Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Crypto account security starts with a unique long password and phishing-resistant sign-in verification, ideally a passkey or FIDO2 security key. Add a backup sign-in method and secure the email account tied to the exchange before enabling withdrawal confirmation and any address allowlist or settings lock the exchange offers. The order matters: a control that confirms withdrawals may not stop an attacker from changing the saved withdrawal address.
Exchange features and their names differ, so treat the Kraken and Coinbase examples below as illustrations, not a universal checklist of identical controls. Check the security settings and current support guidance for your own exchange before relying on a feature.
What should you enable first on a crypto account?
Start with the controls that protect account access and recovery: a unique password, strong sign-in verification, a backup method, and a secured email inbox. Then add controls for moving funds and changing where funds can go. This order helps address two different risks: someone getting into the account, and someone using an already accessible account to send crypto or alter withdrawal destinations.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors- Set a unique password. Use a long password that you do not use anywhere else, and store it in a password manager. Kraken recommends at least 15 characters; Coinbase also recommends a unique strong password and password-manager use. Never reuse the exchange password for the email account linked to it.
- Enable the strongest supported sign-in 2FA. Prefer a passkey or FIDO2 security key if your exchange supports it for sign-in. Kraken recommends passkeys, and Coinbase recommends a security key or passkey for account 2-step verification. If those options are unavailable, use the strongest supported alternative, such as an authenticator app, and protect its recovery material.
- Add a backup before depending on one device. Register another passkey or security key, or a different supported backup method. Keep authenticator recovery codes in a secure offline location.
- Secure the linked email account. Give the inbox its own unique password and strong MFA. Account recovery and security approvals may rely on email, making it part of the exchange account’s security perimeter.
- Require confirmation for withdrawals or crypto sends. Turn on the exchange’s available withdrawal or send verification after confirming which transfers it covers.
- Limit destination changes. Use an address allowlist or settings lock if your exchange offers one, and understand any waiting period or setup window.
Do not assume that enabling one control automatically enables the others. Sign-in 2FA, withdrawal verification, and protection against changing saved addresses are separate functions on some exchanges.
Popular on Amazon
Why are passkeys and security keys the preferred sign-in options?
Passkeys and FIDO2 security keys are designed to resist phishing better than reusable passwords or codes. Kraken explains that its passkeys work only on the real site, so there is no sign-in code to enter on a fake page or share with a scammer. Coinbase likewise recommends a security key or passkey for account 2-step verification.
The practical advantage is that a fake login page is less able to trick you into handing over a code that can be reused elsewhere. This does not make you immune to scams: still check the site or app you are using and pay attention to what a sign-in prompt or approval is asking you to authorize. A passkey also does not replace a strong, unique password where the exchange still requires one.
If passkeys or security keys are not offered for sign-in, use the strongest available method. An authenticator app is one alternative described in exchange guidance. SMS may be the only choice for some users, but it is not the first choice in the cited recommendations. Availability can vary by exchange, account, and region, so check the current options in your account.
A hardware security key is not automatically supported for every function just because an exchange accepts it somewhere. Kraken documents hardware keys for FIDO2 passkeys, but its guidance distinguishes sign-in and Master Key passkeys from Funding 2FA: it documents YubiKey OTP for Funding 2FA and says hardware keys do not support Kraken Trading 2FA. Coinbase’s supported methods may differ. Check compatibility for the exact function you want to protect before buying or setting up a key; Kraken’s hardware-key guidance describes its supported use.
Also popular on Amazon
How should you set up a backup without weakening security?
Set up a backup authentication method before you lose access to your primary phone, key, or device. A second key or passkey is often a straightforward backup if the exchange supports it. Coinbase recommends using multiple methods, such as two security keys or a passkey plus a security key or push notification; Kraken also recommends more than one passkey.
Keep recovery materials protected. If the exchange provides authenticator backup codes, store them offline in a place that is not accessible from the same email account or device they are meant to help recover. Anyone who obtains a code may be able to set up that factor on another device, so do not leave codes in an unprotected note, inbox, or shared folder. Follow the exchange’s own recovery instructions rather than assuming that a particular backup method will work for every account function.
Before removing an old method or changing phones, verify that you can sign in with the backup and that you still control the associated email account. A backup that was never registered, is stored with the lost device, or cannot be used for the relevant action will not help when access is interrupted.
Why does the linked email account need its own protection?
The email address attached to an exchange account can be involved in account recovery and security approval workflows. If someone can access that inbox, they may be able to interfere with recovery or account notifications even if the exchange password is different. Kraken explicitly includes email security in its account guidance.
Also popular on Amazon
Use a unique password for the inbox and enable strong MFA there too. Do not treat email security as a later or optional add-on to exchange security, and avoid using the same password for both. Where possible, make sure the backup methods for the inbox are also protected and accessible only to you. The exchange’s safeguards cannot fully compensate for a compromised recovery channel.
