Exchange and API security
Lesson 9 of 39 in the course “Crypto”. Free, with animations and a quiz.
Lock down your account
Three basics from the picture. 2FA, a second code at login, through an authenticator app rather than SMS. A long, unique password: if you reuse one password, a leak on one site opens all of them. An anti-phishing code: a word the exchange puts in its emails so you can tell them from fakes. Set all this up on day one.
Why not SMS
An authenticator app creates a new code every 30 seconds right on your phone, like 482 913 in the picture. An SMS code is weaker: a scammer can get your SIM card reissued to themselves (a SIM swap) and receive your codes. And remember phishing: a copied site steals your password, so go in from a bookmark and upload KYC documents only on the official site.
Withdrawals only to your addresses
A withdrawal whitelist is a list of addresses the exchange will let you send coins to. You add only your own wallets in advance. If the account is hacked, the thief cannot instantly withdraw to their address: they would have to add a new one, which needs 2FA and often a waiting period. Spoiler: this is one of the most useful settings.
A delay for new addresses
The picture shows how it works. The whitelist holds only your addresses. A new address often goes live only after a delay, for example 24 hours, and needs a 2FA code. That gives you time to spot a stranger's login and freeze the account. When adding an address, check its start, end and network: malware swaps copied text.
API keys: minimum rights
An API key is a password that lets a bot or service operate your account without logging in to the site. The exchange holds your coins, as the picture shows, so a key with withdrawal rights equals access to your money. Grant read-only rights and an IP restriction, meaning it only works from the bot's server address. Never allow withdrawals. Keep keys out of chats and screenshots.
Check yourself
- Which 2FA is safer?
Correct answer: An authenticator app. SMS can be intercepted through a SIM swap. An app code is generated right on your phone and never passes through the carrier. - What rights should an API key for viewing trades get?
Correct answer: Read only. Viewing only needs read rights. Withdrawal rights would turn a leaked key into access to your money. - What does a withdrawal whitelist give you?
Correct answer: Withdrawals only to your addresses. Even after a hack, the thief cannot send coins to their address right away: a new address needs 2FA and often a delay.
← Scams and phishing: stay safe Crypto taxes: painless records →