Security / Incident response
Respond to a suspected exchange, wallet or dApp incident
Classify a suspected account, self-custody wallet, dApp or scam-message incident; preserve only necessary evidence while protecting privacy and avoiding further authorization.
You will learn
- Distinguish a suspicious message from independent evidence of exchange-account access.
- Classify exchange, self-custody wallet and dApp/contract signals by the authority involved.
- Preserve a minimal incident record without disclosing secrets or unnecessary personal data.
- Explain why an address or holder count does not establish a person’s identity or intent.
Before you begin
Read the account, wallet and permission guides. This triage does not require a wallet connection, account login, signature, transaction or disclosure of secrets.
Pause before following a message or request
A warning, text, email, call or direct message is a claim, not proof that an account was accessed. Do not use its link, QR code, phone number or attachment to investigate. Do not reply with a password, one-time code, recovery phrase, private key, signature or identity document. Open a provider’s installed app or navigate to its known official domain independently; the exact support route depends on the service and region.
This guide is a read-only triage aid. It does not ask you to connect a wallet, sign, approve, send a transaction, move assets or test a recovery flow. If more than one kind of access may be involved, record each branch separately rather than assuming one warning explains everything.
Evidence: Binance.com account-security guidance · Binance.com SMS spoofing guidance · Binance.com official support entry · Binance.US account disable guidance · Binance.US SMS spoofing guidance · MetaMask reporting and recovery limits
General security guidance for Binance.com accounts, not Binance.US or a diagnosis of a particular incident; recommendations are not a security guarantee.
This is Binance.com guidance and does not establish whether any particular message or Binance.US account is genuine or compromised.
Official support entry for Binance.com only; navigate independently and confirm that it is the correct account/entity before using a service route.
Applies to Binance.US accounts only; it is not Binance.com guidance. Account interface and support access can vary and change.
Applies to Binance.US messages and accounts only; do not transfer these claims or routes to Binance.com.
MetaMask-specific support guidance; it does not identify an address owner or guarantee recovery or action by a third party.
Use the evidence to choose a branch
Classify what you observed, not what a sender or website says happened. These categories can overlap; a suspicious message alone does not prove an exchange or wallet was compromised.
| Observed signal | Branch to investigate | What it means so far |
|---|---|---|
| Unrecognized login, account change, order or withdrawal shown in an exchange’s own account record; or loss of account access | Exchange account | Use the exact service you have an account with. Binance.com and Binance.US accounts and support are separate. An onchain withdrawal, if one exists, is a separate public-chain event. |
| A recovery phrase/private key may have been disclosed, or wallet history shows an action you did not authorize | Self-custody wallet | Treat the signing authority as potentially exposed. A wallet connection alone, a suspicious message, and a secret disclosure are different facts. Provider recovery capabilities differ. |
| A dApp requested a connection, token allowance, signed message or transaction; or an onchain record identifies an unfamiliar contract | dApp, contract or permission | Record which request or record is actually known. A connection, approval, signature and transaction have different effects; do not reconnect or sign to identify them. |
| A message, call, email or social account asks you to click, call, pay, disclose data or act urgently, with no independent account evidence | Suspected fraudulent message | Preserve the message safely and verify through an independently opened official channel. Receipt of a spoofed message does not by itself prove account compromise. |
Evidence: Binance.com SMS spoofing guidance · Binance.US SMS spoofing guidance · Binance.US and Binance.com account separation · MetaMask incident guidance · MetaMask reporting and recovery limits
This is Binance.com guidance and does not establish whether any particular message or Binance.US account is genuine or compromised.
Applies to Binance.US messages and accounts only; do not transfer these claims or routes to Binance.com.
Use this only for the stated account-separation fact; it is not a recovery promise or a guide for Binance.com users.
MetaMask-specific self-custody guidance; other wallet providers may use different interfaces and recovery models. This lesson does not reproduce the page’s transaction steps.
MetaMask-specific support guidance; it does not identify an address owner or guarantee recovery or action by a third party.
If an exchange account may be involved
First identify the actual exchange account and region from your own records; do not choose a support channel based on the message. Binance.com and Binance.US are separate services. Their official support pages describe different account-disable and support routes, so a Binance.US issue should not be sent to Binance.com support, or the reverse.
If the service’s own record shows suspicious activity or you cannot access the account, use that entity’s current official support or account-disable guidance reached from its app or a domain you type yourself. Disabling an exchange account affects that service account; it cannot reverse an onchain transfer or guarantee that assets will be recovered. Read the provider’s current warnings before taking any account action; this guide does not reproduce account-control steps.
