Two-factor authentication: choose the right type
SMS codes are the weakest option because SIM swapping lets an attacker receive your messages. An authenticator app generates codes locally and is not vulnerable to that attack.
Hardware keys are stronger still.
Anti-phishing code
This is a string you set that appears in every genuine email from the exchange. If an email lacks it, the message is forged.
It is one of the few security features that costs nothing and defeats an entire category of attack.
Device management
Review the list of authorised devices regularly and remove anything unfamiliar. Session hijacking often persists through a device authorisation that the user never noticed.
Withdrawal whitelist
Restrict withdrawals to pre-approved addresses. An attacker who compromises the account still cannot send funds to their own wallet without the delay required to add a new address.
This turns a total loss into a recoverable incident.
Settings that create false confidence
Withdrawal limits
Limits cap damage but do not prevent it. They are not a substitute for 2FA.
Password complexity
A long unique password matters, but reuse across sites is what actually gets people breached.
The pattern behind most losses
Nearly every account takeover involves a conversation: fake support, a fake investment group, a fake job offer. No technical control substitutes for refusing to share credentials or install remote-access software.
