Bro, you get a text at 3 a.m. saying: "Your OKX account logged in from another location." Your first reaction is probably — damn, did I get hacked?
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Don't panic yet. That login alert might just be your IP drifting around. But if it is real and you handle things in the wrong order, your funds could be at risk. Today I'll tell you the exact order to follow after you spot a device from another location.
Step 1: First check whether it is a "false alarm"
Carrier networks often assign users random IP addresses. You might be in Shanghai, but the system shows you logged in from Beijing.
[What to do]: Check the login time and device to see if it is a false alarm.
[How to do it]:
Open the OKX App and go to [Profile] → [Security settings] → [Device management].
In the device list, look at the time of that unfamiliar login and ask yourself whether you were active at that moment. If you had just logged in yourself, it is very likely a false alarm caused by IP drift.
[Done when]: You have confirmed whether the unfamiliar login time matches your actual activity.
Step 2: If it is not a false alarm — freeze the account first
If you definitely did not log in during that time, and the device name and IP address are completely unfamiliar, the next steps must be done in the right order.
[What to do]: Block the fund exit before the attacker makes a move.
[How to do it]: Order: freeze the account → remove devices → change password.
Freeze the account immediately: In [Security settings] → [Account management], find the [Freeze account] function and enable it right away. While frozen, withdrawals, trading, and settings changes are all stopped.
Force logout all devices: In [Device management], force logout every device except the phone you are currently using. If the list includes devices you recognize but have not used for a long time, such as an old computer, delete them too.
Change your password: Go to [Security settings] and change your login password to a strong password you have not used anywhere else.
[Done when]: The account shows as frozen, and the device list only contains the device you are currently using.
Step 3: Check for "backdoors" — clean up authorizations and bindings
After changing your password, the attacker may still have other access channels — such as a bound Google Authenticator, API keys, or third-party login accounts.
[What to do]: Remove all linked permissions that could be exploited.
[How to do it]: Go to [Security center] and check each item:
Google Authenticator: If you see any binding that you did not create, reset it immediately.
API keys: Delete all API keys that you did not create.
Linked social accounts: Unbind all third-party accounts that you did not personally link, such as Google, Apple ID, or Telegram.
Withdrawal address book: Delete all "verified addresses" that you did not add.
[Done when]: You have checked all permission settings pages and there are no unfamiliar bindings left.
FAQ
Q: What if the attacker already changed my password and I cannot log in? A: Use the "Forgot password" self-service process to reset it, or go to the official website and contact online support. Type "emergency account freeze" and follow the instructions to submit a photo of yourself holding your ID. After verification, support will help you force freeze the account.
Q: After freezing my account, can I still trade normally? A: While frozen, you cannot withdraw, trade, or change security settings. You can only view assets and order history. Normal operations resume only after you finish checking and unfreeze the account.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Next step
Go to the security center now and check [Device management]. If you see any device you do not recognize, immediately follow the order above: freeze first, then remove devices, then change your password. A false alarm costs you ten minutes at most. If it is a real theft, every minute you wait is money lost.
