Exchange Account Security Checklist

Even if most of your holdings live in self-custody, almost everyone keeps an exchange account for buying, selling, and cashing out — and that account deserves deliberate hardening, not default settings. The features that matter most are the ones that slow down withdrawals: address allowlists, withdrawal delays, and tightly scoped API keys. This guide is a working checklist for the account itself; choosing strong 2FA and recognizing phishing are covered in their own guides in this path.

Start With the Account Foundations

Before touching exchange-specific features, get the basics to a known-good state:

• Unique password from a password manager. 20+ random characters, used nowhere else. Credential-stuffing — trying passwords leaked from other sites — is still the cheapest attack there is, and exchange logins are exactly what stuffing lists get tested against.
• A dedicated email address used only for exchange accounts. It cuts phishing exposure (any exchange email arriving at your normal address is fake by definition) and keeps your exchange relationship out of ordinary breach datasets.
• Strongest available 2FA on both the exchange and that email account, with SMS removed from login and recovery flows. The details of why are in the 2FA guide; for the checklist's purposes: if the exchange supports hardware security keys, use them.
• Kill old sessions and devices. Every major exchange has a page listing active sessions and authorized devices. Revoke everything you don't recognize, and make a habit of checking it monthly. Also review which third-party apps have OAuth or API access and remove anything stale.

Withdrawal Allowlists: The Highest-Value Setting

A withdrawal address allowlist (some exchanges call it a whitelist or address book lock) restricts crypto withdrawals to addresses you approved in advance — typically your own hardware wallet. Crucially, adding a new address triggers a waiting period, commonly 24-48 hours, during which withdrawals to it are blocked and you get notified.

This one setting changes the economics of nearly every attack. An intruder who fully compromises your login and 2FA still cannot move funds anywhere except to your own wallet. To steal, they must add their address and then hope you ignore the alert emails for two days. For a concrete sense of scale: an account holding $30,000 with no allowlist can be emptied in the five minutes after a successful phishing session; with an allowlist and a 24-hour add delay, the same attacker gets nothing unless they can also suppress your email for a day — which is why the dedicated, hardware-key-protected email matters.

Turn it on, add your self-custody addresses while things are calm, and accept the inconvenience: if you spontaneously need to withdraw somewhere new, you wait. That friction is the feature working. Pair it with a global withdrawal lock or delay if your exchange offers one, and set daily withdrawal limits to the lowest value compatible with how you actually use the account.

Anti-Phishing Codes and Notification Hygiene

Most large exchanges let you set an anti-phishing code: a short phrase you choose (say, mango-vault-73) that the exchange includes in every genuine email it sends you. Mass phishing emails can fake logos and sender names, but they cannot know your personal code — so "urgent security notice" emails missing the code identify themselves as fraud. Set one; it costs thirty seconds.

Then make sure the exchange can actually reach you when it matters:

• Enable notifications for logins from new devices, password and 2FA changes, address-list changes, and withdrawals. These alerts are your tripwire during the allowlist delay window.
• Read them when they arrive. An alert system you've trained yourself to ignore is decoration.
• Know the real support channel. Attackers monitor social media for people complaining about exchange problems and swoop in as "support." Real exchange support never DMs you first, never asks for your seed phrase (exchanges don't have seed phrases to recover), and never asks you to install remote-access software.

API Keys: Scope Them Like They're Money

If you use trading bots, portfolio trackers, or tax software, you'll create API keys — and unscoped API keys are one of the most common ways accounts bleed. Rules:

• Grant the minimum permission set. A portfolio tracker needs read-only. A trading bot needs read + trade. Almost nothing legitimate needs the withdrawal permission — leave it disabled unless you have built something yourself that genuinely requires it and you understand the blast radius.
• IP-restrict every key to the server or home IP that uses it, if the exchange supports it. A leaked key that only works from your bot's IP address is nearly worthless to a thief.
• One key per application, named clearly, so you can revoke a single integration without breaking the others.
• Rotate and prune. Delete keys for services you stopped using; treat a key that's been in a third-party dashboard for two years as leaked until rotated.

Note the interaction with allowlists: on most exchanges, even a key with withdrawal permission can only withdraw to allowlisted addresses. Defense in depth means an attacker must defeat both.

Limit What's There to Steal

The final control is the oldest one: exposure. An exchange account is a claim on a company, not coins in your pocket — its contents are exposed to your credential security and to the exchange's solvency and internal controls, a history covered in the self-custody guide of this path.

Practical policy for an active trader: decide the maximum you're willing to have on-exchange (for many people, whatever they actively trade plus near-term spending — say 10-20% of holdings), sweep profits above that line to cold storage on a schedule, and spread across two exchanges if your balance is large enough that a single account freeze — which can happen for compliance reviews even when you've done nothing wrong — would disrupt your life. Withdrawals to your own allowlisted wallet also double as a recurring test that your exit route actually works.

The Checklist

Run through this today, then re-run it quarterly:

1. Unique manager-generated password; dedicated email; hardware-key or TOTP 2FA on both; SMS removed everywhere possible.
2. Withdrawal address allowlist ON, containing only your own verified addresses; new-address delay confirmed; daily withdrawal limit set low.
3. Anti-phishing code set; alerts enabled for logins, security changes, and withdrawals.
4. Active sessions, devices, and connected apps reviewed; everything unrecognized revoked.
5. API keys: minimum permissions, IP-restricted, one per app, withdrawal permission off, stale keys deleted.
6. On-exchange balance within your predefined ceiling; excess swept to self-custody.

None of these steps requires technical skill — only the decision to spend one focused hour before an attacker spends one on you.

Key Takeaways

• The withdrawal address allowlist with a new-address delay is the single most valuable exchange setting: even a fully compromised login can then only send funds to your own wallet.
• Use a dedicated email plus an anti-phishing code so genuine exchange emails are verifiable and everything else is presumed fraud.
• Scope API keys ruthlessly: minimum permissions, IP restrictions, one key per app, and almost never the withdrawal permission.
• Alerts and session reviews are your tripwires — enable them, read them, and revoke anything you don't recognize.
• Cap what you keep on-exchange and sweep the rest to self-custody; the cheapest asset to defend is the one that isn't there.