How to Secure Your Exchange Account: 2FA, Withdrawal Whitelists and Phishing Protection
with ArbitrageScanner!
How to Secure Your Exchange Account: 2FA, Withdrawal Whitelists and Phishing Protection
Securing an exchange account means closing every shortcut to your money. A password alone does not close them; what matters is the second factor, withdrawal restrictions and habits.
Below is a settings checklist, a threat table and a plan of action in case a shop or service leaks its customer database.
Why securing accounts matters especially for arbitrage traders
A typical investor keeps money on one or two exchanges. An arbitrage trader spreads balances across many venues to close trades simultaneously.
Each exchange is a separate door. From what we see, attackers usually go after the weakest account, not the largest: the one that still has SMS protection or an old API key with withdrawal rights.
Which 2FA to choose on an exchange: SMS, an app or a hardware key
SMS is the weakest second factor. A number can be reissued to someone else's SIM card, and then the codes go to the attacker.
An authenticator app is more reliable because the codes are generated on your device. A hardware key is even better: it only confirms a login on the real exchange website, so a phishing copy will not get the code.
In our view, a sensible minimum is an authenticator on every exchange and a hardware key wherever most of your capital sits. It is best to disable SMS as a second factor wherever possible.
Crypto exchange account security checklist
- a hardware key or authenticator app instead of SMS
- a withdrawal address whitelist, with new addresses added only after confirmation
- an anti-phishing code in the exchange's emails
- a separate email used only for exchanges and not exposed anywhere else
- API keys without withdrawal rights and bound to an IP address
- a unique long password for each exchange via a password manager
- regular checks of active sessions and devices
How to set up a withdrawal address whitelist
A whitelist is a list of addresses the exchange allows withdrawals to. Anything not on the list cannot be sent.
On many exchanges, adding a new address requires confirmation and triggers a withdrawal delay. If someone gains access to the account, you will have time to notice the email and freeze withdrawals.
It is convenient for an arbitrage trader to add the deposit addresses of their own exchanges on the networks they need. Then daily transfers go through without extra steps, while someone else's address cannot be added so easily.
What an anti-phishing code is and why you need it
An anti-phishing code is a phrase you set in your settings. The exchange inserts it into all of its emails.
If an email "from the exchange" arrives without your phrase, it is a fake. Do not open links from such an email.
How to set up API keys securely
An API key is a separate entry point into your account for software. We believe this is where forgotten holes are most often left.
A key almost never needs withdrawal rights. It is worth binding the key to specific IP addresses and deleting old keys for services you no longer use.
Threats and defenses: what protects against what
Threat | What it looks like | Defense |
SIM swap | SMS codes go to a stranger | authenticator or hardware key |
Phishing site | a copy of the exchange asks for your login and code | hardware key, bookmarks instead of links |
Fake email | a request to urgently confirm a withdrawal | anti-phishing code |
Email hack | password reset via email | a separate email with its own 2FA |
API key leak | someone else's software trades or withdraws | key without withdrawals, IP binding |
Account takeover | an attempt to withdraw to a new address | whitelist and delay on new addresses |
What to do if a shop or service leaks its customer database
A recent example is the hardware wallet shop Keystone. The company reported unauthorized access to its web store: names, contact details, shipping addresses and order information leaked, but not keys or recovery phrases.
Users were warned about phishing. Your coins are not directly affected by such a leak, but scammers now know for sure that you hold crypto and which device you bought.
- do not respond to emails, calls or messages about an "urgent wallet update"
- never enter your recovery phrase anywhere for anyone; no service asks for it
- change the password for the email used in the order and check its 2FA
- check whether the same email is used on exchanges
Hypothetical example: what one weak door costs
The numbers are hypothetical. An arbitrage trader holds 12,000 USDT across six exchanges, 2,000 USDT on each.
Five exchanges have an authenticator and a whitelist, while the sixth has only SMS and an old API key with withdrawal rights. 2,000 USDT, a sixth of the capital, is under real threat, even though five accounts are well protected.
An hour spent setting up the sixth exchange closes this hole. Account security is only as strong as its weakest link.
Our tools
The less time you spend manually hunting for price gaps across exchanges, the more you have left to keep your accounts in order, and all venues are easier to keep in one window. Our arbitrage screener keeps dozens of venues in one window, refreshes quotes every second and shows each gap together with the volume actually behind it. The spread calculator helps you check what survives fees, network costs and slippage at your size. The bot is fully manual. It never connects to your exchange API keys.
To test the tools on a live market, ArbitrageScanner offers one day of free access to the whole ecosystem.
FAQ (Frequently Asked Questions)
1. Which two-factor authentication is best for an exchange?
A hardware key or an authenticator app. SMS is the weakest option because of the risk of a SIM swap.
2. What is an address whitelist on an exchange?
It is a list of addresses that withdrawals are allowed to. Funds cannot be withdrawn to any other address, and adding a new one usually requires confirmation.
3. What is an anti-phishing code?
A phrase the exchange inserts into all of its emails. An email without it is a fake.
4. Should an API key have withdrawal rights?
Almost never. It is better to create the key with only the permissions you need and bind it to IP addresses.
5. What should I do if the shop where I bought my wallet was hacked?
Expect phishing: do not follow links in emails, never enter your recovery phrase for anyone, and change the password for the email used in the order.
6. Can I secure my exchange account with just a password?
No. You need a second factor, an address whitelist and a separate email, otherwise the password remains the only barrier.
Conclusion
Exchange account security is built from several layers: a hardware key or authenticator instead of SMS, an address whitelist, an anti-phishing code, a separate email and API keys without withdrawal rights.
For an arbitrage trader with money on many exchanges, it is especially important not to leave weak accounts. Attackers go for the easiest door, so check the settings on every venue, and if a shop or service leaks data, expect phishing right away.
IMPORTANT! We are software developers. We do not give recommendations or promises of earnings and we do not advise you to invest your money anywhere. Our software is fully manual, all your money stays under your own control. We show examples of how our clients have earned on arbitrage in the past, but we do not advise repeating those actions one to one. Your earnings depend solely on your own actions and on market factors.
Want to learn more about crypto arbitrage?
Get a subscription and access the best tool on the market for arbitrage on Spot, Futures, CEX, and DEX exchanges.
