Coinsbuy lost $8.07 million in under an hour on August 9, 2026. The attacker sent a 5 USDT test transaction first, confirmed the hot wallet keys were live, then drained eight TRON wallets and three Ethereum wallets before the exchange’s monitoring caught up. Eighteen days later, on August 27, Moonwell’s lending market on Base lost $8.7 million to an attacker who never touched a line of smart contract code — he just pumped the price of a thinly traded token and borrowed against the inflated collateral. Neither incident required breaking encryption. Both exploited gaps that a careful user or operator could have closed.

TRM Labs puts total crypto losses to hacks at more than $1.2 billion across roughly 276 incidents through the first eight months of 2026, with July alone accounting for about $247 million. Chainalysis separately reported that 2025 crypto theft reached $3.4 billion, with North Korea-linked actors responsible for roughly $2.02 billion of that figure, a 51% jump year over year. None of this is abstract risk. It’s the reason your exchange account, your API keys, and your withdrawal settings need the same level of scrutiny you’d apply to a production database credential.

This tutorial walks through hardening a crypto exchange account from the ground up: authentication, API key permissions, withdrawal controls, and the due-diligence checklist for judging whether an exchange itself is safe to hold funds on. You’ll build a working password-manager-backed setup, a TOTP-based 2FA flow, a scoped API key policy, and a monitoring script that flags suspicious account activity. Every step below is something you can complete in one sitting.

Prerequisites and what you’ll need

Before starting, gather the following. This tutorial assumes a Linux, macOS, or Windows machine with a terminal, and an account on a major centralized exchange (the steps generalize across Coinbase, Kraken, Binance, and similar platforms, though menu names differ slightly).

  • A password manager that supports TOTP storage separately from login credentials — 1Password 8.x, Bitwarden 2025.x, or KeePassXC 2.7.x all work
  • A hardware security key (FIDO2/WebAuthn), such as a YubiKey 5 series, OR a dedicated authenticator app (Aegis, Authy, or Google Authenticator) — not both on the same device you use to log in
  • Python 3.10 or newer, for the account-monitoring script in Step 10
  • The pip package manager and internet access to install requests and python-dotenv
  • A secondary email address used only for exchange accounts, not linked to your primary identity
  • 15–20 minutes per exchange account you’re hardening, plus about 20 minutes for the monitoring script

You do not need programming experience for Steps 1 through 9. Step 10 involves a short Python script; copy-paste is enough to follow along.

Step 1: Audit what’s actually on the exchange right now

Log into each exchange account you hold and write down three things: the balance, the linked email, and the linked phone number. This sounds trivial, but it’s the step people skip, and it’s the reason recovery after an incident takes days instead of minutes. Coinsbuy’s post-incident statement in mid-August 2026 said the exchange covered affected client losses from its own reserves, which meant users didn’t lose funds — but that outcome depended on Coinsbuy having accurate records of who held what before the attack. You want the same clarity on your side.

Open a spreadsheet or a note in your password manager (never a plain text file on your desktop) and log:

  • Exchange name and account creation date
  • Approximate balance by asset
  • Linked email and whether that email itself has 2FA enabled
  • Linked phone number and whether it’s used for SMS 2FA (flag this — you’ll fix it in Step 3)
  • Any active API keys and what they’re connected to

This audit typically takes 10 minutes per exchange and gives you a baseline to compare against if something looks wrong later.

Step 2: Separate your exchange email from your identity

If your exchange account uses the same email as your LinkedIn, your bank, or a data-breach-prone SaaS tool, an attacker who buys a leaked credential list doesn’t need to guess anything — they just try it against every exchange login page. Create a dedicated email address for crypto accounts only, one that has never appeared in a public breach and isn’t reused anywhere else.

Set this email up with its own strong, unique password stored in your password manager, and enable 2FA on the email account itself before you touch the exchange. An exchange account is only as secure as the inbox that receives its password-reset link. If your exchange email gets phished, the attacker resets your exchange password next, whitelist or not.

