How do you secure a crypto exchange account?

To secure a crypto exchange account, the most effective steps are a phishing-resistant login such as a security key or passkey, a withdrawal allowlist, and extra protection on your phone number. Exchange accounts are attractive targets because a thief who gets in can send coins out, and crypto transfers generally cannot be reversed. These steps make that much harder without changing how you trade.

Which 2FA should you use on a crypto exchange?

Two-factor authentication (2FA) adds a second check after your password. Not all types are equal. The US Cybersecurity and Infrastructure Security Agency (CISA) ranks FIDO or WebAuthn methods, which include hardware security keys and passkeys, as the strongest. Authenticator app codes and push prompts with number matching come next. SMS and voice codes sit at the bottom, and CISA says they should be used only as a last resort.

Exchanges reflect the same order. Coinbase's help center calls a security key the strongest option, suggests registering two keys for the highest security, and labels SMS the least secure choice.

What is a crypto security key or passkey?

A crypto security key is a small USB or NFC device that proves who you are by signing a challenge from the website. A passkey does the same job using a credential stored on your phone or computer. Because the credential is tied to the real site, a fake login page cannot reuse it, which is why these methods resist phishing. As of October 2026, Kraken lists FIDO2 passkeys, a global settings lock and no SMS recovery among its account protections.

How does a SIM swap put crypto at risk?

In a SIM swap, a criminal persuades your mobile carrier to move your phone number to a SIM card they control. From then on, texted login codes and reset links go to them. CISA notes that app-based and FIDO methods are not affected by SIM swaps, while SMS codes are.

Carriers have extra duties too. FCC rules adopted in November 2023 require US wireless providers to use secure methods to verify customers before moving a number, and to notify customers right away about SIM change or port-out requests. Asking your carrier about a port-out PIN or account lock adds another layer.

What is a withdrawal allowlist?

A withdrawal allowlist restricts crypto withdrawals to addresses you saved in advance. On Coinbase, a newly added address cannot receive funds for 48 hours, and turning the feature off also takes 48 hours. Robinhood applies a similar 48-hour wait for new allowlisted addresses. The delay gives you time to notice a break-in before funds can go to a thief's wallet address.

Even a well-protected account is still a custodial account. Our guide on what happens if a crypto exchange goes bankrupt covers the risks that login security cannot fix.