What to Do First When a Login from an Unfamiliar City Appears in Your Binance History
Don't panic, but you must act immediately. The vast majority of "unfamiliar city" logins are false alarms — you may have used a VPN, switched network providers, or the IP geolocation itself is inaccurate. But even if there's only a 1% chance it's a real intrusion, you should handle it as if your account has already been compromised to minimize potential loss. Below are the steps in order of priority.
The world's largest cryptocurrency exchange by trading volume,leading in security and liquidity.
New user benefit: Enjoy 20% off trading fees upon registration!
Step 1: Confirm Whether the Login Was You
Open your Binance app or web version, go to [Security Center] — [My Devices] or [Login History], and check the details of that login: time, IP address, device type, and approximate city.
Case A: You were actively using Binance at that time, and the device type matches your usual device→ It's likely a VPN node change causing the IP location to shift. The "city" shown in the login record is the IP registration location, not GPS. If you use a VPN to switch to another country, you'll see that location. No further action is needed in this case.
Case B: You did not operate at that time at all, or the device type is completely unfamiliar→ Go to Step 2.
Completion standard: Confirm whether the login was initiated by you.
Prerequisite: You can log into your Binance account normally and access the device management page.
Step 2: Immediately Terminate the Unfamiliar Device's Session
In the [My Devices] list, find the unfamiliar device record, click [Log Out] or the "X" button on the right, and confirm terminating that device's access.
Completion standard: The device disappears from the list or its status shows "Removed".
Step 3: Immediately Change Your Login Password
Your password is the foundation of all security measures. An unfamiliar device appearing in your login history means your password may have been leaked.
How to do it: Go to [Security Center] — [Password Management] and change your login password. The new password must meet these requirements:
- 8–20 characters long
- Contains uppercase and lowercase letters, numbers, and special symbols
- Do not reuse a password from any other platform
Completion standard: Password changed successfully, and the system asks you to log in again.
Risk notice: After resetting your password, withdrawals, C2C selling, and other functions will be disabled for 48 hours for account safety. This is a platform security measure, not a malfunction.
Step 4: Check and Update All Available Verification Methods
Check the 2FA settings in [Security Center] to confirm whether Google Authenticator, phone number, email, and other verification methods are still under your control:
Case A: Everything is normal→ Directly enable the "Withdrawal Address Whitelist" function in the Security Center, add your commonly used addresses to the whitelist, and block any withdrawals to unfamiliar addresses.
Case B: You find your phone number/email has been changed→ This is a clear sign your account has been compromised. Contact Binance support, follow instructions to provide proof of identity, and apply to reset your security verification methods. Note: Resetting 2FA will also result in a 48-hour withdrawal restriction.
Completion standard: All verification methods are confirmed to be yours.
Step 5: Check Email Security and API Permissions
Many account compromises do not originate from a direct attack on Binance but from your email being taken over and used to reset the password.
How to do it:
- Log into your linked email account and check for any unusual "forwarding rules" or "auto-replies" that have been set up — this is a common trick hackers use to intercept Binance verification codes.
- Go back to Binance [API Management] and delete all API Keys you are not using or do not recognize.
Completion standard: No suspicious forwarding rules in email, and the API Key list is clean.
The world's largest cryptocurrency exchange by trading volume,leading in security and liquidity.
New user benefit: Enjoy 20% off trading fees upon registration!
How to Confirm After Doing All This
The unfamiliar device has been removed from your login history, your password has been changed, and all verification methods are confirmed normal. Then check [Assets] — [Withdrawal History] to make sure there are no unauthorized withdrawal requests — if there are any, contact customer support immediately to freeze your account.
Going forward, check your login history regularly. If you travel abroad or use a VPN in the future, the platform's risk control may be triggered by the change in geographic location and could temporarily lock your account. In that case, just follow customer support instructions and provide proof of your travel itinerary to get it unlocked.