Step 3: Replace SMS 2FA with an authenticator app or hardware key

SMS-based two-factor authentication routes through the telecom SS7 signaling network and your mobile carrier’s account-recovery process, both of which are weaker than most people assume. SIM-swap attacks, where someone convinces or bribes a carrier employee to port your number to a new SIM, remain a recurring vector in individual account takeovers, precisely because they bypass SMS 2FA without needing to breach the exchange at all. Time-based one-time password (TOTP) apps and FIDO2 hardware keys don’t route through the phone network, so they’re not exposed to that attack surface.

Here’s how to switch from SMS to an authenticator app on most exchanges:

  1. Log into your exchange and go to Security Settings > Two-Factor Authentication
  2. Select “Authenticator App” (sometimes labeled TOTP or Google Authenticator) instead of SMS
  3. Scan the QR code with your chosen app — do this on a device separate from the one you’re using to browse the exchange, if possible
  4. Enter the six-digit code to confirm setup
  5. Save the backup/recovery codes shown at this step directly into your password manager’s secure notes, not a screenshot in your camera roll
  6. Return to the 2FA menu and explicitly disable SMS as a fallback option, if the exchange allows it

If your exchange supports FIDO2 hardware keys (Kraken, Coinbase, and Binance all do for at least some account tiers), register one as a second factor in addition to the authenticator app. Hardware keys resist phishing in a way TOTP codes can’t fully match, since the key checks the domain it’s talking to before it responds.

# Example: verifying a TOTP secret locally with Python before
# committing it to your password manager (never paste a real
# secret into a script or terminal you don't control)

pip install pyotp

python3 -c "
import pyotp
secret = 'JBSWY3DPEHPK3PXP'  # replace with your own base32 secret
totp = pyotp.TOTP(secret)
print('Current code:', totp.now())
print('Valid for the next', totp.interval, 'seconds')
"

Run this only to sanity-check that your authenticator app and a backup tool (like a password manager’s TOTP field) generate matching codes before you delete the original QR code image.

2FA methods compared: SMS vs. authenticator app vs. hardware key

Not every second factor offers the same protection, and the differences matter more than most account-setup wizards let on. Before you finish Step 3, it’s worth understanding exactly what each method defends against and what it doesn’t. The table below breaks down the three most common options you’ll find across major exchanges.

MethodResists SIM swapResists phishing relayWorks offlineRecovery difficulty if lost
SMSNoNoNo (needs signal)Easy (carrier resets it)
Authenticator app (TOTP)YesNoYesModerate (needs backup codes)
Hardware key (FIDO2/WebAuthn)YesYesYesHard (needs a spare key or backup codes)

The “resists phishing relay” column is the one people miss. A fake login page can capture your password and, if you’re using a TOTP app, prompt you to type your six-digit code directly into the fake site, which the attacker then relays to the real exchange in real time before the code expires. This is called an adversary-in-the-middle attack, and it defeats authenticator apps just as easily as it defeats SMS. A FIDO2 hardware key doesn’t have this weakness, because the cryptographic handshake is bound to the exact domain the key was registered against. A phishing clone running on a lookalike domain simply can’t complete the exchange, no matter how convincing the page looks.

That said, a hardware key isn’t strictly necessary for everyone. If your balance is modest and you’re diligent about checking URLs before logging in, an authenticator app combined with the anti-phishing code from Step 6 closes most of the practical gap. Reserve the hardware key requirement for accounts holding meaningful balances, or for any account with withdrawal or trading API access enabled.

Step 4: Lock down withdrawal addresses with a whitelist

A withdrawal whitelist (sometimes called an address book or trusted-address list) restricts outgoing transfers to a pre-approved set of wallet addresses. If an attacker gets past your login and 2FA, a whitelist stops them from redirecting funds to an address they control, because adding a new address typically triggers a mandatory delay and a separate confirmation, often 24 to 48 hours, sent to your verified email.

