Skip to content
GetProfitable
Search

Exchange accounts and 2FA

Lesson 5 · about 8 min

In stocks, if someone steals your brokerage login they can make a mess, but they cannot easily walk away with the money; transfers go to bank accounts in your name and can be reversed. In crypto, a stolen login means a withdrawal to an address the thief controls, confirmed on a blockchain in minutes, and gone. Your exchange account is a vault door, and this lesson is about the lock.

The attack you are defending against

Almost nobody has their exchange account "hacked" in the sense of a stranger breaking the exchange's servers. The realistic attacks are on you:

  • Password reuse. Your email and password leaked from some unrelated site years ago and are being tried on every exchange.
  • Phishing. A convincing email or a lookalike domain collects your login when you type it in.
  • SIM swap. Someone convinces your phone company to move your number to their SIM, then receives your SMS codes.
  • Malware. A browser extension or a "trading tool" you installed reads your session or swaps the withdrawal address on your clipboard.

Every control below addresses one of those four.

Passwords

Use a password manager and generate a long, unique password for each exchange. "Unique" is the operative word: the exchange's password should exist nowhere else. If you cannot recite it, that is a feature.

Your email account is the master key, because password resets go there. Give it the same treatment: unique password, strongest available two-factor, and no recovery phone number that could be SIM-swapped.

Two-factor authentication, ranked

Two-factor authentication (2FA) requires something you have as well as something you know. Not all versions are equal:

Method Defends against Weakness
SMS code Password reuse SIM swap; interceptable; avoid
Authenticator app (TOTP) Password reuse, SIM swap Phishing can relay the 6-digit code
Hardware security key (FIDO2) All of the above plus phishing Must not lose it; keep a backup key

Turn off SMS 2FA wherever the exchange allows it. If an authenticator app is your choice, back up the secret (the QR code or the text seed) somewhere offline when you set it up, because losing your phone without a backup means a slow, document-heavy account recovery. A hardware key is the right answer for any account holding more than you would be comfortable losing.

Key idea: Crypto withdrawals are irreversible, so the login is the money. Unique password, non-SMS two-factor on both the exchange and the email behind it, and a hardware key once the balance justifies it.

Withdrawal-side controls

Good exchanges offer controls that act after a login is compromised:

  • Withdrawal address whitelist. Only pre-approved addresses can receive withdrawals, and adding one triggers a delay (often 24 hours) plus email confirmation. Turn it on; it is the single most effective control on the list.
  • Anti-phishing code. A word you choose that appears in every legitimate email from the exchange. Emails without it are fake.
  • Withdrawal confirmations by email and 2FA. Both, not either.
  • Device and IP management. Log out sessions you do not recognise; review the list monthly.
  • Time locks after security changes. Many exchanges freeze withdrawals for 24 to 48 hours after a password or 2FA change. That delay is protecting you; do not disable it.

Hygiene that costs nothing

  • Bookmark the exchange and only ever log in from the bookmark. Never from a link in an email, message or search result ad.
  • Use a dedicated browser profile, or a dedicated browser, for exchange access with no extensions installed.
  • Keep the operating system and browser updated.
  • Never install a "trading bot", "signal tool" or "airdrop checker" someone sends you.
  • Assume any unsolicited message from "exchange support" is an attack. Real support does not DM you first.

Sub-accounts and separation

If your exchange offers sub-accounts, use them: one for spot trading, one for derivatives if you use them, and keep the main account holding only what is being moved. Limits and API keys (next lesson) can then be scoped narrowly.

Try it: Log in to your exchange and check five things: is SMS 2FA off; is an authenticator or hardware key on; is the withdrawal whitelist enabled; is an anti-phishing code set; and are there any logged-in devices you do not recognise. Fix whichever fail before you deposit another dollar.

Recap

  • The realistic attacks are password reuse, phishing, SIM swap and malware, all aimed at you rather than the exchange.
  • Unique passwords from a manager, and treat the email account as the master key.
  • SMS 2FA is the weakest option; use an authenticator app at minimum and a hardware key for meaningful balances.
  • Enable the withdrawal whitelist and anti-phishing code; keep the post-change withdrawal lock.
  • Only log in from a bookmark, in a clean browser, and never install tools sent to you.

See it drawn

Original diagrams for the ideas on this page. Illustrative, not real market data.

An equity curve and its drawdownAn account balance rising over a year, falling from a peak to a trough, then climbing back to the old peak.ACCOUNT EQUITY$20k$12k$8k024681012TIME (MONTHS)PEAK $16,000TROUGH $12,000DRAWDOWN−25%RECOVERY
Equity curve and drawdown. An account balance plotted month by month. The fall from the $16,000 peak to the $12,000 trough is a 25% drawdown, and the shaded area lasts until the balance climbs back to the old peak.
Support, resistance and the flip between themA price path bouncing three times off a horizontal support line and turning back three times at a resistance line, then breaking above it and settling back onto the same level.RESISTANCESUPPORT62.0056.00breaks aboveold resistance,now supportIllustrative price path: the level stays the same, its role changes.
Support, resistance and the flip. Support is a price where buyers keep stepping in and the fall stops; resistance is a price where sellers keep stepping in and the rise stops. Once price closes above an old ceiling, that same level often acts as the new floor.