In this lesson
- find five things in the exchange's settings worth turning on right away
- find out why SMS as the only verification is not enough
- learn to recognise a genuine email from the exchange by its anti-phishing code
You know the general security rules from Crypto basics. Here is the practical version: open Profile → Security on your exchange (the name differs only slightly between exchanges) and go through five switches with us. It takes a quarter of an hour and turns your account from a tent into a fortress.
1. Two-factor authentication#
Besides your password, you need a second proof – a code or a confirmation.
- Best: a passkey or a security key. It cannot be intercepted or phished on a fake website.
- Good: an authenticator app that generates six-digit codes.
- Emergency only: SMS. Better than nothing, but a scammer can move your number to another SIM card. Do not keep it as your only method.
2. The anti-phishing code#
The exchange lets you set your own word – say "bluepenguin". The so-called anti-phishing code is then included in every email the exchange sends you. An email without your code does not come from the exchange, however convincing it looks.
3. Withdrawal whitelist#
A withdrawal whitelist holds only addresses you have approved yourself – your hardware wallet, for example. If an attacker gets into your account, they cannot send the money to their own address. A new address usually becomes usable only after a waiting period, often 24 hours.
4. Devices and logins#
The device list shows where logins came from. Log out any unknown device and change your password. Turn on alerts for every new login.
5. The account's email#
Whoever controls your email can reset your exchange password. So secure the email your exchange account uses just as well: a strong password and two-factor authentication.
Changing security locks withdrawals for a while
When you change your password, 2FA or email, the exchange usually blocks withdrawals for 24–48 hours. It is not a bug but protection: if an attacker made the change, you have time to step in.
Common myths#
- "An SMS code is enough." Not as the only method – a SIM card can be moved.
- "The email has the exchange's logo, so it is genuine." Anyone can copy a logo. Your anti-phishing code decides.
- "A withdrawal whitelist is a pointless hassle." It is the cheapest insurance against your account being emptied.
Summary
- Two-factor authentication: a passkey or an app, SMS only as a backup.
- An anti-phishing code tells genuine emails from the exchange apart from fakes.
- A withdrawal whitelist stops withdrawals to someone else's address.
- Watch the logged-in devices and secure the account's email too.