Free tools Windows power users keep installed
One-click scans. No signup required.
The highest-impact crypto account protections are phishing-resistant sign-in 2FA, a withdrawal-address whitelist, a timed settings or withdrawal lock, transaction-specific 2FA, and immediate alerts for account and device changes. Secure the email address and phone number tied to the account as well. These controls work together: 2FA blocks many logins, whitelists limit where funds can go, locks prevent an intruder from changing those protections, and alerts give you time to react.
Exact names, hold periods, and availability vary by exchange, country, account type, and app. The settings below describe documented controls from Kraken, Coinbase Exchange, Binance, and Binance.US; do not assume that one platform’s menu or timing exists on another.
As an Amazon Associate I earn from qualifying purchases.
Use phishing-resistant 2FA for sign-in first
Sign-in protection is the foundation because an attacker who can enter your account may try to disable other controls. Kraken calls sign-in 2FA with passkeys “the most important security feature on your account” and describes passkeys as resistant to phishing. A passkey or FIDO2 security key verifies the legitimate site or app as part of authentication, making it much harder for a fake login page to capture a reusable code.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Passkeys and hardware security keys
Register at least two passkeys where the exchange permits it. Use one as the everyday credential and keep a second as a recovery option in a separate secure location. Kraken specifically recommends keeping a Master Key passkey on a hardware security key. A FIDO2/passkey hardware security key is the central physical product fit for crypto 2FA, but compatibility must be confirmed for the exchange, browser, mobile operating system, and account-recovery flow before purchase.
#1 Best Overall
Authenticator apps when passkeys are unavailable
If an exchange does not offer passkeys or security-key authentication, choose an authenticator app rather than SMS whenever possible. During setup, generate backup codes and store them offline, for example in a sealed paper copy or another encrypted offline record. Do not leave the only copy in the same email account or cloud storage that an attacker could reach through a compromised login.
Why SMS should be the fallback, not the default
SMS codes can be exposed through number-porting or SIM-swap attacks. If SMS is the only option, add carrier protections such as a SIM PIN and a port freeze, and treat the phone number as a recovery dependency that needs its own monitoring. Move to a passkey or authenticator app as soon as the platform supports one.
Lock down withdrawal destinations
A login does not automatically give an attacker a useful path to steal funds if withdrawals can go only to pre-approved addresses. A withdrawal-address whitelist, sometimes called an Address Book restriction, limits destinations to entries you deliberately saved.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCoinbase Exchange: Address Book whitelisting
Coinbase Exchange describes whitelisting as a security feature in the Address Book that allows crypto withdrawals only to external or Coinbase addresses already designated there. New addresses are subject to a 48-hour hold. Enabling or disabling the feature requires 2FA.
Rank #2
This documented control is for Coinbase Exchange. It is not available through Coinbase.com or the Coinbase mobile app, so an account holder using those consumer interfaces should not expect the same menu or behavior. Confirm that you are in the Exchange product and check the current help instructions before moving funds.
Binance: whitelist limits and address-change delays
Binance documents a whitelist-withdrawal limit that suspends withdrawals to newly added addresses for a period you select. Disabling the limit allows immediate withdrawal to newly added addresses, which is why leaving the protection enabled is important. Binance says up to 200 withdrawal addresses can be whitelisted. Its documentation also notes that whitelist changes may trigger a temporary withdrawal suspension of 24, 48, or 72 hours.
What a whitelist can and cannot stop
- It can block a withdrawal to an address that was never approved.
- It can slow an attacker by imposing an address-addition hold.
- It cannot protect funds already sent to an approved address that an attacker controls.
- It does not replace sign-in 2FA or a settings lock, because an intruder may try to add an address or disable the whitelist.
Enable a settings lock or timed withdrawal lock
Whitelists are strongest when another control prevents an intruder from changing them. Look for a Global Settings Lock, withdrawal lock, whitelist-withdrawal limit, or similarly named setting.