To set one up:

  1. Navigate to Security Settings > Withdrawal Address Management (naming varies by exchange)
  2. Add only addresses you control and can independently verify — paste from your own hardware wallet’s screen, not from a clipboard that could’ve been swapped by clipboard-hijacking malware
  3. Enable the “lock” or “global lock” option if offered, which prevents withdrawals to any address for a set window after a whitelist change
  4. Turn on email confirmation for every whitelist modification, even if it feels redundant
  5. Remove any old or unused addresses left over from previous transfers

This single control is one of the highest-leverage things you can do, because it converts a login compromise from “immediate total loss” into “a 24-to-48-hour window where you can still notice and react.”

Step 5: Scope and rotate your API keys

If you connect a trading bot, portfolio tracker, or tax tool to your exchange, you’re issuing an API key, and that key is a credential just like a password. The most common mistakes are granting withdrawal permission to a key that only needs read access, skipping IP whitelisting, and storing the key in plaintext in a config file that ends up in a git repository or a cloud notes app.

Set up API keys with the principle of least privilege:

  • Read-only by default. Only grant trading permission if the tool actually places orders, and only grant withdrawal permission if you have no alternative — most legitimate bots never need it
  • IP whitelist the key to the specific server or home IP that will use it, if your exchange supports this
  • Store keys in environment variables or a secrets manager, never hardcoded in a script
  • Rotate keys every 90 days and immediately after removing any third-party integration you no longer use
  • Name each key descriptively (“tax-tool-readonly-2026-08”) so a stale or unrecognized key is easy to spot during an audit
# .env file (add this filename to .gitignore immediately)
EXCHANGE_API_KEY=your_read_only_key_here
EXCHANGE_API_SECRET=your_secret_here

# Python: load credentials without hardcoding them
from dotenv import load_dotenv
import os

load_dotenv()
api_key = os.getenv("EXCHANGE_API_KEY")
api_secret = os.getenv("EXCHANGE_API_SECRET")

if not api_key or not api_secret:
    raise RuntimeError("Missing exchange API credentials in .env")

Check your .gitignore before your first commit. A leaked API key in a public repository is discovered by scanning bots within minutes, not days — even a read-only key can be used to map your entire trading history for social-engineering purposes.

Step 6: Set up anti-phishing codes and device recognition

Most major exchanges let you set a custom anti-phishing code, a short phrase that appears in every legitimate email the exchange sends you. If an email claiming to be from the exchange doesn’t include your code, it’s a phishing attempt, full stop. This closes a gap that 2FA alone doesn’t: a convincing fake login page can still capture your password and even relay a TOTP code in real time (an “adversary in the middle” attack), but it can’t forge the anti-phishing code without already having account access.

  1. Go to Security Settings > Anti-Phishing Code
  2. Set a phrase that’s not guessable from your public social media or username
  3. Enable device recognition or “new device login alerts” in the same settings area
  4. Review the list of currently trusted devices and remove any you don’t recognize or no longer use

Combine this with device/session review: log out of all sessions except your current one at least once a quarter, forcing any lingering unauthorized session to re-authenticate.

Step 7: Evaluate the exchange itself before depositing more funds

Personal account hardening only protects you from account-level compromise. It does nothing if the exchange’s own hot wallets get drained, which is exactly what happened to Coinsbuy. Before increasing your balance on any platform, run through a due-diligence checklist on the exchange’s own security posture.

