When a crypto exchange session will not log out remotely, first determine whether you are looking at a web session, an authorized device, an API key, or a connected application. Preserve the record, use the exchange's official revoke or account-lock control, then confirm the result from a trusted device and close every other access path.

Key Takeaways

A device record and a live browser session are not always the same object.

A stale activity page can keep showing a revoked entry, so verify state after a fresh sign-in.

Password changes must not be assumed to invalidate API keys, OAuth grants, or every token.

If the session is suspicious, secure email and MFA and restrict transfers before extended troubleshooting.

Support needs timestamps, session identifiers, and attempted actions—not your password or one-time code.

Why can a crypto exchange session remain visible?

“Session” is often used loosely. An exchange may separately track web cookies, mobile-app installations, trusted devices, remembered browsers, API credentials, and third-party connections. Removing one record may leave another valid. The activity page may also show historical devices or update after a delay.

Kraken documents a Device Management view that lists active devices, authorization times, location/IP clues, and controls to deactivate one or all devices.［1］ Coinbase describes separate web sessions and confirmed devices, with controls for individual or broad revocation.［2］ The exact labels are provider-specific, so read the heading and help text before assuming a failed logout.

Common explanations include:

What you see	Possible explanation	Verification
Entry remains after clicking revoke	Cached or delayed activity view	Sign out locally, reopen the official service, and refresh the activity page
Device disappears but activity continues	Separate web token, API key, or connected app	Review every access category and new account events
Device returns immediately	App automatically signs in, syncs, or reauthorizes	Close the app on that device if owned; otherwise lock the account
“Last active” changes	Token is still being used or the timestamp has another meaning	Preserve exact times and ask support to interpret the field
Revoke control errors	Network/UI failure, permissions, or provider incident	Record the error and use an official emergency lock if risk is material

Start with the online security guide for the wider account layers. The technical difference between password theft and token theft is covered in session hijacking.

What should you record before revoking access?

Use a device you trust and open the exchange independently. Avoid links in email, text messages, advertisements, search-result support numbers, or direct messages. If the potentially compromised device is your only device, do not install remote-support software or share its screen with a stranger.

Record these fields when available:

Session or device identifier, label, browser, operating system, and app type.
Authorization time, last-active time, displayed time zone, IP, and approximate location.
Whether the entry is labeled active, trusted, remembered, historical, or API-related.
The revoke action used, exact time, confirmation message, error, and whether the page changed.
Account events before and after the attempt: trades, withdrawals, address edits, MFA changes, and API-key activity.
Provider incident notices or support case numbers relevant to the attempt.

Evidence matters because repeated clicks can erase the distinction between an initial compromise and your own recovery activity. However, do not delay a provider's emergency account lock to perfect the record when a withdrawal or settings change is underway.

How do you revoke an exchange session and verify the result?

Treat revocation and verification as separate steps:

Open the official security or activity page. Confirm you are on the intended domain or installed app.
Identify the access object. Note whether it is a session, device, browser, mobile app, API key, or connected application.
Revoke the suspicious entry. Use the individual control if the object is unambiguous.
Use “disconnect all” or “sign out all” when scope is uncertain. Expect your trusted device to require a fresh login.
Close your own local sessions. This prevents an owned app from immediately refreshing a device record while you test.
Wait only for the documented interface behavior. Do not keep clicking rapidly or approve new login prompts.
Start a clean verification session. Reopen the official app or site, authenticate, and reload the activity view.
Check new account activity. A vanished row is insufficient if unknown actions or a separate access method continue.

A successful result means more than a toast message. The suspicious entry is inactive or absent according to the provider's current view, no new activity is attributable to it, and no alternate credential remains. If the page does not explain whether it is historical, support must clarify that distinction.

Do not attempt to “test” the remote session by messaging whoever might control it. Do not share a login code to force a logout. Never send funds to a “safe” address as part of session removal.

What if a crypto exchange session will not log out even after you retry?

