If someone gets into your crypto exchange account and sends your coins to their own wallet, there is usually no bank to call and no way to reverse the transfer. The US Federal Trade Commission warns that cryptocurrency payments generally cannot be reversed and typically lack the dispute process that card payments have. That makes the security of your exchange login, your phone number and your withdrawal settings far more important than for most online accounts. This guide explains, in plain English, how exchange accounts are taken over and the settings that stop it: passkeys and security keys, withdrawal address allowlists, anti-phishing codes, protection against SIM swaps, safe use of API keys and what to do if your account is hacked. It is for anyone who holds crypto on an exchange, and for the support and security staff who advise them. How exchanges secure their own systems and keys is a different subject, covered in the Crypto Exchange Identity and Key Security Guide. This page names no exchange; feature names vary, so look for the equivalent setting in your exchange's security menu.
Key takeaways
- Replace SMS codes with a passkey or security key. CISA ranks SMS and voice codes as the weakest form of multi-factor authentication because of phishing and SIM swap attacks; FIDO passkeys resist phishing by design.
- Turn on a withdrawal allowlist. Limiting withdrawals to addresses you saved in advance, ideally with a waiting period for new ones, stops a thief who gets into your account from emptying it immediately.
- Protect your phone number as if it were a password. Add a carrier account PIN or port lock, and remove your phone number as a recovery method where the exchange allows it.
- Treat every unexpected call or message as a scam. Criminals use leaked customer data to pose as exchange support; no genuine support agent will ask you to move funds or read out a code.
- Keep only what you trade on the exchange. Long-term holdings are safer in a wallet you control, set up carefully.
How exchange accounts get taken over
Most exchange account thefts follow one of a handful of routes. Knowing them tells you which settings matter.
| Attack | How it works | What stops it |
|---|---|---|
| Phishing site or email | A fake login page captures your password and the one-time code you type, and the attacker uses them immediately | Passkey or security key (will not work on a fake site); anti-phishing code in emails; bookmarking the real site |
| SIM swap | The criminal convinces or bribes your mobile carrier to move your number to their SIM, then receives your SMS codes and password reset texts | No SMS for sign-in or recovery; carrier PIN or port lock; watch for sudden loss of signal |
| Fake support calls | Someone posing as the exchange's fraud team says your account is at risk and talks you into moving funds to a "safe" wallet or reading out codes | Never act on inbound calls; contact support only through the official app or site |
| Password reuse | A password leaked from another site is tried on the exchange | Unique password from a password manager, or a passkey instead |
| Malware on your computer or phone | Malicious software steals session cookies, swaps copied wallet addresses or overlays fake screens | Updated devices, apps only from official stores, checking the full address before confirming |
| Leaked API key | A trading bot key with withdrawal permission is exposed | Keys without withdrawal rights, restricted to your IP address, with an expiry date |
The FBI has reported SIM swapping as a route into bank and crypto accounts: criminals impersonate the victim to the carrier, bribe carrier employees or compromise carrier systems, then use the SMS codes for password resets. Its 2022 public service announcement recorded 1,611 complaints with more than $68 million in adjusted losses in 2021, up from 320 complaints and about $12 million across 2018 to 2020.
Data leaks also feed impersonation. In the Coinbase insider breach, bribed support staff copied customer names, contact details, balances and ID images, and criminals used those details to phone customers posing as the exchange and persuade them to send funds. No password or code was stolen; the attack worked because the caller sounded genuine.
Sign-in: passkeys, security keys and two-step verification
CISA's guidance on multi-factor authentication ranks the options from strongest to weakest. Use the strongest your exchange supports.
| Method | CISA ranking | Resists phishing? | Resists SIM swap? | Notes for exchange users |
|---|---|---|---|---|
| Passkey or hardware security key (FIDO/WebAuthn) | Phishing-resistant (strongest) | Yes | Yes | Register two: for example a phone passkey and a hardware key kept somewhere safe |
| Authenticator app code (TOTP) | App-based | No: a fake site can capture the code | Yes | Good fallback; back up the setup securely when you enable it |
| App push with number matching | App-based | Partly | Yes | Never approve a prompt you did not start |
| App push without number matching | Weaker | No; open to prompt flooding | Yes | Avoid if better options exist |
| SMS or voice code | Weakest, "last resort" | No | No | Remove once a stronger method is set up |
- Why passkeys work: according to the FIDO Alliance, a passkey uses public-key cryptography and is tied to the specific website or app it was created for, so there is nothing to type into a fake site and no shared secret for the exchange to leak. You approve sign-in with your face, fingerprint or device PIN.
