API Key Compromised? What to Do Immediately

If you suspect your exchange API key has leaked, act now: revoke the key, check your trade and withdrawal history, then generate a new one before reconnecting anything. In that order — revoking first is what actually stops further damage; everything after that is assessment and cleanup.

The three steps

1. Revoke the key. Log into your exchange account directly and delete the key from its API management page. This is the single most important action and takes under a minute — it cuts off anything using that key immediately, regardless of what platform it was connected to, because the exchange rejects any signed request from a key it no longer recognizes. See how to revoke API access on Binance, Bybit, OKX, Kraken, and Gate.io for the exact steps.

2. Check your trade and withdrawal history. Look for orders you didn't place or balance changes you can't explain. If the key had trade permissions only (no withdrawal), unauthorized activity will show up as unusual trades — sometimes deliberately manipulative ones, not a direct transfer out. See the next section for why that distinction still matters even with a trade-only key.

3. Generate a new key, scoped correctly, before reconnecting. Create a fresh API key with read and trade permissions only — never withdrawal — and add an IP restriction if your exchange supports it, since that neutralizes the key even if it leaks again. Use it to reconnect any bot you want running again. Don't reuse the old key's settings without checking them first; if it had broader permissions than it needed, that's worth fixing at the same time.

Why a trade-only key still isn't zero risk

A key without withdrawal rights can't move funds directly off the exchange, but it can still be misused: an attacker with trade access can place manipulative orders — buying illiquid assets at inflated prices, for example, to profit from the resulting price movement at your expense — without ever triggering a withdrawal. This is why revoking access matters even when you're confident the key never had withdrawal permission in the first place. For the full picture of what a key can and can't do, see what data a trading bot can access through an API key.

How keys actually get compromised

Understanding the leak vector matters as much as the immediate cleanup, since it's what stops the next one. The common paths, in roughly descending order of how often they show up in incident reporting: phishing emails or messages impersonating an exchange or bot platform's support team, asking you to "verify" a key or paste it somewhere; malicious browser extensions with permission to read page content, which can capture a key as you copy it from an exchange's settings page; fake support agents in Telegram, Discord, or social media DMs who ask for a key directly, framed as troubleshooting; and, less commonly, malware that monitors clipboard contents. Legitimate platforms never ask you to send an API key through chat, email, or a support ticket — a request to do so is itself the clearest available signal that something is wrong, before any unauthorized trade ever shows up.

How common this actually is

Credential and private-key compromise is a real, tracked category of crypto loss, not a rare edge case. Blockchain security firm SlowMist's 2026 mid-year report recorded 182 total security incidents across the industry between January and June 2026, totaling roughly $956 million in losses — and within that, 17 separate incidents were specifically private-key or credential compromise, accounting for approximately $130 million. That's a smaller share than smart-contract exploits (the largest single category), but a consistent, ongoing one, not a fading risk. Separately, Chainalysis's 2026 Crypto Crime Report put total crypto scam losses at approximately $17 billion for 2025, with the average scam payment size up 253% year-over-year and impersonation-scam volume up 1,400% over the same period — a reminder that the tactics used to get a key in the first place are both common and getting more expensive when they land.

Suspected vs. confirmed compromise

The three steps above apply the moment you suspect a leak, not only once you've confirmed one — revoking a key that turns out to have been fine costs you a few minutes of reconnecting a bot; leaving a genuinely compromised key active costs considerably more. If your trade history check in step two comes back clean, that's a reasonable point to stop treating it as an active incident, but it's still worth completing step three (a fresh key with tighter scope) rather than reverting to the old one, since whatever made you suspicious in the first place is worth designing around going forward.

After the immediate steps

Once the compromised key is gone and a new one is active, review where the leak might have come from using the list above, so the new key doesn't end up in the same place. The Crypto Bot Risk Checklist covers the broader set of precautions worth reviewing once the immediate risk is handled.

Revoking a key takes under a minute. Everything an attacker does with a leaked key takes longer than that — the order you act in is the whole strategy.

FAQ

What's the very first thing I should do if my API key is compromised? Revoke it on your exchange's API management page immediately. This stops anything using that key before you do anything else.

Can someone steal my funds with a trade-only API key? Not by withdrawing them directly, but they can still manipulate your balance through unauthorized trades. Revoke the key regardless of its permission scope.

How do API keys usually get stolen? Most commonly through phishing messages impersonating support, malicious browser extensions, or fake support agents asking for the key directly. A legitimate platform never asks for your API key through chat or email.

Should I generate a new API key with the same permissions as the old one? Only if the old one was already scoped correctly — read and trade, no withdrawal. Use this as a chance to check and tighten permissions, and add an IP restriction, if it wasn't.

How common is API key compromise in crypto? It's a tracked, ongoing category of loss. SlowMist's 2026 mid-year security report counted 17 private-key/credential-compromise incidents totaling about $130 million in the first half of 2026 alone.