What should I do if my account or API key may be compromised?

Take these steps immediately:

• Reset the account password and sign out any device or session you do not recognize.
• Revoke existing API keys, create replacements, and update the affected applications.
• Review recent orders, top-ups, and API requests; note the time and relevant IDs for anything suspicious.

Then contact support from the registered email. Never send a full password, API key, private key, or session data; support does not need those credentials to verify the account.