Security decision matrix
Identify the threat before changing settings
Fast action helps only when it matches the incident. Start with the account, email, device, and withdrawal path.
| Signal | Likely risk | First safe action |
|---|---|---|
| Unexpected login alert | Possible credential exposure | Secure email first, then review sessions from a clean device. |
| 2FA device lost | Access recovery risk | Use official recovery. Do not pay anyone or share backup codes. |
| Fake support contact | Phishing or recovery scam | Stop replying. Open the provider through a bookmark or typed domain. |
| Unknown API key | Automated account access risk | Revoke it, rotate credentials, and review trades and withdrawals. |
| Withdrawal address changed | Funds may be at immediate risk | Freeze withdrawals if available and contact official support. |
| Account locked | Security, KYC, region, or policy review | Read the exact status and use the matching official appeal route. |
Account lock triage desk
Identify what is locked before trying fixes
A locked exchange account can mean login protection, security review, identity review, policy restriction, or suspected account takeover.
Wrong password or too many attempts
This is usually about authentication, not funds. Stop guessing passwords and protect the linked email before resetting anything.
Use the official password or account recovery route from a typed domain.New device, location, password, 2FA, or suspicious activity
The provider may slow access or withdrawals after sensitive changes. Review alerts, sessions, and whether unauthorized activity is possible.
Preserve the timeline and avoid repeated resets that create more signals.KYC or proof-of-ownership check
A lock can require identity evidence, address evidence, liveness check, or account history. Edited or mismatched documents usually slow review.
Submit only through the protected official upload flow.Service restriction or account closure notice
Some restrictions are not solved by another password reset. Read whether the account, product, country, asset, or withdrawal function is affected.
Ask for the allowed next step, not a workaround through another account.Recovery scam filter
Unlock promises are a common trap
- Do not pay a tax, fine, verification fee, or employee fee to unlock access.
- Do not create a second account unless the provider explicitly tells you to.
- Do not share a screen, password, live 2FA code, recovery code, or identity document by chat.
- Do not send crypto to prove ownership or activate withdrawals.
Read the exact status before acting
Take note of the wording shown in the verified app or website. An incorrect-password lock, disabled login, identity review, withdrawal restriction, frozen account, and closed account are different conditions and may use different recovery processes.
Check whether the message appears only in an email or text. Do not follow its link. Open the provider from a trusted bookmark or type the known official domain, then compare the status inside the authenticated account.
Separate login access from account functions. If you can log in but cannot withdraw, use the withdrawal-disabled path. If you cannot log in at all, prioritize email, device, and official account recovery.
- Exact error or restriction message
- Time and device where it appeared
- Whether login, trading, deposits, or withdrawals are affected
- Recent password, email, phone, or 2FA changes
- Recent travel, device, network, VPN, or identity updates
- Any official case number already issued
Protect access you still have
If a trusted session remains open, do not log out reflexively. Review recent activity, sessions, API keys, withdrawal addresses, account notices, and security notifications without making unnecessary changes.
Secure the linked email and mobile account from a clean device. Change a reused or exposed password, but avoid repeated resets or verification attempts that can create more alerts.
If the lock followed an unfamiliar login, unknown API key, changed withdrawal address, or unexpected 2FA prompt, treat the case as possible account compromise. Preserve evidence before removing suspicious items when the provider allows removal.
Use the matching official recovery route
Use the provider's login recovery, identity review, security appeal, or authenticated support flow that matches the displayed status. A legitimate review may request account identifiers, device history, transaction details, or identity evidence through a protected upload process.
Submit only the information requested and keep the case number. Identity checks and authenticator replacement can take time because they protect account ownership. Do not create duplicate accounts or upload edited documents unless the provider explicitly instructs you to do so.
If the lock appeared after suspicious activity, say that in the official case. If it appeared after repeated failed attempts, stop trying random resets and preserve the exact timeline instead.
Escalate without creating a second problem
If the stated review period has passed, reply through the existing official case instead of opening many conflicting tickets. Summarize the exact status, when it started, actions already completed, and the evidence available.
Treat anyone promising guaranteed recovery, priority access, employee contact, or a manual unlock for payment as untrusted. Do not send crypto to unlock an account, pay a tax, or prove ownership.
If unauthorized activity is possible, state that clearly in the official case and preserve timestamps, messages, IP or device alerts, API key changes, withdrawal-address changes, and transaction IDs.
Reopen access carefully after approval
When the provider restores access, review security before resuming deposits or trading. Check sessions, login history, API keys, withdrawal allowlists, device list, email rules, and notification settings.
Expect temporary withdrawal or feature delays after a password reset, authenticator replacement, identity review, or security appeal. A cooldown can be annoying, but it also prevents a rushed attacker from using the same recovery path.
Do not immediately move large balances simply because login works again. Confirm the account state, support case status, and withdrawal settings first.
Common questions
Frequently asked questions
Why would a crypto exchange lock an account?
Possible reasons include repeated login failures, unusual access, a sensitive security change, identity review, policy or regional restrictions, or suspected unauthorized activity. The exact message matters.
Should I create a new account if the old one is locked?
Usually not without official instruction. A duplicate account can complicate identity checks or violate provider rules. Use the recovery or appeal route for the existing account.
Can someone on social media unlock my exchange account?
Do not trust that claim. Use only support reached from the verified provider website or app, and never disclose authentication secrets or send an unlock payment.
Is an account lock the same as a disabled withdrawal?
Not always. If you can log in but only withdrawals are blocked, the issue may be a withdrawal restriction, balance condition, security hold, or asset maintenance rather than a full account lock.
Primary references
Official sources checked
These official pages were reviewed on June 15, 2026. Exchange policies can change, so open the source before acting.