What is the most important security step for an exchange account?

Enabling a hardware security key (FIDO2/WebAuthn, like a YubiKey) as your primary 2FA method. This is phishing-resistant — even if you enter your credentials on a fake site, the attacker cannot complete login without physically having your key. This single step prevents the vast majority of exchange account takeovers.

What is a withdrawal whitelist?

A withdrawal whitelist restricts crypto withdrawals from your account to a pre-approved list of addresses. Any withdrawal to an address not on the whitelist is blocked. Even if an attacker gains access to your account, they cannot withdraw to their own address. Most major exchanges offer this in security settings.

Are API keys dangerous?

API keys with withdrawal permissions are extremely dangerous if leaked. They allow automated access to your account, including withdrawals, without the usual 2FA protection (some exchanges bypass 2FA for API key operations). Only create API keys if you specifically need them, give them the minimum required permissions, and treat them like passwords.

What should I do if my exchange account is compromised?

Immediately: change your password from a secure, uncompromised device, revoke all API keys, contact the exchange's security team to freeze the account, enable withdrawal freezing if available, and review recent login history and activity. Document everything for potential law enforcement reporting.

Security · Accounts

Exchange Account Security

Exchange accounts holding crypto are high-value targets. These seven steps protect yours against the most common attack vectors.

By Ashir Khan2 min read

Ashir Khan writes about cryptocurrency security, self-custody, macro market analysis, and regulatory policy at CryptoBeacon.

Last updated: September 1, 2026

The seven security steps

Critical

Use a hardware security key for 2FA

A FIDO2/WebAuthn hardware key (YubiKey, Google Titan) is phishing-resistant — even a fake exchange site cannot capture it. This is the most important security upgrade for any exchange account.

Critical

Enable withdrawal whitelist

Restrict withdrawals to pre-approved addresses. Even if your account is compromised, the attacker cannot move funds to their wallet. Find this in Security Settings on Binance, Coinbase, Kraken, and most major exchanges.

High

Use a unique, strong password

Generate a long random password with a password manager (Bitwarden, 1Password). Never reuse passwords between sites. Exchange account passwords are high-value targets for credential stuffing attacks.

High

Use a dedicated email address

Create an email address used only for your exchange account — no sign-ups, no newsletters. This limits exposure in data breaches. Use a provider with strong 2FA (Gmail with security key, ProtonMail).

High

Enable login notifications

Turn on email and/or SMS alerts for new logins and withdrawal requests. Unusual login activity — unfamiliar country, device, or time — is an early warning of compromise.

Medium

Minimise or delete API keys

API keys with trade and withdrawal permissions are high-risk. Delete any keys you don't actively use. Keys you do need should have the minimum required permissions — no withdrawal rights unless absolutely necessary.

Medium

Always access via bookmark

Never navigate to your exchange by searching. Bookmark it after verifying the URL the first time. Phishing sites targeting Coinbase, Binance, and Kraken are common in paid search results.

A word on custody

Even a perfectly secured exchange account carries risks that self-custody eliminates: exchange insolvency (FTX), regulatory freezes, or hacks of the exchange's own infrastructure. For significant holdings you don't need to trade regularly, a hardware wallet is the appropriate complement to an exchange account.

Learn more: Exchange or Personal Wallet — Which Should You Use? →

For 2FA method comparison: Two-Factor Authentication for Crypto →