Crypto account security in layers
| Layer | Protection | Stops |
|---|---|---|
| Password | Unique, from a password manager | Reuse of leaked passwords |
| Second factor | Authenticator app, passkey or security key | Logins with a stolen password |
| Its own strong password and two-factor authentication | Password resets by an attacker | |
| Phone number | Carrier PIN against SIM swaps | Takeover of SMS codes |
| Withdrawals | Address allow-list and confirmation delays | Withdrawals to an attacker |
| Habits | Bookmark the exchange; never share codes | Phishing and fake support |
Two-factor authentication for crypto account security
A second factor means a stolen password alone is not enough to log in.
Authenticator apps, passkeys and hardware security keys are stronger than SMS, which depends on your mobile number.
Keep backup codes for your second factor offline, in case you lose your phone.
Phishing and crypto account security
Phishing sites copy an exchange's login page and capture what you type, sometimes including your two-factor code in real time.
Open your exchange only from a bookmark or by typing the address, and be suspicious of links in emails, texts, search ads and social media.
Passkeys and security keys resist phishing better because they check the website's real address.
Withdrawal protections
An allow-list limits withdrawals to addresses you saved earlier, often with a waiting period for new ones.
Alerts for logins and withdrawals let you react quickly if something happens.
Check your crypto account security
The account security check scores your setup in ten questions and lists what to fix.
Crypto account security: passwords done right
- A long, unique password for each exchange and for your email.
- Generated and stored by a password manager.
- Never reused from another site, because leaked passwords are tried everywhere.
- Changed at once if a site you use reports a breach.
Crypto account security: comparing second factors
| Second factor | Protection against phishing | Protection against SIM swap |
|---|---|---|
| SMS code | Low | Low |
| Authenticator app code | Medium | High |
| Passkey | High | High |
| Hardware security key | High | High |
General comparison; support varies by exchange.
Crypto account security: API keys and connected apps
Some users connect portfolio trackers or trading tools to their exchange with API keys.
Give such keys read-only permission where possible, never withdrawal permission, and delete keys you no longer use.
A leaked key with trading permission can be abused even without withdrawal rights.
Crypto account security: travel and public networks
Logging in on public Wi-Fi or shared computers adds risk.
Use your own device, keep it updated and avoid logging in to exchanges on computers you do not control.
Crypto account security: a quarterly routine
- Review active sessions and devices in the exchange and email.
- Check the withdrawal allow-list for unknown addresses.
- Delete unused API keys.
- Confirm backup codes are still stored safely.
Crypto account security: how account takeovers happen
| Route | How it works | Best defence |
|---|---|---|
| Password reuse | A password leaked from another site is tried on exchanges | Unique passwords from a password manager |
| Phishing page | A copied login page captures your password and code | Bookmarks and passkeys |
| Email takeover | The attacker resets your exchange password by email | Strong email security with 2FA |
| SIM swap | Your number is moved to the attacker's SIM | App-based 2FA and a carrier PIN |
| Malware | A program steals session data or swaps addresses | Updated devices, official apps only |
| Social engineering | "Support" persuades you to share codes or screens | Never share codes; hang up and use official channels |
Crypto account security: setting up a new account properly
- Use a unique email address for financial accounts if possible.
- Generate a long password in a password manager.
- Turn on app-based 2FA or a passkey before depositing.
- Store backup codes offline.
- Turn on login and withdrawal alerts.
- Set up an address allow-list and withdrawal delays where offered.
- Bookmark the login page and use only that bookmark.
Crypto account security: recognising phishing
- An address that looks almost right but has an extra letter or a different ending.
- A message that creates urgency: account locked, suspicious login, last chance.
- A request for your 2FA code, which genuine staff never need.
- A search ad that appears above the real exchange's site.
- A QR code in an email that leads to a login page.
When unsure, close the message and open the exchange through your bookmark; real alerts also appear inside your account.
Crypto account security for families
If several family members use crypto, a short shared checklist helps everyone: no shared passwords, app-based 2FA for each person, and a rule that no one moves money because of a phone call.
Older relatives are frequent targets of impersonation scams, so agreeing on a family code word or a call-back rule can stop a scam in its tracks.
Crypto account security: after a breach elsewhere
When a website you use reports a data breach, the leaked email and password are often tried on other services.
- Change the password on the breached site and anywhere it was reused.
- Check your email account for unknown logins or forwarding rules.
- Watch for phishing that uses leaked details to look convincing.
Crypto account security and MiCA
MiCA requires authorised exchanges to safeguard client assets and to have sound governance and systems, and a custodian is liable for losses from incidents attributable to it.
Losses caused by a customer sharing credentials are a different matter, which is why your own security habits remain essential, as the guide to MiCA investor protection explains.
Crypto account security: frequently asked questions
Should I use the exchange's own authenticator? Any standard authenticator app works; what matters is that it is not SMS and that backup codes are stored safely.
Is biometric login safe? It protects the device unlock; combine it with a strong account password and second factor.
How often should I change passwords? A strong, unique password does not need frequent changes, but change it at once after any breach or suspicious activity.
Crypto account security: what to do if you clicked a phishing link
- Do not enter anything more on the page.
- Open your exchange through your bookmark and change your password.
- Reset two-factor authentication if you entered a code.
- Check withdrawals and allow-list changes in your account.
- Contact the exchange through its official support if anything looks wrong.
- Secure your email as well, in case the same password was used.
Crypto account security: password manager basics
A password manager creates and stores long, unique passwords, so you only need to remember one strong master password.
Protect the manager itself with two-factor authentication, and keep its recovery information safe.
Many password managers also warn you when you are on a site that does not match the one saved, which helps against phishing.
Crypto account security: summary
Passwords
One per site, from a password manager.
Second factor
App, passkey or security key, not SMS.
Access
Bookmarks and official apps only.
Crypto account security: questions readers ask
Is it safe to save my exchange password in the browser? A dedicated password manager with its own strong protection is generally safer than a browser on a shared or unprotected device.
What if I lose my authenticator phone? Use your offline backup codes to log in and set up the authenticator again, which is why those codes matter.
Does a VPN make my account safer? A VPN can protect traffic on public networks, but it does not replace strong passwords and two-factor authentication, and exchanges may restrict access from some locations.
Should I give API keys to portfolio apps? Only read-only keys, never with withdrawal permission, and only to apps you trust.
Crypto account security: your ten-minute upgrade
- Install an authenticator app and switch your exchange to it.
- Do the same for your email.
- Store backup codes on paper.
- Turn on withdrawal alerts and an allow-list.
- Bookmark the exchange login.
Ten minutes of setup closes the routes behind most account takeovers.
More on crypto account security and related safety tools
Safety works best as a set of habits, and each guide and tool below covers a different part of the picture around crypto account security.
Use them together: check the firm, check the offer, secure your account and know what to do if something goes wrong.
If you remember one thing from this page, make it this: check before you send, and never let urgency decide for you.
Frequently asked questions
What is the most important crypto account security step?
App-based two-factor authentication on both your exchange and your email account.
Is SMS two-factor authentication enough?
It is better than nothing, but SIM swaps can bypass it. Use an app, passkey or security key where possible.
What is a withdrawal allow-list?
A setting that limits withdrawals to addresses you saved earlier, often with a delay for new ones.
How do I avoid phishing?
Use a bookmark or type the address, ignore links in messages and ads, and prefer passkeys.
What should I do if my account is compromised?
Contact the exchange through its official site at once, secure your email, change passwords from a clean device and report the incident.
Every figure on this page is checked against the ESMA register, the exchange's own terms and fee pages or another primary source, and the sources are listed above. Editorial policy · How we rate