SignalWhat to look forWhy it matters
Proof of reservesRegularly published, third-party attested, ideally Merkle-tree verifiableConfirms customer assets are actually held 1:1, not just claimed
Hot/cold wallet split disclosureExchange states what % of funds sits in cold storage vs. hot walletsCoinsbuy’s loss came entirely from hot wallets; higher cold-storage ratios limit blast radius
Incident historySearch “[exchange name] hack” and read how past incidents were disclosed and resolvedHow an exchange communicates during a breach predicts how it’ll treat you during the next one
Regulatory registrationLicensed or registered in a jurisdiction with actual enforcement (FinCEN MSB, FCA, etc.)Provides a legal backstop and audit requirement, though it’s not a guarantee
Withdrawal reliabilityTest a small withdrawal before depositing a large sumFrozen or delayed withdrawals are often the first visible sign of insolvency trouble
Bug bounty programActive program on HackerOne, Immunefi, or similarSignals ongoing external security testing rather than a one-time audit

None of these signals are individually sufficient. Moonwell’s exploit didn’t come from a broken smart contract or a missing audit — CertiK and PeckShield both confirmed the code itself worked as written, according to post-incident reporting. The attacker manipulated the price of an illiquid token, MAMO, used as collateral, then borrowed real assets against the inflated value. That’s a design and market-structure risk that a code audit alone wouldn’t have caught, which is why the checklist above spans governance and disclosure, not just technical review.

How security defaults differ across major exchanges

The steps in this tutorial generalize across platforms, but the defaults you land on out of the box vary quite a bit, and knowing where each exchange tends to fall short saves you from assuming a feature is on when it isn’t. Coinbase leans toward simplicity for mainstream users: 2FA is required, but withdrawal whitelisting and granular API scoping are less prominent in the standard interface and often require digging into advanced settings or the Coinbase Advanced Trade product to fully configure. Kraken has historically positioned itself around security-conscious traders, and its “Global Settings Lock” feature, which freezes changes to withdrawal addresses, 2FA, and email for a period you choose, is one of the more thorough implementations of the whitelist-lock concept described in Step 4. Binance offers the broadest set of individual controls, including device management, anti-phishing codes, and API IP whitelisting, but the sheer number of settings means it’s also the easiest platform to leave partially configured.

None of this is a recommendation to prefer one exchange over another purely on security grounds; fees, available markets, and regulatory footprint all factor into that decision too. It’s a reminder that “the exchange has 2FA” is not the same claim as “the exchange has the specific controls this tutorial walks through, turned on, by default.” Check each setting individually rather than assuming parity between platforms, and revisit the check whenever an exchange rolls out a UI redesign, since settings occasionally move or reset during major interface changes.

If you use more than one exchange, keep a simple record (in your password manager, alongside the audit from Step 1) of which controls are actually enabled where. It’s common to enable a whitelist on your primary trading account and forget to replicate it on a secondary account used only occasionally, which then becomes the weaker link an attacker targets first.

Step 8: Set withdrawal limits and cooling-off periods

Most exchanges let you cap the maximum amount withdrawable in a 24-hour window, independent of your actual balance. Setting this lower than your typical need means that even a fully compromised account with 2FA bypassed can only be drained up to your self-imposed ceiling before the exchange blocks further withdrawals until the next window.

  1. Go to Security Settings > Withdrawal Limits
  2. Set a daily cap close to what you’d realistically withdraw in a normal week, not your total balance
  3. If the exchange offers a “large withdrawal delay” (a manual review triggered above a threshold), enable it
  4. Combine this with the whitelist from Step 4 so limits and address controls reinforce each other

Raising the limit temporarily when you actually need a larger withdrawal takes two minutes. It’s a small friction cost for a meaningful reduction in worst-case exposure.

Step 9: Reduce your standing balance on any single exchange

The single most effective control isn’t a setting at all — it’s balance discipline. Exchanges are for trading, not long-term storage. Coinsbuy covered its users’ losses from company reserves, but that’s not guaranteed at every exchange, and it wasn’t guaranteed during the 2022 wave of exchange collapses either. Treat any centralized exchange balance as money you could lose entirely, and size your holdings there accordingly.

A reasonable rule of thumb used by many active traders: keep only what you need for open positions or upcoming trades on an exchange, and move the rest to self-custody. If you’re new to that process, a hardware wallet transfer takes about 15 minutes once set up. This tutorial focuses on exchange-side security, but the underlying principle is the same one that governs any custody decision: the party holding your keys is the party that ultimately decides whether you get your funds back.

