When you discover your Binance account has been stolen, the first 30 minutes determine whether you can save your assets. This article provides a "what to do immediately" checklist. Following these steps in order maximizes the probability of minimizing your losses. If you can still log in, first open the Binance official website to freeze it immediately, and then use the Binance official APP to check synchronously. Apple users can refer to the iOS Installation Guide to install the APP.
How to Determine if Your Binance Account is Stolen
Common signs of theft:
- Receiving an unfamiliar device login notification email (from an unfamiliar country or IP).
- Assets decreasing inexplicably, or orders appearing that you never placed.
- Unrecognized addresses in withdrawal records.
- Keys you never created appearing in the API Key list.
- Receiving a "withdrawal confirmation" SMS from Binance, but you didn't initiate any operation.
- Login password suddenly becoming invalid, prompting incorrect password.
- Bound email or mobile number being changed.
If any of the above occurs, do not hesitate, follow the process below immediately. For every extra minute you wait, the possibility of your assets being transferred out increases.
Step 1 (0-3 minutes): Freeze Account Immediately
This is the most critical operation. Binance provides a "one-click freeze" function. Anyone who knows your email or phone number can trigger it — this mechanism is designed specifically for hacked users.
Freezing Method A: Freeze from the Login Page
- Open the binance.com login page.
- Even if the password has been changed, click "Forgot Password".
- Enter your registered email/phone number.
- On the pop-up page, find the "Account hacked? Freeze immediately" option.
- After clicking, the system will send a freeze confirmation email.
- Open the email and click the freeze link, the account will be frozen immediately.
Freezing Method B: Freeze from an Active Session
If another one of your devices is still logged in:
- Go to "Security".
- Find the "Freeze Account" option.
- Click it and select "I suspect my account is hacked".
- Confirm to freeze, and all functions will stop immediately.
Freezing Method C: Contact Customer Service to Force Freeze
If neither of the above works, immediately click "Online Customer Service" in the lower right corner of the Binance official website and tell the agent, "My account has been stolen, please freeze it immediately." The agent will ask you to provide your registered email, phone number, KYC name, and other info for identity verification.
What happens after freezing? All trading, withdrawals, and API operations are completely stopped. Even if the hacker is still in your account, they cannot move any assets. The freeze period is 14 days by default, which is enough time for you to complete the appeal.
Step 2 (3-10 minutes): Save Evidence
After freezing, collect all relevant evidence immediately, which will be needed when submitting an appeal later:
Take Screenshots to Save the Following
- Login Records: "Security" → "Login Devices", screenshot all recent login records, specially marking unfamiliar IPs.
- Asset Changes: "Assets → Transaction History", screenshot all suspicious orders.
- Withdrawal Records: "Assets → Withdrawal History", screenshot unfamiliar withdrawal addresses and amounts.
- API Management: "API Management", screenshot the creation time and permissions of all API Keys.
- All Notification Emails from Binance: Keep the timestamps.
Record Key Information
- Approximate time of theft (accurate to the minute).
- Stolen coin types and amounts.
- The hacker's withdrawal addresses (these addresses might be blacklisted by Binance).
- The time of your last normal operation.
Do not delete any screenshots, keep them for at least 3 months.
Step 3 (10-30 minutes): Submit an Appeal
After collecting screenshots, submit an account recovery appeal immediately.
Appeal Entrance
- Go to "Customer Support" → "Submit a Ticket".
- Select the ticket category "Account Hacked/Assets Lost".
- Set the priority to "Urgent".
What to Detail in the Appeal
Title: Urgent Appeal for Stolen Account [Your Email]
Body:
- Registered Email: [email protected]
- Registered Phone Number: +86 1xxxxxxxxxx
- KYC Name: xxx
- Time of Theft: Around 2026-04-08 16:30
- Lost Assets: Approx. X USDT
- Hacker's Withdrawal Address: Address starting with 0x
- My Last Normal Login Time: 2026-04-08 14:00
- I have already frozen the account via [Freezing Method X]
Reason why I suspect being hacked:
(Explain your suspected attack route, such as recently clicking a phishing link, password might have leaked on other sites, etc.)
