Crypto Account Hacked? What to Do in the First Hour

If something has just happened (a withdrawal you didn't make, a "password changed" email, an app that suddenly won't let you in), skip to Minutes 0 to 5 below and start there. Read everything else later.

If you're here to prepare, that's even better. People who've read this list once, on a calm day, move much faster when it's real.

And if it's your KWIQ account, take a breath. A stolen or hacked phone isn't enough for someone to move your funds (here's why), and our support team is here to help, day and night.

Minutes 0 to 5: stop, breathe, switch devices

1. Don't keep using the device you suspect. If your phone or laptop might have malware on it, anything you type there, including new passwords, could be seen. Use a different device you trust: a second phone, a family member's laptop, a work computer.

2. Don't reply to anyone who contacts you about it. Not an email saying "click here to secure your account", not a DM from "support", not a phone call. Hackers often follow up a break-in with a fake rescue. Only use contact details you find yourself, in the official app or on the official website.

Minutes 5 to 15: take back your email

Your email is the master key. Almost every password reset goes there, so if the hacker controls it, they can undo everything else you fix.

3. Change your email password to a strong one you've never used anywhere else.

4. Sign out every other session. Most email providers have an option in their security settings to sign out of all other devices. Use it.

5. Check what the hacker may have changed:

• the recovery phone number and recovery email;
• forwarding rules and filters (hackers sometimes set these up to hide security alerts from you);
• connected apps and devices you don't recognise.

6. Turn on two-step verification with an authenticator app, if it isn't on already. An authenticator is safer than SMS codes, for reasons that will become clear at step 10.

Minutes 15 to 25: contact the platform's support

7. Tell the platform what happened, through its official channels. Many platforms can help secure an account if they hear about a problem quickly. Explain what you noticed, roughly when it started, and any transactions you didn't make.

If it's your KWIQ account, use live chat in the app if you can still sign in. If you can't, use live chat on kwiq.app, email admin@kwiq.app or call +2348098460000. Our support page has the same details. Support is available 24/7, and the team is always happy to help, however small or late-night the worry.

How KWIQ protects your funds

Protecting your money is the job we take most seriously, so KWIQ is built on the assumption that phones get lost, stolen and hacked:

• Internal security checks protect every account, so getting hold of your phone isn't enough for someone else to move your funds.
• Your transaction PIN is needed to move money out of your account. It's separate from your phone's lock screen, so keep it to yourself and never write it on the phone.
• Your email address can't be changed. A common trick elsewhere is to switch the account email and lock the real owner out. On KWIQ, that door is closed.
• Wallet services and naira payments run through licensed partners.
• Real people, around the clock. Support is there 24/7 to help you secure your account and talk you through what to do next.

Whatever platform it is, real support will never ask for your password, PIN or one-time codes. KWIQ never does, by chat, phone, email or social media. If someone in a "support" conversation asks for them, you're talking to the wrong person.

Minutes 25 to 35: lock the doors

8. Change the account's password and PIN, using the device you trust. Make them new, not variations of the old ones.

9. Remove anything the hacker added. Sign out of other sessions or devices if the app lets you see them. On exchanges, also check for new API keys, new saved withdrawal addresses and changed security settings, and delete anything you didn't set up.

10. Check your SIM. If your phone shows "No service" while people around you on the same network have signal, your number may have been moved to another SIM. Call your network's customer care from another phone and ask them to block the line. The customer care short code is 300 on every Nigerian network, dialled from a line on that network. Our guide to SIM swap fraud explains the warning signs.

11. Call your bank if the hacked account is linked to it, if you used the same password for online banking, or if you notice any unfamiliar transactions.

If it's a self-custody wallet

Nobody can lock a self-custody wallet such as MetaMask or Trust Wallet for you, not even the company that makes the app. What you do depends on how the theft happened.

• If someone may have your seed phrase or private key (you typed it into a website, gave it to "support", or kept a photo of it), the wallet is permanently unsafe. Create a new wallet with a new seed phrase on a device you trust, and move whatever is left right away. Our seed phrase guide shows how to set it up properly.
• If tokens left after you connected to a dodgy site, the cause may be a token approval. Revoke it before more tokens arrive. Here's how to check and revoke token approvals.

If the gas coin you send in to move funds disappears within seconds, a bot is sweeping the wallet. Stop sending more.

Minutes 35 to 50: write everything down

12. Build a record while it's fresh. Support and your bank will move faster with it. Include:

• the date and time you first noticed something wrong;
• every transaction you didn't make, with amounts, addresses and transaction hashes (our guide to tracking a transaction with a block explorer shows where to find them);
• screenshots of alert emails, texts and in-app messages;
• anything unusual you clicked, installed or shared in the days before.

Minutes 50 to 60: let support help you finish

13. Send your record to support. Share it with the platform's support team so they can check every transaction with you. On KWIQ, send it through live chat or to admin@kwiq.app: the team is always happy to help, will work with you to secure your account, and will keep you updated until it's sorted. If the hacked account is on another platform, send the same record to its support team, and to your bank if your bank account was involved.

In the days that follow

Clean up the device you suspected. Remove apps you don't recognise, any remote-access or screen-sharing apps, and unfamiliar browser extensions. Update the operating system. If you're not sure it's clean, back up your photos and documents and reset it to factory settings.

Change reused passwords. If the hacked password was used anywhere else, change it there too. A password manager makes unique passwords painless.

Work out how it happened. The common routes are a phishing link, a password reused from another site that leaked, a SIM swap, a fake app, or a code shared with fake support. Our guide to fake crypto support scams covers the last one. Knowing the route helps you close it.

Watch out for "recovery experts". Within days, someone may offer to get your crypto back for a fee. They can't, and they'll take more if you let them. Read crypto recovery scams before you answer anyone.

And go easy on yourself. Accounts get hacked even when people are careful. What counts is how quickly you respond, and you're already doing that.

Before you ever need this

Save KWIQ's support contacts in your phone now, turn on every security option your apps offer, and keep your email locked down. Then, if the worst happens, you'll have the right numbers to hand instead of searching in a panic. If you haven't joined yet, download the KWIQ app. Low on phone storage? You can also sign up on the web.