How to Secure Your Exchange Account
By moonbag.info team · · Beginner
If you buy crypto on a centralized exchange, your account is a target. Attackers don’t need to break the exchange’s systems if they can log in as you. Most account takeovers come from reused passwords, weak two-factor authentication, phishing or SIM swaps. This checklist covers the settings that make the biggest difference.
It applies to most major exchanges, though menus and names vary. This guide does not recommend any specific exchange.
1. Secure your email first
Your email is the master key to most accounts, because password resets go there.
- Use a strong, unique password for your email.
- Turn on strong two-factor authentication for your email account.
- Consider using an email address that you use only for financial accounts and don’t share publicly.
- Review recovery options (backup email and phone) and remove any you no longer control.
2. Use a unique, strong password
- Use a password manager to generate a long, random password that you don’t use anywhere else.
- Never reuse a password from another site. Data breaches elsewhere are a common way accounts get taken over.
3. Turn on the strongest 2FA available
Two-factor authentication options, from strongest to weakest:
- Hardware security keys or passkeys (based on standards like FIDO2/WebAuthn). These resist phishing because they only work on the real website.
- Authenticator apps that generate six-digit codes. Much better than SMS.
- SMS codes. Better than nothing, but vulnerable to SIM swaps.
Once you’ve set up a stronger method, remove SMS as a 2FA option if the exchange allows it. Save the backup codes for your authenticator offline, in a safe place.
4. Protect your phone number from SIM swaps
In a SIM swap, a scammer convinces your mobile carrier to move your number to their SIM, then receives your SMS codes. To reduce the risk:
- Ask your carrier about a port-out PIN, number lock or SIM lock feature, and turn it on.
- Use a strong, unique PIN on your carrier account.
- Avoid using your phone number as the only recovery method for important accounts.
5. Turn on a withdrawal allowlist
Many exchanges let you restrict withdrawals to a list of pre-approved addresses (often called an allowlist or whitelist). New addresses may need a waiting period, often 24 to 48 hours, before they can be used.
If an attacker gets into your account, this can stop them from withdrawing to their own address immediately. Combine it with alerts so you’d notice a new address being added.
6. Set an anti-phishing code
Some exchanges let you set a personal code that appears in every genuine email they send. If an “exchange” email arrives without your code, treat it as phishing.
7. Review devices, sessions and API keys
- Active sessions and devices: log out anything you don’t recognize.
- API keys: if you created keys for a portfolio tracker or bot, check their permissions. Read-only keys shouldn’t have trading or withdrawal rights. Delete unused keys.
- Alerts: turn on notifications for logins, new devices, password changes and withdrawals.
8. Recognize phishing and fake support
- Bookmark the exchange’s site and always use the bookmark or the official app.
- Don’t click links in emails, texts or DMs about urgent account problems. Log in directly instead.
- Real support won’t DM you first, ask for your password or 2FA codes, ask you to install remote-access software, or ask you to move funds to a “safe” wallet.
- Beware search ads that lead to look-alike sites.
9. Don’t keep more on the exchange than you need
Even a well-secured account is exposed to the exchange’s own risks, such as hacks, freezes or insolvency. Many people keep only what they actively trade on an exchange and move long-term holdings, such as a moonbag, to self-custody. See Moving From an Exchange to Self-Custody.
10. Keep your devices clean
- Keep your phone and computer operating systems updated.
- Install apps only from official stores.
- Avoid browser extensions you don’t need; some malicious extensions target crypto users.
- Be careful on public Wi-Fi, and never log in on shared computers.
Quick checklist
| Setting | Done? |
|---|---|
| Email has unique password and strong 2FA | ☐ |
| Exchange password unique, from a password manager | ☐ |
| Hardware key, passkey or authenticator app enabled | ☐ |
| SMS 2FA removed (if possible) | ☐ |
| Carrier port-out PIN or SIM lock enabled | ☐ |
| Withdrawal allowlist on | ☐ |
| Anti-phishing code set | ☐ |
| Unused API keys deleted | ☐ |
| Login and withdrawal alerts on | ☐ |
| Backup codes stored offline | ☐ |
If you think your account is compromised
- Log in from a trusted device, change your password and reset 2FA.
- Contact the exchange through its official website or app (not a number from a search result or social media).
- Freeze or lock the account if that option exists.
- Check your email account for forwarding rules or unknown logins.
- Report it. In the US, the FBI’s IC3 accepts reports of online fraud.
Common mistakes
- Reusing passwords across sites.
- Relying on SMS 2FA alone.
- Trusting “support” accounts that message you first.
- Leaving API keys with withdrawal permissions active.
- Clicking email links instead of using a bookmark.
- Keeping all holdings on one exchange.
Key takeaways
- Secure your email first, then your exchange account.
- Use a unique password and the strongest 2FA available, and remove SMS if possible.
- Turn on withdrawal allowlists, alerts and an anti-phishing code.
- Keep only what you need on an exchange.