Security & Anti-Scam
OKX Account Compromised? The First-Hour Checklist and the Hardening That Follows
Strange login alerts, orders you never placed, balances moving on their own - in that moment, speed beats diagnosis. An ordered checklist: cut access, freeze the exits, preserve evidence, file the ticket. Then harden so it cannot recur.
Checked July 13, 2026. Emergency option names vary by version; the Security settings section of the official app is authoritative.
An unfamiliar-device alert, an order you never placed, a balance that moved - at that moment, acting fast matters more than knowing why. Execute the list below in order; investigate afterward.
The first hour, in order
1. Change the login password immediately. A brand-new strong password you have never used anywhere. If the old one was reused elsewhere, change those accounts too.
2. Freeze the account if it looks serious. Security settings include an account freeze/disable option; if you cannot log in, request an emergency freeze via the official app's Support Center. Freezing halts trading and withdrawals - stop the bleeding first.
3. Kick every unknown device. Security settings → Device management: remove every device and session you do not recognize.
4. Audit withdrawal-related settings. Check the address book for entries you never added and verify no security method was swapped. The 24-hour withdrawal pause that follows a password change is your ally here - it buys you the time window.
5. Preserve evidence. Login times and IPs, screenshots of foreign orders, balance change records - capture everything for the appeal.
6. File an official ticket. Only via the Support Center in the app or official site. Describe the timeline and attach the evidence. Anyone who contacts you offering to "recover your funds" is the second scam - especially if payment or a transfer comes first; see the fake support playbook.
Finding the door they came through
| Vector | Typical sign | Countermeasure |
|---|---|---|
| Phishing site / fake app | You entered credentials on an odd page | Download only from official channels - how to spot fakes |
| Password reuse + credential stuffing | The same password leaked elsewhere | Unique passwords + a password manager |
| SMS 2FA hijack | SIM anomalies, intercepted codes | Switch to an authenticator app - code troubleshooting |
| Infected device | Rogue extensions, clipboard tampering | Full malware scan; reinstall if needed before logging in again |
Hardening checklist
- Login password and funding password: separate and unique (funding password reset: this guide);
- 2FA on an authenticator app, not SMS;
- Every login and withdrawal notification switched on;
- Consider separating long-term holdings from the trading account - custody trade-offs in exchange vs own wallet;
- Review devices and authorizations quarterly.
FAQ
Q: Can stolen funds be recovered? On-chain transfers are irreversible; recovery odds depend on where funds went (exchanges can sometimes freeze). Report to police with TxIDs immediately and keep the platform case open.
Q: Is a platform risk-control freeze the same as being hacked? No - that freeze is a protective measure cleared by appeal; see the account freeze guide.
Q: Nothing was taken - just a strange login. Overkill to do all this? No. The attacker may be waiting out the withdrawal cooldown or studying your habits. Running the checklist costs minutes; the alternative costs everything.
This article is for educational purposes only and is not investment advice. Crypto assets are volatile; assess the risks yourself before acting. All rules and fees are subject to what OKX officially displays in your account. This site is not affiliated with OKX.