Most exchange breaches don't start with a cracked password. They start with an email inbox someone forgot to lock, a phone number that got ported, or an API key created for a portfolio tracker two years ago and never deleted. Your exchange login is one door into your money; the email account tied to it, the phone number used for 2FA, the withdrawal allowlist, and the API keys you've issued are all separate doors, and each one needs its own lock.
Start with the email account, not the exchange
The exchange inherits whatever security your email has. If someone owns your inbox, they own every password reset that follows, and no amount of 2FA on the trading account will stop them.
Lock down the recovery address
Use a dedicated email for crypto that you never post publicly and never use to sign up for random services. Turn on 2FA for that inbox too, ideally with a hardware key or an authenticator app rather than SMS. Then open the recovery options: an old phone number or a stale backup address is a back door that outlives the device it was set up on.
Search for forwarding rules you didn't create
Attackers who get into an inbox often add a silent forwarding rule so password-reset emails land in their own account instead of yours. Open your email settings and scan the filters and forwarding section. If you find an address you don't recognize, remove it and change your password from a clean device, not the one you suspect.
Kill SMS as your second factor
SIM-swap fraud is boring and effective: someone convinces your carrier to port your number to a new SIM, then receives every text code meant for you. A checklist that still leans on SMS has a hole in it.
Move to an authenticator app or hardware key
Most major exchanges support app-based codes and, increasingly, physical security keys. A hardware key is the strongest option because it can't be phished by a fake login page. Where a key isn't supported, an authenticator app beats text messages every time.
Set a carrier port-out PIN
Call your mobile provider and ask for a port-out PIN or transfer lock. It takes about five minutes and makes the SIM swap harder to pull off. Do it even if you've already dropped SMS for exchange logins, because your number still guards other accounts.
The withdrawal controls most people skip
Login security stops account takeover. Withdrawal controls limit the damage if someone gets in anyway, and this is where a checklist earns its keep.
Consider a concrete case. You hold roughly $40,000 in a mix of assets on an exchange and you've enabled 2FA. Fine so far. But you never set a withdrawal address allowlist, so an attacker who phishes your session can send funds to any wallet on earth. With an allowlist turned on and a hold period for new addresses, that same attacker hits a wall: the new address sits in a cooldown, and you get an email you can act on before the funds move.
Run through these before you fund the account heavily:
- Address allowlist — only pre-approved withdrawal addresses can receive funds.
- New-address hold — a delay (often 24 hours or more) before a freshly added address goes live.
- Withdrawal confirmation — email or app approval on top of 2FA for large transfers.
- Anti-phishing code — a phrase that appears in genuine exchange emails so fakes stand out.
- Device and session review — log out unknown sessions and check active API keys.
That last item matters for anyone using DeFi. If you've connected an exchange-funded wallet to a lending protocol like Aave to borrow against collateral, review which apps and API keys can move funds. A stale API key with withdrawal permission is a loaded gun sitting in your account settings.
Treat API keys and connected apps as credentials
API keys are passwords that can trade or withdraw without a login prompt. Many people create one for a portfolio tracker and forget it exists until it shows up in a breach report.
Scope keys to read-only unless you truly need more
If a tool only needs to read balances, give it read-only permission and disable withdrawals. Restrict the key by IP address where the exchange allows it. Delete keys you no longer use rather than leaving them dormant.
Audit connected wallets after any scare
If you suspect a compromise, don't just change your password. Revoke token approvals on your wallet, disconnect unfamiliar apps, and move remaining funds to a fresh address you control. On lending positions, check that your collateral and health factor are intact before you breathe out.
Frequently asked questions
Is 2FA enough to secure an exchange account?
No. Two-factor authentication is essential, but it only protects the login step. You also need withdrawal allowlists, a locked-down email account, and a review of API keys and connected apps. An attacker who phishes a live session can sometimes bypass login prompts entirely, which is why withdrawal controls matter as much as 2FA.
Should I use SMS or an authenticator app for exchange 2FA?
Use an authenticator app or, better, a hardware security key. SMS codes can be intercepted through SIM-swap fraud, where someone ports your number to a new device. If your exchange supports physical keys, enable one; it's the hardest factor to phish.
How often should I re-run this security checklist?
Do a full pass every few months and any time something changes: a new device, a new API key, a phone number switch, or a large deposit. Re-check after you connect a wallet to a new protocol, too. Small drift — an old key, a forgotten forwarding rule — is exactly what attackers look for.
Open your exchange's security settings right now and check one thing: whether a withdrawal address allowlist is switched on. If it isn't, that's your next ten minutes.