Secure the email account tied to your exchange, use unique passwords, choose phishing-resistant sign-in where available, and add withdrawal controls before moving significant funds. Then make a habit of checking account access and acting quickly on unfamiliar activity. The steps below focus on account takeover, phishing and unauthorized withdrawals; exact controls vary by exchange and can change.
1. Secure the email account linked to your exchange
Your inbox may receive login alerts and account-recovery messages, and may be used to reset your exchange password. If someone can access it, exchange protections may be easier to bypass.
- Use a unique email password stored in a password manager.
- Enable the strongest sign-in method your email provider offers and protect the account’s recovery options.
- Review the email account’s active sessions and recovery addresses or phone numbers; remove anything you do not recognize.
Both Kraken’s security guidance and Coinbase’s account-security guidance emphasize protecting the email account associated with an exchange.
2. Set a unique exchange password
Generate a password that you do not use anywhere else, and store it in a reputable password manager rather than relying on memory or reusing a familiar phrase. Kraken recommends at least 15 characters; that is Kraken-specific guidance, not a universal rule for every exchange. Coinbase sets its own password requirements. Check the current rules for your account when creating or changing a password.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
A password manager also reduces the temptation to reuse a password across your email, exchange and other services. Kraken and Coinbase both recommend using one to create or store unique passwords in their respective help materials.
3. Choose a strong sign-in method
Where the exchange supports them, passkeys and hardware security keys are preferable to methods that rely on entering a code into a potentially fake sign-in page. The platforms cited here recommend passkeys or security keys, but availability and the actions each method protects differ by exchange.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
| Method | What to consider |
|---|---|
| Passkey or security key | Kraken describes passkeys as phishing-resistant; Coinbase recommends a security key or passkey for two-step verification, and Binance lists passkeys and security keys among account-security options. Confirm that your exchange supports the method for the sign-in and sensitive actions you need, and that your devices are compatible. |
| Authenticator app | An option in some exchange flows. Keep backup or recovery material somewhere secure and offline. If codes are synced across devices, consider the consequences of losing access to the account that controls that sync. |
| SMS | May be offered as a fallback, but Kraken’s guidance treats it as weaker than stronger authentication options. Use it only with an understanding of the exchange’s alternatives and recovery process. |
Before changing methods, find out how the exchange handles lost devices and account recovery. A robust sign-in method is less useful if its only backup is an unsecured inbox or a recovery route you have not protected.
For current platform-specific options, see Kraken’s security page, Coinbase’s account-security guidance and Binance Academy’s account-security checklist, updated June 26, 2026.
Recommended Free Tools
4. Protect withdrawals and account changes
Use an address allowlist if the exchange offers one
An address allowlist limits withdrawals to destinations you have approved, but the setup rules are platform-specific. Coinbase says that when allowlisting is enabled, newly added addresses have a 48-hour hold. Its help page also describes an initial window after enabling the feature that can affect setup. Read the current instructions in your account before relying on the control or planning a transfer.
Approve only addresses you control and have checked carefully. A delay can create time to respond to a compromised account, but an allowlist is not a substitute for securing sign-in and recovery methods.
Rank #4
Check what withdrawal two-step verification actually protects
Do not assume a withdrawal code prevents someone from changing the destination address. Kraken explicitly warns that funding two-step verification does not stop a user or attacker from adding a withdrawal address. Check whether your exchange applies verification to adding or changing addresses, withdrawals, or both.
Coinbase’s allowlist details are in its address allowlisting instructions. Kraken explains its funding verification limits in funding 2FA guidance.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
5. Make phishing and fake support harder to pull off
- Open the exchange using a bookmark you created or its official app; avoid sign-in links in unexpected messages or search ads.
- Never share your password or verification codes with someone claiming to be support.
- Do not install remote-access software because a stranger asks you to, and do not transfer cryptocurrency to an address supplied by someone offering help.
- Pause when a message creates urgency. Reach support through the exchange’s official help center rather than replying to the message.
Coinbase says its staff will not ask for passwords, two-step verification codes, remote access, or a transfer to a specific address. It states: “Coinbase staff will never ask you to send cryptocurrency to external addresses.” See Coinbase’s phishing guidance and Coinbase’s scam-prevention guidance.
6. Review access and respond to warning signs
Check the exchange’s account-security area periodically for active sessions, recognized devices, connected apps and security alerts. Revoke sessions or access you do not recognize. Keep alerts enabled so an unfamiliar login or account change is less likely to go unnoticed.
If you see an unauthorized login or suspect an account takeover, act promptly:
- Use the exchange’s official app or help center to follow its compromised-account instructions.
- Change the exchange password and the password for the linked email account, using new unique passwords.
- Review sessions, devices, connected apps, recovery details and withdrawal addresses; revoke or remove unfamiliar entries where possible.
- Contact support through the official help center, not through contact details supplied in an unsolicited message.
Kraken, Coinbase and Binance each provide platform-specific security guidance; use the instructions for the exchange where your account is held rather than assuming that one platform’s recovery steps apply to another.
Before you rely on any control
- Confirm that your email and exchange passwords are unique and that both accounts have protected recovery paths.
- Verify which sign-in methods your exchange supports, what they protect, and how to recover access if a device is lost.
- Read the exchange’s current allowlist and withdrawal-verification rules, including any holds or setup windows.
- Save the official help-center route and know where to review sessions and security alerts.
Exchange interfaces and account rules change. Kraken’s security page reports an update of September 30, 2026, and Binance Academy’s checklist reports an update of June 26, 2026; publication dates were not established for the cited Coinbase pages or Kraken funding-2FA page. Verify current controls in your own account before depending on them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
