Exchange Account Hacked or Frozen? Work Out Which It Is First, Then Follow the Steps (With Each Exchange's Official Support Links and a Message Template)

You suddenly can’t log in, your assets have been moved out, or the withdraw button has gone grey: each of these is handled very differently. This article covers how to tell which situation you are in when your exchange account is hacked or frozen, who to contact in each case, what evidence to prepare, and the official self-service features and support channels at Binance, OKX, Bybit and Bitget. It is based on each exchange’s official help pages.

The short version: if your exchange account is hacked, the first step is to freeze it with the exchange’s self-service feature. All four exchanges have one, and there are alternatives if you can’t log in. Then take back your email and phone number, keep the evidence, and contact support from inside the app or the official website. If the exchange has frozen your account, start with the reason given in its email and in-app notifications: follow the notice for a risk review or a document request; for a judicial or police freeze, go to the authority that ordered it, because exchange support can’t help. Whichever it is, anyone who asks you to pay first to unfreeze your account or recover your funds is not official.

This article is a summary of information, not legal, investment or tax advice, and it can’t replace help from the police or a lawyer. If you need to file a police report, are dealing with a judicial freeze, or a large amount is involved, consult a local lawyer or report it to the police. Each exchange’s features, menu locations and rules change. The official pages cited here were all checked on 2026-10-16; before you act, go by what the exchange’s pages show at that time.

First work out which one it is: hacked, risk control, document request or legal freeze

The table below is my classification based on each exchange’s official help pages; the “First step” column is this article’s own summary.

The last one has nothing to do with your account. For example, after Bitget was hacked in September 2026 it suspended withdrawals site-wide, and restoring them in batches took 4 to 8 days. Incidents like this are collected in “Centralized Exchange Incident Timeline”; if the exchange has gone bankrupt rather than paused, see “What Happens When a Crypto Exchange Goes Bankrupt?”.

Exchange account hacked: freeze it first, then take back your email and phone number

Freeze the account with the self-service feature

Freezing temporarily stops the account from logging in or withdrawing, and that applies to whoever stole it too. Here are the paths at the four exchanges (checked 2026-10-16):

A few details to watch:

• When disabling at Bitget, you can choose to auto-close positions and repay loans with collateral, so that you aren’t force-liquidated while the account is disabled. Both options execute at market price, so think it through before ticking them. Bitget’s self-service disabling only applies to individual main accounts; business accounts (KYB) and subaccounts are not supported.
• If you can’t log in: at Bybit, while logged out, click the headset icon in the bottom right corner of the website to open the support chatbot, then choose “Lock Account” to request a lock by email; if you signed up with a phone number or have also lost control of your email, Bybit says to ask live chat support to freeze the account immediately. Binance’s security article of 23 June 2023 also recommends contacting support as soon as possible to explain that your account has been compromised.
• After reactivating at Bybit, you can’t withdraw for 24 hours; if the system detects suspicious activity, you have to submit a self-service unlock, which takes about 5 to 7 working days (Bybit help page, updated 2026-08-19). The documents to prepare are in the evidence checklist further down.

Take back your email and phone number

The exchange sends its verification codes and alerts to your email or phone. If someone else controls either one, take it back as well once the exchange account is frozen. The US Federal Trade Commission (FTC) guide to recovering a hacked account from August 2023 says that once you regain your email account, you should:

1. Change to a strong password.
2. Log out of all devices to kick out anyone still logged in.
3. Turn on two-factor authentication.
4. Make sure the recovery email and phone number on the account are your own.
5. Check for forwarding rules you didn’t set up, and delete any you find.

The last one is especially important: if the attacker has set up a forwarding rule, the verification emails from the exchange go to them as well. If your phone number has been taken over (a SIM swap), see “Exchange Account Security Settings Compared”; where you can, don’t rely on SMS alone for the exchange’s two-factor authentication.

Check logged-in devices and third-party authorizations

OKX’s account security guide (updated 2026-08-26) lists what to do if your account is hacked: change your login password immediately, freeze the account under account management in the security settings, remove any devices you don’t recognize from your linked devices, and immediately revoke authorization for any third-party app you don’t recognize. Binance’s security article also recommends changing your password and turning on two-factor authentication, and writing down every action you didn’t take, along with when you first noticed something was wrong.

When the money was moved to another exchange

If the stolen crypto was moved into another exchange, you can report it to that exchange. Take Bybit’s help page on reporting stolen assets (updated 2026-03-10) as an example:

• You can only request a freeze if the stolen assets were moved into Bybit.
• You need to report it to the police and obtain a freeze order first; in an emergency you can submit the case details first.
• You need to provide the type and amount of the stolen assets, the hacker’s address (if you have it), how the theft happened and your contact details; Bybit replies within about 12 hours of submission.
• For cases without a freeze order, Bybit currently acts at its discretion only for verified VIP users.
• Bybit won’t tell you what it discusses with law enforcement, so ask the law enforcement agency directly for updates; Bybit also states that recovery is not guaranteed.