Insurance coverage, where it exists, rarely closes this gap completely. Some exchanges carry limited crime insurance policies covering hot wallet theft up to a set cap, but these policies typically exclude losses from compromised individual accounts (as opposed to platform-wide breaches), and payout timelines can stretch to months while claims are investigated. Read the actual policy terms if an exchange advertises “FDIC insured” or “insured custody,” since in the US those labels frequently apply only to the cash-equivalent portion of a balance held with a banking partner, not to the crypto assets themselves.

Step 10: Build a lightweight account-activity monitor

Most exchanges expose a read-only API endpoint for account activity and balances. A small script that polls this endpoint and alerts you on unexpected changes catches problems faster than checking the app manually. This example uses a generic REST pattern; adapt the endpoint and authentication header to your specific exchange’s API documentation.

#!/usr/bin/env python3
"""
Minimal exchange balance monitor.
Polls a read-only balance endpoint and alerts on unexpected drops.
Requires: pip install requests python-dotenv
"""
import os
import time
import requests
from dotenv import load_dotenv

load_dotenv()

API_KEY = os.getenv("EXCHANGE_API_KEY")
BALANCE_URL = "https://api.example-exchange.com/v1/account/balance"
CHECK_INTERVAL_SECONDS = 300  # 5 minutes
DROP_THRESHOLD_PCT = 5  # alert if balance drops more than 5% between checks

def get_balance():
    headers = {"X-API-KEY": API_KEY}
    resp = requests.get(BALANCE_URL, headers=headers, timeout=10)
    resp.raise_for_status()
    data = resp.json()
    return float(data["total_usd_value"])

def alert(message):
    # Replace with a real notification: email, SMS gateway, or webhook
    print(f"[ALERT] {message}")

def main():
    last_balance = get_balance()
    print(f"Starting balance: ${last_balance:,.2f}")
    while True:
        time.sleep(CHECK_INTERVAL_SECONDS)
        try:
            current = get_balance()
        except requests.RequestException as e:
            alert(f"Balance check failed: {e}")
            continue
        if last_balance > 0:
            change_pct = ((last_balance - current) / last_balance) * 100
            if change_pct > DROP_THRESHOLD_PCT:
                alert(
                    f"Balance dropped {change_pct:.1f}% "
                    f"(${last_balance:,.2f} -> ${current:,.2f})"
                )
        last_balance = current

if __name__ == "__main__":
    main()

Run this with a read-only API key only, from Step 5. Wire the alert() function to a real channel (a Slack webhook, Twilio SMS, or a simple email via SMTP) so you’re not staring at a terminal. A 5-minute polling interval catches most unauthorized activity fast enough to act, without hammering the exchange’s rate limits.

Step 11: Prepare an incident response checklist before you need it

Write this down now, not during a panic. If you get an alert or notice unauthorized activity:

  1. Change your exchange password immediately from a device you know is clean
  2. Revoke all active API keys, even ones that look untouched
  3. Contact exchange support through the official app or verified URL, never a link from an email or DM
  4. Check whether your linked email has also been compromised, and secure it first if so
  5. Document timestamps and transaction hashes for anything already moved — this is what exchanges and, if needed, law enforcement will ask for
  6. Revoke device sessions from Step 6’s trusted-device list
  7. If a SIM swap is suspected, contact your mobile carrier’s fraud department directly, using a number you look up independently

Having this list ready shaves minutes off your response time, and minutes matter: forensic tracing of the Coinsbuy attack found most of the stolen funds moved through a non-custodial swap service and, in some cases, into Monero within the same hour the exploit began, which sharply cuts recovery odds the longer funds sit unmoved.

