Instagram Hacked and Posting Crypto Scams? What to Do

A friend messages you on WhatsApp: "Is this really you?" Your Instagram story shows a screenshot of a huge crypto balance and a line about a trading mentor who "changed my life". You never posted it, and your password no longer works.

The short answer: your account has almost certainly been taken over and turned into an advert aimed at the people who trust you. Take back the email first, then the account, then warn your followers from somewhere else. Followers who already sent money need their bank and 997, not the hacker.

This guide covers the recovery steps in order, how to warn people without making things worse, what to do if Instagram disables the account over the scam posts, and what a follower who paid should do in Malaysia.

Last checked: 5 October 2026.

#What Should You Do If Your Hacked Instagram Is Posting Crypto Scams?

Act on two fronts at once. For the account: secure the email inbox linked to Instagram, look for the email from [email protected] and select "secure my account" if the email address was changed, and if that fails request a login link or go to instagram.com/hacked. For your followers: post a warning on every other channel you control, telling people not to send money or click links, and to report the scam posts. Once you are back in, change the password, delete the posts and turn on two-factor authentication. Only Meta can restore the account.

#Why Hackers Turn Your Account Into a Crypto Billboard

A stranger promising crypto profits is easy to ignore. Your face, your name and your years of posts are not. Instagram's own page on avoiding scams says scammers compromise existing accounts to deceive or defraud the owner's friends, and describes investment scams that promise to turn a small sum into a much larger one before the scammer disappears with the payment.

The posts usually follow a familiar script, in English, Bahasa Malaysia or Chinese:

• Stories showing a screenshot of a crypto wallet or bank balance, with a caption claiming you just withdrew your profits.
• A tag or link to a "trading mentor", "account manager" or investment page, often with a new username.
• Direct Messages to your followers saying you were sceptical too, but it really works.
• Replies to anyone who asks questions, written in your voice, pushing them to a chat app outside Instagram.
• Your bio, name or profile photo changed so it is harder for you to prove the account is yours.

Instagram's page on unauthorised content says that if your profile is commenting or sharing things you did not post, your password may be compromised. It adds that Instagram may show a "Try again later" error when it detects inauthentic activity on the account. If money requests rather than investment posts are going out, our guide to a hacked account messaging friends for money covers that version.

#Recover the Account: The Order That Works

Work from the email outwards. Whoever controls the inbox can reset Instagram again, so a new Instagram password means little until the email is safe.

1. Secure the email account linked to Instagram: change its password, sign out other sessions, and remove forwarding rules or recovery details you did not add.
2. Search that inbox, including spam, for a message from [email protected] about an email change. Instagram's hacked account page says selecting "secure my account" in that message may undo the change.
3. If the password was also changed, tap "Forgot password?" on the login screen, enter your username, email or phone, and choose "Send login link". Complete the captcha and open the link from your own inbox or SMS.
4. If the link does not reach you, go to instagram.com/hacked in a browser and follow the on-screen steps. Instagram says to give a secure email address that only you can access.
5. If Instagram asks you to verify your identity, follow its instructions (see the next section).
6. Once you are in, change the password straight away. It is the first step Instagram's hacked account page lists for an account you can log in to.

If the attacker changed both the email and the phone number, the steps get narrower. Our walkthrough of an Instagram hacked with the email and phone changed covers that case in detail.

#What Instagram's Identity Check Asks For

Instagram's hacked account page describes two checks, depending on whether the account has photos of you.

Instagram says the video selfie is never shown on Instagram and is deleted within 30 days, and that you can submit a new video if it could not confirm your identity from the first one. If the hacker replaced your profile photo with someone else's, the selfie check may struggle. Instagram does not publish how it handles that, so mention the swapped photo plainly if its support team emails you.

#Warn Your Followers Without Making It Worse

Every hour the posts stay up, someone may be reading them. You cannot delete them yet, but you can make sure people hear from the real you.

• Post a short warning on WhatsApp status, Facebook, TikTok or any other account you still control: "My Instagram was hacked. The crypto and trading posts are not from me. Do not send money or click any links."
• Message close friends and family directly, especially older relatives who are less likely to question a post from you.
• If you run a business, pin the warning on your other pages and tell regular customers.
• Ask friends to report the scam posts themselves, once each, using the "Scam, fraud or spam" reason. Instagram's reporting page lists that option and says reports are anonymous.
• Ask people not to mass report the whole profile or organise others to do it. Reporting what is genuinely there is fine; piling reports onto the profile will not speed up your recovery and could add to action against the account you are trying to get back.
• Ask friends not to argue with the hacker in comments or Direct Messages. Instagram's advice on scams is simple: do not respond, report it.

