How to Keep Your Crypto Safe on an Exchange

To keep crypto safe on an exchange, secure the account with app-based or hardware two-factor authentication, use a unique password, turn on withdrawal protections, stay alert to scams, and keep only what you are actively trading there. Most exchange losses among ordinary users do not come from the exchange being hacked — they come from an individual account being compromised or the user being tricked. The good news is that the defences are simple and free, and this guide runs through them in order of impact.

Turn on strong two-factor authentication

Two-factor authentication (2FA) is the single most important setting, but not all 2FA is equal. Use an authenticator app such as Authy or Google Authenticator, or better still a hardware security key, and avoid SMS text-message codes where you can. SMS is vulnerable to 'SIM-swap' attacks, where a criminal takes over your phone number and intercepts the codes. If an exchange only offers SMS, that is a mark against it. Set up your app-based 2FA the day you open the account, before you deposit anything.

Use a unique password and a password manager

Your exchange password should be long, random, and used nowhere else. Reusing a password means a leak from some unrelated website can hand a criminal your exchange login. A password manager generates and stores a unique password for every site so you never have to remember or reuse one. Combine that with app-based 2FA and you have closed the two most common doors an attacker walks through. It takes ten minutes and protects everything behind it.

Lock down withdrawals

Most reputable exchanges let you add extra withdrawal protections, and you should use them. A withdrawal address allow-list restricts payouts to wallets you have pre-approved, so even if someone gets into your account they cannot send funds to an unknown address. A short time-lock on new addresses, and an email or app confirmation for every withdrawal, add further friction for an attacker while barely inconveniencing you. Turn these on and you make a compromised login far less catastrophic.

Learn the scams that target account holders

The most effective attacks are social, not technical. Phishing emails and fake login pages harvest your password; fake 'support' agents in chat or on social media ask for your 2FA code or recovery phrase; and 'your account is at risk, move your funds to this safe wallet' messages are pure theft. Remember two rules: no real exchange will ever ask for your password, 2FA code, or recovery phrase, and any urgent message pushing you to act fast is a warning sign. Knowing the red flags of a bad exchange and the scams around it is as important as any setting.

Don't use an exchange as a vault

The strongest protection is not to keep large long-term holdings on an exchange at all. No account setting protects you from the exchange itself failing, and the safest crypto is the crypto you have moved into self-custody. Treat the exchange as a place to buy, sell and actively trade, and sweep anything you intend to hold for the long term into a wallet you control. That way, the amount exposed to any exchange risk is only ever what you are willing to have in play.

Start with a well-secured exchange

Your own habits matter most, but the exchange's own security is the foundation you build on — cold storage, proof of reserves, strong 2FA options and a good track record. Choosing a venue that takes security seriously in the first place is covered in our ranking of the best crypto exchanges. Get the venue and the settings right, keep only what you trade on it, and you have done everything within your control. None of this is financial advice, and it does not tell you what to buy.

Secure the devices and email behind the account

Your exchange is only as secure as the email and devices that control it, so protect those too. Your email is often the master key — it can reset passwords and receive confirmation links — so give it its own strong, unique password and its own app-based two-factor authentication. Keep your phone and computer updated, lock them with a passcode or biometrics, and be cautious about browser extensions and apps that request broad permissions, since a compromised device can undermine every other precaution. Attackers frequently go after the email first precisely because it unlocks everything downstream.

Be especially careful on public Wi-Fi and shared computers. Avoid logging into an exchange on a network or machine you do not control, and never save your password in a shared browser. If you must access your account away from home, a trusted connection and your own device are worth the wait. These are small habits, but account takeovers often exploit exactly these gaps rather than any weakness in the exchange itself.

Write down your recovery codes and plan for access

When you set up two-factor authentication, the exchange gives you backup or recovery codes. Save them offline, somewhere only you can reach, because losing your 2FA device without them can lock you out of your own account. This is a different phrase from a wallet's recovery phrase — an exchange account can usually be recovered through support with identity checks, whereas a self-custody wallet cannot — but being locked out is still stressful and slow, so plan for it in advance rather than in a panic.

It is also worth thinking about what happens to your crypto if you cannot access it — through illness, or worse. Because crypto has no central helpline, a trusted person knowing that an account exists and how it could be recovered can prevent funds being lost forever. You do not need to write your passwords in a shared document; you need a plan that a person you trust could follow with the right legal authority. Security includes making sure your own precautions do not become the reason the funds are unreachable.