Recommended Free Tools
Kraken Global Settings Lock
Kraken says its Global Settings Lock blocks changes to account settings and withdrawal addresses, even if someone gets into the account. Removing the lock can be delayed from one to 30 days; the documented default is three days. Choose a delay that gives you enough time to notice an unauthorized request and contact support, while remembering that a longer delay can also slow legitimate account changes.
Kraken treats the Global Settings Lock as distinct from transaction-specific 2FA. The lock helps stop an intruder from turning off security settings, while 2FA can require an additional check for a particular action.
Binance whitelist-withdrawal limit
On Binance, keep the whitelist-withdrawal limit enabled and select a suspension period that fits your operating needs. Turning it off removes the delay for newly added addresses, so disabling it for convenience creates a meaningful security trade-off. Verify the selected period after changing the setting and record when it will expire or take effect.
Binance.US password-change restriction
Binance.US documents a 24-hour withdrawal restriction after a password change. Treat this as a protective delay, not as a substitute for a whitelist or settings lock: a password change can be a sign of recovery activity, but it does not define which addresses are trusted.
Require 2FA for withdrawals, trading, and API keys
Some exchanges expose separate 2FA controls for high-risk actions. Kraken lists distinct 2FA for withdrawals, trading, and API keys. Enable each available control, especially withdrawal 2FA, rather than assuming that sign-in 2FA automatically applies to every transaction.
Rank #4
These action-specific checks are effective only if an intruder cannot turn them off. Kraken warns that sign-in 2FA or the Global Settings Lock helps prevent an attacker who has entered the account from disabling the separate controls. Set the order carefully: establish phishing-resistant sign-in protection, then enable action-specific checks, then apply the settings lock.
Turn on alerts and review sessions
Alerts are your detection layer. Enable email notifications for sign-ins, new devices, withdrawals, address-book changes, security-setting changes, password or recovery events, and API-key activity whenever the exchange offers them. Kraken recommends enabled email notifications and quick action on unexpected new-device approvals or new withdrawal-address notices.
Check active sessions and devices
- Open the exchange’s security, devices, or sessions page.
- Review every listed browser, phone, location, and recent activity time.
- Revoke sessions you do not recognize and rotate the password if anything is suspicious.
- Repeat the review after traveling, using a shared computer, or approving a new device.
Binance.US exposes device management and an anti-phishing code. Set a code that you can recognize in genuine notification emails; an email without the expected code, or with a different code, should be treated as potentially fraudulent. Never click a security email’s link before checking the sender and opening the exchange through a bookmark or manually entered address.
How to react to an alert
- Unexpected sign-in or device approval: revoke the session, change the exchange password from a known-clean device, and verify 2FA methods.
- New withdrawal address: use the exchange’s security controls to lock withdrawals, revoke the session, and contact support immediately. Do not wait for a hold to expire.
- Security setting changed: check whether 2FA, whitelist, lock, API keys, email, or phone details were altered; preserve the alert and activity record for support.
- Suspicious email only: do not reply or use its links. Open the exchange directly and inspect sessions and settings.
Secure the email address and phone account connected to the exchange
Exchange security can be bypassed through a weak recovery channel. Kraken notes that access to the account email may let someone request a username, reset a password, and approve withdrawals. Use a dedicated email address for financial accounts, a long unique password, a passkey or non-SMS 2FA, and carrier protections such as a port freeze or SIM PIN.
Keep the email account’s recovery address and phone number under the same standard. Remove old forwarding rules, unknown delegated users, and unrecognized sessions. If your carrier supports an account PIN or port-out lock, enable it and ask how emergency recovery works before you need it. Store the exchange’s backup codes separately from the email account so one compromise does not expose both layers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Set the controls in an order that avoids lockout
- Prepare recovery: secure the dedicated email, carrier account, and a separate offline location for backup codes.
- Enable sign-in 2FA: register two passkeys or security keys. If unavailable, use an authenticator app and test a backup code.
- Record recovery details: store backup codes offline and verify that you understand the exchange’s account-recovery process.
- Enable action 2FA: turn on separate withdrawal, trading, and API-key checks if offered.
