The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Secure an exchange account in layers: use a unique 15-character-or-longer password, enable a passkey or FIDO2 security key, protect the email account that can reset access, allowlist withdrawal addresses, require funding or withdrawal 2FA, and lock settings. Keep a second recovery factor offline, review sessions regularly, and access the exchange only through official apps or a bookmarked site. These controls reduce the chance that a stolen password becomes a successful withdrawal, although they can add delays to legitimate account changes.
Start with the settings that stop an account takeover
Change the controls in this order so a compromised password alone is not enough to move funds:
| Control | Recommended setting | What it prevents | Trade-off |
|---|---|---|---|
| Password | Unique, randomly generated, at least 15 characters | Password-reuse attacks and guessing | You must store it in a password manager |
| Sign-in 2FA | Passkey or FIDO2/WebAuthn hardware key | Phishing of one-time codes and replay of stolen passwords | You need a compatible device and a backup factor |
| Email security | Separate strong password and 2FA on the mailbox | Password-reset takeover | One more account to maintain |
| Withdrawal allowlist | Allowlist-only withdrawals, with the exchange’s waiting period enabled | Transfers to a new attacker-controlled address | New addresses may be unusable for a delay |
| Funding or withdrawal 2FA | Require a second factor for deposits, withdrawals, or both | Unauthorized movement after sign-in | Extra prompts during transfers |
| Settings lock | Use the longest delay you can tolerate | Changes to security and withdrawal settings | Legitimate changes are delayed |
| Sessions and devices | Revoke anything unfamiliar | Persistent unauthorized access | You may need to sign in again on trusted devices |
Exchange menus and feature names change, and availability can depend on your country, account tier, or asset. Confirm the exact labels shown in your account before relying on a control.
1. Replace your password with a unique, long secret
Use a password that has never appeared on another site. Kraken recommends at least 15 characters and recommends a password manager to generate and store a random value (Kraken guidance, 2026). A randomly generated 20- or 30-character password is preferable when the service accepts it.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Set it safely
- Open the exchange by typing its known address or using your bookmarked official site; do not follow a login link in an unsolicited message.
- Open the account security or password page and create a random password in your password manager.
- Save the entry before signing out, then sign in again from a trusted device to verify it works.
- Change the password for the email account associated with the exchange if it has been reused anywhere else.
Never share the exchange password with support staff, a trading bot, or anyone claiming to need it for verification. An exchange employee should not need your password or one-time code.
2. Prefer phishing-resistant sign-in 2FA
Passkeys and FIDO2/WebAuthn security keys bind authentication to the legitimate domain or app. A fake login page cannot normally use the credential, which makes these methods stronger against phishing than SMS or a typed authenticator code.
Passkey
A passkey uses FIDO2 security stored on a phone, computer, or hardware-backed credential. Kraken describes passkeys as phishing-resistant FIDO2 authentication. Register it from the exchange’s security page, then test a fresh sign-in in a private browser window or on a second trusted device.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →FIDO2 hardware key
Coinbase describes two security keys as its “Highest security” option and supports WebAuthn/FIDO2-compatible keys, including YubiKey-type devices. Kraken identifies a hardware key as its most secure funding-2FA method. Register two keys: keep one with you and store the spare in a separate secure location.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Authenticator app
An authenticator app is a practical fallback when passkeys or hardware keys are unavailable. It is stronger than SMS in many threat models, but a real-time phishing site can trick you into typing a current code. Store the service’s recovery codes offline, not in the same cloud account used for the exchange, and protect the phone with a device passcode.
SMS
Use SMS only when stronger methods are not offered. Phone-number takeover and intercepted messages can defeat it. If SMS is your current method, add a passkey or security key first, verify it, and then remove SMS where the exchange permits.
3. Build a recovery plan before you need it
Strong authentication becomes a lockout risk if the only key is lost. Coinbase recommends two security keys; another resilient arrangement is a passkey plus a hardware-key backup.
Recommended Free Tools
- Register two independent security keys, or a passkey on one device plus a hardware key stored separately.
- Print or write authenticator recovery codes and keep them offline in a location protected from fire, theft, and casual access.
- Do not store every factor on one phone, one laptop, or one cloud account.
- Record the exchange’s documented account-recovery process before an emergency; support may require identity checks and may impose a waiting period.
- Test the backup factor without deleting the primary factor.
A backup factor should be reachable when your primary device is unavailable but not continuously connected to the device you use for daily trading.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Secure the email account that controls recovery
Anyone who controls your email may be able to reset the exchange password, approve a login, or intercept security notifications. Coinbase explicitly advises enabling 2FA on the personal email account, and Binance recommends a secure or dedicated email address for the exchange.
- Use a unique password for the mailbox, generated and stored by your password manager.
- Enable a passkey or hardware-key 2FA on the mailbox if supported; otherwise use an authenticator app.
- Review forwarding rules, filters, recovery addresses, and logged-in sessions for changes you did not make.
- Keep the mailbox recovery phone number and backup email current, but protect those recovery channels with equivalent security.
A dedicated email address can reduce exposure to ordinary newsletters and social engineering, but it does not replace 2FA or a strong password.
5. Turn on withdrawal-address allowlisting
Allowlisting restricts withdrawals to addresses you have explicitly saved. Coinbase says a newly added address is subject to a 48-hour hold before it can be used under its current help guidance. Binance describes a whitelist-only mode that blocks withdrawals to addresses outside the list.
Configure it
- Open Security, Withdrawals, or the equivalent address-book area.