- Synced or device-bound: synced passkeys are stored by a passkey provider (your phone's built-in password manager or a third-party app) and copied end-to-end encrypted to your other devices. Device-bound passkeys, such as those on a hardware security key, never leave that device; FIDO describes them as the highest assurance. For large balances, a hardware key as one of your two methods is worth the small cost.
- Protect the account behind the passkey: a synced passkey is only as safe as the cloud account that syncs it. Secure that account with its own strong sign-in.
- Step-up checks: many exchanges ask for a second check again before withdrawals, changing security settings or creating API keys. Turn these on wherever offered.
US federal guidance points the same way: NIST SP 800-63B-4 classes SMS and voice codes as a "restricted" authenticator, tells services to consider signs such as a SIM change or number porting before sending a code by text, and requires services at its middle assurance level to offer at least one phishing-resistant option.
See the Passkeys for Everyone Guide for setting up passkeys across devices.
Withdrawal protection: allowlists, delays and locks
Sign-in protection keeps attackers out. Withdrawal protection limits the damage if they get in anyway. Look for these settings, which exchanges name differently.
- Withdrawal address allowlist (also called whitelist or address book lock): withdrawals are only allowed to addresses you saved in advance. Save your own wallet addresses, then switch the allowlist on.
- New address waiting period: some exchanges hold withdrawals to a newly added address for a period, often 24 to 48 hours, and email you. That delay is your window to spot and stop a theft. Do not ask support to shorten it.
- Settings lock: some exchanges let you lock security settings so that changing email, two-step verification or the allowlist needs extra verification or a separate key.
- Withdrawal confirmation by email: keep it on, and check the address in the email matches the one you intended.
- Address checking: malware can swap a copied address for the attacker's. Check the first and last several characters, and send a small test amount for large transfers.
Decision guidance: an allowlist adds a little friction every time you withdraw to somewhere new. If you trade actively but withdraw rarely, that friction is negligible and the protection is large. If you regularly pay many different addresses from the exchange, consider moving that activity to a separate wallet and keeping the exchange account locked down.
Anti-phishing codes and spotting fake messages
An anti-phishing code is a word or phrase you choose in the exchange's security settings, which the exchange then includes in every genuine email it sends you. An email claiming to be from the exchange without your code is fake. It helps with email only: a fake text message, social media message or phone call will not carry it, and an attacker who has seen one of your genuine emails may copy it.
- Calls: treat any inbound call about your account as suspicious, even if the caller knows your balance, recent trades or part of your ID number. Hang up and contact support through the official app.
- "Safe wallet" requests: the FTC notes that impersonators create urgency, claiming fraud or a frozen account, to get you to move crypto. Moving funds to a wallet someone else gives you is always a scam.
- Recovery scams: after a theft, people offering to recover your coins for a fee are typically running a second scam.
- Search ads and lookalike domains: bookmark the real exchange site and use the official app rather than following links or ads.
See the Cryptocurrency Scam Awareness Guide and the How to Spot a Phishing Email Guide.
Protecting your phone number from SIM swaps
- Add a carrier PIN or passcode: ask your mobile carrier to require a PIN for account changes, SIM replacements and number transfers, and to enable any port-out lock it offers.
- Remove SMS from the exchange: once a passkey or authenticator app is set up, remove SMS as a sign-in and recovery method if the exchange lets you.
- Use a separate email for the exchange: an email address you use nowhere else, protected with its own passkey, is harder to find and target.
- Keep holdings private: the FBI advises not publicising crypto holdings on social media or forums and limiting personal details posted online.
- Watch for loss of signal: if your phone suddenly shows no service and you have not travelled, contact your carrier from another phone immediately, then secure your exchange and email accounts.
The US Federal Communications Commission notes that eSIMs reduce the risk of physical SIM theft but do not stop port-out scams. See the Mobile Communications Protection for High-Risk Individuals Guide for stronger measures.