- Build the whitelist: add only addresses you control or have independently verified. Confirm network and address details before saving.
- Apply the delay: enable the exchange’s whitelist-withdrawal limit, address-addition hold, or equivalent timed restriction.
- Enable the settings lock: apply Global Settings Lock or the closest available control after confirming your recovery method works.
- Turn on alerts: enable email and device notifications, set an anti-phishing code where available, and check that messages arrive.
- Review sessions: revoke old devices, browser sessions, and API keys that are no longer needed.
- Test safely: make a small, planned transfer only after checking the approved address, network, required 2FA, and any pending hold.
Exchange differences at a glance
| Exchange or product | Phishing-resistant 2FA | Separate transaction 2FA | Whitelist and delay details | Settings or withdrawal lock | Alerts and device visibility | Availability qualification |
|---|---|---|---|---|---|---|
| Kraken | Passkeys recommended; hardware security-key Master Key supported in its guidance | Separate 2FA listed for withdrawals, trading, and API keys | Withdrawal-address behavior and holds not stated in the cited guidance | Global Settings Lock; removal delay 1–30 days, three-day default | Email notifications, new-device and new-address notices; review active sessions and connected devices | Check the current account, regional, and app support |
| Coinbase Exchange | 2FA required to enable or disable whitelisting; exact passkey/security-key support not stated in the cited help material | Not stated | Address Book whitelist; new addresses held 48 hours | Whitelist changes require 2FA; a separate settings-lock period is not stated | Not stated in the cited help material | Exchange-only; unavailable through Coinbase.com or the Coinbase app |
| Binance | Supported methods and phishing resistance vary by account; confirm current options | Not stated | Up to 200 addresses; newly added addresses can face 24-, 48-, or 72-hour suspension after whitelist changes | Whitelist-withdrawal limit can suspend new-address withdrawals; disabling it permits immediate withdrawals | Review the current device, session, and notification controls | Features and timing can vary by region and account |
| Binance.US | Current methods vary; confirm in Security settings | Not stated | Whitelist details not stated in the cited security page | 24-hour withdrawal restriction after a password change | Device management and anti-phishing code | Separate US service and controls; use its current settings page |
Common failure modes and fixes
You lose your only passkey or security key
Use the second registered passkey or key. If none exists, follow the exchange’s recovery process using offline backup codes and expect additional identity checks or a waiting period. Do not remove the remaining working method until a replacement is enrolled and tested.
You cannot withdraw to a legitimate new address
Check whether an address-addition hold or whitelist suspension is active. Coinbase Exchange’s documented hold is 48 hours; Binance documents 24, 48, or 72 hours after certain whitelist changes. Confirm the network and address independently, then wait for the stated control to expire rather than disabling the protection.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →A lock blocks an urgent legitimate change
Use the documented removal process and its delay. Kraken’s Global Settings Lock removal can take one to 30 days, with three days as the default. Plan address changes before a time-sensitive transfer and keep an approved recovery address available.
You receive a convincing phishing email
Do not use its links, attachments, or reply address. Open the exchange directly, compare the listed sessions and security settings, and change credentials from a clean device if anything is unfamiliar. An anti-phishing code can help identify genuine Binance.US notifications, but it does not make clicking an untrusted link safe.
How to compare an exchange before depositing funds
Evaluate the controls as a system rather than choosing an exchange solely by its sign-in method. Ask these questions before funding an account:
- Can you use a passkey or FIDO2 hardware key, and can you register a second one?
- Is withdrawal 2FA separate from sign-in 2FA?
- Does a whitelist cover all withdrawals, and how long are new addresses held?
- Can an intruder disable the whitelist or 2FA immediately, or does a settings lock prevent that?
- Are new-device approvals, sessions, address changes, and API activity visible and alertable?
- Is the control available in your country, account tier, web interface, and mobile app?
Recheck the exchange’s live support documentation before making a security decision. Timings, menus, and regional availability can change, and a feature documented for an exchange product may not exist in its consumer app.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