- Add each wallet address carefully. Compare the first and last several characters on the exchange with the destination wallet; malware can replace a copied address.
- Complete the exchange’s confirmation steps, such as email or 2FA approval.
- Enable the option that permits withdrawals only to allowlisted addresses.
- Wait through the stated hold period before relying on a newly added address.
Use a written change process for treasury or business accounts: two people independently verify a new address, and the second person confirms the network as well as the address. Allowlisting can delay a legitimate transfer, so add a destination well before you need to withdraw.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Protect the funding and withdrawal action itself
Sign-in 2FA proves who is entering the account; it does not necessarily approve every transfer. Kraken supports funding 2FA for deposits and withdrawals. Check whether your exchange exposes separate controls for trading, deposits, withdrawals, API changes, and account recovery.
Pair funding 2FA with a settings lock
Funding 2FA may not stop an attacker who first changes the withdrawal address or disables the control. Kraken warns that funding 2FA requires sign-in 2FA or Global Settings Lock to remain effective. Enable both where available.
Kraken’s Global Settings Lock blocks changes to account settings and withdrawal addresses for a chosen delay of 1 to 30 days, with a default of 3 days (Kraken guidance, 2026). Select the longest period compatible with your trading needs. A delay gives you time to notice an unauthorized change and contact official support before it becomes usable.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute7. Add an anti-phishing marker to official messages
Binance’s anti-phishing code appears in genuine Binance emails. Set a distinctive code that does not reveal personal information, then treat any message without the expected marker as suspicious. The marker is a warning aid, not proof that a link is safe: open the exchange through your bookmark instead of clicking the email.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
8. Review sessions, devices, and IP activity
Open the exchange’s recognized-device, active-session, or login-history page at setup and on a regular schedule. Look for unfamiliar browsers, locations, IP addresses, or access times.
- Sign out or revoke every session you do not recognize.
- Remove old phones, browsers, and API keys that you no longer use.
- Change the exchange password and the email password immediately if unauthorized access is plausible.
- Re-register trusted 2FA factors if an attacker may have changed them.
- Contact support through the official app or bookmarked site; never use a phone number or chat handle supplied by an unsolicited message.
Session history can be imperfect because mobile networks and VPNs change IP addresses. Treat an unknown device or successful login you cannot explain as the stronger warning signal.
9. Use only official access paths
Fake apps, search advertisements, and impersonators can capture credentials even when every account setting is correct. Kraken warns that impersonators and fake applications ask for sign-in details.
- Install the exchange app from the platform’s official app store listing and verify the publisher.
- Bookmark the exchange website after confirming the address through a trusted, independent source.
- Type the address yourself for security changes instead of using links in email, direct messages, or support tickets.
- Ignore anyone who asks you to move funds to a “safe” wallet, disclose a recovery phrase, or share a one-time code.
10. Harden the device you use to trade
Binance advises using device passcodes, avoiding untrusted software, and keeping antivirus updated. Never enter exchange credentials on a shared, rooted, jailbroken, or suspected-compromised device.
Minimum endpoint checklist
- Use a strong screen lock and enable automatic updates for the operating system, browser, and exchange app.
- Install software only from official stores or the publisher’s verified site.
- Remove remote-control tools and browser extensions you do not need.
- Use a separate user profile or dedicated device for high-value administration when practical.
- Do not save exchange passwords in a browser profile shared with other people.
- On public Wi-Fi, postpone security changes until you can use a trusted network; a network alone cannot make a phishing page legitimate.
Which second factor should you choose?
| Method | Phishing resistance | Recovery considerations | Best use |
|---|---|---|---|
| Passkey | High; FIDO2 binds it to the legitimate site or app | Requires a second passkey or hardware-key backup | Primary sign-in on a modern phone or computer |
| FIDO2 hardware key | High; the key does not disclose a reusable secret | Register and store a spare key | Highest-assurance sign-in and funding approval |
| Authenticator app (TOTP) | Moderate; codes can be phished in real time | Protect offline recovery codes and the phone | Fallback when passkeys or keys are unavailable |
| SMS | Low relative to the methods above | Depends on control of the phone number | Last-resort option |
Choose the strongest method the exchange supports, then preserve a separate recovery path. A security key that can be lost without a backup is not a complete security plan.
Deploy the checklist without locking yourself out
- Secure the email account and password manager first.
- Change the exchange password and sign out other sessions.
- Register the primary and backup passkeys or hardware keys.
- Save recovery codes offline and verify the backup factor.
- Enable funding or withdrawal 2FA and note which actions it covers.
- Add and verify withdrawal addresses, then enable allowlist-only withdrawals.
- Set the settings-lock delay and record when it will expire.
- Set the anti-phishing marker, if offered.
- Review devices, IP activity, API keys, and notification preferences.
- Document the official support route and test a small withdrawal only after the controls are active.
What to do if you suspect compromise
Act from a clean, trusted device. Stop trading and withdrawals, revoke unknown sessions and API keys, change the exchange and email passwords, and disable any factor you did not create. Contact official support through the exchange’s verified app or bookmarked website. Tell support when you noticed the problem, which sessions or addresses were unfamiliar, and whether a withdrawal was attempted. Do not negotiate with an impersonator who promises recovery for an upfront payment.
There is no official cross-exchange statistic establishing how often these settings prevent breaches. Their value is practical and layered: a long unique password limits credential attacks, phishing-resistant 2FA blocks many fake-login attempts, and allowlists plus settings delays constrain what an intruder can do after sign-in.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
