You thought changing your password made your account safe, but your funds were transferred out anyway—such cases were not uncommon in 2024 and 2025. The problem is you changed your "password," while the attacker holds your "login session" (session), which is a totally separate authentication system from your password.
In simple terms, hackers don't need to know your new password at all. If they steal that session token generated after you log in, they can move freely in your account until the session expires or is manually terminated. Changing your password leaves the session token still valid.
Understanding Why Changing Your Password Doesn't Work – Sessions and Passwords Are Two Separate Systems
First, understand the relationship between password and session token. When you log in, the exchange gives you an "authenticated" credential, like a ticket valid for a certain period. This ticket can last for hours or even days, independent of your password.
According to Kraken's security settings, the default auto-logout is 120 minutes, and users can customize this anywhere from 2 to 10080 minutes. If a hacker steals this ticket before it expires, changing your password is like changing the lock on the front door, but the hacker already has the "room key card" and is inside. In a Binance official case, a victim had malicious code injected via a Chrome extension, and the hacker hijacked their trading session, completely bypassing passwords and 2FA to operate the account.
Confirm If Your Session Token Has Been Compromised – Check Active Devices
If you notice funds still moving after you changed your password, that means the attacker is still using your valid session.
How to do it: Log into your exchange app or website immediately, find the "Security Settings" or "Device Management" section, and view the list of all active sessions.
For example, on Kraken, go to "Security" > "Overview" and scroll down to the "Active Sessions" area. You can see the date, time, device, geographic location/IP of all recent sessions, and you can end any session or click "End All Sessions" to kick them all out at once. Bitget also provides a view and removal of unauthorized devices in "Security Center" > "Device Management", and removing a device will instantly log it out. OKX also recommends that users go to the device management in the security center to remove all unrecognized devices when detecting abnormal activity.
Completion standard: All active sessions not operated by you have been manually removed. Your account login state is wiped clean.
Risk reminder: After you change your password, some platforms may trigger a 24-hour withdrawal limit for sensitive security changes (such as resetting Google Authenticator). This is a safety mechanism, not a problem. According to OKX, closing or changing your authenticator will pause withdrawals for 24 hours. However, changing your password alone usually does not trigger this ban. Do not assume that "being able to withdraw means you're safe."
Clear Other Possible Access Channels – API Keys and Third-Party Logins
Session tokens are one risk, but API keys and third-party authorizations can also become backdoors.
How to do it: Go to the API management page and delete all API keys that you did not create yourself. Also check the third-party logins tied to your account (such as Google, Apple ID, Telegram) and remove any social account you did not authorize.
Completion standard: Only your own created entries remain in the API key list and third-party login list.
Common failure reason: Many people think changing the password is enough and overlook the "API key" entry. After breaching an account, attackers often create a high-permission API key (capable of withdrawing or trading) to maintain persistent control, then bind a third-party Telegram or Google account. Even after you change the password, they can still operate through the API. Even if the API is cleaned up, if the third-party login is not removed, the attacker can still bypass the password and log in again through Google or Telegram.
Stop the Source of Session Token Theft – Browser Extensions and Device Isolation
How do session tokens get stolen? In most cases it's not "credential stuffing" but "browser poisoning." According to OKX's 2026 half-year security report, many attacks no longer start from unfamiliar links. They come from app stores, search results, friend accounts, recruitment processes, customer service emails – entry points where users feel familiar and let their guard down.
In the June 2024 series of OKX user thefts, research firm Dilation Effect pointed out that hackers used AI-generated videos to apply for changing users' phone numbers, emails, and Google Authenticator, successfully bypassing some security settings. OKX founder Star admitted that methods to steal users' Google Authenticator included device trojan implantation, SIM card cloning, fake base stations, and theft via SMS service providers. That same year, a Binance user installed a seemingly harmless Chrome extension called "Aggr," which led to the hijacking of browser cookies, session theft, and a loss of approximately $1 million.
How to do it: Thoroughly check your browser. Uninstall all extensions from unknown sources or those with unclear functions. Consider using incognito mode for important operations, or isolate fund-related actions on a clean device (such as a phone used only for trading).
How to verify success: After completing the steps above, do not rush to deposit funds. First, re-log into all devices and manually end all old sessions. Second, enable or reset Google Authenticator (GA) and make sure its cloud backup feature is turned off. Third, follow the principle of least privilege when setting up APIs, and avoid high-risk configurations like "whitelisted withdrawal addresses without authentication." Final confirmation: you see no unknown devices in the device management list, the API list is empty or contains only keys you know about, and there are no abnormal withdrawal records.
