What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The strongest practical setup combines three layers: a passkey (or, where unavailable, an authenticator app) for sign-in, separate protection for sensitive account actions, and a withdrawal allowlist that blocks transfers to unapproved destinations. Secure the email account and devices that can recover access first, then configure each control in the exchange’s official app or website. Exact menus, supported methods, account tiers, regions and waiting periods differ, so treat the platform-specific examples below as guides rather than universal instructions.
What each security layer protects
These controls address different failure points. A passkey or other two-factor method helps stop an intruder from signing in with only your password. Action-specific 2FA can require another approval when someone changes security settings, trades or withdraws. An allowlist limits withdrawals to addresses you have approved, often with a cooling-off period before a new address works.
No single control makes theft impossible. A compromised email account, an unlocked device, a malicious browser extension, a hijacked session or a destination wallet controlled by an attacker can still defeat a poorly maintained setup. Think in layers, and verify every address and network before saving it.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesSecure the email account and devices first
Your exchange account is only as secure as the accounts that can reset it. Kraken warns that access to a linked email account can enable username retrieval, password resets and withdrawal approval. Before changing exchange settings:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Use a unique, long password for the email account; do not reuse the exchange password.
- Enable a passkey or the strongest non-SMS two-factor option the email provider supports. Kraken recommends avoiding SMS 2FA when another method is available.
- Review recovery addresses, phone numbers, backup codes and logged-in sessions. Remove recovery routes you no longer control.
- Consider a dedicated email account used only for financial services. Keep its recovery information in a separate, secure location.
- Install operating-system and browser updates, use a screen lock, and remove unknown profiles, extensions and remote-access tools.
- Turn on sign-in and security alerts so an unexpected password reset, new device or recovery change is visible quickly.
Never give a support representative your password, passkey approval, seed phrase, recovery code or authenticator code. A caller or chat agent who asks you to install remote-access software or move funds to a “safe” address is not following a legitimate recovery process.
Choose the strongest sign-in method your exchange supports
| Method | What it does well | Main exposure | Recovery and compatibility considerations |
|---|---|---|---|
| Passkey or FIDO2 security key | Phishing-resistant sign-in credential. Kraken describes passkeys as FIDO2 credentials stored on the enabled device; approval can use biometrics, a screen-lock PIN or a physical security key. | An attacker who controls an already-unlocked device, or a device account that synchronizes passkeys, may still gain access. | Check whether passkeys synchronize between your devices, whether the exchange supports a separate hardware key, and how it handles a lost or replaced device. |
| Authenticator-app code | Works without cellular service and is generally stronger than SMS. Kraken says its authenticator codes are 6–8 digits and change every 30 seconds. | A real-time phishing site can relay a code, and losing the phone or authenticator data can complicate recovery. | Store the exchange’s recovery information separately. If the app offers encrypted backup, understand where that backup is stored and who can unlock it. |
| SMS code | Available on many services and easy to use. | Phone-number takeover, SIM replacement and message interception can expose the code. | Use it only when stronger methods are unavailable or as a carefully assessed fallback. Kraken and Binance both point users toward passkeys or authenticator apps instead of SMS where possible. |
The recommendations in that table are platform guidance, not an independent percentage ranking of effectiveness. The reviewed platform documentation does not provide a verified statistic showing how much any method reduces exchange-account compromise.
Enable a passkey safely
- Open the exchange by typing its known address, using a bookmarked sign-in page or opening the official app. Do not follow an unsolicited link in an email, text message or direct message.
- Go to the account’s Security, Sign-in security or similarly named area and choose Passkey, Security key or FIDO2. Menu labels vary by provider and app version.
- Approve creation on the device that will hold the credential. The prompt may ask for Face ID, a fingerprint, a device PIN or insertion/touch of a hardware security key.
- Give the credential a recognizable name, such as “Personal phone” or “USB security key,” if the exchange allows labels. Record which device or password-manager vault contains it.
- Sign out and test a fresh sign-in while you still have your existing 2FA method available. Confirm that the passkey works on every device you expect to use.
- Read the recovery instructions before removing an old phone, resetting a device or deleting an authenticator. Keep at least one recovery path that is not stored on the same device as the passkey.
Kraken’s 2FA guidance states, “Important: We highly recommend enabling Passkeys over any other 2FA method.” That is Kraken Support’s platform-specific recommendation. Other exchanges may support passkeys only for sign-in, only on selected operating systems, or not at all; verify the scope in your own account.
