Skip to main content
Category: Hacks → Account Takeover (CEX, Email, SIM Swap)HacksAccount TakeoverShared DeviceReading time: 10 minutes
Risk level: High
Target audience: Exchange users, shared device users

​
Meet Tunde

Tunde works in a co-working space and sometimes uses a shared office laptop for work. One day, he quickly checks his Binance account on the shared laptop to verify his holdings. He logs in using the browser’s “Remember me” feature, checks his balance, and closes the tab without logging out. He assumes the session is closed and leaves the laptop. A colleague (or someone with access to the office) discovers that Binance is still logged in on the browser. They notice the high balance and withdraw all funds to a personal wallet before Tunde has a chance to notice. Loss: ₦1.85 million in just minutes.

​
Where the Scammer Won

  • Shared device access: The laptop was accessible to multiple people.
  • Session persistence: The “Remember me” feature kept the session active even after closing the tab.
  • No explicit logout: Tunde didn’t log out, leaving the session active.
  • High balance visibility: The attacker could see the account balance and act quickly.

​
Red Flags Tunde Missed

  • Never use shared devices for crypto accounts.
  • Never use “Remember me” on public/shared devices.
  • Always log out explicitly (not just closing the tab).
  • Clear browser cache/cookies after using on shared devices.

​
How Shared Device Compromise Works

What happens: User logs into exchange account on shared/public device, possibly using “Remember me.”
What happens: Browser keeps session active even after tab is closed, if “Remember me” was used.
What happens: Another person accesses the device and finds the active session.
What happens: Attacker withdraws all funds to their own wallet before user notices.

​
Prevention

Use only your personal device for exchange logins.
If you must use a shared device, use incognito/private browsing (doesn’t cache credentials).
Always log out explicitly.
Change your exchange password if you suspect someone accessed a shared device.
Never use “Remember me” on shared or public devices.

​
If You Already Used a Shared Device

1

Log Out Immediately

If still on the device, log out immediately from all accounts.
2

Change Password

Change your exchange password immediately from a secure device.
3

Check Account Activity

Review recent transactions and withdrawals for unauthorized activity.
4

Enable 2FA

Ensure 2FA is enabled on your exchange account.
5

Report Unauthorized Access

If funds were stolen, report to exchange support and law enforcement.

Email Account Takeover

How email compromise leads to account takeover

Hacks Category

Explore all types of account takeover attacks

Check Your Wallet

Verify if addresses are reported as malicious

​
References

  1. Browser session security best practices
  2. Shared device security guidelines
  3. Exchange account security recommendations