Evidence: Binance.com account disable guidance · Binance.com official scam-report route · Binance.US account disable guidance · Binance.US and Binance.com account separation
Applies to Binance.com exchange accounts only; it is not Binance.US guidance and disabling an exchange account does not reverse onchain transactions.
Describes reporting routes for Binance.com users. Open support independently from the official app/site; menus and eligibility can change.
Applies to Binance.US accounts only; it is not Binance.com guidance. Account interface and support access can vary and change.
Use this only for the stated account-separation fact; it is not a recovery promise or a guide for Binance.com users.
If a self-custody wallet or dApp may be involved
A self-custody wallet and an exchange account are different control systems. If a recovery phrase or private key may have been disclosed, do not share it again—not with a site, a caller or support. Use the wallet provider’s official incident documentation opened independently. MetaMask’s documentation is specific to MetaMask and says it cannot retrieve self-custodied funds; other wallets may have different designs, but no provider can be assumed to know a user’s secret.
For a dApp, keep separate what happened: a site connection may disclose an address; a token approval may grant a spender authority; a signed message may authorize a protocol-specific action; a transaction may create a public state change. A disconnect does not establish that an onchain allowance or separate signature was canceled. L42 explains these concepts; this incident guide gives no revocation, signing or transaction procedure.
Do not reconnect or sign merely to reproduce a suspicious request. If an unauthorized transaction is already visible in records you can access without connecting, preserve its network and transaction hash as evidence. A hash can help locate a record but does not identify a person, establish motive or promise recovery.
Evidence: Wallet recovery models · MetaMask incident guidance · MetaMask reporting and recovery limits · ERC-20 specification · Signed approvals · Disconnect vs revoke
MetaMask-specific self-custody guidance; other wallet providers may use different interfaces and recovery models. This lesson does not reproduce the page’s transaction steps.
MetaMask-specific support guidance; it does not identify an address owner or guarantee recovery or action by a third party.
If the only signal is a message
Do not click, scan, call, pay or reply using the message’s instructions. Preserve its sender details and time, then verify the service by opening its known app or official domain independently. Binance.com’s spoofing guidance explicitly says that receiving a fake SMS or call does not necessarily mean the Binance.com account was hacked; this statement is about that service and is not a finding about any particular message or Binance.US account.
If the independently accessed account record later shows an unfamiliar login, setting change or movement, classify that additional evidence in the exchange branch. If there is no such evidence, keep the conclusion narrow: “suspicious message received; account compromise not established.” Do not treat the absence of a visible alert as a guarantee that nothing happened.
Evidence: Binance.com SMS spoofing guidance · Binance.US SMS spoofing guidance · Binance.com account-security guidance · Binance.com official support entry
This is Binance.com guidance and does not establish whether any particular message or Binance.US account is genuine or compromised.
Applies to Binance.US messages and accounts only; do not transfer these claims or routes to Binance.com.
General security guidance for Binance.com accounts, not Binance.US or a diagnosis of a particular incident; recommendations are not a security guarantee.
Official support entry for Binance.com only; navigate independently and confirm that it is the correct account/entity before using a service route.
Preserve a minimum record without exposing more data
Write down when and where the signal arrived, using a time zone; the service/entity and region involved; what you directly observed; whether a link was opened or information was entered; whether a wallet request or transaction already occurred; and what you have already done. Keep the original message or a private screenshot if appropriate, but do not forward it widely. Record an official support case reference if you already have one.
For an onchain event already known to you, note the network and transaction hash; include a public address only when it is needed to locate the specific record. Keep these details private and share them only through the relevant official support route. Public addresses and hashes can expose activity when linked to a person. Redact email, phone, account ID, identity documents, unrelated balances and message previews before sharing evidence. Never include a password, one-time code, recovery phrase, private key or signing material.
Evidence: Binance.com official scam-report route · Binance.com SMS spoofing guidance · Binance.com official support entry · Binance.US account disable guidance · Binance.US SMS spoofing guidance
Describes reporting routes for Binance.com users. Open support independently from the official app/site; menus and eligibility can change.
This is Binance.com guidance and does not establish whether any particular message or Binance.US account is genuine or compromised.
Official support entry for Binance.com only; navigate independently and confirm that it is the correct account/entity before using a service route.
Applies to Binance.US accounts only; it is not Binance.com guidance. Account interface and support access can vary and change.
Applies to Binance.US messages and accounts only; do not transfer these claims or routes to Binance.com.
Resolve a fictional message-only example
Fictional case: someone receives an SMS that claims to be from Binance.US and says a withdrawal needs urgent confirmation. They do not open its link, call the number, share a code or connect a wallet. In a separate check through their already-installed Binance.US app, they see no unfamiliar account event. No real account, message, wallet or transaction was examined for this example.
