You typed credentials somewhere
Work in this order. It puts what somebody can act through ahead of what you are most worried about.
The sequence
- Get in through an address you verified yourself. Not the one you were just using, which may be the problem. This step is first because everything after it is pointless if you do it on the same page.
- Change the password. To something used nowhere else. If the old one was reused anywhere, change it there too, because the same list is being tried everywhere.
- Reset the second factor, and save the new recovery material before closing the page.
- Read the message log. Before the balance. A stolen account is most valuable as a way to talk to people who trust it, so check what was said in your name and to whom.
- Check open orders and saved addresses for anything you did not do.
- Then the balance. Last, deliberately.
If it was a code rather than a password
Assume the session is live right now. A second factor code is short lived and a live attacker does not need it to live long, so the window between handing one over and it being used is measured in seconds. The sequence is the same and the urgency is real, which is the one place on this site where hurrying is correct.
If it was a wallet seed
Move whatever remains to a new wallet immediately, and do nothing else first. This is the only item in the register where the correct response is measured in minutes and where nothing on the platform matters by comparison. No legitimate flow ever asks for a seed, so there is also no version of this where it turns out to have been fine.
What not to do
- Do not go looking for support. There is none, and everything presenting itself as support is aimed at people in exactly your position. See the fake support account.
- Do not post details publicly. It advertises an account worth attacking and invites private messages from strangers.
- Do not try a dozen passwords quickly. Rate limiting will make the next hour worse.
- Do not accept an address somebody offers you now. The timing is not a coincidence.
Afterwards
Work out which channel put the page in front of you, because that is the part that generalises. Almost always it was a channel that cannot prove anything about itself, and almost always the page was believed because of where it was found rather than because of anything it demonstrated. That is what the check exists to replace.