AWS Account Hacked: Unauthorized Charges and Crypto Miners

How to fix it

Try these in order — the most common fix is first.

1. 1. Lock down credentials

   Copy steps
   1. Change the root password and enable MFA
   2. IAM > Users > Security credentials: make leaked access keys inactive then delete them
   3. Remove unknown IAM users, roles and access keys
   Did this fix it? Yes No

2. 2. Remove attacker resources

   Copy steps
   1. Check every region in the EC2 console (use Billing by region) and terminate unknown instances
   2. Check Lambda, SageMaker, Lightsail and other services in Cost Explorer
   Did this fix it? Yes No

3. 3. Contact AWS

   Copy steps
   1. Support Center > Create case > Account and billing
   2. Reply to any notice from AWS Trust & Safety
   3. Ask about adjusting charges; outcomes vary and refunds are not guaranteed per user reports
   Did this fix it? Yes No

4. 4. Prevent repeats

   Copy steps
   1. Use IAM roles instead of long-lived keys
   2. Turn on budget alerts and Cost Anomaly Detection
   3. Enable MFA everywhere
   Did this fix it? Yes No

Symptoms

Unknown EC2 instances (often in unusual regions), a sudden large bill or an AWS notice about exposed credentials.

Why it happens

• Access keys committed to GitHub or leaked
• No MFA on root or IAM users
• Over-permissive IAM roles
• Weak or reused passwords

This guide also covers

• aws account hacked
• aws unauthorized charges
• aws crypto mining charges refund
• aws leaked access keys

The same problem in other apps

All billing, cancellation & refunds guides →

• DigitalOcean Unexpected Bill: Charged for Deleted or Powered-Off Droplets (DigitalOcean)
• Vercel Unexpected Bill: Why Usage Charges Spiked (Vercel)

Other AWS errors

• AWS Unexpected Charges: Why Is My AWS Bill So High?
• AWS Charges After Free Tier: Why Am I Being Billed?
• AWS Account Suspended: How to Reactivate It
• EC2 SSH Connection Timed Out
• EC2 SSH 'Permission denied (publickey)' and Key File Errors
• S3 Access Denied (403 Forbidden) Error
• AWS 'Not Authorized to Perform' IAM Error
• Lambda 'Task timed out after 3.00 seconds' Error