Classification: suspected fraudulent message; the facts shown do not establish an exchange-account or wallet compromise. Preserve the sender and time privately, do not use the message’s route, and use the Binance.US official support/security information reached independently if a question remains. If new account-record evidence appears, add an exchange-account branch rather than rewriting what the original SMS proved. The example does not guarantee that an account is safe or that a service will recover assets.
Evidence: Binance.US account disable guidance · Binance.US and Binance.com account separation · Binance.US SMS spoofing guidance
Applies to Binance.US accounts only; it is not Binance.com guidance. Account interface and support access can vary and change.
Use this only for the stated account-separation fact; it is not a recovery promise or a guide for Binance.com users.
Applies to Binance.US messages and accounts only; do not transfer these claims or routes to Binance.com.
Do not turn a public address into an identity claim
Ethereum.org describes Ethereum's public ledger as transparent and pseudonymous; that page does not identify anyone and is not a BNB Chain-specific analysis. A public blockchain address by itself does not establish a person's legal identity, location, intent or responsibility. A token-holder list displays addresses; it does not establish the number of independent people. Labels such as "exchange," "pool" or "team" require evidence and can be wrong. Public activity patterns may still be linked to other information, so avoid publishing addresses or hashes alongside personal details unnecessarily.
An explorer can show records associated with an address, but it cannot by itself establish why an action happened, who controlled the key at that moment, whether a service will credit a deposit, or whether funds can be recovered. This is educational triage, not an audit, investigation, legal advice, guarantee of recovery, or substitute for the relevant official provider’s current instructions.
Evidence: Public-ledger privacy limits
The source describes Ethereum; it is used only for the general privacy limit that public address activity can be linkable, not as a BNB Chain-specific measurement or identity finding.
Check your understanding
In the fictional case, an SMS claims that Binance.US blocked a withdrawal, but the person did not use its link and has no unfamiliar event in a separate official-app check. What can be concluded?
Show explanation
Only that a suspicious message was received and the evidence described does not establish account compromise. It does not prove that every account is safe. Keep the message and account evidence separate, protect personal data, and use the appropriate official service channel if more evidence appears.
Primary sources
- How to Disable My Binance AccountBinance Support · 2026-10-26
Applies to Binance.com exchange accounts only; it is not Binance.US guidance and disabling an exchange account does not reverse onchain transactions.
- How to Report Scams on Binance Support?Binance Support · 2026-10-26
Describes reporting routes for Binance.com users. Open support independently from the official app/site; menus and eligibility can change.
- How to Secure My Binance AccountBinance Support · 2026-10-26
General security guidance for Binance.com accounts, not Binance.US or a diagnosis of a particular incident; recommendations are not a security guarantee.
- What Is SMS Spoofing and How to AvoidBinance Support · 2026-10-26
This is Binance.com guidance and does not establish whether any particular message or Binance.US account is genuine or compromised.
- Support CenterBinance Support · 2026-10-26
Official support entry for Binance.com only; navigate independently and confirm that it is the correct account/entity before using a service route.
- How to disable your Binance.US accountBinance.US Help Center · 2026-10-26
Applies to Binance.US accounts only; it is not Binance.com guidance. Account interface and support access can vary and change.
- How to reactivate your Binance.US accountBinance.US Help Center · 2026-10-26
Use this only for the stated account-separation fact; it is not a recovery promise or a guide for Binance.com users.
- How to protect yourself from SMS spoofingBinance.US Help Center · 2026-10-26
Applies to Binance.US messages and accounts only; do not transfer these claims or routes to Binance.com.
- ERC-20: token standardEthereum Improvement Proposals · 2026-10-26
- Privacy on Ethereumethereum.org · 2026-10-26
The source describes Ethereum; it is used only for the general privacy limit that public address activity can be linkable, not as a BNB Chain-specific measurement or identity finding.
- Secret Recovery Phrase, password and private keysMetaMask Help Center · 2026-10-25
- I've been hacked or scammed (unauthorized transactions on my account)MetaMask Help Center · 2026-10-26
MetaMask-specific self-custody guidance; other wallet providers may use different interfaces and recovery models. This lesson does not reproduce the page’s transaction steps.
- How to report a scamMetaMask Help Center · 2026-10-26
MetaMask-specific support guidance; it does not identify an address owner or guarantee recovery or action by a third party.
- ERC-2612: signed token approvalsEthereum Improvement Proposals · 2026-10-26
- Revoke smart contract allowances and token approvalsMetaMask Help Center · 2026-10-25