Table of Content
Table of Content
Protect your exchange login and your emailKeep your devices and apps under your controlVerify every message yourself, especially after a hackReview withdrawal controls and check every transactionMake a deliberate custody and recovery planYour crypto security checklist and incident planIf something goes wrong
Table of Content
On 3 November 2026, Binance published an initial report on its 29 October security incident. It describes a months-long campaign: attackers lured staff into installing a tampered developer tool and completing a coding test with hidden malware, then used that access to reach the systems that sign wallet transactions.
Threats keep evolving, and even sophisticated infrastructure like Binance’s can be targeted. Binance says it has rebuilt the affected systems, replenished 98% of affected assets and is restoring withdrawals in phases. Meanwhile, these crypto security tips cover what you can do yourself to keep your money, including crypto assets, safer.
Protect your exchange login and your email
Many account takeovers start with a reused password or an inbox someone else can read. Your email works like the ring that holds your other keys: password resets and login alerts land there, so whoever controls it can request new access and delete the warnings. Learning how to secure a crypto exchange account means securing two accounts, not one.
Give each a unique password from a password manager. CISA and the FBI note a side benefit: it fills credentials only on the genuine site, so a lookalike page stands out. Then upgrade the second factor. Where supported, a passkey or hardware security key is the strongest option, because it is bound to the real website and will not sign in to a fake one.
Is an authenticator app phishing resistant? No. It adds a useful layer, but its codes can be typed into a fake page and relayed within seconds. SMS codes can also be redirected through a SIM swap.
horizontal scroll
| Second factor | Phishing-resistant? | Main weakness |
|---|---|---|
| Passkey | Yes | Only as secure as the device and account it is stored on |
| Hardware security key | Yes | Can be lost – register a backup key |
| Authenticator app code | No | Can be entered on a fake page and relayed |
| SMS code | No | SIM swaps and interception |
Table 1. How common second factors hold up against phishing. Source: CISA, 2022; CISA and FBI, 2024
Good crypto account security also means reviewing active sessions and recognised devices in both accounts and signing out anything unfamiliar. Keep backup codes offline or in your password manager, never in a shared drive. And can 2FA protect against an exchange hack? No – it guards your login, not the exchange’s servers.
Keep your devices and apps under your control
Device hygiene rarely tops lists of cryptocurrency security tips, yet Binance’s report traces the first foothold to a tampered installer that an engineer found through a search engine. At home, malware can capture passwords or swap a copied wallet address for its own, and no exchange setting fixes that.
Keep the operating system, browser and wallet or exchange apps updated automatically. Install apps only from the official app store or the provider’s own website, not from search ads, and check the publisher name first – fake wallet apps copy names and logos. A price tracker has no reason to request access to your SMS or screen.
Remove browser extensions you no longer use. Treat any unsolicited request to install a "security update", a remote-access tool or a recruiter’s "test project" as an attack – callers posing as support are a common route, as our guide to impersonation scams explains. Keep antivirus on, but a clean scan does not prove a device is clean.
Verify every message yourself, especially after a hack
Large incidents produce a second wave of fraud that borrows the headline. The most useful crypto safety tips here are plain, and Binance gave the main one itself: rely only on its official channels.
Take a hypothetical case. Marta, a designer in Porto, keeps €300 of ETH on an exchange. After the news breaks, an email with the exchange’s logo tells her to "verify her wallet" within 24 hours to qualify for reimbursement. The link opens a copy of the login page; if she enters her password and code, the attacker uses both at once. If she opens the app already on her phone, she sees no such request.
That habit is most of how to protect crypto assets when the news is loud. Use the installed app or a saved bookmark, and reach support only through the official app or site. Legitimate support has no reason to ask for a password, one-time code, private key or recovery phrase, or to move your funds to a "safe wallet" – see what a payment service will never ask you to do. Our guide to how modern phishing scams work shows how fake login pages are built, and strangers offering to recover lost crypto for a fee are running recovery scams that target victims again.
Review withdrawal controls and check every transaction
Withdrawal controls limit what someone can do with a stolen login. Depending on the provider, you may find a withdrawal allowlist (only pre-approved addresses can receive funds), alerts for security changes and extra confirmation steps. Settings differ, so check your own exchange’s security menu. These controls protect your account from misuse; they do not stop a compromise of the exchange’s own systems.