Protect actions beyond sign-in
“2FA” is not one universal switch. An exchange may separate sign-in, trading, funding or withdrawal approvals, API-key activity, security-setting changes and a recovery or master-key function. A login check does not automatically mean that every later action requires a second approval.
Kraken’s separate categories
Kraken documents sign-in, trading, funding and Master Key 2FA as distinct functions. Its sign-in 2FA can trigger step-up checks when 2FA settings are changed. Kraken also explains that withdrawal and trading protections depend on sign-in 2FA or Global Settings Lock being in place, so an intruder cannot simply disable those protections after gaining access. The page was updated August 5, 2025; the terminology should not be assumed to map one-to-one to another exchange.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Audit your own exchange
- List every security option shown in the account: sign-in, trading, funding, withdrawal, API keys, password changes and account recovery.
- Enable the strongest supported method for each sensitive action. If a passkey is accepted only for sign-in, retain an authenticator app for actions that require it.
- Disable unused API keys and review permissions. A key that can withdraw or trade should be treated like a second login.
- Look for a global lock or withdrawal lock that prevents security settings from being weakened. Record how long it lasts and how it can be removed.
- Run a low-value, planned test only after confirming the asset, network and destination. Do not test by sending funds to an address you have not independently verified.
Use a withdrawal allowlist without locking yourself out
An allowlist, sometimes called an address book or whitelist, restricts sends to destinations you have approved. It reduces the chance that a thief who reaches the withdrawal screen can enter an arbitrary address, but it does not secure the receiving wallet, protect a compromised exchange, or reverse a transaction sent to the wrong network.
Safe setup sequence
- Open the receiving wallet or service and copy the deposit address from its current instructions. Confirm the asset and network it accepts.
- In the exchange’s withdrawal or address-book screen, paste the address rather than typing it. Compare the first and last several characters with the receiving service. Malware can replace copied addresses, so check the full value when practical.
- Select the exact asset and network. Do not assume that an address valid for one chain is valid for another. Binance requires an address added for a specific crypto to have the appropriate network selected; Coinbase’s consumer guidance says EVM assets should use an EVM address.
- Add a label that identifies the destination and owner. A label is not proof that the address is correct.
- Complete the exchange’s passkey, authenticator or other approval, then note the activation time and any displayed hold.
- Wait for the stated hold to expire before planning a time-sensitive transfer. Keep the old approved destination until the new one is confirmed, unless retaining it creates a separate risk.
Record the address, asset, network, date added and the exchange’s displayed release time in a private log. Never rely on memory when several networks use similar-looking addresses.
Coinbase: consumer allowlisting and Coinbase Exchange are different
Consumer Coinbase account
Coinbase’s consumer help documentation describes allowlisting as an address-book feature that limits sends to saved addresses. It requires access to 2-step verification to activate, deactivate and use the feature. The documented path starts in profile settings, but labels can change, so follow the current security or address-book prompts in your account.
On the consumer feature described by Coinbase Help, a newly added address becomes available for sends after 48 hours. Turning allowlisting off generally also takes 48 hours, except when it is disabled within eight hours of activation. These are Coinbase’s stated timings for that consumer feature, not an industry-wide rule. If the app shows a different timer, use the timer displayed for your account.
For an Ethereum Virtual Machine asset, Coinbase says to use an EVM address. Confirm that the receiving service supports the particular token and network before saving it; an EVM-compatible format alone does not guarantee that every network or token is supported.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Coinbase Exchange
Coinbase Exchange documents a separate Address Book or whitelisting feature with a 48-hour hold for new addresses. The documentation says this feature is available on Coinbase Exchange, not on Coinbase.com or the Coinbase consumer app. Do not follow Exchange instructions expecting the same controls in a regular consumer account.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchBinance: address management, suspension windows and convenience trade-offs
- In the official Binance app or website, open Settings > Withdrawal > Address Management.
- Choose to add an address, assign a label, select the crypto and choose its network where the form requires one.
- Compare the pasted address and network with the receiving wallet’s instructions, then approve the change with a passkey or 2FA.
- Review the withdrawal settings for whitelist and withdrawal-limit controls. Save the release time shown after the change.
