Secure an exchange account in layers: replace any reused password, add phishing-resistant sign-in protection, keep a separate recovery factor, lock down the email account behind the exchange, restrict withdrawals to approved addresses, and review devices regularly. Add funding-level 2FA and a settings lock when the exchange offers them. These controls address different failure points, so enabling only one does not provide equivalent protection.
Menu names and availability vary by exchange, country, account tier and app version. Use the security or account-settings area of your own exchange and verify each control after saving it.
As an Amazon Associate I earn from qualifying purchases.
Why exchange security settings need several layers
An exchange account can be compromised through a stolen password, a phished one-time code, an attacked email inbox, a malicious device or a changed withdrawal address. Sign-in protection alone may stop an attacker from logging in, but it does not necessarily prevent every account change or transfer once a session is hijacked. Withdrawal allowlisting, transaction-level checks and a delay on security-setting changes create containment even after a credential is exposed.
Kraken’s warning is a useful rule for every platform: “No amount of security on our end can make up for weak personal security.” Your phone, email account, browser and recovery materials are part of the exchange’s security perimeter.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Controls at a glance
| Control | Primary threat addressed | Important trade-off or limit |
|---|---|---|
| Passkey or FIDO2/U2F security key | Phishing and stolen passwords during sign-in | Keep a second registered factor so loss of the primary device does not lock you out. |
| Authenticator-app 2FA | Basic account takeover when a password is exposed | Codes are less phishing-resistant than passkeys or hardware keys; protect recovery codes offline. |
| Withdrawal-address allowlist | Funds sent to an attacker-controlled address | New addresses may be subject to a waiting period, delaying legitimate transfers. |
| Funding or withdrawal 2FA | Unauthorized deposits and withdrawals | On Kraken, this control remains effective only with sign-in 2FA or Global Settings Lock; it may not stop adding a new address by itself. |
| Settings lock | An attacker changing security settings or withdrawal addresses | Removal and legitimate changes are delayed for the selected period. |
| Email-account 2FA | Password-reset and security-alert interception | The email account must use a separate, well-protected factor. |
| Session and device review | Persistent access through an unknown browser or device | Revoking a session does not replace changing exposed credentials. |
The security checklist, in priority order
1. Replace the password with a unique long one
Change the exchange password before configuring other controls if the current password is reused, short or known to anyone else. Kraken recommends at least 15 characters and no reuse (2026 guidance). Generate a random password in a password manager rather than modifying an old password with a predictable suffix.
- Use a different password from your email, banking, cloud-storage and device accounts.
- Store it in the manager’s encrypted vault, not in a notes app, screenshot or browser profile shared with other people.
- Do not disclose the password to anyone claiming to be exchange support; legitimate support should not need it.
After saving, sign out of old sessions if the exchange offers that option, then sign back in through the official app or a bookmarked exchange site.
2. Make phishing-resistant 2FA your first sign-in factor
Prefer a passkey or a FIDO2/WebAuthn security key. These methods authenticate the legitimate website or app origin, making a copied login page much less useful to an attacker. Kraken describes passkeys as phishing-resistant FIDO2 security. Coinbase identifies two security keys as its “Highest security” option and documents U2F/WebAuthn/FIDO2-compatible keys, including YubiKey-type devices.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteIn the exchange’s Security, Two-factor authentication or Passkeys area, register the passkey or key, complete the device prompt, and confirm that it appears as an active sign-in method. Test a fresh sign-in in a private browser window before ending the setup session.
SMS codes are a weaker fallback because a phone number can be transferred or intercepted. Time-based authenticator codes are generally stronger than SMS, but a real-time phishing site can relay a code while it is valid. Use them when a passkey or hardware key is unavailable, not as the preferred option when a phishing-resistant method is supported.
3. Register a genuine backup factor
Account recovery is where a well-secured account can fail. Register two security keys, or a passkey plus a separate security-key backup. Keep the second key in a different secure location so theft, loss or damage to one device does not remove your only recovery path.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you use an authenticator app, save its recovery codes when the exchange displays them. Print or write the codes and store them offline in a place protected from both theft and fire; do not leave the only copy in the same phone that generates the codes. A recovery device should not be permanently signed in to the exchange.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →4. Secure the email account connected to the exchange
An attacker who controls your email may reset the exchange password, approve a new device or read withdrawal alerts. Coinbase explicitly advises enabling 2FA on the personal email account, and Binance recommends using a secure or dedicated email address for exchange activity.
