Crypto Exchange 'Account Compromised' Call
A fake exchange 'security team' says your account was accessed and pressures you to move your crypto to a 'safe' wallet or share your codes — draining it.
Think a message like this reached you? You can check it right now.
What this scam is
You get a call, text, or email claiming your crypto exchange account was compromised. A 'security agent' urges you to secure funds by moving them to a new wallet they help set up, or to read back your two-factor code or recovery phrase. Any of those hands your crypto to the scammer. Because crypto transfers are irreversible, the loss is usually permanent. Real exchanges never ask for your recovery phrase or codes.
What it usually looks like
- An alert that your exchange account was accessed.
- A 'security agent' offering to help move funds to safety.
- Requests for your 2FA code or recovery phrase.
- Instructions to send crypto to a 'protected' wallet.
Common warning signs
- Anyone asking for your recovery phrase or 2FA code.
- Being told to move crypto to a 'safe' wallet they provide.
- Urgency and fear about a hack.
- Support that called you first.
Example wording scammers use
“This is Coinbase Security. Unauthorized access was detected. Move your funds to the secure wallet we set up now.”
“To protect your account, verify by reading back the code we just sent and your recovery phrase.”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- Your recovery phrase or 2FA codes.
- You to transfer crypto to their wallet.
- Irreversible access to your funds.
What to do
- Hang up; contact the exchange only through its official app or website.
- Never share your recovery phrase or 2FA codes with anyone.
- Never move crypto to a wallet someone else set up.
- Enable a hardware security key where possible.
What to do if you already responded
- Move remaining funds to a wallet only you control and reset credentials.
- Report to the exchange, ic3.gov, and reportfraud.ftc.gov.
- Assume shared recovery phrases are compromised.