Agent Lane robot mascotAgent Lane
Menu

Guide

How to lock down your crypto exchange account: 2FA, allowlist and more

Some links may earn us a commission at no cost to you, which helps keep these guides free and up to date.

Short answer: Assume your password will leak one day and set up your account so that alone isn’t enough. Use an authenticator app or security key instead of text-message codes, put a PIN on your phone account, turn on a withdrawal allowlist if your exchange has one, and keep long-term savings off the exchange.

By Agent Lane Editorial · Page dated 3 November 2026

Why lock down an exchange account?

A password alone is easy to lose. The FTC says scammers phish passwords, buy them from data breaches, and try them on other sites when people reuse them. Once someone is in an exchange account, crypto sent out usually can’t be reversed. The settings below make a stolen password much less useful.

Which two-factor login is safest?

Two-factor login (2FA) asks for a second proof after your password. The FTC says text or email codes are better than nothing, but an authenticator app or a security key is safer. A security key is a small physical device you plug in or tap. Text codes have a specific weak spot: in a SIM swap, a scammer talks your carrier into moving your number to their phone, and the FTC warns text verification may not stop that.

How do I protect my phone number from a SIM swap?

The FTC recommends setting a PIN or password on your mobile phone account so nobody can change it without that code, limiting the personal details you post publicly, and switching important accounts to an app or security key. The FBI logged 971 SIM-swap complaints and $17 million in losses in 2025. If your phone suddenly loses service, call your carrier right away.

What is a withdrawal allowlist, and should I turn it on?

Yes, if your exchange offers it. An allowlist means crypto can only be sent to addresses you saved in advance. On Coinbase, for example, a newly added address can’t be used for 48 hours, and turning the allowlist off also takes 48 hours (unless you do it within 8 hours of turning it on). That delay gives you time to notice a break-in before anything leaves.

What other account settings help?

  • An account lock, if offered. Kraken’s Global Settings Lock blocks changes to your account, even by Kraken Support, and unlocking it without a backup key takes at least 24 hours (up to 30 days, depending on your settings).
  • A separate email. Use an email address for the exchange that you don’t post anywhere, with its own strong password and 2FA. Whoever controls that inbox can often reset the exchange password.
  • A unique password from a password manager, never reused elsewhere.
  • Login and withdrawal alerts turned on, so you hear about activity right away.
  • No AI or bot access you don’t need. If you connect a trading tool, give it the narrowest access available and never permission to withdraw. See Is that AI trading bot legit?

Should I keep my crypto on the exchange?

Only what you plan to trade soon. The FTC notes that if an exchange goes out of business or your wallet is stolen or compromised, you’re likely to find no one can step in to help recover your funds. Long-term savings are safer in a wallet you control, such as a hardware wallet from Ledger or Trezor, bought from the maker’s own store. Write the recovery phrase on paper and never type it into a website or app.

What if someone calls saying my account is hacked?

Hang up. Coinbase says its support staff will never ask you to move your funds, share your password or 2-step codes, or install software. Open the exchange app yourself to check. More on fake support calls and chats: AI crypto scams.

Sources

Checked 3 November 2026 on each organization’s own site.

Related guides

All guides