Crypto exchange security comes down to two things: how the platform handles its customers' money and how well you guard your own account. The first is a matter of choosing the right exchange; the second is on you. This lesson covers the settings worth turning on today, how phishing works, and the rules for handling API keys.
- Most of the time, thieves don't rob the exchange, they rob the user: through phishing, a weak password or intercepted SMS codes.
- Turn on 2FA via an app or hardware key, an anti-phishing code and a withdrawal address whitelist.
- Never give API keys for third-party services permission to withdraw funds.
- Don't keep more on the exchange than you need for trading: the rest is safer in your own wallet.
Where the threats come from
Beginners tend to think the main enemy is hackers breaking into an entire exchange. That does happen, but people lose money far more often when a single account is compromised: the password leaked from another site, the login details were entered on a fake page, or a scammer talked the owner into reading out an SMS code.
There are also risks that come from the exchange itself. A platform can freeze withdrawals, mishandle customer funds or go bankrupt altogether. The FTX collapse in 2022 showed clearly that even a big name is no protection against failure.
Hence the two-layer approach: keep outsiders out of your account, and don't hold more on any one platform than you can afford to lose. What to look for when picking a platform is covered in detail in the lesson on how to choose an exchange for trading.
Using forged documents or help from someone at the mobile carrier, a scammer gets your SIM card reissued to themselves and starts receiving all your SMS codes. That's why SMS is the weakest second factor.
Basic account protection: a 15-minute setup
Right after registration and verification, before your first deposit, go through your settings. They're usually tucked away in your profile under “Security.”
Two-factor authentication through an app is more reliable than SMS, and a hardware key or passkey is more reliable still. They can't be intercepted remotely or fooled by a fake website, so if the exchange supports them, they're the best choice for your main account.
Don't forget about your email and phone. Your email is used to reset your password, and your phone number is used to get back into your email, so a weak link anywhere in that chain puts everything else at risk. Don't use an inbox flooded with newsletters for your exchange account, and if your carrier offers it, ask them to block SIM reissues without an in-person visit.
- Set a long, unique password that you don't use anywhere else, and keep it in a password manager.
- Turn on 2FA with an authenticator app or a hardware key, and keep SMS only as a backup or turn it off.
- Write your 2FA backup key down on paper and put it wherever you keep your documents.
- Set an anti-phishing code: it will appear in every genuine email from the exchange.
- Turn on a withdrawal address whitelist so money can only be sent to addresses you've added in advance.
- Link the exchange to a separate email that isn't visible on social media, and protect it with 2FA too.
- Review the list of active devices and sessions and end any you don't recognize.
Even if an attacker gets into your account, adding a new withdrawal address usually requires confirmation, and withdrawals to it are only enabled after a delay. That gives you time to notice the alert and lock your account.
Phishing and social engineering
A phishing site copies an exchange down to the last detail: same logo, same login form, with just one letter different in the address. Sites like these often show up at the top of search ads, so only go to the exchange through a saved bookmark or the official app from the app store.
The second common scenario is “support” messaging you first on Telegram or in your DMs: they report a suspicious login and urge you to confirm your identity right away and read out a code. Don't fall for it. Real support never asks for 2FA codes, passwords or seed phrases, and never suggests moving your funds to a “safe account.”
Be careful with files, too. Browser extensions, so-called trading bots and “signal software” from dubious sources can steal passwords and swap addresses in your clipboard. After pasting an address, always check its first and last characters.
Urgency is a scammer's favorite tool. Is someone rushing you and asking for a password, a code or a transfer? Stop and ask yourself: why would a real exchange need this from me?
API keys: convenient, but only with restrictions
An API key gives an outside program access to your account: it can show your balance, place orders and track stats. Trading terminals, bots and portfolio trackers all connect to exchanges through keys. It's convenient, but every key is one more door into your account.
The main rule is to give a key the bare minimum of permissions. A portfolio tracker only needs read access, and a trading terminal needs trading access, but neither ever needs withdrawals. Where possible, restrict the key to the service's IP addresses and set an expiry date.
