Exchange security and 2FA: 5 practical defenses for your account

However well you trade, a single account compromise can empty your balance in moments. Here are the essential exchange security settings, from 2FA and phishing protection to withdrawal allowlists and API keys, explained for beginners.

A password alone is no longer a sufficient defense for an exchange account. Leaks, reuse and phishing can expose it, and many hacking losses begin with account theft. Exchanges themselves can also be hacked, but much of the risk you can personally control depends on your account settings. Check the following five defenses in order.

1. 2FA (OTP): A basic, powerful lock

2FA, or two-factor authentication, requires a 6-digit code that changes every 1 minute in addition to the password. Even if the password leaks, a login cannot proceed without the OTP device.

Store the recovery key or backup codes shown during authenticator setup separately on paper or offline. If your phone is lost or reset, account access may be blocked without these codes.

2. Phishing prevention: Spotting fake sites and emails

Phishing directs you to a fake exchange that looks genuine to steal login details and OTP codes. Following these habits can prevent many attacks.

• Access the exchange only by typing the URL yourself or using a bookmark; avoid links in search advertisements.
• Enable the exchange's anti-phishing code so genuine emails contain a word you chose.
• Be suspicious of urgent messages such as “Urgent withdrawal verification” or “Account frozen.”

3. Withdrawal allowlists: Restricting where funds can go

A withdrawal allowlist permits withdrawals only to wallet addresses registered in advance. Even after compromising the account, an attacker cannot send coins to their own wallet. Adding a new address commonly triggers a 24–48-hour withdrawal delay, allowing time to notice unusual activity. Enable the allowlist in exchange security settings and register only addresses you use regularly.

4. API keys: Essential checks for bot and automated-trading users

An API key issued to connect a bot or external tool effectively delegates some account permissions. Incorrect settings can let a leaked key expose your assets.

1. Never grant withdrawal permission. Trading and read permissions are sufficient for most purposes.
2. Use an IP allowlist so the key works only from the bot server's IP address.
3. Do not expose keys or secrets in code, chats or screenshots. Delete and reissue them immediately if you suspect a leak.

5. Preparing for compromise: Habits that reduce damage

• Use a different password for each exchange and consider a password manager.
• Separate long-term holdings into a hardware wallet, or cold wallet, rather than keeping them on an exchange.
• Regularly check login notifications and device management for unrecognized access.

No security setting reduces risk to 0. Exchange insolvency, internal incidents and new attacks cannot be fully controlled by an individual, so avoiding keeping all your assets in one place is a practical precaution. Security is an ongoing habit, not a one-time setup. Combining it with capital-management and leverage principles can help you manage assets more safely.