A working exchange account security checklist rests on three controls: a unique password kept in a manager, phishing-resistant two-factor authentication, and withdrawal allowlists backed by address verification. Device hygiene, API key scoping, and session monitoring matter, but they sit on top of that foundation. If you hold tokenized T-bills or other real-asset tokens on a centralized venue, treat the setup as permanent infrastructure. Those positions are meant to be held for months or years, which gives an attacker far more time to find a gap than a day-trader's account ever allows.
Fix the login layer before you touch the trading screen
Most people configure their account once, at signup, and never reopen the settings page. That is where trouble starts. Access control deserves the same periodic review you would give a rental property's insurance policy: dull, scheduled, and worth the hour.
Passwords and password managers
One credential per exchange, never reused. A manager such as Bitwarden or 1Password will generate a 20-plus character string you cannot memorize, which is the point. If you are typing your exchange password from memory, assume it exists in some breach dump alongside your email address.
Two-factor authentication that resists phishing
SMS codes fall to SIM-swap attacks. Authenticator apps are better but can still be phished in real time by a convincing fake login page. Hardware security keys (FIDO2) and passkeys close that gap because they bind to the domain, so a lookalike site gets nothing. Check whether your venue supports them; many now do. Enable every backup method the exchange offers, then write recovery codes on paper and store them offline, not in your email inbox.
Lock down withdrawals and addresses
This is where losses actually happen. Account takeover is bad. Account takeover with an open withdrawal path is how people lose everything in a single evening.
Allowlists and time locks
Turn on a withdrawal address allowlist so funds can only leave to addresses you pre-approved. Pair it with the exchange's withdrawal time lock, a delay between request and execution. A 24-hour hold gives you a window to cancel a transfer you did not initiate.
A scenario worth internalizing
Suppose you hold roughly $40,000 in tokenized short-term Treasuries on a centralized exchange. An attacker phishes your session cookie, logs in, and tries to move the position to a wallet they control. With an allowlist active, the withdrawal fails outright. Without one, and without a time lock, the balance is gone before you finish dinner. Two settings decide the outcome.
Harden the devices and networks you log in from
Your account is only as strong as the machine you open it on. A handful of habits cover most of the risk:
- Keep the exchange app and browser updated; patched vulnerabilities are the cheapest security you will ever get.
- Skip exchange logins on public Wi-Fi, or route through a trusted VPN if you have no choice.
- Reserve one browser profile or device for financial accounts and nothing else.
- Log out of sessions on shared machines and review active sessions monthly.
- Never screen-share, paste, or type seed phrases or 2FA codes into a chat window.
None of that is glamorous. It is also the difference between a nuisance and a loss.
Scope API keys and review account activity
Trading bots, portfolio trackers, and tax tools all need API keys, and each key is a door into your account. Treat every one as if it were a password, because functionally it is.
API key hygiene
Grant the minimum permissions; read-only if that is all the tool needs. Disable withdrawal permission on every key unless there is a specific, documented reason. Set IP allowlists where the exchange supports them, and delete keys when a tool stops being useful rather than leaving them dormant.
Monitoring and alerts
Turn on email and push alerts for logins, password changes, and withdrawals, then actually read them. A five-minute monthly review of login history and connected apps catches drift before it becomes an incident.
| Control | Effort | Risk it removes |
|---|---|---|
| Hardware 2FA key | Low | Phishing and SIM swap |
| Withdrawal allowlist | Low | Unauthorized transfers |
| Withdrawal time lock | Low | Fast exfiltration |
| Read-only API keys | Medium | Third-party tool abuse |
| Session review | Low | Stale or hijacked logins |
Frequently asked questions
Is SMS 2FA good enough for an exchange account?
For small balances, it beats nothing. For anything meaningful, no. SIM-swap attacks are common and well-documented, and a determined attacker can relay SMS codes in real time. Move to an authenticator app at minimum, and to a hardware key or passkey if your exchange supports it.
Should I keep tokenized real-asset holdings on an exchange at all?
Exchanges are convenient for trading and sometimes for earning, but they are custodial, which means you are trusting a counterparty with your assets. Long-term positions are often better held in self-custody where the token and network support it. If you do keep balances on a venue, this checklist matters more, not less.
How often should I review these settings?
Do a full pass when you open the account, then quarterly. Re-check immediately after any suspicious email, any new device login, or any change to the tools connected to your account.
What is the single highest-impact step?
Withdrawal controls. A hardware key stops most takeovers, but an allowlist plus time lock limits the damage even if someone gets in. Do both.
Open your exchange's security settings now and confirm three things: hardware or app-based 2FA is active, a withdrawal allowlist exists, and a time lock is enabled. If any of the three is missing, fix it before you close the tab.