If a login from an unfamiliar device suddenly appears in your account, the first action is to immediately terminate that device session, not rush to change the password or contact customer support. Cutting off the unknown device's access to your account first can prevent attackers from moving assets during the interval.
The world's largest cryptocurrency exchange by trading volume,leading in security and liquidity.
New user benefit: Enjoy 20% off trading fees upon registration!
Step 1: Immediately Terminate the Unknown Device Session
This is the most direct way to block the attacker's current access, making their login status invalid.
What to do: In the Binance App or website's "Device Management" page, find the unrecognized device record and click "Terminate Session" or "Log Out".
How to do it: Go to [Account Center] → [Security Settings] → [Device Management]. The list shows all currently logged-in devices and their IP locations. After confirming it's an unknown device, click "Terminate" or "Log Out" to immediately log that device out of the account.
Completion standard: Refresh the device management page; the unknown device should have disappeared from the list or show as "Logged Out".
Step 2: Check Asset Status and Set Fund Protection
Confirm that assets have not been transferred out and add an extra security barrier.
What to do: Quickly check the balances of spot and earn accounts, and then immediately enable "Withdrawal Whitelist" or "Fund Password" protection.
How to do it:
First, check the total assets on the "Overview" page to make sure there are no unusual outgoing transactions.
In [Security Settings], enable "Withdrawal Address Whitelist" and "Fund Password" (or anti-phishing code). Once enabled, even if the account is logged in abnormally again, withdrawals cannot be completed without the fund password.
If there are assets in savings or earn products, confirm their status is normal.
Completion standard: Asset amounts are correct, and the withdrawal function is protected by additional verification measures.
If the unknown device reappears after terminating the session, it means your login credentials (possibly cookies or API keys) have been leaked. At this point, you need to go to the [API Management] page, disable or delete all API keys not created by you, to prevent attackers from manipulating assets through programmatic interfaces. This action is second only to terminating the session in priority.
Step 3: Investigate the Source of the Login Credential Leak and Change Password
After cutting off access, you need to find out how the account was logged in to avoid being compromised again.
What to do: Check for unauthorized third-party app access or shared sessions, then change the account password.
How to do it:
Check the IP location in device management and recall if you used public Wi-Fi or a proxy network during that period.
Change the login password in [Security Settings]. It is recommended to use a combination of uppercase and lowercase letters, numbers, and special characters.
Check and unbind any third-party authorized apps that are no longer in use.
Completion standard: Password has been updated, and no unknown third-party app authorizations remain.
Common Failure Reasons and Risk Reminders
The common mistake after discovering an unknown device is not to kick the device offline first, but to contact customer service or change the password. Changing the password may require a verification code and takes a certain time window. During this period, if the attacker is making a withdrawal, the funds could already be transferred out. Always kick the unknown device out of the login state first, then handle the subsequent security settings.
How to Verify the Operation is Complete
After changing the password, check the device management list to ensure only the device and browser you are currently using remain. It is recommended to log out and log in again to verify the new password works.
The world's largest cryptocurrency exchange by trading volume,leading in security and liquidity.
New user benefit: Enjoy 20% off trading fees upon registration!
Next Steps to Take
If you have a significant amount of assets in the account, consider transferring some funds to a cold wallet or withdrawing to a personal wallet address temporarily. Wait 1-2 days to observe no abnormal login records before transferring them back.
