Original topic illustration: ChainView BTC866 original topic diagram · ChainView BTC866 Editorial · CC BY 4.0
Protect recovery channels first
An exchange account depends on email, phone, recovery codes, and support recovery as well as its login password. Secure email with unique credentials and strong authentication, and review forwarding rules. Understand recovery procedures so weak fallback channels do not undermine strong login controls. Protect and back up the password manager appropriately.
Choose authentication methods
Hardware keys, authenticator codes, and SMS differ in phishing resistance and recovery dependencies. Check support for origin-bound authentication and enroll a protected spare key where appropriate. SMS depends on carrier controls. Store recovery codes separately from routine devices, and verify notifications after any authentication method is added or removed.
Withdrawal allowlists and cooldowns
Allowlist protection depends on address enrollment, delays, and alerts. Verify network and full destination before adding entries. Check cooldowns for disabling the list or recovering an account, including bypasses. An allowlist cannot eliminate venue risk or establish ownership of a destination; a mistakenly enrolled address can also obstruct your own withdrawal process.
Devices, sessions, and API keys
Review sessions, devices, and API keys; revoke unused access. Grant automation only necessary permissions and avoid withdrawal authority where possible. Understand IP restrictions and rotation. Uninstalling a third-party app does not revoke copied credentials. Verify login alerts through the official account interface instead of following potentially malicious notification links.
Alerts and response plans
Enable and test alerts for logins, credential changes, address changes, and withdrawals. Document official freeze and support procedures before an incident. Protect email and recovery channels and follow verified steps. Never pass one-time codes to supposed support agents, because doing so can defeat the authentication control you intended to rely on.
Conduct low-risk reviews
Review spare keys, recovery material, sessions, and notifications without initiating a withdrawal. Read platform requirements before testing recovery to avoid unnecessary lockouts. Keep a dated checklist privately. Strong authentication reduces unauthorized access but does not address insolvency, trading losses, or every operational error, so it belongs within broader custody and liquidity planning.
Worked review example
A hardware-protected login can still depend on weak email recovery. Map login, recovery, allowlist changes, and API access with alerts and cooldowns. Keep spare keys and recovery codes outside the same unprotected failure domain. Test actual notifications. Protection is only as coherent as the complete set of entry and fallback paths, not the strongest login method alone.
