Exchange account takeover

Attackers reach the account in several ways: passwords reused from other breached sites, phishing pages that capture credentials and two-factor codes in real time, SIM swaps that redirect SMS codes, malware that steals browser session cookies and leaked or poorly scoped API keys. Once inside, they often change the email, add a withdrawal address and move funds out quickly, or use API access to trade the balance into illiquid tokens they control.

Account takeovers are one of the most common ways retail users lose crypto held on exchanges, and platforms invest heavily in defences such as new-device checks, withdrawal address allowlists, mandatory holds after security changes and anti-phishing codes in emails. Takeovers of influential social media accounts are a related problem, used to push scams to large audiences.

Users can close most doors: a unique password from a manager, an authenticator app or security key instead of SMS, withdrawal allowlists, API keys with withdrawals disabled and IP restrictions, and caution with links. Exchanges sometimes reimburse victims, but terms usually place responsibility on the user when credentials were compromised outside the platform.