Crypto Exchange Account Security Checklist: 2FA to Login Logs
To secure a crypto exchange account, use a unique password stored in a password manager, switch two-factor authentication from SMS to an authenticator app or a passkey, turn on the withdrawal address whitelist, set an anti-phishing code for official emails, and review linked devices, API keys and login history every month. None of this protects you from a platform-level breach, so do not keep more on any exchange than you actively trade.
Late October 2026 brought two reminders of why exchange accounts deserve attention: one large exchange lost funds from its hot wallets, and a Korean exchange disclosed that customer identity data had leaked. Those were platform-level events that no user setting could have stopped. What they did trigger, almost immediately, was a wave of fake “compensation” emails, fake support agents and phishing pages aimed at the users of those platforms. That second wave is where your own account settings matter. This checklist covers what to turn on, in roughly the order that gives the most protection for the least effort.
Step 1: Lock Down the Login
Everything starts with the password and the second factor.
- Use a unique password. If you reuse your exchange password on any other site, one leak elsewhere is enough. A password manager makes long, unique passwords painless.
- Use the email address only for the exchange. A separate address that you never post publicly is harder to target with phishing.
- Move off SMS codes. The U.S. Cybersecurity and Infrastructure Security Agency recommends multifactor authentication for every important account and points out that phishing-resistant methods are the strongest. In practice, an authenticator app beats text messages, and a hardware key or passkey beats both.
- Turn on a passkey if offered. Passkeys are bound to the real website domain, so a lookalike phishing page cannot capture them the way it can capture a typed code.
| Second factor | Resists SIM swap | Resists fake login pages | Effort |
|---|---|---|---|
| SMS code | No | No | Low |
| Authenticator app | Yes | No | Low |
| Hardware security key | Yes | Yes | Medium |
| Passkey | Yes | Yes | Low |
Write down and store the backup codes offline. Losing your phone without them can lock you out for days.
Step 2: Protect Withdrawals
An attacker who logs in wants one thing: to move your funds out. Make that as slow and noisy as possible.
- Turn on the withdrawal whitelist. Only saved addresses can receive funds, and adding a new one triggers extra checks.
- Accept the waiting period. Many exchanges lock withdrawals for a day or more after a new address, password change or 2FA reset. It is annoying for you and much more annoying for a thief.
- Set a withdrawal limit below your full balance if the platform allows it.
- Remove old API keys. Trading bots and portfolio trackers often hold keys with broad permissions. Delete any you no longer use, and never give a key withdrawal rights unless you truly need it.
Step 3: Spot Fake Messages
After any big exchange incident, scammers move fast. The U.S. Cybersecurity and Infrastructure Security Agency’s page on how to recognize and report phishing describes the usual signs: urgency, a story about a problem with your account, and a link or attachment you are told to open right away.
- Set an anti-phishing code. Genuine emails from the exchange will show it. Anything without it goes in the trash.
- Type the address yourself. Bookmark the real site and open the app directly instead of tapping links in emails, texts or social posts.
- No real support agent asks for your seed phrase, password or 2FA code. Ever. The same applies to “refund” or “priority withdrawal” offers that ask you to connect a wallet or pay a fee first.
- Check sender details. Lookalike domains swap one letter or add a hyphen.
Our list of crypto scam red flags covers more patterns, including fake giveaways and recovery services that target people who have already lost money.
Step 4: Review Devices and Login History
Most exchanges show a list of signed-in devices and a log of recent logins and security changes. Open it once a month.
- Remove any device you do not recognize, then change your password.
- Look for logins from countries or cities you have never been to.
- Check the security log for changes you did not make, such as a new phone number, a disabled 2FA method or a new whitelist address.
- Keep your phone’s operating system and the exchange app updated, and avoid installing apps from outside the official stores.
If your identity details were exposed in a data leak, assume criminals may use them to sound convincing. Expect calls or messages that quote your real name or ID number, and treat that as a reason to be more suspicious, not less.
Step 5: Limit What Any Account Can Lose
No checklist protects you from a breach of the platform itself. When an exchange pauses withdrawals after an incident, every user waits, however well their account is secured. The only defense there is concentration risk. Our guide on how much crypto to keep on an exchange walks through a simple way to split trading funds from long-term holdings. If you buy on a schedule, a plan like dollar-cost averaging also makes it easier to move each purchase to your own wallet instead of letting it pile up on the platform.
The Quick Checklist
| Item | Done? |
|---|---|
| Unique password in a password manager | |
| Authenticator app, security key or passkey instead of SMS | |
| Backup codes stored offline | |
| Withdrawal whitelist turned on | |
| Anti-phishing code set | |
| Unused API keys deleted | |
| Devices and login history reviewed this month | |
| Only active trading funds kept on the exchange |
Run through the table today, then again whenever an exchange makes headlines. Scam waves follow the news, so the week after an incident is when a fake message is most likely to land in your inbox.
Frequently asked questions
Is SMS two-factor authentication good enough for a crypto exchange?
It is better than nothing but it is the weakest option. Text codes can be intercepted through SIM swapping, where a criminal convinces your carrier to move your number to their SIM. An authenticator app, a hardware security key or a passkey is much harder to steal remotely.
What is a passkey and should I use one?
A passkey is a login credential stored on your phone, computer or security key and unlocked with your fingerprint, face or device PIN. It is tied to the real website, so a fake login page cannot capture it. If your exchange supports passkeys, turning one on is one of the strongest upgrades you can make.
What does a withdrawal whitelist do?
It limits withdrawals to addresses you have saved in advance. Adding a new address usually triggers extra verification and often a waiting period. If someone gets into your account, they cannot simply send your funds to their own address without passing those steps.
What is an anti-phishing code?
It is a short phrase you set in the exchange's security settings. The exchange includes it in every genuine email it sends you. An email that claims to be from the exchange but does not show your code should be treated as fake.
How often should I check my login history?
Monthly is a reasonable habit, plus any time you get an unexpected security alert. Look for unknown devices, locations you have never visited and logins at hours you were asleep. Remove any device you do not recognize and change your password right away.
Does account security protect me if the exchange itself is hacked?
No. Strong account settings protect against someone taking over your login. They do not protect against a breach of the platform's own wallets or systems. The only defense there is limiting how much you keep on any single exchange and holding long-term funds in your own wallet.