Most crypto losses are not caused by exchange hacks — they come from phishing, weak passwords and scams. These ten steps make your account much harder to attack.
1. Use a unique, strong password
Use a password manager to create a long, random password that you use nowhere else.
2. Turn on app-based 2FA
Use an authenticator app (such as Google Authenticator) or a hardware key instead of SMS codes, which can be stolen through SIM-swap attacks. Back up your 2FA recovery key offline.
3. Set an anti-phishing code
Exchanges such as Bitunix and MEXC let you set a personal code that appears in every genuine email. If an email does not show your code, it is fake.
4. Enable a withdrawal address whitelist
With a whitelist, funds can only be withdrawn to addresses you approved in advance — often with a 24-hour delay for new addresses.
5. Bookmark the official website
Always open the exchange from a saved bookmark or the official app. Fake sites copy logos exactly and are often promoted through ads and Telegram messages.
6. Never share API keys with withdrawal permission
If you connect a trading bot, create API keys with trading only permission and restrict them to the bot's IP address.
7. Ignore "support" in private messages
Real exchange support will never message you first on Telegram or WhatsApp or ask for your password, 2FA code or seed phrase.
8. Complete KYC early
Verifying your identity before you need to withdraw avoids your funds being locked at a stressful moment.
9. Keep long-term savings in your own wallet
Keep only active trading capital on an exchange. Store long-term holdings in a hardware wallet whose seed phrase only you control.
10. Do not use a VPN to get around restrictions
Using a VPN to access an exchange that does not serve your country breaks its terms and can lead to frozen withdrawals. Check our country guides to find exchanges that accept you.
