What Should You Do if an Exchange You Use Gets Hacked?
If an exchange you use gets hacked, speed matters — here's the actual sequence of steps worth taking in the immediate aftermath.
Finding out an exchange holding your funds has been hacked is a distressing moment, but the specific actions you take in the immediate aftermath can meaningfully affect the outcome, separate from anything the exchange itself does to respond.
First: Confirm the Report Through Independent Sources
Before reacting, verify the hack report through independent, established crypto news coverage or the exchange's own official communication channels — rumors and unconfirmed reports spread quickly during a crisis, and acting on inaccurate information can create unnecessary panic or missteps.
Attempt to Withdraw Immediately if Withdrawals Are Still Functioning
If the exchange's withdrawal function is still operational following a confirmed hack, attempting to withdraw remaining funds immediately — rather than waiting to see how the situation develops — can be the difference between recovering your funds and having them frozen or lost if the exchange subsequently halts withdrawals or becomes insolvent.
Why Withdrawals May Already Be Paused by the Time You Learn About It
Exchanges frequently pause withdrawals immediately upon discovering a security breach, specifically to prevent further loss — meaning the window to withdraw before this happens may already be closed by the time public reporting confirms what happened, which is why speed matters disproportionately in this specific scenario.
Change Any Reused Passwords Immediately
If you used the same or a similar password on the compromised exchange as on other accounts — including email, other exchanges, or wallet-related services — changing those passwords immediately reduces the risk of the breach cascading into other accounts through credential reuse.
Monitor for Phishing Attempts Specifically Targeting Affected Users
A confirmed hack often triggers a wave of follow-up phishing attempts specifically targeting known users of the affected exchange — fake "compensation" or "verification" messages claiming to help recover funds are common in the aftermath, requiring the same scrutiny as any other phishing attempt.
Document Your Account Balance and Holdings
Taking screenshots or otherwise documenting your account balance and transaction history at the time of the incident creates a record that may be relevant for any eventual compensation process, insurance claim, or legal proceeding related to the breach.
Follow the Exchange's Official Communication for Compensation or Recovery Information
Legitimate exchanges typically provide official updates about compensation plans, recovery timelines, or next steps through their verified official channels — checking these directly rather than relying on secondhand information or social media speculation provides the most accurate available guidance.
What This Means for Future Exchange Usage
An exchange hack, regardless of how it's ultimately resolved, is a concrete data point worth factoring into how much you're willing to hold on that specific platform going forward — limiting exchange-held balances to what's actually needed reduces exposure to exactly this kind of event.
Check an exchange's current status and official communications directly if you suspect or confirm a security incident — speed and verified information both matter in the immediate aftermath.