A crypto exchange account holds both your funds and your personal information, making it one of the most valuable targets an attacker can pursue. Yet many traders fund an account and start trading before completing even basic security settings, leaving the door open to credential theft, SIM swapping and unauthorised withdrawals. A short security checklist, completed once and reviewed occasionally, closes most of those gaps. Consider using a dedicated email address solely for your exchange accounts, so a breach of your everyday inbox does not automatically expose your trading accounts as well.

Start with the fundamentals: a long, unique password that you use nowhere else, stored in a reputable password manager rather than reused across sites. Then enable two-factor authentication using an authenticator app, not text messages — SIM swapping attacks, where an attacker convinces a phone carrier to transfer your number, can defeat SMS codes, while app-based codes stay on your device. Keep backup codes for your authenticator stored securely offline, because losing access to both your password and your authenticator can lock you out. Hardware security keys, which require a physical tap to approve logins, offer the strongest form of two-factor authentication and are worth considering for accounts holding significant funds.

Next, set up a withdrawal whitelist if your exchange offers one. Whitelisting means withdrawals can only go to addresses you have pre-approved, with a waiting period before new addresses become active. This single setting dramatically limits the damage from a compromised account, because an attacker who gains access still cannot send funds to their own address immediately. It adds minor friction when you add a new address, but that friction is exactly the point. Some exchanges let you set a withdrawal lock period after security changes, which delays withdrawals following a password reset and gives you time to react if the change was unauthorised.

Review the exchange's other controls while you are in the settings. Many exchanges offer anti-phishing codes that appear in genuine emails, device management showing where your account is logged in, and options to require extra confirmation for withdrawals or account changes. Enable what is available, and log out of devices you no longer recognise. A session left active on an old phone or shared computer is a forgotten open door. Reviewing your account's login history occasionally can reveal unrecognised devices or locations that indicate someone else has accessed your account without your knowledge.

Alerts turn you into your own early-warning system. Enable notifications for logins, withdrawals, password changes and new device access, and make sure they reach an email account that is itself well secured with its own strong password and two-factor authentication. Your email is often the key to resetting exchange passwords, so a weakly secured email undermines every other setting you configure. API keys created for portfolio trackers should be read-only wherever possible, since a tracker never needs trading or withdrawal permission to display your balances.

Revisit these settings periodically, not just once. Exchanges add new security features over time, your devices change, and old whitelisted addresses may no longer be relevant. A quarterly review — checking active sessions, whitelisted addresses, authentication methods and alert settings — takes a few minutes and keeps your defences current. Treat it like servicing a car: routine maintenance prevents most breakdowns. Keeping your devices' operating systems and browsers updated closes security holes that attackers exploit, and it costs nothing but a few minutes of attention each month.

Completing this checklist will not make you invulnerable, but it moves you from an easy target to a hard one, and attackers overwhelmingly prefer easy targets. The traders who suffer account takeovers are rarely victims of exotic hacks; they are usually victims of skipped basics. Spend the hour, secure the account, and then trade with the confidence that your funds have real protection. Security settings are only effective if you actually complete them, so work through the checklist in one focused session rather than leaving half of it for a someday that never arrives.