Keeping your account secure: a practical checklist

Exchanges put a lot of work into protecting their own systems, but the most common way an individual account is compromised has little to do with the exchange. It happens through a reused password, a convincing fake login page, or an email inbox that was taken over first. The good news is that a handful of habits close most of those doors.

Start with a unique password

Use a password you have never used anywhere else, ideally generated and stored by a password manager. When another website suffers a data breach, attackers try the leaked email and password pairs on other services. A unique password makes that attack useless.

Turn on two-factor authentication

Two-factor authentication (2FA) asks for a second proof, usually a six-digit code from an authenticator app, in addition to your password. Even if your password leaks, someone without your phone cannot sign in. App-based codes are generally considered stronger than text messages, which can be intercepted through SIM-swap fraud.

Protect the email behind the account

Your email address is the master key for password resets. Give it its own unique password and its own 2FA. Whoever controls your inbox can often reset everything else.

Learn to spot phishing

• Type the exchange address yourself or use a bookmark, rather than following links in emails and messages.
• Check the domain carefully. Look-alike addresses often swap, add or drop a single character.
• Support staff will never ask for your password, your 2FA code or a wallet recovery phrase.
• Treat urgency as a red flag. A message claiming your account will be closed within the hour is a pressure tactic.

Keep API keys on a short leash

If you connect trading tools through API keys, create a separate key for each tool, give it only the permissions it genuinely needs, and revoke keys you no longer use. Never paste a key secret into a website or chat you do not fully trust.

Treat withdrawals with care

• Double-check the destination address and network before confirming. Crypto transfers are generally irreversible.
• Send a small test amount first when using a new address.
• Compare the first and last few characters of any pasted address with the original, to catch clipboard-swapping malware.

Keep your devices clean

Keep your operating system and browser up to date, remove browser extensions you do not need, and avoid signing in from shared or public computers. A compromised device can capture anything you type, including one-time codes.

If something looks wrong

Change your password, sign out of other sessions and contact support straight away using the official website. The sooner a problem is reported, the more options there are to contain it.