Account Takeover: The First 30 Minutes

An account takeover on an exchange or a wallet service is usually a race with a short clock. The first thirty minutes decide whether you keep control of the balance, because the useful defensive actions are all time-sensitive and most of them lock the attacker out only if you get there first. An account takeover that is reported an hour later is a withdrawal dispute, not a recovery.

The clock matters because the sequence is predictable. The attacker needs a session, then a change of credentials, then a change of withdrawal destination. Each step takes minutes. An incident interrupted at step two is survivable; one that completes step three is usually not.

• Speed beats completeness. A partial response in five minutes is worth more than a perfect one in an hour.
• Sessions are the first target. Changing a password does nothing while an active session remains.
• Withdrawal addresses persist. Check them even if balances look untouched.
• Email is part of the account. Forwarding rules and recovery settings outlive a password change.

What an account takeover looks like in the first hour

The visible symptoms are rarely dramatic. Most takeovers begin with a login notification you did not expect, or with total silence followed by a password reset email you never requested.

The first five minutes

Expect a password change and, if the venue allows it, a new two-factor method. The attacker’s goal in this window is to make your own recovery harder, which is why the first thing to be replaced is often the contact channel rather than the password.

Minutes five to thirty

Withdrawal addresses get added and API keys get created. Both are quiet by design. An API key with trading and withdrawal permission needs no further interaction, and a new address may sit unverified until a waiting period expires, which is the one delay that works in your favour.

What comes later

Support tickets filed in your name, appeals against account freezes, and removal of your remaining recovery options. A takeover that fails on the night can succeed a week later if the attacker keeps a foothold in the mailbox.

Why the first 30 minutes decide the outcome

Two mechanisms compress the timeline. The first is that most venues treat a logged-in session as proof of identity, so account takeover defence depends on ending sessions rather than on proving who you are. The second is that withdrawal address allowlists, where they exist, often have a holding period measured in hours or days. That delay is the single most valuable thing you own during an incident, and it starts when the address is added, not when you notice.

This is also why the response order matters more than the response list. Locking the account first prevents new changes. Killing sessions second removes the attacker’s access. Everything else, including the password, can follow.

Cost is part of the calculation. Every minute spent searching for a setting is a minute the attacker spends moving funds, and the asymmetry is severe: a freeze costs you a few hours of access, while a completed withdrawal costs the balance. When you are unsure which control to reach for first, choose the one that makes the account inert.

The goal in the first half hour is not to explain what happened. It is to make the account unusable by anyone, including you, until you understand it.

Account takeover response, minute by minute

A 30-minute account takeover procedure

Run this from a device you trust, ideally not the one you were using when you noticed the problem. If the only available device is the suspect one, use a phone on mobile data instead.

1. Freeze withdrawals or disable trading in the venue’s security settings. Accept the inconvenience; it is reversible.
2. Terminate every active session, including mobile apps and any connected third-party tool.
3. Delete all API keys, then recreate only the ones you actually use with the minimum permissions.
4. Review withdrawal addresses and remove anything you did not add yourself.
5. Change the email password, then check forwarding rules, filters and recovery addresses for entries you did not create.
6. Replace the password on the exchange account and reset two-factor authentication to a method you control.
7. Write down the timeline: what you saw, when, and which settings changed. The venue will ask.
8. Contact the venue through its published support channel, not a link in any message you received.

Preventing account takeover before it happens

Prevention is mostly about removing the single point that unlocks everything. An email address that can reset every financial account is that point, and it should be dedicated, unlisted and protected by a hardware key rather than by codes sent to a phone number.

Second, use the controls the venue already offers. Withdrawal allowlists with a holding period, separate API keys per application, and alerts on login and address changes are cheap and they convert a silent takeover into a noisy one. An alert you receive in ninety seconds is worth more than a security page you read once.

Third, assume that any message asking you to act urgently is an attempt until proven otherwise. Account takeover attempts frequently begin with a call or message that creates the urgency the attacker needs, whether or not any technical compromise follows.