1. Start with email and devices
Email often handles alerts and recovery, so protect it before the exchange account. Use a unique password and additional authentication where offered. Review connected devices and recovery methods: control of that inbox can enable attempts to change other accounts without the trading password.
Keep browsers, operating systems and apps updated. Install the exchange app through its official channel and avoid unnecessary extensions on the device used for trading. Encryption and a browser padlock do not establish that a site is authentic: a fake page can also use HTTPS.
2. Use a unique password and a known entry point
Create a long, unreused password and keep it in a manager you can recover securely. Do not email it or store it in a shared note. The aim is to prevent a breach at another service from also handing over your financial account.
Bookmark the official domain and inspect destinations from search results or messages. Watch for changed letters, deceptive subdomains and support advertisements. A password manager refusing to autofill can reveal a domain mismatch, but does not replace checking where you are.
3. Enable a supported passkey or second factor
FIDO2 passkeys are bound to the service and resist phishing pages trying to capture codes. Available options depend on the exchange, browser and device. Kraken documents passkeys and authenticator apps, for example; this does not mean all platforms offer the same combination.
If you use temporary app codes, do not enter them through chat links or give them to support. They can be captured and used while valid. Also check which actions a factor protects: sign-in, settings changes and withdrawals can have different controls.
4. Plan recovery without making it easy for others
Keep recovery codes and backups separate from the device they depend on. If several authentication factors are allowed, consider a backup and confirm that you can use it before an emergency. Do not send a full set of secrets to an unprotected inbox merely for convenience.
Distinguish exchange-account recovery from a wallet seed phrase. An agent does not need your seed to investigate a bank deposit or a sign-in code to handle a ticket. If you enable a lock with a waiting period, understand its unlock process and which recovery method can override it.
5. Add useful withdrawal protections
Where offered, address allowlists and settings locks can make withdrawal to a new destination harder after a compromise. Check activation delays and change notifications. Kraken’s Global Settings Lock is a specific example, not a rule you can assume at every exchange.
For each withdrawal, compare address, network and memo with the recipient instructions, even for saved destinations. Use a test exceeding minimums when the route is new and the added cost makes sense. See transferring between exchanges for the process rather than assuming clipboard contents are always trustworthy.
6. Limit sessions, bots and API keys
Depending on permissions, an API key may read balances, trade or withdraw. Read-only access limits what a portfolio tool can do, but the shared information remains sensitive. For a trading bot, question whether withdrawals are actually required rather than enabling them for convenience.
Remove unused keys, restrict IPs where supported and review unfamiliar sessions. The LBank review describes its API as a product; opening an account or reading a review does not require connecting one. Neither does using a platform comparator.
7. Recognise requests you should not fulfil
Someone claiming to be staff who requests a 2FA code, remote access, a payment to unlock funds or a wallet connection presents a concrete risk. Do not continue through their link: independently open official support and verify the issue there.
Urgent messages about a blocked account, unexpected deposit or reward can push you to skip checks. Inspect activity directly. For a first BTC purchase or euro bank withdrawal, complete authentication within the provider instead of sending codes to another person.
If you suspect compromise
Use a device you consider safe, enter through the official channel and use available account-lock or urgent-support options. Secure email, review sessions, revoke suspicious keys and change credentials through the provider’s process. Preserve dates, alerts and transaction identifiers instead of deleting evidence to tidy the history.
Avoid hurriedly moving funds from a device that may remain compromised or accepting a recovery service offered by message. Afterwards identify the failed control and test your recovery access. A periodic review of devices, factors, addresses and permissions is more useful than accumulating unfamiliar tools you never check again.