Bybit’s process centers on a police report and a freeze order, so report it to the police first; the exchange’s reporting form is a supplement.

Risk control or a document request: follow the notice, don’t rush to switch accounts

Risk control restrictions: start with the reason in the email

OKX’s help page on withdrawal problems (updated 2026-08-05) describes several common kinds of risk control separately:

• T+N restriction after a P2P purchase: buying crypto on P2P may trigger a period in which you can’t withdraw, and it lifts automatically when the time is up.
• Double-spend risk control: only an amount equal to that deposit is blocked from being withdrawn or sold, and other features are not affected; the withdrawal page shows when the restriction is expected to lift.
• High-risk withdrawal address: when the system detects a risk, withdrawals are suspended for 48 hours while other features work as normal; the reason is given in an email sent to your registered address.
• Other freezes or restrictions: check your inbox and spam folder for emails from the platform and follow the instructions in them.

Bitget’s help page on frozen assets (2025-01-02) lists a wider range of reasons: incomplete identity verification, reviews required by regulation, withdrawals being processed, system maintenance, a whitelist or asset lock you turned on yourself, open P2P or spot and futures orders, detection of an unfamiliar login or large unusual trades, and breaches of platform rules. The order it recommends: check the notification center, update your identity verification (reviewed about 24 hours after submission), and cancel open orders; if none of these explains it, submit a support ticket with the transaction ID, the error message and your account activity.

A security change you just made yourself can also trigger a restriction. Binance’s guide to resetting 2FA says that after you reset two-factor authentication, withdrawals, P2P selling and payment services are disabled for 48 hours. Restrictions like this are a protective measure; wait until the time is up before withdrawing.

Document requests: proof of source of funds and source of wealth

The documents exchanges most often ask for are an identity verification update or enhanced due diligence (EDD). Bybit’s EDD help page (updated 2026-03-30) says EDD is a normal compliance measure and does not imply any wrongdoing, and asks you to explain two things:

• Source of funds (SOF): where the money deposited into the exchange came from, for example salary, savings, the sale of assets or a loan.
• Source of wealth (SOW): how your overall wealth was built up, for example long-term employment, running a business, investments or an inheritance.

Accepted documents include:

When you submit documents, make sure they are clear and complete, and don’t alter them; there is no need to volunteer information the exchange hasn’t asked for. Don’t borrow someone else’s account or open a new one just because yours is restricted: Bitget’s P2P risk control rules (2024-02-11) state that if you sell, lend or rent your account to someone else, the platform may freeze that account and any linked accounts; if you refuse or fail to cooperate with anti-money laundering checks, the platform may also freeze your account until the proof you provide passes its review.

Scam money received on P2P, and judicial or police freezes

When you sell crypto on P2P, if the buyer’s money came from a scam, you may be caught up in it once the victim reports it to the police. Binance’s P2P help page (published 2019-12-06) describes this situation: a buyer uses scam proceeds to buy crypto, the victim reports it to the police, and the unwitting P2P seller’s bank account is frozen too.

What you can do at that point:

1. First confirm who froze it. The notices from the exchange and the bank usually state which authority and which case number.
2. Go to the authority that ordered the freeze. Bitget’s P2P risk control rules state that when an account is frozen on the basis of an official letter from a judicial authority, during the freeze the user should contact that judicial authority, not the platform; to extend a freeze after it expires, the judicial authority has to send another official letter. Bybit also says it won’t tell users about its communications with law enforcement, and that users should ask the law enforcement agency directly.
3. Prepare your transaction records. Binance’s advice is to contact your bank right away, cooperate with the local authorities by providing evidence and transaction records related to that buyer, and seek legal help if needed; if you can’t reach the buyer, take your order screenshots and details to the platform’s support.
4. Consult a local lawyer. A judicial freeze involves local legal procedures. Explaining that you didn’t know and showing that the trade was legitimate is best done with a lawyer’s help.

For how to lower this risk before a P2P trade (pay only from an account in your own name, cancel if the other party’s verified name doesn’t match, and release the crypto only after you see the money arrive in your bank account), see the P2P checklist in “How to Buy USDT”.

What evidence to prepare

Whether your account was hacked, hit by risk control or frozen by the authorities, the sooner you gather the following, the better. In brackets is the official guidance that mentions each item:

• Timeline: when you first noticed something was wrong, and every action after that which you didn’t take (Binance’s security article recommends writing these down).
• Screenshots: suspicious emails, login history and transaction history (the evidence Binance recommends giving to support); OKX recommends attaching screenshots when contacting support.
• Transaction details: transaction ID (TxID), receiving address, coin, amount and time; if your account was hacked, also note the hacker’s address (information Bybit’s reporting form asks for).
• Error messages and notices: the error message from a failed withdrawal and the risk control emails from the exchange (Bitget recommends attaching these to a support ticket).
• Police report details: proof of the report, the case number and the contact details of the handling unit.
• Identity and source of funds documents: the same ID document you originally verified with; Bybit’s self-service unlock may also ask for a selfie photo and selfie video of you holding the ID and a handwritten note (stating your request and the date), plus a screen recording of logging in to the original exchange and opening your withdrawal history and the on-chain transaction, to prove that the earlier deposit was made by you.