- Use a unique password for the mailbox.
- Prefer a passkey or hardware key for the mailbox too; otherwise use an authenticator app rather than SMS where possible.
- Review forwarding rules, recovery addresses and logged-in sessions for changes you did not make.
- Keep the exchange email separate from public social profiles and avoid publishing it.
Do not disable email alerts to reduce noise. They can reveal a password reset, new-device login or withdrawal attempt while there is still time to respond.
5. Turn on withdrawal-address allowlisting
Allowlisting, also called address whitelisting, limits withdrawals to addresses you have explicitly saved. In the exchange’s Withdraw, Address book or Withdrawal settings section, enable the restriction, add each destination carefully, and complete the required confirmation.
Coinbase’s current help guidance says a newly allowlisted address is held for 48 hours before it can be used. That delay is intentional: it gives you time to spot an attacker’s change and contact official support. Binance likewise describes whitelist-only withdrawals.
Recommended Free Tools
Plan the delay before an urgent transfer. Verify the network as well as the address; an address that looks correct can still be incompatible with the selected asset or chain. Keep an independent record of approved addresses, but do not copy them from an untrusted message.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
6. Add transaction-level or funding 2FA
Some exchanges separate sign-in 2FA from controls for deposits, withdrawals or other funding actions. Enable the funding or withdrawal-specific option in addition to sign-in protection. Kraken supports funding 2FA for deposits and withdrawals and identifies a hardware key as its most secure funding-2FA method.
There is an important dependency: Kraken says funding 2FA requires sign-in 2FA or Global Settings Lock to keep the control effective. A funding prompt may also cover a transfer but not prevent an attacker from first adding a new withdrawal address. Pair funding 2FA with allowlisting and a settings lock where available.
7. Set a Global Settings Lock or equivalent delay
A settings lock prevents changes to security settings and withdrawal addresses for a chosen period. Kraken’s Global Settings Lock supports a delay from 1 to 30 days, with a default of 3 days (2026 guidance). Select a delay that matches your normal trading needs: a longer delay gives more time to detect account takeover, while a shorter one reduces friction when you legitimately need to change a setting.
Before enabling the lock, finish registering backup factors and verify that your email and recovery information are correct. Test the account while unlocked, then record how to remove or modify the lock through the official help path. If you later lose your primary key, the delay can affect recovery actions as well as an attacker’s changes.
8. Add an anti-phishing marker to emails
Where offered, set a private anti-phishing phrase or code in the exchange’s security settings. Binance includes the customer’s anti-phishing code in genuine Binance emails. Treat any message without your exact marker, or with a changed marker, as suspicious.
An anti-phishing code does not authenticate a phone call, chat message or web page. Never follow a login link from an unsolicited message; open your bookmark or the official app and inspect alerts there.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
9. Review sessions, devices and IP activity
Open Devices, Recognized devices, Sessions or Login activity and inspect every entry. Check the date, approximate location, browser and IP information if shown. Revoke anything you do not recognize, including old phones and browsers you no longer control.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If access looks unauthorized, act in this order:
- Use a known-clean device to change the exchange password.
- Change the connected email password and revoke unfamiliar email sessions.
- Remove unknown exchange sessions and review API keys, withdrawal addresses and security settings.
- Contact the exchange through its official support channel and report the suspicious activity.
Do not rely on an unfamiliar device’s displayed location alone: mobile networks and VPNs can make locations imprecise. An unknown device combined with a new withdrawal address or security-setting change is a stronger warning.
10. Use only official access paths
Bookmark the exchange’s verified web address and install its app from the platform’s official store listing. Kraken warns that fake apps and impersonators ask for sign-in details. Never install an app from a direct message, remote-support session or unsolicited advertisement.
Check the domain before entering credentials, and do not approve a passkey prompt you did not initiate. Support agents should not ask for your password, authenticator code, recovery code or hardware-key touch.