The exchange shows the secret part of the key only once. Don't send it through messaging apps, don't store it in your phone's notes, and delete keys you no longer use right away.
| Key permission | What it allows | When to enable it |
|---|---|---|
| Read | View balances, orders and history | Portfolio tracking and analytics services |
| Spot trading | Buy and sell on the spot market | Trading terminals and trusted bots |
| Futures | Open leveraged positions | Only if you trade futures yourself |
| Withdrawals | Send coins off the exchange | Practically never for third-party services |
Don't keep everything on the exchange
While your coins sit on an exchange, what you own isn't the coins themselves but the exchange's promise to give them back. That's fine for active trading, but long-term savings are better kept in your own wallet, where only you hold the keys. For larger amounts, it makes sense to get a hardware wallet. There's more on that in the lesson on Ledger, Trezor and MetaMask wallets.
Some exchanges publish proof of reserves, a report showing that customer assets are actually on the platform. It's a useful signal, but not a guarantee: the report is a snapshot of a specific date and doesn't always account for the exchange's liabilities.
A sensible setup for most people: keep as much on the exchange as you need for current trading and the rest in a personal wallet. If you trade large volumes, spread your funds across two or three platforms.
If you use several exchanges, keep a simple spreadsheet: what's held where, which email is linked, and which keys have been issued for which services. In an emergency, it'll help you keep a clear head and not forget about an old account with a leftover balance you haven't thought about in ages.
If your account gets hacked
Speed matters most here: the faster you lock your account, the less chance the attacker has to withdraw your money.
Once things are resolved, figure out where the breach happened: a reused password, a login from someone else's computer, a program you installed, a chat with “support.” Without that review, the next attack can come in the same way, even if you change all your passwords.
- Lock your account using the emergency freeze feature in the exchange's app or website.
- Contact support only through the official website or app, and include the time and a description of the suspicious transactions.
- Change the password for the email linked to the exchange, and check whether any forwarding rules have appeared in it.
- Delete all API keys and end all sessions.
- Scan your computer and phone with antivirus software before logging back into your account.
- If funds were stolen, save the transaction hashes and report it to the police: exchanges sometimes freeze stolen funds on request.
A user got an email about a login from a new device, noticed it didn't contain their anti-phishing code, realized it was fake and didn't click the link. One setting turned on in advance worked better than anything they could have done after a hack.
Go through the checklist from the “Basic account protection” section in your exchange account or, if you don't have one yet, in the email you plan to link to it. Mark what's done and what isn't: 2FA via an app instead of SMS, backup codes on paper, unfamiliar sessions, forwarding rules in your email. You should end up with a short list of holes you can close today.
Entry is free and you trade on a demo account, so you need no money of your own. Free tournaments pay out Tour Passes, and those get you into tournaments with USDT prizes. The best go further — to a $5,000 funded account.
FAQ
Which is more secure: SMS, Google Authenticator or a hardware key?
SMS is the most vulnerable option: codes can be intercepted with a SIM swap. An authenticator app is noticeably more secure, and the best protection against phishing comes from a hardware key or passkey, because they simply won't work on a fake website.
Is it safe to keep crypto on an exchange?
For active trading, it's fine as long as your account is well protected. But long-term savings are safer in your own wallet: an exchange can get hacked, and withdrawals can get frozen.
What is an anti-phishing code on an exchange?
It's a word or phrase you set in your account settings, and the exchange includes it in all of its emails. If an email “from the exchange” doesn't contain your code, it's fake.
Can I get my money back after my account is hacked?
There are no guarantees. Your chances are better if you locked your account quickly and reported the theft to the exchange and the police. Exchanges sometimes freeze stolen funds that land on their platforms, but getting them back is far from certain.
Discussion
Comments from BuyCrypt Live. Sign in with Google or Apple — we create your BuyCrypt account on the way, the same one as in the app.