Give transaction IDs and addresses only in an official support ticket, and don’t post them in public groups; the next section explains why.

How to contact official support: each exchange’s channels and a message template

Official support channels at each exchange

Always reach support from inside the exchange’s app, or from the official website at an address you typed yourself; don’t click links other people send you. The addresses in the table below were checked on 2026-10-16:

Support message template

The first time you contact support, give all the information at once so there is less back and forth. Below is a template I put together. Edit it to fit your situation and replace the bracketed parts with your own details:

Hello, the following has happened to my account (registered email or UID: ___). Please help me resolve it:

1. Situation: (e.g. account hacked, with withdrawals I did not make / account restricted from withdrawing / asked to provide documents)
2. Time noticed: (YYYY-MM-DD HH:MM, time zone ___)
3. What I have already done: (e.g. froze the account via self-service, changed my email password, reported it to ___ police, case number ___)
4. Related transactions: (coin, amount, transaction ID, receiving address, time)
5. Notices or error messages received: (original text or screenshot)
6. My request: (e.g. please confirm the reason for the account restriction and which documents I need to provide / please investigate the unauthorized withdrawals)

Attachments: screenshots, police report (if any).
Please reply through this ticket or to my registered email. Thank you.

After submitting, note the ticket number and date, and use the same ticket for any follow-up instead of opening a new one and explaining everything again.

Beware of fake support and fake “recovery services”

When something goes wrong with your account, be especially careful not to get scammed a second time. Below are some lines that official sources state explicitly (checked 2026-10-16):

• Official support won’t message you first. OKX’s security guide says its official support will not start a private chat with you, and won’t ask you to log in to your account or reveal account information; OKX’s help page on withdrawal problems also says that anyone on an unofficial channel such as QQ, Telegram or WeChat who asks you to transfer crypto, scan a QR code or give a verification code is a scammer.
• Being asked to pay first to unfreeze your account means it’s a scam. OKX lists “withdrawals blocked, another deposit demanded” as a sign of a scam platform (see “Crypto Scam Playbooks in the Chinese-Speaking World”). A real exchange’s risk control will only ask you for documents or to wait out a set period; it won’t ask you to deposit more money.
• Lawyers, hackers and blockchain tracing analysts who claim they can recover your funds are almost always a second scam. A 2024 FBI alert says victims of fake law firms running follow-up scams reported losses of more than US$9.9 million in a single year; law enforcement does not charge victims to investigate crimes. Freezing and returning stolen assets is a process between the police and the exchange.

If you ask “my account was frozen, what do I do?” in a public group or on social media, a “support agent” will often message you right away. Each exchange’s official verification tools and local police reporting numbers are collected in “Crypto Scam Playbooks in the Chinese-Speaking World”.

Once your account is sorted out, add passkeys, a withdrawal whitelist and an anti-phishing code; see “Exchange Account Security Settings Compared”. Keep long-term holdings in a wallet where you hold the private keys yourself; see “Cold Wallet vs Hot Wallet vs Exchange Custody”.

FAQ

My exchange account was hacked. What should I do first?

First use the exchange's self-service feature to freeze or disable the account; Binance, OKX, Bybit and Bitget all have one. Once it is frozen, secure your email and phone number, check your logged-in devices and third-party authorizations, and then contact official support with your evidence.

Can I still freeze my account if I can't log in?

At Bybit, you can request an email-based account lock from the support chatbot in the bottom right corner of the website while logged out; if you signed up with a phone number or have also lost control of your email, Bybit says to ask live chat support to freeze the account immediately. Binance's security article also recommends contacting support as soon as possible to explain that your account has been compromised.

The exchange says my account is under risk review. How long until it is lifted?

It depends on the reason. OKX's T+N restriction after a P2P purchase and its 48-hour withdrawal restriction for high-risk addresses lift automatically when the time is up; a Bybit self-service unlock takes about 5 to 7 working days after you submit it. Other cases have no fixed timeline, so first check what the exchange's emails and in-app notifications ask you to do.

My account was asked for more documents (KYC or proof of funds). Does that mean I did something wrong?

Not necessarily. Bybit's help page says enhanced due diligence (EDD) is a normal compliance measure and does not imply any wrongdoing. Just provide the documents listed in the notice, such as an ID document, proof of address from the last 3 months and bank statements.

Money I received on P2P was reported as scam proceeds and my account was frozen by the authorities. What now?

Deal with the authority that ordered the freeze. Bitget's P2P risk control rules state that when an account is frozen at the request of a judicial authority, the user should contact that authority, not the platform. Have your orders, payment records and chat logs ready, and consult a local lawyer.

Someone says they can unfreeze my account or recover my stolen crypto if I pay. Can I trust them?

No. OKX lists blocked withdrawals with a demand for another deposit as a sign of a scam platform, and OKX also states that its official support will not message you first. Law enforcement does not charge victims to investigate crimes; freezing and returning funds is a process between the police and the exchange.