Exchange accounts use normal passwords, so all your password basics apply. The difference is what happens after a theft: crypto transfers are usually final. This guide is part of our guide to securing your key accounts, and it bridges into Crypto secrets.
Why exchange logins need extra care
| Bank account | Exchange account |
|---|---|
| Fraud teams may reverse payments | Transfers usually cannot be reversed |
| Regulated protections in many countries | Protections vary widely |
| Thieves need to cash out slowly | Funds can move in minutes |
Step 1: Use a dedicated email
Create an address that you use only for exchanges and never share. Give it its own unique password and strong two-factor login. Read why email is the master key.
Step 2: Use a unique password
Generate one in your password manager. If an exchange has been named in a breach, change it, and check for leaks.
Step 3: Use your strongest second factor
From best to worst: a security key or passkey, then an authenticator app. Remove SMS as a login and recovery option where possible, because holders are often targeted by SIM swaps.
Step 4: Lock down withdrawals
- Turn on an allowlist, so that funds can go only to addresses you have approved.
- Enable the delay on adding new addresses.
- Set low daily withdrawal limits, if available.
Step 5: Add an anti-phishing code
Many exchanges let you set a code word that appears in their genuine emails. If an email lacks it, treat it as fake.
Step 6: Review apps and devices
Remove old API keys, trading bots and logged-in devices. Never paste your API secret into a website that you do not fully trust.
Consider what you keep there
An exchange holds the keys for you, which means that you depend on the company. For savings, many holders move funds to their own wallet. Our guides to hardware wallets cover the options, and hardware wallet vs exchange compares them. Once you hold your own keys, the risks change, so read why a seed phrase is different.