or perform any operations, maximizing asset protection.
Freeze via the App:
- Open the Binance App
- Go to "Account" → "Security"
- Find "Account Activity" or "Disable Account"
- Tap "Disable Account" to confirm the freeze
Freeze via Email:
If the hacker already changed your password and you can't log in to the App, find the "Disable Account" link at the bottom of a recent Binance login notification email. One click freezes your account.
Freeze via the Website:
Visit the Binance website and click "Security Emergency" or "Forgot Password" on the login page to trigger the account freeze process.
Step Two: Assess the Damage
After freezing your account, calmly review the following:
Login History: Under "Security" → "Device Management" or "Account Activity Log," check recent logins for unusual times, IP addresses, and device information.
Transaction and Withdrawal Records: Check for any trades or withdrawals you didn't authorize. Pay special attention to:
- Unauthorized sell orders in your spot account
- Large withdrawal requests
- Unexpected positions opened in your futures account
- Changes in your funding account balance
API Keys: Check whether any new API keys were created. Hackers sometimes skip direct withdrawals and use API access to remotely control your account trades.
Step Three: Contact Binance Support
After confirming the extent of the damage, contact Binance support immediately:
- Open the Binance App → Support → Live Chat
- Select the "Account Security Issues" category
- Describe the situation: when you discovered the anomaly, how much was lost, and what unauthorized actions occurred
- Provide screenshot evidence
The Binance security team will investigate. If a withdrawal is still pending, there's a chance it can be intercepted. If it has already been confirmed on-chain, recovery becomes much harder — but you should still report it, as Binance may freeze other accounts linked to the receiving address.
Step Four: Reset All Security Credentials
Once support is involved, reset your security settings in this order:
- Change your login password: Use a brand-new, strong password never used on any other platform
- Reset your 2FA authenticator: Unbind the old Google Authenticator and set up a new one
- Change your email password: The hacker likely compromised your email first
- Verify your phone number: Confirm it hasn't been swapped
- Delete all API keys: Remove everything and recreate only what you need
- Clear trusted devices: Remove all devices and re-add only yours
How Accounts Get Compromised: Common Attack Methods
Understanding attack vectors helps you avoid falling victim again:
Phishing Attacks: Clicking links in fake emails or websites impersonating Binance and entering your credentials on a fraudulent page. Prevention: Set up a Binance anti-phishing code.
SIM Swapping: Hackers use social engineering to convince your carrier to transfer your phone number to their SIM card, letting them receive your SMS verification codes. Prevention: Use Google Authenticator instead of SMS as your primary 2FA.
Malware: Trojans on your phone or computer recording your keystrokes. Prevention: Never install software from unknown sources — only download the Binance APK from official channels.
Password Leaks: Using the same password across multiple platforms, where a data breach on one exposes the rest. Prevention: Use a unique password for every platform and a password manager.
Social Engineering: Someone impersonating Binance support via Telegram, WeChat, or other channels to trick you into sharing verification codes or clicking malicious links.
Strengthening Security After Recovery
Once your account is restored, implement these security enhancements:
- Enable all available verification methods: Google Authenticator + SMS + email verification for triple protection
- Set an anti-phishing code: Configure a secret phrase in Security Settings — all official Binance emails will include this phrase
- Enable withdrawal address whitelist: Only allow withdrawals to preset addresses, so even if hacked, funds can't go to the attacker's wallet
- Enable 24-hour withdrawal cooling period: Newly added withdrawal addresses require a 24-hour wait before use
- Regularly check login devices: Review the device management list weekly and remove any unfamiliar devices immediately
Can Stolen Assets Be Recovered?
Honestly, recovery chances depend on several factors:
- Discovery time: The sooner you notice, the better. If the withdrawal is still pending, Binance may intercept it
- Withdrawal destination: If funds went to another centralized exchange (like OKX or Bybit), Binance can coordinate to freeze the funds
- Police report: Filing a report with local law enforcement and providing the case number to Binance helps accelerate the process
- On-chain tracking: Binance's security team can trace funds on-chain, but if the hacker used a mixing service, tracking difficulty increases significantly
Prevention Is Always Better Than Cure
The best security strategy is to never let hackers succeed. After you sign up for Binance, set up the following immediately:
- Bind Google Authenticator
- Set an anti-phishing code
- Enable the withdrawal whitelist
- Use a unique, strong password
- Never click unofficial links
FAQ
Q: How long does it take to unfreeze a self-frozen account?
You can request to unfreeze at any time. After identity verification, it typically takes 2–24 hours. If Binance froze the account for security reasons, you'll need to cooperate with the investigation before it can be unfrozen.
Q: Will Binance compensate for stolen assets?
Binance has the SAFU (Secure Asset Fund for Users), specifically for extreme security incidents. However, losses due to personal password leaks typically aren't covered. That's why personal security measures are crucial.
Q: Should I call the police first or freeze the account first?
Freeze the account first. Freezing takes seconds, while filing a police report takes time. Stopping the bleeding is always the top priority — then report to police and contact support.
Q: The hacker changed my password and 2FA. Can I still freeze the account?
Yes. Use the "Disable Account" link in a Binance login notification email to freeze without logging in. This is why keeping your email account secure is absolutely critical.
Q: Could Binance have leaked my information internally?
Extremely unlikely. Binance's security systems undergo regular third-party audits. The vast majority of account compromises stem from user-side security issues: password reuse, phishing links, malware, and so on.