Every week people arrive at our Telegram channel holding the same story. A login here, a verification code there, and suddenly the exchange balance is gone or the account is locked. The attack almost never breaks the exchange. It breaks the person. Here is how these operations actually work, what the first hours are worth, and what a realistic recovery path looks like.
## How the credentials actually get stolen
The dominant pattern is a fake support or bonus page. You get a message, an email, or a search result that looks like the exchange’s official channel, complete with the right logo and a near identical domain. You are asked to log in, then asked for your two factor code. The moment you enter that code, the operator has a live session, because a 2FA code from an authenticator app is a one time password that is valid for a short window and can be replayed in that window by whoever phished it.
A second pattern is the remote session scam, common in over the counter trading circles. Someone offers to help you set up a wallet or verify funds and asks you to share your screen or install a remote access tool. While you watch one window, they copy a seed phrase from another.
A third is the API key trap. A trading bot or arbitrage service asks you to create an API key with withdrawal permissions and paste it into their interface. The key is a credential. Handing over a withdrawal enabled key is the same as handing over the account, minus the withdrawal whitelist.
## Why the first 24 hours decide the outcome
Once funds leave the exchange wallet, the trail ages badly. Most majors like Tether can blacklist a receiving address, but only if the issuer or an exchange with compliance staff raises it in time, and tracing requests pile up behind volume. The actions available to you degrade by the hour.
If the account itself is locked rather than drained, speed matters even more, because you are now in a race to prove you are the real owner before the attacker completes a reset chain through your compromised email.
## What to do, in order
First, from a device you believe is clean, change the password on the email account connected to the exchange. The email is the master key for password resets. If the attacker holds the email, every other lock you change gets reopened.
Second, change the exchange password and revoke every active session and every API key. Most major exchanges have a session management page under security settings. Revoke all of it, including things that look legitimate, because you cannot tell a phishing session from your own by name alone.
Third, remove and re enroll two factor authentication. If you used an authenticator app, the codes were exposed at the moment you typed them into the phishing page. If you used SMS 2FA, contact your mobile operator to add a port freeze, because SIM swap is the standard follow up move.
Fourth, open a ticket with the exchange’s real support channel, reached by typing the domain yourself, never by following a link from a message. State the exact times of the unauthorized login or withdrawal, the transaction hashes, and the destination addresses. Exchanges can freeze withdrawals to internal addresses immediately and can flag outgoing transactions for their compliance review.
Fifth, if funds moved on chain, get the transaction documented by a tracing service and raise it with the receiving venue if the funds land at another exchange. This is the step where most people lose time, because doing it properly requires pulling the hashes yourself, in the right format, with timestamps.
## What recovery actually looks like
The realistic mechanism is not a blockchain reversal, it does not exist. It is a freeze at a downstream venue, followed by a law enforcement or court process that establishes ownership, followed by release. For USDT specifically, Tether acts on verified law enforcement requests to blacklist and later release funds at tainted addresses. We describe that mechanism in detail in what a risky address flag actually means and what you can do about it.
If the exchange itself froze your account as a fraud response, expect a document request: proof of identity, proof of funding source, and a statement of events. We walk through assembling that file in how to prove source of funds when an exchange freezes your crypto. The people who recover are overwhelmingly the people who answer that request completely and quickly, not the people who argue.
## Prevention, briefly and specifically
Use a hardware key or authenticator app, never SMS, for anything holding real value. Keep withdrawal whitelists on, with a 24 hour cooldown, so a stolen session cannot redirect funds to a fresh address instantly. Never create an API key with withdrawal permissions for any third party service, whatever the promised yield. Treat every inbound message about your account as hostile by default and navigate to the exchange by typing the domain.
The uncomfortable summary is that the technical attacks are old and well understood, and they still work because they arrive wearing a support badge at the moment you are worried about your money. Speed and verified channels are the whole game after that.