11. Harden the device you use to trade
Binance advises using device passcodes, avoiding untrusted software and keeping antivirus updated. Apply operating-system and browser security updates promptly, enable full-device encryption where available, and use a separate user profile for sensitive activity if the computer is shared.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Never enter exchange credentials on a public, shared or compromised computer.
- Remove browser extensions you do not recognize and review extensions that can read page content.
- Use a screen lock and do not leave an unlocked phone with an active exchange session.
- Keep recovery keys and printed codes away from the device they protect.
Passkey, hardware key or authenticator app?
Choose based on phishing resistance and recovery practicality, not convenience alone.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
| Method | Best use | Recovery setup |
|---|---|---|
| Passkey | Preferred everyday sign-in when the exchange supports FIDO2/WebAuthn | Register a second passkey or a hardware-key backup; verify that the backup is stored separately. |
| FIDO2/U2F hardware security key | Highest-resistance option for sign-in and, where supported, funding approval | Keep two registered keys in separate secure locations and test both before relying on them. |
| Authenticator app (TOTP) | Fallback when passkeys or keys are not supported | Store recovery codes offline and maintain a separate recovery device; never share a current code with support. |
| SMS | Last-resort fallback only | Secure the mobile account, but recognize that number takeover and message interception remain risks. |
How the protections work together during an attack
If your password is stolen
A passkey or hardware key should block a password-only login. If an attacker still reaches an existing session, the allowlist, funding 2FA and settings-lock delay can prevent or slow a transfer and give you time to revoke sessions and contact support.
If a phishing site captures a one-time code
Passkeys and FIDO2 keys are designed to resist this type of relay because they authenticate the legitimate origin. TOTP and SMS codes can be relayed in real time, so use the strongest available factor and never approve an unexpected prompt.
If your email is compromised
Email-account 2FA, a unique mailbox password and review of forwarding rules reduce the chance that an attacker can reset the exchange account or hide alerts. Exchange-side controls still matter because email protection does not restrict a withdrawal address.
If an attacker adds a new withdrawal address
Allowlisting can reject the address, while a settings lock can delay the change. Coinbase’s 48-hour hold for a newly allowlisted address is an example of this containment model; the exact period and behavior differ by platform.
Verification checklist after changing settings
- Sign out and complete a test sign-in with the newly configured primary and backup factors.
- Confirm that the withdrawal page rejects an address that is not allowlisted, if the exchange provides a safe way to test the rule.
- Check where funding 2FA is requested and whether it covers both deposits and withdrawals.
- Record the active settings-lock duration and the date it will expire or can be changed.
- Confirm that email alerts arrive and contain your anti-phishing marker when that feature is enabled.
- Save recovery codes offline and verify that your backup key or passkey is accessible without exposing it to another person.
Common mistakes that weaken the setup
- One factor stored in one place: losing a phone or key can become an account lockout. Register and test a separate backup.
- Allowlisting without a settings lock: an attacker with sufficient account access may still try to alter the address book. Use both controls when the exchange supports them.
- Assuming all 2FA is equivalent: SMS, TOTP, passkeys and hardware keys have different phishing resistance and recovery requirements.
- Ignoring operational delays: a 48-hour address hold or a 1-to-30-day settings lock can interrupt a time-sensitive transfer. Configure them before you need to move funds.
- Leaving old sessions active: changing a password does not necessarily terminate every browser or API session. Revoke unknown access explicitly.
- Trusting a caller or message claiming to be support: use only the exchange’s official support path and never disclose authentication secrets.
What to do if you suspect compromise
- Stop new deposits and withdrawals until you understand what changed.
- From a clean device, change the exchange and email passwords.
- Revoke unfamiliar sessions, API keys and devices; inspect withdrawal addresses and recent activity.
- Use the exchange’s official account-freeze or support process and preserve timestamps, emails and transaction IDs.
- Do not delete evidence or keep communicating with an impersonator who asks for codes or remote access.
No official source reviewed publishes a qualifying cross-exchange statistic showing how often these settings prevent breaches, so treat them as layered risk-reduction measures rather than a guarantee. The practical goal is to make unauthorized access difficult, contain withdrawals and provide enough delay to respond.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
