Security Incidents

What to do when something is wrong — account compromise, suspicious activity, phishing, or a security issue you want to report.

---

I think my account was compromised. Act in this order, fastest first:

1. Move funds first if a wallet key may be exposed. This is the only step that actually protects on-chain funds — see the wallet section below. Nothing you do inside Alphio can claw back an on-chain transfer.
2. Reset your password from the sign-in screen via Forgot password. If you sign in with a social login, secure that provider account directly — that provider controls access to Alphio.
3. Sign in again on every platform you use. Alphio keeps only one active session per platform, so signing in again ends any other session on that platform. Web and the mobile app are tracked separately — signing in on web does not end an app session, so do both.
4. Disconnect connected brokers and exchanges from each connected account's actions (Profile → Account) to stop further trade authorization.
5. Cancel any running Agentic Trading tasks individually from your Tasks list, stop any copy traders you have running, stop your Agent Warrior, and turn off fast trading.
6. Contact contact@alphio.ai with the timestamp of suspected compromise, the IP / device if known, and any suspicious actions observed (trades, withdrawals, settings changes).

Some limits to plan around, because they change what actually helps:

• Resetting your password does not sign out other devices — that is what step 3 is for. Alphio has no active-sessions screen. Treat a password reset as changing the lock, not as evicting whoever is already inside.
• Alphio's authenticator app protects withdrawals, private-key export and new withdrawal addresses, but not sign-in. If you've set one up, someone who only has your password still needs a code from your device for those actions. If you haven't, set one up from Setting → Authenticator app once you're back in control. See Wallet and Security FAQ.
• There is no in-product password change while signed in, and no single switch that pauses everything at once. Agentic Trading tasks are cancelled one by one.
• Support cannot freeze your account, reverse a transaction, or recover transferred funds. For Hyperliquid, Alphio does not custody your assets — Alphio's trading agent can place orders but can't withdraw. Speed on step 1 is what protects you.

Suspicious activity on my wallet. For on-chain wallets you control, the chain itself is the source of truth — check a block explorer for the wallet's tx history:

• If you see unauthorized transactions, the private key may be compromised. Move remaining funds to a fresh wallet (newly generated, never exposed) immediately.
• For your Alphio (Privy) wallet — if you exported the key and it was leaked, the wallet is compromised. Move the funds to a fresh wallet you control right away.
• For MetaMask / WalletConnect / external — the wallet's seed phrase / private key lives in the wallet app, not Alphio. If suspected leaked, migrate to a new wallet immediately.

Disconnecting a broker or exchange in Alphio only removes the connection on Alphio's side. An API key you created at an exchange (KuCoin, Kraken) is not revoked automatically — delete it yourself in that exchange's API settings. For Robinhood, also disconnect the agent in the Robinhood app.

Removing a wallet in Alphio only removes the wallet record from your account — it does not destroy the key or move the funds, and it does not make a leaked key safe. Moving the funds is the fix; removing the record is only bookkeeping.

Revoke token approvals on the affected wallet using a tool like revoke.cash to stop further pulls via existing approvals. Report the incident via support with the wallet address and the suspicious tx hashes.

Lost my Telegram bot connection — security implications? Losing the Telegram bot binding stops notification delivery to that Telegram account; it does not by itself grant new access to anyone else:

• The Telegram binding is a notification channel plus a two-way chat with Alphio AI. It cannot place orders or move funds, but it is more than read-only: it can show balances and holdings, and create or change scheduled tasks and notification rules. Treat it as account access, not just a feed.
• If you suspect the Telegram account itself was compromised (not just the bot binding), treat it as a broader compromise: secure the Telegram account, then re-bind to a clean Telegram account.
• If the bot disconnected for an unknown reason, just re-bind through Connect Telegram — most disconnections are routine (token rotation, account changes).

Reporting a security issue. For platform-level security issues (not just account compromise), email contact@alphio.ai with:

• A clear description of the issue.
• Reproduction steps if applicable.
• Impact assessment as you see it (what could an attacker do?).
• Your account so the team can attribute and follow up.

Phishing email pretending to be Alphio. Phishing is increasingly common. Some heuristics that help spot a fake:

• Sender domain — legitimate Alphio email comes from @alphio.ai. Lookalike domains (alph10.ai, alphio-support.com, etc.) are phishing.
• Urgency / threats — "your account will be deleted in 24 hours unless you click here" is a classic phishing pattern. Alphio doesn't send those.
• Asks for password / seed phrase — Alphio never asks for your password or wallet seed phrase by email. Any email requesting them is phishing.
• Asks for unsolicited transfers — Alphio never asks you to send funds to an address for "verification" or "unlocking".

If you receive a suspicious email, forward it to contact@alphio.ai for confirmation. Do not click links in suspicious emails — type alphio.ai into the browser instead.

The official Alphio channels are contact@alphio.ai, telegram.me/AlphioAI, and discord.gg/ZB92kjEk9r. Anything else claiming to be Alphio support — especially a DM that reaches out to you first — is not us.