Crypto Exchange Security Settings: 5 to Change on Coinbase or Kraken

Five settings close the easiest gaps in a crypto exchange account: replace text message codes with a security key or authenticator app, turn on a withdrawal allowlist, set an anti-phishing code, delete old API keys and unknown devices, and give the account its own email address. The settings are free, though a hardware security key costs money, and most take a few minutes.

The defaults are the weak spot. Coinbase’s own help center says text message (SMS) is the default 2-step verification method and calls it “the least secure option.” If you opened an account years ago and never went back into the security tab, this guide walks through what to change, in order. It explains settings, not which exchange to use. Menu names differ by exchange and change over time, so look for each setting in your account’s security section.

Why are text message codes the weakest exchange login?

Text message codes are the weakest exchange login because they go to a phone number, and a phone number can be moved to a criminal’s SIM card. The FBI calls this SIM swapping. In a February 2022 warning, the FBI said: “Once the SIM is swapped, the victim’s calls, texts, and other data are diverted to the criminal’s device.”

The FBI’s Internet Crime Complaint Center (IC3) counted 1,611 SIM swapping complaints in 2021, with adjusted losses of more than $68 million. From 2018 through 2020 it counted 320 complaints and about $12 million.

The US Cybersecurity and Infrastructure Security Agency (CISA) says SMS and voice codes are “vulnerable to phishing, SS7, and SIM swap attacks” and should only be used as a last resort. CISA calls phishing-resistant methods, such as FIDO security keys, “the gold standard.” Kraken’s support page explains why a key resists fake sites: it “will only respond to a challenge from the website that you registered it on.”

The fix: add a security key and a second key as a backup, or an authenticator app, then switch text codes off if the exchange allows it. Our comparison of SMS, authenticator apps and security keys covers how each one fails.

What is a withdrawal allowlist?

A withdrawal allowlist is an exchange setting that only lets your account send crypto to addresses you saved in advance. Coinbase’s help center says that with its address book allowlist on, a newly added address becomes available for sends after 48 hours.

That waiting period is the point. If someone gets into your account and adds their own address, they still can’t send to it for two days. That is two days for you to see the alert and lock the account.

Kraken takes a different route. It lets you require a second factor on withdrawals and rates a hardware security key “most secure” for that. But Kraken’s page warns that withdrawal 2FA “does not prevent the addition of cryptocurrency withdrawal addresses.” For that, Kraken offers a Global Settings Lock (GSL), which it says “acts as the last line of defense if your sign-in password and sign-in 2FA are compromised.” Kraken lists adding a crypto withdrawal address among the changes the lock blocks. It says the lock prevents changes to the account, “including by Kraken Support,” and that unlocking it without a master key takes at least 24 hours, or up to 30 days.

Turn the allowlist or lock on, add only addresses you control, and let the waiting period run before you need them.

What is an anti-phishing code on a crypto exchange?

An anti-phishing code is a short word or phrase you choose in your exchange’s security settings, which the exchange then puts in its real emails. Binance.US says that once you set it, the code will be included in all genuine Binance.US emails. An email without your code did not come from the exchange, however real it looks.

Pick a word nobody could guess. Type it only into that settings box. Not every exchange offers this setting, so if yours doesn’t, the next two steps matter more.

How do you clean up API keys and logged-in devices?

You clean up API keys by deleting every key you don’t use and removing withdrawal permission from the rest. An API key is a password you give an app, such as a portfolio tracker, tax tool or trading bot, so it can connect to your account. Keys often outlive the apps that used them.

Kraken’s developer guide says: “Set the minimum permissions required.” It also warns: “A compromised key with withdrawal permissions is a direct financial risk.” A tracker only needs to read balances. For a bot that needs a key, Kraken recommends locking it to the internet (IP) addresses your system runs from, saying “this single measure prevents almost all key misuse even if the key is leaked.”

Then check devices. Kraken’s security section includes “session and device management,” with “a timeline of all recent sessions.” End any session from an old phone, a browser you don’t use or a place you’ve never been, and change your password.

Why should your exchange account have its own email address?

Your exchange account should have its own email address because a scammer who knows your name and account email can write a very convincing fake message. In a May 2025 filing with the SEC, Coinbase said criminals appear to have obtained customer data by “paying multiple contractors or employees working in support roles outside the United States.” The data included names, addresses, phone numbers and emails.

Coinbase said the incident did not involve passwords or private keys. But the filing warned the information “could be used in social-engineering attempts,” meaning scams built on real personal details.

An email used only for your exchange, and never typed into shopping sites or social profiles, is harder to find and harder to fake. Protect that inbox with its own security key or authenticator app, because whoever controls the email can often reset everything else.

The five settings at a glance

Setting	What it stops	Where to look
Security key or authenticator app, SMS off	SIM swaps; fake login pages (keys only)	Security, 2-step verification
Withdrawal allowlist or settings lock	Sends to an address an intruder just added	Security, address book or allowlist
Anti-phishing code	Fake emails pretending to be the exchange	Security settings, if offered
API key and device cleanup	Old keys and forgotten sessions used to get in	API section; sessions or devices
Dedicated email	Targeted phishing using leaked details	Account profile, email address

What can’t exchange security settings protect you from?

Exchange security settings can’t protect you from three things. First, they protect your login, not the company’s own systems; the Coinbase data in that filing was taken from the inside. Second, no setting stops a transfer you approve yourself, so if a caller talks you into sending coins, every lock works as designed for the wrong person. Third, strong locks carry lockout risk, which is why Coinbase’s help center suggests registering two security keys, one as the primary and one as a backup.

These settings lower the risk. They don’t erase it. If you move coins off an exchange, our guide to sending a small test transaction first covers the safe way to do it.

Your 5-minute exchange security checklist

1. Add a security key and a backup key, or an authenticator app, then turn text codes off.
2. Turn on the withdrawal allowlist or your exchange’s settings lock, and add only addresses you control.
3. Set an anti-phishing code if your exchange offers one.
4. Delete old API keys, remove withdrawal permission from the rest, and sign out every device you don’t recognize.
5. Move the account to an email used for nothing else, and protect that email with its own key or app.

Learn your exchange’s account recovery steps now, before you need them.

What to check next

Check whether each exchange you use has added passkeys, security keys or new withdrawal locks, since options change. The settings described here are as of October 2026. Watch for login and new-address alerts, and act on them the same day. If an account has already been taken over, our guide on what to do when crypto is stolen covers the first hour, and our piece on exchange shutdowns covers the risks no setting can fix.

Sources

• Coinbase Help: Set up your 2-step verification
• FBI IC3: Criminals Increasing SIM Swap Schemes (Feb 8, 2022)
• CISA: Implementing Phishing-Resistant MFA (Oct 2022)
• Coinbase Help: Address book allowlist
• Kraken Support: What is the Global Settings Lock?
• Kraken Support: How does 2FA for funding (withdrawals) work?
• Kraken Support: Using a Security Key for 2FA
• Kraken Support: Where can I find my active sessions?
• Kraken API documentation: API key permissions
• Binance.US: Anti-Phishing Code
• Coinbase Form 8-K, SEC EDGAR (May 2025)