Step 12: Schedule a recurring security review

Security settings decay. A trading bot you forgot about keeps an API key active for months after you stopped using it. A whitelist address for an old cold wallet you migrated away from stays approved indefinitely. Put a recurring 15-minute calendar reminder, quarterly at minimum, to walk back through Steps 1, 5, 6, and 8: recheck the account audit, prune unused API keys, review trusted devices, and confirm withdrawal limits still match your actual usage.

This is the step most tutorials skip, and it’s the one that actually matters over a multi-year horizon. A security setup configured once and never revisited degrades exactly as fast as your memory of why you configured it that way in the first place.

Common pitfalls

  • Reusing your exchange password anywhere else. Credential-stuffing bots try leaked password lists against every major exchange login page automatically; a unique password neutralizes this entirely
  • Storing 2FA backup codes as a screenshot. Cloud photo backups are a common breach target; put backup codes in your password manager’s encrypted notes instead
  • Granting withdrawal permission to API keys “just in case.” Almost no legitimate bot needs it; unused permissions are pure downside
  • Skipping the whitelist because it’s “annoying” for frequent traders. The 24-48 hour delay only applies to adding new addresses, not withdrawing to already-approved ones
  • Using the same authenticator app profile across every exchange with no distinct labels. Makes it easy to approve the wrong prompt during a phishing attempt
  • Trusting an anti-phishing code that’s still the exchange’s default text. If you never customized it, it offers no protection
  • Ignoring small “test” withdrawals in your transaction history. A 5 USDT test transaction, like the one that preceded the Coinsbuy exploit, is a known reconnaissance pattern
  • Leaving old API keys active after switching trading tools. Revoke, don’t just stop using

Troubleshooting

  • TOTP codes are “invalid” even though I typed them correctly. Your device clock is likely out of sync. TOTP is time-based; enable automatic time sync in your phone or computer’s settings and try again
  • I lost my authenticator app and don’t have backup codes. Most exchanges require identity verification (a video call or document upload) to restore access without 2FA. This can take 24-72 hours, which is exactly why Step 3’s backup-code step matters
  • My withdrawal is stuck in the whitelist confirmation window. This is expected behavior after adding a new address; check your email (including spam) for the confirmation link, and wait out the cooling-off period rather than trying to bypass it
  • The exchange’s API is rejecting my read-only key with a permissions error. Double-check the key’s scope in the exchange dashboard; some platforms default new keys to zero permissions until you explicitly enable “read” access
  • My monitoring script (Step 10) throws a connection timeout. Check the exchange’s API status page first; rate limits or scheduled maintenance are more common causes than a code bug
  • I set an anti-phishing code but don’t see it in recent emails. Some transactional emails (password reset, in particular) are sent from a separate system that may not include the code; verify directly through the exchange’s app instead of the email link if in doubt
  • I can’t find a withdrawal address whitelist option on my exchange. Not all platforms offer this feature at all tiers; check if it requires a higher verification level (KYC tier 2 or 3)
  • My hardware key isn’t recognized by the exchange’s login page. Confirm the exchange supports FIDO2/WebAuthn specifically (not just U2F), and that your browser is current — older browser versions sometimes lack full WebAuthn support

Advanced tips

Once the twelve steps above are in place, a few additional measures push your setup further for larger balances or professional trading operations.

  • Use a dedicated hardware device for exchange access. A separate laptop or a hardened browser profile used only for trading reduces the chance that malware from unrelated browsing compromises your session
  • Split holdings across multiple exchanges by proof-of-reserves quality, rather than concentrating everything on whichever platform has the best trading fees
  • Set up a canary transaction. Keep a small, easily monitored balance you check daily as an early-warning trip wire before checking your main holdings
  • For API-driven trading, run the bot from a fixed IP (a VPS with a static address) so IP whitelisting in Step 5 is actually enforceable
  • Subscribe to the exchange’s official status and security-advisory channel (not a third-party Telegram group) so you learn about incidents from the primary source

Complete working setup: putting it together

Here’s the full account-hardening checklist as a single reference, plus the monitoring script from Step 10 combined into one file you can run end to end.

