Key takeaways
Use different passwords for email, exchange, and password manager.
Enable anti-phishing codes and a withdrawal allowlist.
Unique password · authenticator · forwarding review
Authenticator or security key · offline recovery
Address allowlist · new-address hold · alerts
Least-privilege API · no withdrawal · IP restriction
Complete on registration day
Enable an authenticator or security key, save offline recovery codes, set an anti-phishing code, review devices, and enable withdrawal alerts.
Monthly review
Remove unused API keys, devices, and authorized apps; verify allowlisted addresses; and review suspicious email forwarding rules.
Secure email before the exchange
Email often resets the exchange password, so use a unique strong password, authenticator or security key, and review recovery methods and forwarding rules. Reusing a password can compromise both layers at once.
A password manager can generate unique credentials. Store recovery codes offline, not in chat, email drafts, or cloud storage accessible from the same account.
Reduce withdrawal and API risk
Enable withdrawal allowlists, new-address holds, anti-phishing codes, and login alerts. Test new addresses and label their network clearly. Remove unused devices, connected apps, and API keys regularly.
Grant an API key only the permissions required, keep withdrawals disabled by default, and restrict trusted IPs. On an unknown login, mail rule, or API, freeze access and revoke permissions before contacting official support.
Review recent sign-ins, withdrawal addresses, and security notices monthly. Before changing phone, email, or authenticator, preserve recovery methods and allow for a possible withdrawal cooling period.
FAQ
Is SMS authentication enough?
SMS is better than no second factor but is more exposed to SIM swap attacks. Prefer an authenticator or security key when available.
Should SMS and an authenticator both be enabled?
Use supported multi-factor options, prioritizing an authenticator, passkey, or hardware security key for sensitive actions while protecting the phone number from SIM swaps.
Can a withdrawal allowlist delay an urgent transfer?
It can. New addresses often have a hold, which is precisely what slows theft. Maintain trusted common addresses in advance.
Do API keys need a separate review?
Yes, at no lower priority than passwords. An API key operates the account directly, bypassing the interface, and a leaked key triggers no login alert. Review permissions on existing keys, disable withdrawal rights you do not use, and restrict source IPs.
Sources and verification
Sources prioritize protocol, network, and exchange documentation. External pages can change; signed-in confirmation screens remain authoritative for fees and account status.