We could not find a dedicated "this account is hacked" report option in Instagram's help pages at the time of writing, so we do not tell friends to look for one. The owner's route is instagram.com/hacked, and only the owner can complete it.

#Once You Are Back In: The Clean-Up Checklist

Getting the login back is half the job. Hackers often leave a way to return, and the scam posts keep working until they are gone.

1. Screenshot the scam posts, stories, captions and any Direct Messages sent from your account, with the date visible. Followers who paid may need them for a police report.
2. Delete the posts, stories, highlights and comments you did not make, and restore your bio, name and profile photo.
3. Remove the hacker's email or phone number and confirm your own are correct in Accounts Center.
4. Check Accounts Center for linked accounts you do not recognise and remove them, as Instagram's unauthorised content page advises.
5. Revoke access for any third-party app you do not trust. Instagram warns that an app holding your login details or access token can gain complete access to the account.
6. Turn on two-factor authentication and save the backup codes offline, somewhere only you can reach.
7. Open Account Status and check for removed content or restricted features (see below).
8. Post one calm update to followers saying the account is back and the earlier posts were not yours.

#If the Scam Posts Got Your Account Disabled or Restricted

Scam posts break Instagram's rules even when you did not write them. Instagram's Account Status page lets you see content removed for going against its Community Standards under "Removed content", features you can no longer use under "Features you can't use", and "Request a review" if you think a removal was wrong. Instagram says repeated removals can cost you the account, usually after a warning.

If Instagram's notice instead says you were disabled for pretending to be someone else, rather than for the scam content itself, see our guide to Instagram disabled for impersonation, but it's your account. If you see a disabled message when you log in, Instagram's page on disabled accounts says you may be able to ask for a review by logging in and following the on-screen instructions. In your review, explain briefly that the account was hacked, when you lost access and when you regained it. The same page says a deleted account cannot be restored, which is why acting before the hacker deletes it matters. Our guide to disabled Instagram accounts goes through the appeal in full.

#Mistakes That Make Recovery Harder

• Resetting the Instagram password while the hacker still controls your email.
• Requesting login link after login link, then clicking an old or fake one.
• Replying to "Meta Support" accounts in your Direct Messages or comments. Instagram says it never sends you Direct Messages about your account.
• Paying a "recovery hacker" who appears under your warning post.
• Asking friends to mass report your own profile, which could add to action against it.
• Deleting the scam posts before saving screenshots that a follower who paid may need.
• Waiting for the hacker to get bored. Instagram says a deleted account cannot be restored.

#If a Follower Already Sent Money

This part is about money, not Instagram, and speed matters. The government's NSRC 997 page lists cryptocurrency and investment scams among the cases the National Scam Response Centre handles. It tells victims to call 997 within 24 hours of discovering the scam so authorities can try to block accounts and transactions, to contact their bank, and to make a police report at the nearest station.

1. Call the bank that sent the money, using the number on the card or the bank's official website, or call 997.
2. Make a police report and bring the screenshots of the posts, the chat with the "mentor", and the payment details.
3. Stop paying. Investment scams often ask for a "withdrawal fee" or "tax" before releasing profits that do not exist.
4. Before paying anyone online in future, check the bank account or phone number on PDRM's Semak Mule portal. A clean result does not prove an account is safe.

Nobody can promise the money comes back. Our guide to Macau and investment scams in Malaysia explains the bank and police steps in more depth. A phishing link or fake login page used in the takeover can also be reported to CyberSecurity Malaysia's Cyber999 by online form, email, phone or its app.

#When a Case Review Makes Sense

Many people get their account back with the steps above, and only Meta can restore an Instagram account. A second opinion helps when the email and phone were both changed, when the identity check keeps failing because the hacker swapped your photos, when the account was disabled after the scam posts, or when the account carries your business. SocialSafe by AwareXone, our recovery service, reviews your case first and tells you honestly whether an official route is still open. We use the same Instagram processes described here, the outcome is best effort, and some accounts are not restored. You can see how we handle Instagram account recovery, and our Trust Center sets out what we will never ask for, starting with your password and codes.

#Frequently Asked Questions