Someone Logged Into Your Crypto Account: What to Do in the First 10 Minutes After a Sign-In Alert You Didn't Expect
The email arrives at 2:14 a.m. "New sign-in to your account from a device we don't recognise."
You did not sign in. Now you have a few minutes in which the order you do things matters more than how fast you do them, because the wrong first move can lock you out of your own recovery.
I send that email on Wealtii every time an account is accessed from a new device, and I built the rest of the sign-in flow around what happens next. This post is the sequence I would follow on my own platform or on any other, written for someone who has never had to do it before.
The direct answer: secure your email inbox before you touch the investing account, then sign in yourself to end the intruder's session, then change the password, then turn on an authenticator app, then check for pending withdrawals and contact support with timestamps. In that order.
What an attacker actually needs
Start with the mechanism, because it tells you where to put your effort.
On Wealtii, a sign-in needs your password and a one-time code sent to your email. If you have turned on two-factor authentication, moving money out also needs a code from your authenticator app; if you have not, it needs an email code. A new-device sign-in triggers an alert to your email. Repeated failed sign-ins temporarily lock the account.
Read that list again and notice what appears in every line. Your email inbox is the master key. Someone with your password and nothing else is stopped at the sign-in code. Someone with your email inbox can request that code, receive the alert and delete it, confirm a withdrawal, and reset your password if they want to.
This is why the first ten minutes should not start on the investing platform. If the intruder has your inbox, every action you take on the platform can be undone from the inbox. Secure the inbox, then everything else.
Minute 0 to 3: lock the inbox
Do this from a device you trust, not from a link in the alert email.
- Change your email password. Pick something you have never used anywhere else.
- Sign out every other session in your email provider's security settings. Most providers have a single button for this.
- Check forwarding rules and filters. This is the step almost everyone skips. A common attack adds a rule that silently forwards or archives messages from your investing platform, so the one-time codes and alerts never reach you. Delete any rule you did not create.
- Check the recovery phone and recovery email on the mail account. If either has been changed, change it back. If any of those were tampered with, you have learned something important: the intruder was in the inbox, not just the platform, and the platform alert did its job.
Minute 3 to 5: end their session
On Wealtii, signing in on a new device ends the previous session. That design choice exists for exactly this moment. Sign in yourself, from your trusted device, and whoever was inside is signed out.
If your password no longer works, the intruder changed it. Use the password reset, which goes to the inbox you have just secured. This is the second reason the inbox comes first: a reset sent to a compromised inbox is a reset sent to the attacker.
Once you are in, change the platform password, again to something unique.
Minute 5 to 7: raise the bar for next time
If you have not already, turn on two-factor authentication with an authenticator app. On Wealtii it is optional and strongly recommended, and this is the moment the recommendation stops being abstract. With it on, confirming a withdrawal needs a code generated on your phone rather than a code delivered to your email, which removes the inbox from the withdrawal path.
Save the backup codes somewhere that is not the same phone and not the same inbox. A later post of mine covers what to do if you lose the phone, and the short version is that the backup codes are the whole plan.
Minute 7 to 10: find out what they did
Now, and only now, look at the account itself.
- Open the transaction history and look for sells or withdrawals you did not make.
- Look for a pending withdrawal. On Wealtii every withdrawal needs a confirmation code and some are held for an extra manual check, so there is a window in which a withdrawal may exist but not yet have left.
- Note timestamps. The time of the sign-in alert, the time of anything in the history you did not do, the time you regained control.
- Contact support immediately with those timestamps, the device or location shown in the alert if any, and the transaction details. Do this through the platform's own support channel, never through a link or account that contacts you first. What support can and cannot do is worth knowing before you ask. No support team can reverse a transaction that has already settled on-chain, mine included. What they can do is act on anything still inside the platform, review the account, and tell you exactly what the record shows.
What the alert does not tell you
An alert says a new device signed in. It does not tell you how the password was obtained, and the answer decides whether this happens again next week.
The three most common routes, in rough order: the same password was used on another site that got breached; a phishing page collected the password and the sign-in code in real time; or the device itself has something on it. The first is fixed by unique passwords everywhere, ideally from a password manager. The second is fixed by typing the platform address yourself and never signing in from an emailed link. The third needs the device checked before you trust it again.
If you cannot tell which it was, assume all three and fix all three. The cost is an afternoon. The alternative is the same email at 2:14 a.m. next month.
The ten-minute checklist, in order
- Email password changed, other sessions signed out.
- Forwarding rules and filters checked, anything unfamiliar deleted.
- Email recovery options checked and restored.
- Signed in to the platform yourself, ending the intruder's session.
- Platform password changed.
- Authenticator app 2FA turned on, backup codes stored separately.
- Transaction history reviewed, pending withdrawals noted.
- Support contacted with timestamps and details.
- Cause identified: reuse, phishing, or device.
- Every other account that shared the password changed. Keep this list somewhere you can reach it without signing in to anything. The whole point is that you will need it when you are stressed, half awake, and not in a position to think it through from scratch.
What I built, and what it still does not solve
The choices behind Wealtii's sign-in flow are deliberate and I want to be plain about their limits.
I send a new-device alert so you hear about a sign-in while there is still time to act. I keep one session at a time, so your own sign-in evicts anyone else. I require an email code on every sign-in and a code on every withdrawal, so a stolen password alone moves nothing. I lock the account temporarily after repeated failed attempts, so guessing at scale stalls. And I hold some withdrawals for an extra manual check, which is friction I accept for exactly this scenario.
What that does not solve: none of it protects an inbox I do not control, which is why this whole post starts there. It cannot reverse anything already settled on-chain. And it cannot make 2FA mandatory for you; that switch is yours, and the day you most wish it were on is the day described above.
Wealtii is a custodial platform operated by me, with no third-party security audit yet, no deposit insurance, and no investor-compensation scheme. Account security on any platform is shared work, and the half that lives in your inbox and on your devices is yours.
The current sign-in, session, and withdrawal protections are described on the Wealtii security page, and the how-it-works guide shows what a withdrawal confirmation looks like before you ever need one.
Digital assets are volatile and you can lose some or all of the money you invest. Blockchain transactions cannot be reversed. This is educational content, not security, legal, or financial advice.