How to recover my mining pool balance if my account got hacked?

Immediate Account Lockdown Procedures

1. Access the mining pool’s official login page and attempt to trigger the “Forgot Password” flow using your registered email address.

2. If the password reset link fails or bounces, verify whether the account’s recovery email has been altered by checking associated mailbox logs for unauthorized forwarding rules or alias changes.

3. Simultaneously disable all active API keys from any accessible session—many pools expose this under “API Management” even when logged in via secondary credentials.

4. Submit a timestamped support ticket quoting your wallet address, last known IP geolocation, and approximate time of compromise; include screenshots of recent transaction hashes visible on-chain explorers.

5. Do not reuse any previous passwords, seed phrases, or 2FA backup codes—even if they appear unchanged—assume full credential exposure.

On-Chain Evidence Collection

1. Navigate to a blockchain explorer compatible with the pool’s native coin (e.g., Etherscan for ETH-based pools, Blockchair for BTC-based pools) and paste your payout wallet address.

2. Identify all outgoing transfers initiated after the suspected breach time, noting transaction IDs, destination addresses, and gas fees where applicable.

3. Export raw transaction JSON data for each suspicious transfer and save locally—this serves as immutable evidence for dispute escalation.

4. Cross-reference timestamps against pool dashboard activity logs—if available—to confirm whether withdrawals originated from the pool interface or external RPC calls.

5. Flag any transactions sent to known mixer contracts or privacy-focused wallets; such patterns are routinely flagged by pool security teams during manual review.

Pool-Specific Recovery Channels

1. For Slush Pool: Email support@slushpool.com with subject line “URGENT: Compromised Account Recovery Request – [Your Username]” and attach signed PGP message proving ownership of the original registration email.

2. For F2Pool: Submit form at https://www.f2pool.com/support, selecting “Account Security Incident” as category; include your miner ID, ASIC serial numbers, and proof of historical hashrate contributions.

3. For ViaBTC: Initiate live chat during UTC business hours (08:00–20:00); agents require voice verification and may request photo ID matching the name on the KYC document submitted during registration.

4. For BTC.com: Use the “Report Hacked Account” button embedded in the account settings panel—this auto-generates an encrypted incident report routed directly to their anti-fraud unit.

5. For NanoPool: File recovery request at https://nanopool.org/recovery; only submissions containing valid Ethereum signature over a nonce issued by their backend are processed.

Wallet-Level Mitigation Tactics

1. Import your compromised wallet into a clean, air-gapped hardware device and sweep all remaining balance to a newly generated address with no prior transaction history.

2. Revoke permissions granted to third-party dApps using tools like Etherscan’s “Token Approvals” tab or Revoke.cash for Ethereum-compatible chains.

3. Check for unauthorized smart contract deployments linked to your address using blockchain analytics platforms such as Arkham Intelligence or Nansen.

4. Freeze further payouts by disabling auto-withdrawal in pool settings—if still accessible—and switch to manual withdrawal mode with multi-signature confirmation enabled.

5. Audit all connected browser extensions; remove MetaMask, Trust Wallet, or Phantom plugins that lack verified publisher signatures or show abnormal permission requests.

Frequently Asked Questions

Q: Can I reverse a confirmed blockchain transaction sent from my hacked pool account?A: No. Once included in a block and confirmed across six or more blocks on most PoW chains, transactions are cryptographically irreversible. Recovery depends entirely on voluntary return by the attacker or pool-level intervention before final settlement.

Q: Does changing my pool password restore access to balances already withdrawn to external wallets?A: No. Password reset only secures future access. Withdrawn funds reside outside the pool’s custody and cannot be clawed back through authentication changes alone.

Q: Will the pool refund losses if I provide evidence of unauthorized API key usage?A: Refund eligibility varies by operator policy. Slush Pool and BTC.com maintain discretionary fraud reimbursement programs for verified cases involving zero-day API exploits, but exclude losses from reused credentials or phishing-induced key exposure.

Q: How do I know if my mining rig itself was compromised rather than just the pool account?A: Check rig system logs for unexpected cron jobs, unknown SSH sessions, or outbound connections to C2 domains. Run rkhunter --check and clamav -r / on Linux-based miners; examine Windows Event Viewer for anomalous service installations.