Crypto Account Security Baseline: A One-Evening Hardening Checklist

How do I run this in one evening?

Block out two to three hours when you will not be interrupted, and treat it like a project, not a mood. The checklist below is ordered on purpose. Each stage protects the next, and doing them in a different order leaves gaps. You will not finish a perfect security posture in an evening, and you do not need to. The goal is a baseline that removes the most common ways accounts get taken over, using only free or inexpensive controls, so that an attacker has to work much harder than they will against the average person.

Have these ready before you start: your phone, a pen and paper, a quiet place to write recovery details, and a device you trust (updated, free of software you do not recognize). Do not do this on a shared computer or a public network. This guide is general education and not a guarantee, since every exchange and email provider uses different menus and may change them, so use the stage names here as a map and look up each provider's current instructions in its own help centre.

Stage 1: Which accounts are in scope?

Start with a short inventory, written on paper. List every exchange, wallet app, and brokerage that holds or can move crypto, then the email address attached to each, then the phone number attached to each. Add any account that can be used to recover those, including your main email provider, your mobile carrier account, and your cloud storage. You are mapping the login chain: if any link in it is weak, the strongest exchange setting does not matter.

Mark anything you no longer use. Dormant exchange accounts with old passwords and stored withdrawal addresses are liabilities, so withdraw any balance to your own custody if appropriate, then close what you can. Keep it simple: a small number of accounts you actively maintain is far easier to defend than a long tail of forgotten logins. Note the date, because you will revisit this list every few months.

Stage 2: Why does email come first?

Almost every account recovery flow ends in a link sent to your email address. Whoever controls that mailbox can request a reset on your exchange and complete it. That makes your email account the root of trust for your entire crypto footprint, and it deserves stronger protection than any single exchange. Give it a unique long password, turn on the strongest second factor it supports, and prefer an authenticator app, passkey or hardware key over SMS. CISA advises turning on multifactor authentication for every account or app that offers it and names email accounts among the important accounts to check.

Then audit the mailbox itself. Review the recovery phone number and recovery email, because an old address you no longer control is a back door. Check forwarding rules and filters, since attackers who get in sometimes add a rule to hide reset emails from you. Check which devices and apps are signed in, and sign out anything you do not recognize. Consider using a dedicated email address for crypto accounts that you do not use for newsletters or shopping, which also reduces the phishing mail aimed at it. The sequence matters: do this before touching exchange settings.

Stage 3: Passwords and second factors

Set up a password manager if you have not already, and generate a new unique password for each account on your inventory, following CISA's guidance of a different strong password for each account and at least 16 characters. Then move each account off SMS two-factor where the provider offers something better. NIST describes SMS-based out-of-band authentication as restricted and not phishing-resistant, and the FBI has warned that SIM-swap attacks target the phone numbers used for text codes. Choose an authenticator app, or a passkey or hardware key if offered. Our guide on password managers and passkeys at /guides/password-managers-passkeys-crypto-accounts goes deeper on the trade-offs.

Save the backup or recovery codes each provider issues, and store them offline on paper, not in a screenshot or an email. Add a carrier-level protection as well: ask your mobile carrier about a port-out or SIM-change lock and a PIN on the account, and keep that PIN out of your phone's notes app. Test each login in a fresh session before you log out of the old one. If you hold meaningful value, consider two hardware keys, with one stored separately as a spare.

Stage 4: Exchange controls that limit the damage

Most exchanges offer settings that assume your login might one day be compromised and limit what an intruder can do. Look in the security settings of each exchange for a withdrawal address allowlist, which restricts withdrawals to addresses you pre-approved, on some exchanges with a waiting period before a new address becomes usable (Coinbase, for example, documents a 48-hour hold on newly added addresses). Turn it on, and add only addresses you control. Look for an anti-phishing code, a personal phrase that exchanges such as Binance and Kraken say they include in genuine emails, so you can spot messages that lack it; not every exchange offers one. Look for notifications on login, withdrawal and security changes, and make sure those go to an inbox you check.

Also look for session and device management, an account lock or freeze option you can use in an emergency, and API key settings. If you have API keys you do not use, delete them, and never grant withdrawal permission to an API key you do not strictly need. Feature names and availability differ between exchanges and change over time, so check each provider's help page. Allowlists and codes slow an attacker down and give you a window to notice; they do not make a compromised account safe, and they are not a substitute for strong passwords and second factors.

Stage 5: Device hygiene

Your devices are where passwords and codes are entered, so keep them boring and current. Install operating system and browser updates, remove software you do not use, and keep browser extensions to a minimum, because a malicious or compromised extension can read what you see. Use a device passcode, enable full-disk encryption where your device supports it, and lock the screen automatically. Use a separate browser profile, or a separate browser, only for financial and crypto sites, with no extensions, so everyday browsing does not mix with it.

Be careful about what you install and who you let help. Never install remote-access software because someone contacted you, and read our fake support guide at /guides/fake-support-account-takeover for why. Do not run commands that a web page or a stranger tells you to paste into a terminal, which our ClickFix guide at /guides/clickfix-paste-command-scam covers. Download wallet and exchange apps only from the official store links on the provider's own website. If a device behaves strangely after a download, disconnect it from the network, and treat the credentials you used on it as exposed until you have changed them from a clean device.

Stage 6: Recovery, contacts, and review

Last, plan for the day something goes wrong, because a plan made calmly beats improvising in panic. Write down, on paper, how to recover your email, your password manager, and each exchange, and keep it somewhere physical and safe that is separate from your recovery phrase. Many providers allow a trusted contact or recovery contact, or have a documented identity-verification process for regaining access, so find out how yours works while you are not locked out. Make sure someone you trust knows where to look if you cannot respond, which links to our crypto inheritance plan guide at /guides/crypto-inheritance-plan.

Finally, schedule a review. Put a recurring reminder in your calendar every three to six months to re-check the inventory, remove dead accounts, confirm the allowlists contain only addresses you still control, and confirm your contact details are current. If something does go wrong, our scam recovery next-steps guide at /guides/crypto-scam-recovery-next-steps covers reporting. A baseline is a habit more than a project: the evening gets you most of the benefit, and the review keeps it from decaying. Where you want help, tools like NordPass or Proton are options; we may earn a commission on those links, at no cost to you.

FAQ