Escalate from narrow revocation to account containment:

Use the exchange's official account-lock, transfer-restriction, or compromised-account process. Coinbase documents that its security lock signs out devices and pauses transactions and account changes while retaining review and support access.［3］ Do not assume another provider behaves identically.
Secure the primary email: set a unique password, terminate unknown sessions, remove unauthorized forwarding or recovery changes, and strengthen MFA.
Change the exchange password from a trusted device. Do not reuse the email password.
Replace compromised MFA methods and recovery codes. Remove unknown passkeys or security keys.
Revoke all unnecessary API keys and connected apps. Review permissions, IP restrictions, creation times, and recent use.
Inspect withdrawal addresses, payment methods, pending transfers, trades, and profile changes.
Contact official support and provide the evidence package. Ask whether the row is active, delayed, or historical and whether a server-side invalidation was recorded.

Do not rely on password rotation as the only step. An API key can be independent of a browser password; a connected application can hold its own grant; and a stolen endpoint can capture the replacement credential. If new sessions keep appearing, inspect the trusted device for malicious extensions, remote-control tools, information-stealing malware, or a compromised password manager.

How do you know the account is safe to unlock?

Use a layered exit checklist rather than a quiet screen:

The primary email has a unique password, known recovery methods, strong MFA, and no suspicious forwarding.
Exchange password and MFA have been replaced where exposure is plausible.
Unknown web sessions, devices, mobile sessions, API keys, and connected apps are revoked.
Address books, allowlists, bank details, pending withdrawals, trades, and profile data match your records.
The provider has acknowledged the incident or explained any persistent historical entry.
A trusted endpoint shows no credible sign of credential theft or remote control.
You have saved case IDs and a timeline for later disputes or reporting.

If financial activity is disputed, keep recovery and transaction evidence separate. The article on a leaked exchange API key covers key permissions and programmatic access. If the initial clue was a new device, follow the unknown-device attribution checklist.

Changing the network path does not invalidate an exchange token. A VPN cannot revoke sessions, disable API keys, lock an exchange account, or confirm that server-side logout succeeded.

Summary

Identify the credential type before judging whether remote logout failed.
Preserve identifiers and timestamps, then perform explicit revocation from the official service.
Verify in a fresh trusted session and inspect account actions, not only the device row.
Escalate to account lock, email recovery, MFA replacement, and API cleanup when doubt remains.
Keep the account restricted until access paths and money-moving settings are reconciled.

Frequently Asked Questions

Why does a revoked session still show in the list?

It may be cached, delayed, or retained as history. Refresh through a new trusted login and ask official support whether the entry is active if the interface does not say.

Is a trusted device the same as an active session?

Not necessarily. A provider may store device authorization separately from browser cookies, mobile tokens, API keys, and third-party grants.

Will changing my password log out every device?

Do not assume so. Use the provider's explicit all-session and all-device controls, then review API keys and connected apps separately.

Should I keep pressing the revoke button?

No. Record the first result, refresh deliberately, and escalate through the official lock or support path if the state remains uncertain. Rapid retries can obscure evidence.

What if the session returns after I remove it?

An owned app may be reauthorizing, or an attacker may still control email, credentials, MFA, an endpoint, or an API key. Restrict the account and investigate every persistence layer.

Can an API key stay active after web logout?

Yes, depending on the platform. Treat API credentials as a separate access category and revoke unknown or unnecessary keys explicitly.

When should I lock the whole account?

Lock or restrict it when the session is unexplained and funds, security settings, email, or identity data may be exposed, especially if unknown actions continue.

What should I send support?

Send the session/device identifiers, timestamps with time zone, screenshots, errors, related account events, and steps already taken. Never send a password, seed phrase, recovery code, or one-time code.

Disclaimer: This article provides general security education, not financial, investment, legal, or professional incident-response advice. Session terminology and emergency controls vary by exchange.

Sources:

Kraken — Where can I see my connected devices? — https://support.kraken.com/articles/360048970351-where-can-i-see-my-connected-devices-
Coinbase — Why did I receive an unexpected device confirmation email? — https://help.coinbase.com/en/pro/privacy-and-security/avoiding-phishing-and-scams/why-did-i-receive-an-unexpected-device-confirmation-email
Coinbase — Lock or unlock your compromised account — https://help.coinbase.com/en/coinbase/privacy-and-security/account-compromised/my-account-was-compromised

Sources checked 12 September 2026.

Related Articles:

Crypto Exchange Session Will Not Log Out Remotely