Attachments: Login records screenshots, withdrawal records screenshots, suspicious emails screenshots
The more complete the attachments, the better, allowing customer service to quickly locate the issue.
Step 4: Facial Recognition Secondary Verification
After submitting the ticket, Binance usually replies within 24 hours and requires a "Secondary Identity Verification":
- Customer service will send an encrypted link to your registered email.
- Click the link to perform real-time facial recognition.
- Record a proof video: Hold your ID card (cover the middle 4 digits of your ID number) and read a script designated by customer service, for example: "I am xxx, my Binance account was stolen, and the appeal time is April 8, 2026."
- Upload the proof video and the front and back of your ID card.
This step is crucial for determining account ownership. Your live face + ID card + the recorded script at the time, if any of these don't match, it will fail.
Step 5: Waiting for Review 3-7 Business Days
After submitting all materials, it's time to wait. Binance's security team will:
- Verify your KYC information.
- Inspect the hacker's attack path.
- Trace the on-chain flow of the stolen funds.
- Decide whether to recover part or all of the assets.
Things to note during the review period:
- Do not submit duplicate tickets, it will disrupt the processing order.
- Keep your email accessible, customer service might ask for additional materials.
- Do not trust any "Customer Service DMs", Binance customer service only replies through the official ticket system.
- Do not pay any "expedite fees", legitimate customer service never charges any fees.
What Can Be Recovered vs. What Cannot
Relatively Easy to Recover:
- Assets are still on the Binance platform and haven't been withdrawn (in sub-accounts, Earn, Futures).
- Assets are in the withdrawal pending zone (Binance can cancel directly).
- The withdrawal address has already been recognized as a blacklisted address by Binance's risk control system.
Hard to Recover:
- Assets have already been withdrawn to other on-chain addresses (Binance cannot control on-chain assets).
- Assets have been transferred multiple times to cryptocurrency mixers (like Tornado Cash).
- Discovered the theft after more than 24 hours.
5 Must-Do Things to Prevent Being Hacked Again
After recovering your account (even if the recovery fails), you must do these 5 things immediately to prevent being hacked again:
1. Set a New, Unique Strong Password
At least 16 characters, mixing uppercase, lowercase, numbers, and special characters. Do not share it with any other websites.
2. Enable Google Authenticator 2FA
Do not use SMS 2FA (susceptible to SIM swapping), use Google Authenticator or Authy. Write down the backup code and store it in a safe place.
3. Enable Anti-Phishing Code
Set a piece of text that only you know, all future official Binance emails will include this text, any email without it is a phishing email.
4. Enable Withdrawal Address Whitelist
Only allow withdrawals to addresses you have pre-added. New addresses require a 24-hour waiting period before they can be used, giving you time to check.
5. Delete All Unnecessary API Keys
API Keys are an often overlooked avenue for theft. Keep only the ones in use, and delete all others.
Frequently Asked Questions
Q: How long before the account automatically unfreezes after being frozen?
A: 14 days by default. If you have submitted an appeal, it will not unfreeze automatically during the appeal period, and will remain frozen until customer service finishes processing.
Q: The hacker made futures trading losses with my account, who bears the loss?
A: Include this in your appeal as well, Binance will make a comprehensive judgment. If it can be proven that it was a hacked operation (not by you), futures losses might be recovered together.
Q: Can stolen coins be recovered on-chain?
A: On-chain recovery is extremely difficult. Only when the hacker transfers the coins to a centralized exchange (with KYC verification) is it possible to freeze them through law enforcement agencies. Contact local police and Binance simultaneously when reporting the case.
Q: How long does it take to restore the account after a successful appeal?
A: Generally, account access will be restored within 24 hours after the review passes, but asset recovery might take longer, depending on where the funds are currently located.
Q: I noticed suspicious activity but haven't confirmed if it's a hack, should I freeze it?
A: It's better to wrongly freeze than to miss freezing. Freezing is free, reversible, and can be done in a few minutes. If it's a misunderstanding, it can be restored in a few minutes; if you are truly hacked, freezing can save your assets.