API keys for trading bots and tax tools
API keys let software act on your account. A leaked key with the wrong permissions can drain it without your password or second factor.
| Use | Permissions to grant | Permissions to refuse | Extra settings |
|---|---|---|---|
| Portfolio tracker or tax tool | Read balances and history only | Trading, withdrawals | Expiry date; delete when you stop using the tool |
| Trading bot | Read and trade | Withdrawals | Restrict to the bot's IP address; expiry date |
| Automated withdrawals | Only if truly needed | Everything else | IP restriction plus withdrawal allowlist |
Never paste API keys into chat groups, browser extensions you do not trust or code you upload to public repositories. Review your active keys every few months and delete the ones you no longer use. These keys are non-human credentials: see the Crypto Wallet Security Guide for wallet-side practices.
If your exchange account is hacked
- Freeze the account: most exchanges have an emergency "disable account" or "lock account" option in the app or in security emails. Use it first.
- Contact support through the official app or site: never through numbers or links from search results or social media.
- Secure your email and phone: change the email password, check forwarding rules, and contact your carrier if you suspect a SIM swap, as the FBI recommends.
- Revoke sessions, API keys and allowlisted addresses you do not recognise, then reset your password and second factors once you have control.
- Record the evidence: transaction IDs, destination addresses, times and any messages or call logs.
- Report it: in the US, the FTC lists ReportFraud.ftc.gov, the FBI's IC3 (ic3.gov), the CFTC and the SEC, plus the exchange you used. In the UK, report to Report Fraud (which replaced Action Fraud on 4 December 2025) at reportfraud.police.uk or 0300 123 2040. In Scotland, report to Police Scotland on 101. Elsewhere, report to your national fraud reporting service and the police.
- Beware recovery offers: anyone promising to get your coins back for an upfront fee is almost certainly a scammer.
Measuring whether your setup is strong
A quick self-audit, repeated every six months, shows whether the protections are in place:
- Sign-in: at least two phishing-resistant methods registered, and no SMS method left active.
- Withdrawals: allowlist on, containing only addresses you recognise.
- Phone: carrier PIN or port lock confirmed with your carrier.
- Keys: number of active API keys with withdrawal rights, ideally zero.
- Exposure: share of your holdings left on exchanges, kept to what you actively trade.
- Alerts: sign-in, withdrawal and security change notifications all reach an inbox you check.
How this maps to security frameworks
For readers who work in security, the same threats and controls appear in the standard frameworks:
- MITRE ATT&CK: SIM swapping is technique T1451 SIM Card Swap in ATT&CK for Mobile; fake login pages fall under T1566 Phishing; flooding a user with approval prompts is T1621 Multi-Factor Authentication Request Generation.
- NIST CSF 2.0: PR.AA-03, users, services and hardware are authenticated, covers the sign-in controls on this page.
- NIST SP 800-53 Rev. 5: IA-5 Authenticator Management covers registering, backing up and revoking authenticators and API keys.
Common failure patterns
- SMS left as a backup: users add an authenticator app but leave SMS active for recovery, so a SIM swap still opens the account.
- Trusting a caller who knows your details: leaked data such as balances and ID images makes impersonators convincing, as the Coinbase insider breach showed.
- Allowlist never switched on: the feature exists but is off by default on many accounts.
- Over-powered API keys: a portfolio tracker key created with withdrawal permission and no IP restriction.
- Email account weaker than the exchange: a password reset through a poorly protected email account bypasses all exchange settings.
- Everything on one exchange: long-term savings held where a single account takeover, or an exchange failure, can wipe them out. See the Crypto exchange breaches guide for how exchanges themselves have been compromised.
Practitioner checklist
- Register a passkey and a backup (second passkey, hardware security key or authenticator app) on the exchange.
- Remove SMS as a sign-in and recovery method once a stronger method works.
- Turn on the withdrawal address allowlist and the new-address waiting period.
- Set an anti-phishing code and enable sign-in and withdrawal alerts.
- Add a PIN and port lock with your mobile carrier.
- Protect the exchange's email account with its own passkey and check forwarding rules.
- Review API keys: read-only where possible, no withdrawal rights, IP restricted, with expiry.
- Hang up on any inbound "exchange support" call and contact support through the app.
- Move long-term holdings you do not trade to a wallet you control.
Standards and references
- CISA: Implementing Phishing-Resistant MFA
- FIDO Alliance: Passkeys
- FBI IC3: Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public
- FTC: What To Know About Cryptocurrency and Scams
- FCC: Cell Phone Fraud
- NIST: SP 800-63B-4 Authentication and Authenticator Management
Related NHI Mgmt Group resources: Crypto Exchange Identity and Key Security Guide · Crypto Wallet Security Guide · Cryptocurrency Scam Awareness Guide · Account Takeover Response Playbook