Exchange account security and withdrawal allowlists

How to lock down a centralised exchange account: 2FA, anti-phishing codes, withdrawal allowlists, API keys and what to keep on the exchange at all.

Last reviewed 2026-10-27 · 2 min read

On this page
  1. Settings to turn on
  2. API keys
  3. How much to keep on an exchange
  4. Common exchange scams

An exchange account is one of the most valuable things an attacker can take over: a single login can give access to everything you hold there, plus your linked bank account. Exchanges offer good protections, but most are off by default.

Settings to turn on

  • Strong 2FA. Use a security key or passkey if available, otherwise an authenticator app. Remove SMS where possible. See two-factor authentication.
  • Withdrawal address allowlist (also called whitelist or address book lock). Withdrawals can then go only to addresses you have pre-approved. Adding a new address usually requires extra confirmation and may trigger a waiting period. This one setting stops many account takeovers from turning into losses.
  • Anti-phishing code. A phrase of your choosing included in every genuine email from the exchange. An email without it is not from them.
  • Login and withdrawal notifications to an email account that is itself secured.
  • Device management. Review logged-in devices and sessions regularly and remove what you do not recognise.

API keys

Trading bots and portfolio trackers often ask for exchange API keys.

  • Create keys with the minimum permissions needed. A portfolio tracker needs read-only access, never withdrawal rights.
  • Restrict keys to specific IP addresses where the exchange allows it.
  • Delete keys you no longer use.
  • Never paste API keys and secrets into unknown websites, bots or spreadsheets shared by strangers.

How much to keep on an exchange

Funds on an exchange depend on that company staying solvent, secure and willing to process withdrawals. Keep only what you are actively trading, and withdraw the rest to a wallet you control. See hot vs cold wallets.

Common exchange scams

  • Fake exchange websites from search ads and email links. Use your bookmark or the official app.
  • Fake "security team" calls saying your account is compromised and you must move funds to a "safe wallet". No exchange asks you to do this.
  • Fake support chats on social media. Use in-app support only.
  • Withdrawal to the wrong network. Not a scam, but a frequent loss: always choose the same network on both sides, and send a small test first.