If you once created API keys for a tracker or trading bot, delete unused ones and remove withdrawal permission from the rest. If you have never used an API, skip this step.
Then check the transaction itself, because screens can be manipulated. In February 2025, the Bybit exchange lost more than 400,000 ETH after attackers tampered with the interface its staff used to approve transfers: signers saw a routine transfer and approved a different transaction. Before any transfer, ask what should I check before a crypto withdrawal – then run through this list:
- Address: compare the full address – start, middle and end. Address-poisoning scams create lookalikes that match only the first and last characters.
- Network: confirm the recipient supports the network you chose; funds sent on the wrong one can be hard or impossible to recover.
- Asset and amount: check both, including any fee shown.
- Permissions: an "approve" request can let a contract move your tokens later. On a hardware wallet, confirm details on the device’s own screen.
For a new destination, a small test transfer confirms the address and network work, but not that the recipient is trustworthy.
Make a deliberate custody and recovery plan
After an incident, many people ask: should I keep all my crypto on one exchange? Holding everything with one provider concentrates two risks – a security failure and a withdrawal pause, which Binance customers faced during its checks. Spreading funds across unvetted services does not fix that.
A more useful split is by purpose. Say you buy €150 of ETH each month and have built up €4,000 over two years: the monthly amount has a reason to sit on the exchange, the long-term balance may not. There is no correct percentage – see hot and cold wallet risks for the trade-offs.
Self-custody moves the responsibility to you. A recovery phrase is like the only key to a lock no locksmith can open: whoever holds it gets in, and if it is lost, nobody can let you back in. A hardware wallet keeps keys offline, but it still signs whatever you approve. So what is the safest way to store cryptocurrency? The setup you can operate, back up and recover under stress. That is how to keep crypto safe over years.
As for how to protect a crypto wallet recovery phrase: write it on paper or metal, keep it offline and private, and never photograph it or type it into a website. Exchange recovery codes are different – they restore access to an account the exchange controls. Store the two apart.
Your crypto security checklist and incident plan
This crypto security checklist turns the five tips into actions. Like all cryptocurrency safety tips, they work only once switched on.
- Unique passwords, plus a passkey or hardware key on exchange and email where supported.
- Devices and apps updated; unused extensions removed.
- Official app and site bookmarked; unsolicited links ignored.
- Allowlist and alerts on where offered; unused API keys deleted.
- Working balance separated from long-term holdings; recovery phrase offline, apart from backup codes.
If something goes wrong
What to do after a crypto exchange security incident depends on where the problem sits.
The provider has an incident. Follow its official channels only and ignore unsolicited compensation offers. As of 3 November 2026, Binance says it has replenished 98% of affected assets and is restoring withdrawals in phases.
Your own account shows suspicious activity. Use a trusted device, secure your email, change passwords, sign out all sessions, review API keys and contact official support. Our guide to responding to account compromise walks through the next steps.
Your recovery phrase or private key is exposed. Treat the wallet as compromised, follow your wallet provider’s verified guidance and ignore anyone promising recovery.
FAQ
Can two-factor authentication protect my assets if an exchange’s own systems are breached?
No. It protects the login to your account, not the exchange’s internal systems, which is where Binance says its incident occurred.
How do passkeys, authenticator apps and SMS codes differ?
A passkey is tied to the genuine website and will not work on a lookalike page. Authenticator codes can be relayed from a fake page, and SMS codes can also be redirected through a SIM swap.
Why should I protect my email account as carefully as my exchange login?
Password resets and login alerts often go to your email. Someone who controls your inbox can request new access and delete the warnings.
What should I verify before approving a crypto withdrawal or wallet transaction?
Check the full address, network, asset and amount, and what any contract approval grants. On a hardware wallet, confirm details on its own screen.
Should I move everything to self-custody after hearing about an exchange incident?
Not automatically. Self-custody removes provider risk but makes you responsible for keys and backups, so move funds only into a setup you can operate and recover.
How do I keep a wallet recovery phrase separate from account recovery codes?
Keep the phrase offline, on paper or metal, in a different place from exchange backup codes. Exchange codes restore an account the provider controls; the phrase controls the wallet itself.
What should I do if my own account shows suspicious activity during an exchange incident?
Use a trusted device, secure your email first, then change your password, sign out all sessions and revoke API keys. Contact support through the official app only.