Binance says whitelist modifications can cause temporary withdrawal suspensions of 24, 48 or 72 hours, depending on the selected setting. Its configurable withdrawal limit can also suspend withdrawals to newly added addresses for the chosen period. The reviewed Binance support article lists a maximum of 200 withdrawal addresses; limits are product settings that can change, so rely on the current account screen.
Binance also describes a “one-step withdrawal” option that can permit a small withdrawal to an allowlisted address without 2FA. That can reduce friction, but it removes a second approval from that particular transaction. Enable it only after deciding the maximum amount, understanding the residual risk and confirming that the address list itself is tightly controlled.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why an address is on hold
A hold usually means the exchange is enforcing a cooling-off period after a new address, whitelist change or security-setting change. It is not necessarily a failed blockchain transaction. Check:
- The exact timestamp when the address was saved and the release time shown in the exchange.
- Whether you changed allowlisting, 2FA, a password, a passkey or a withdrawal limit at the same time.
- Whether the address is enabled for the selected asset and network, rather than merely present in the address book.
- Whether you are using the correct product. Coinbase consumer accounts and Coinbase Exchange expose different allowlisting features.
- Whether an account-wide security lock or compliance review is applying a separate restriction.
Do not repeatedly delete and re-add an address to “refresh” it; that can restart the timer. If the stated period has passed, capture the status and contact support through the official app or website. Never pay a supposed agent to release funds and never share an approval code.
Recommended Free Tools
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- USB TYPE C Connectivity & DONGLE Design: Designed for PCs, Macs, laptops, iPhones, and Android devices that utilize a USB-C port. Plug and stay, or carry it on a keychain. (Item Size: 0.73 x 0.60 x 0.30 inches)
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC functionality is not supported.
Respond quickly if you suspect compromise
- Stop withdrawals, trades and API activity. If the platform provides an official disable, freeze or account-lock control, use it from the official app or site.
- From a clean device, secure the linked email account: change its password, revoke unknown sessions and remove unfamiliar recovery methods.
- Change the exchange password and revoke unknown devices, sessions, API keys and passkeys. Do not delete evidence before recording times and device names.
- Contact official support through the platform’s published route. Binance advises disabling the account from its official site or app and contacting official support when suspicious activity appears.
- Review transaction history, address-book changes, security events and email forwarding rules. Preserve screenshots, transaction IDs and timestamps.
- Warn any destination service or wallet provider if funds were sent. Blockchain transfers may be irreversible, but the receiving service may have incident procedures.
Kraken advises using its official apps and a bookmarked sign-in route and warns about support impersonators requesting credentials or remote access. Treat unexpected calls, direct messages and urgent instructions as hostile until independently verified.
Ongoing maintenance checklist
- Review active sessions and trusted devices at least monthly and after travel, device repair or a software reset.
- Remove passkeys, authenticator entries and API keys for devices or applications you no longer control.
- Confirm that email, phone and recovery details still belong to you.
- Check security alerts promptly; do not approve a passkey prompt you did not initiate.
- Keep device encryption, screen lock and operating-system updates enabled.
- Before every withdrawal, verify the asset, network, destination label and first-and-last address characters.
- Keep recovery information offline or in a separate protected location, and never send it to support or anyone else.
A practical decision framework
If passkeys are supported
Use a passkey for sign-in, keep a second recovery method that you understand, and enable additional 2FA or action locks for withdrawals, trading and security changes. A compatible FIDO2 hardware key is an option when you want a credential that is not stored on a phone; the cited platform material does not endorse a particular brand or model.
If passkeys are unavailable
Use an authenticator app rather than SMS when possible. Protect the authenticator device, keep recovery information separate and verify which account actions still require the code.
If the exchange offers only SMS
Strengthen the email account and mobile-carrier account, add a withdrawal allowlist and monitor alerts closely. Move to a passkey or authenticator method as soon as the platform supports one.
If you frequently change withdrawal destinations
Expect cooling-off periods and plan transfers in advance. Keep only destinations you have independently verified, and avoid convenience features that remove a second approval unless the reduced protection is an intentional decision.
Bottom line
Secure the recovery path first, then use a passkey wherever the exchange supports it, configure 2FA for every sensitive action rather than only login, and enable a carefully verified withdrawal allowlist. Treat network selection, device recovery and waiting periods as part of the security design—not as afterthoughts—and use only the exchange’s official app, website and support channels.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