What protects withdrawals, and what protects saved addresses?
Withdrawal verification asks for additional confirmation when funds are sent. An address allowlist or settings lock is intended to restrict or protect changes to withdrawal destinations. These controls address related but different actions, so confirm exactly what your exchange’s setting covers.
For example, Kraken’s Funding 2FA requires confirmation to withdraw funds, but Kraken says Funding 2FA alone does not prevent someone from adding a withdrawal address. Its Global Settings Lock can protect account settings and withdrawal addresses. Coinbase recommends 2-step verification for crypto sends and offers address allowlisting, which restricts withdrawals to saved addresses. The Kraken Funding 2FA explanation and Coinbase account-security guidance describe examples of these separate controls.
Allowlisting can add friction when you need to send to a new destination. Coinbase’s support guidance describes a 48-hour hold when a new address is added after allowlisting is active. It also describes an initial eight-hour window after enabling the feature during which addresses can be added and the feature disabled without the hold. Because implementation details can change, check the current terms and timing in your account before treating the hold as a dependable safeguard.
Also popular on Amazon
Before enabling a lock or allowlist, make sure you understand how to add a legitimate address, how long it takes to become usable, and what recovery or removal process applies if you lose access. Kraken’s Global Settings Lock has a removal wait; learn the current procedure before activating it. A delay can be useful against an attacker, but it can also delay your own account changes.
How do Kraken and Coinbase illustrate the differences?
These official support pages show why the setting name alone is not enough: check the function, supported method, and effect on address changes. The examples below are not a claim that either exchange offers the same features to every user or in every region.
| Control | Kraken documentation | Coinbase documentation | What to verify on your exchange |
|---|---|---|---|
| Sign-in verification | Recommends passkeys; hardware keys are documented for FIDO2 passkeys. | Recommends a security key or passkey. | Which methods protect sign-in, and whether they work on all devices you use. |
| Backup | Recommends more than one passkey. | Recommends multiple methods, such as two keys or a passkey plus a key or push notification. | Whether your backup is registered and can recover access if the primary device is lost. |
| Withdrawal confirmation | Funding 2FA; documentation describes an authenticator app or YubiKey OTP for this function. | Recommends 2-step verification for crypto sends. | Which transfer types are covered and what confirmation is required. |
| Address protection | Funding 2FA alone does not block new withdrawal addresses; Global Settings Lock protects settings and addresses. | Address allowlisting restricts withdrawals to saved addresses; documented address holds apply after the initial setup window. | Whether the control blocks changes, how long holds last, and how to remove or recover it. |
The table summarizes the cited support guidance, not a guarantee of current feature availability. Consult Kraken’s account-security guidance, Coinbase’s 2-step verification guidance, and the current settings in your own account for the latest supported behavior.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What habits help prevent security settings from being bypassed?
Start from a known-good route to the exchange. Use a saved official bookmark or type the exchange’s known domain rather than following an unexpected sign-in link. Install only official exchange apps, and do not hand account access to someone who offers to set up or manage your account. Kraken warns about impersonation and third-party apps in its security guidance.
Also popular on Amazon
Pause when a message or person pressures you to approve a sign-in, send, or settings change. Phishing-resistant authentication can reduce the chance of a fake site collecting a reusable code, but it cannot tell you whether a request you are approving is legitimate. Read the destination and action on an approval screen before confirming, and contact the exchange through its official channels if a message asks you to disable a safeguard or reveal recovery material.
Review your security configuration when you change devices, email accounts, or recovery methods. Remove an old key only after confirming that another method works. If you suspect someone else has access, use the exchange’s official security and account-recovery process, secure the linked email account, and review saved withdrawal destinations and account settings.
Frequently Asked Questions
Can I use one security key for more than one crypto exchange?
A key may be usable with more than one service, but each exchange has its own supported methods and setup process. Register it separately with each account and keep a distinct backup method for each, rather than assuming one exchange’s setup secures another.
Free tools Windows power users keep installed
One-click scans. No signup required.
Should I keep my recovery codes in cloud storage?
Avoid storing recovery codes in an unprotected note or inbox, particularly if that account or device is also used to recover your exchange access. Follow the exchange’s instructions and keep any offline copy somewhere private and secure.
What should I do if I lose my phone with an authenticator app?
Use a separately registered backup method or the exchange’s official account-recovery process; do not rely on an untested assumption that the app can be restored. Also secure the email account linked to the exchange and contact support only through the exchange’s official site or app.
Does 2FA guarantee that crypto in an exchange account cannot be stolen?
No single setting guarantees account safety, and the reviewed exchange guidance does not provide a universal effectiveness percentage. Verification, destination restrictions, strong recovery-channel security, and careful approval habits address different risks and work best as layers.