# requirements.txt
requests==2.32.3
python-dotenv==1.0.1
pyotp==2.9.0

# Directory layout
exchange-security/
├── .env                 # API keys, never committed
├── .gitignore            # must include .env
├── requirements.txt
├── verify_totp.py         # Step 3 sanity check
└── monitor.py             # Step 10 balance monitor

# .gitignore
.env
__pycache__/
*.pyc

# Setup
python3 -m venv venv
source venv/bin/activate      # Windows: venv\Scripts\activate
pip install -r requirements.txt
python3 monitor.py

Expected output when the monitor starts successfully:

Starting balance: $12,450.32
[ALERT] Balance dropped 8.2% ($12,450.32 -> $11,430.10)

An alert firing doesn’t always mean a breach — it could be a trade you placed and forgot about, or a withdrawal you made yourself. Treat every alert as a checkpoint to verify, not an automatic panic trigger, but never dismiss one without confirming the cause.

Recent 2026 exchange security incidents by the numbers

IncidentDateAmount lostRoot cause
Coinsbuy (TRON/Ethereum hot wallets)Aug 9, 2026~$8.07MHot wallet key compromise, coordinated cross-chain withdrawal
Moonwell (Base lending market)Aug 27, 2026~$8.7MOracle price manipulation of illiquid MAMO collateral
2026 year-to-date total (all incidents)Through Aug 2026$1.2B+276 incidents across exchanges and DeFi, per TRM Labs
2025 total crypto theftFull year 2025$3.4BIncludes ~$2.02B attributed to North Korea-linked actors, per Chainalysis

The pattern across both 2026 headline incidents is worth internalizing: neither was a cryptographic break. Coinsbuy was an operational security failure (hot wallet key exposure), and Moonwell was a market-design flaw (thin liquidity enabling price manipulation). The steps in this tutorial address the account-level equivalent of both failure modes — credential and key hygiene, plus judgment calls about where you concentrate risk.

Frequently asked questions

Is an authenticator app enough, or do I need a hardware key too?

An authenticator app is a significant upgrade over SMS and covers most individual users adequately. A hardware key adds phishing resistance an app can’t fully match, since it verifies the website’s domain before responding. For balances you’d consider a serious loss, use both where the exchange supports it.

How often should I rotate my exchange password?

There’s no fixed schedule that beats using a strong, unique, randomly generated password stored in a password manager and changing it only after a suspected exposure (a data breach notification, a phishing attempt, or unusual account activity). Frequent forced rotation without cause tends to produce weaker passwords, not stronger ones.

Does a withdrawal whitelist slow down my ability to trade?

No. The delay only applies when you add a brand-new address. Withdrawals to addresses already on your whitelist process normally, with no added friction for routine activity.

What’s the difference between proof of reserves and an audit?

Proof of reserves verifies that an exchange holds enough assets to cover customer balances at a specific point in time, often using a cryptographic Merkle-tree method so individual users can confirm their balance is included. A security audit reviews code and infrastructure for vulnerabilities. Both are useful; neither alone is a complete guarantee, since proof of reserves is typically a snapshot, not continuous monitoring.

Should I keep funds on an exchange at all?

For active trading, yes, in amounts sized to what you’re actively using. For long-term holding, self-custody with a hardware wallet removes exchange counterparty risk entirely, at the cost of taking on full responsibility for your own key management.

Can API key permissions be changed after the key is created?

On most exchanges, no — you need to revoke the existing key and generate a new one with the correct scope. This is a good reason to default to minimal permissions from the start rather than granting broad access and planning to restrict it later.

What should I do first if I suspect my account is compromised?

Change your password from a device you trust, revoke all API keys, and contact exchange support through the official app rather than any link in an email. Follow the full checklist in Step 11 above, and do it immediately rather than trying to investigate the cause first.