Securing the email behind your crypto accounts

Think of your email as the master key to your online life. If an attacker controls it, they can reset passwords on exchanges, social accounts and many wallet-related services, and they can read every confirmation and alert you would have used to notice.

Lock it down

• Use a unique, long password stored in a password manager.
• Use the strongest 2FA available, ideally a security key or passkey. Remove SMS as a fallback if your provider allows it.
• Review recovery options. An old phone number or forgotten backup address is a back door.
• Check forwarding rules and filters. A common trick after a takeover is a hidden rule that forwards or deletes messages from exchanges, so you never see withdrawal confirmations.
• Check connected apps and active sessions and remove anything you do not recognise.

Consider a dedicated address for crypto

A separate email that you use only for exchanges and crypto services, and never publish, is much harder to target. It also makes phishing easier to spot: a "Binance" email arriving at your public address cannot be real.

Recognising crypto phishing emails

Common themes:

• "Unusual login detected. Click here to secure your account."
• "Your wallet will be suspended unless you verify."
• "You are eligible for an airdrop. Claim before it expires."
• "Mandatory KYC update" or "regulatory compliance" deadlines.
• Fake invoices or purchase confirmations designed to make you call a "support" number.

What to do:

• Do not click links in the email. Open the service by typing its address or using your bookmark, and check for the alert there.
• Look at the full sender address, not just the display name. Note, though, that sender addresses can be spoofed and real-looking senders can be compromised, so the address alone does not prove anything.
• Some exchanges offer an anti-phishing code: a phrase you choose that appears in every genuine email from them. Turn it on.

After a data leak

If a service you use announces a breach, expect targeted phishing that uses your real name, purchase history or account details. Accuracy is not proof of authenticity. Be extra suspicious for months afterwards.