The Complete Exchange Security Checklist

Published August 1, 2026 · Updated August 1, 2026

AI-assisted content · Swoopr is responsible for the final published article.

Key Takeaways

Exchange security isn't one decision — it's a sequence of decisions spread across the entire time you hold an account, starting before you've even signed up and continuing for as long as you keep funds on the platform. A reader who picks a well-regulated, transparent exchange but never enables an authenticator app is still exposed. A reader who locks down every account setting perfectly but leaves their entire portfolio sitting on the platform indefinitely is still exposed, just to a different kind of failure. Every other guide in this sub-group goes deep on one piece of that sequence. This page exists to turn all of it into a single routine you can actually run, in order, rather than thirteen separate facts to remember under pressure.

Direct answer: Run a three-phase routine for every exchange account you hold. Before choosing: check the exchange's regulatory status and jurisdiction disclosure, look for published proof of reserves, understand its custody and cold-storage practices, check whether any insurance or protection fund is real and transparent, and research its history of hacks or incidents. When setting up an account: enable the strongest available two-factor authentication, enable withdrawal address whitelisting, set a verification tier and withdrawal limit appropriate to how you'll actually use the account, and secure any API keys you create with the minimum permissions a third-party tool actually needs. Ongoing: watch for unusual account notifications, periodically review your API keys and whitelist entries, never respond to unsolicited "support" contact, and keep only the funds you actively need on the platform rather than your full holdings.

Thirteen checklist items, grouped into three phases, cover the full lifecycle of an exchange relationship from before you sign up through however long you keep using the account.
No single item is sufficient by itself; the checklist works as a set because a failure at one phase is often caught, or its damage limited, by a habit from another phase.
This page deliberately doesn't re-explain concepts covered in depth elsewhere in the sub-group — each checklist item links to the guide that covers its mechanics fully.
The ongoing phase is the one most people skip entirely once an account feels "set up," which is exactly why account monitoring and fund-limiting habits fail even for readers who nailed the first two phases.
The worked example below applies all thirteen items in sequence to a single, realistic first-time exchange signup, showing how the checklist actually plays out rather than just listing it.

The Exchange Security Checklist, by Phase

Exchange risk isn't concentrated in a single moment — it's spread across three distinct phases, each with its own failure mode. Before you choose a platform, the failure mode is picking one that was never structurally trustworthy to begin with, no matter how carefully you secure your own account afterward. When you set up that account, the failure mode is leaving a default configuration in place that an attacker can walk through. Ongoing, the failure mode is complacency: treating a secured account as a permanently solved problem instead of something that needs periodic attention for as long as it holds your money. This checklist is organized around those three phases rather than as one flat list, because the practices genuinely belong to different moments and different habits.

Phase 1 — Before Choosing an Exchange

Checklist Item	Why It Matters
Check regulatory status and jurisdiction disclosure	An exchange's licensing and the jurisdiction it actually operates under determine what legal recourse, if any, exists if something goes wrong, and a platform that obscures this information is telling you something by itself.
Check for published proof of reserves	A recurring, independently attestable proof-of-reserves practice is evidence an exchange is willing to demonstrate it holds what it claims, rather than asking customers to take solvency on faith.
Check custody and cold-storage practices	How an exchange actually stores customer assets — the split between hot wallets needed for withdrawals and cold storage kept offline — determines how much is exposed if the platform's systems are breached.
Check insurance and protection fund transparency	A named insurance policy or protection fund means little without public detail on what it actually covers, its funding size relative to customer assets, and the conditions under which it would pay out.
Research the exchange's history of hacks or incidents	How a platform actually responded to a past breach — disclosure speed, customer reimbursement, and concrete security changes afterward — is a far more reliable signal than marketing copy about how secure it is today.

Phase 2 — When Setting Up Your Account

Checklist Item	Why It Matters
Enable the strongest available two-factor authentication	The default second factor an exchange nudges you toward at signup is rarely the strongest one it actually supports, and the gap between SMS and a hardware key is the difference between an account a SIM swap can take over and one it can't.
Enable withdrawal address whitelisting	A whitelist restricts withdrawals to addresses you've pre-approved, so even a fully compromised login and second factor can't move funds to a new, attacker-controlled address without clearing an additional step.
Set a verification tier and withdrawal limit appropriate to actual use	A higher verification tier usually unlocks a higher withdrawal limit, and matching that limit to what you actually need caps the maximum single-session loss from a takeover, rather than leaving it wide open by default.
Secure API keys with the minimum permissions any third-party tool needs	An API key generated for a portfolio tracker or trading bot only needs read access or trade access, essentially never withdrawal access, and a key scoped narrower than what's technically offered limits what a leaked key could ever do.

Phase 3 — Ongoing and Periodic

Checklist Item	Why It Matters
Monitor for unusual account notifications	A login alert, password-change confirmation, or new-device notice you didn't trigger is often the earliest, and sometimes the only, warning that an account is actively being compromised before real damage occurs.
Periodically review API key and whitelist entries	Neither expires on its own, so a key from a tool you stopped using months ago or a whitelist entry for an address you no longer control sits as a permanent, silent liability until someone actively removes it.
Never respond to unsolicited "support" contact	Real exchange support does not call, message, or email you first asking to "verify" your account, and treating every inbound contact as untrusted by default closes off one of the most common paths into an otherwise well-secured account.
Keep only necessary funds on the platform, not full holdings	An exchange balance is only as safe as the platform's own security and solvency; funds you're not actively trading with belong in self-custody, which caps what any single exchange-side failure could ever cost you.

Common mistake

The most common mistake with this checklist isn't skipping an individual item — it's treating Phase 3 as optional because Phases 1 and 2 "already happened correctly." Exchange risk is cumulative, not point-in-time: an account chosen carefully and configured correctly on day one can still be sitting on a stale API key, an outdated whitelist entry, or a growing balance that's drifted far past what's actually needed for active trading, months or years later. The before-choosing and setup phases protect you at the moment you join and configure an account; only the ongoing phase protects you from what's quietly accumulated since.

Worked Example: Choosing and Setting Up a New Exchange for the First Time

Realistic scenario — for education only.

Assume a Swoopr reader has decided to open their first exchange account after months of learning about crypto through self-study, planning to start with a modest amount they're comfortable actively trading. They've narrowed their choice to two well-known, similarly priced platforms and want to apply the full checklist before committing to either.

Applying the before-choosing items. The reader starts by checking each platform's regulatory disclosures, finding that one clearly states its licensing and the specific jurisdiction it operates under while the other is vague about both, buried in a footer link rather than disclosed prominently. They check for proof of reserves next: the first platform publishes a recurring, independently attestable snapshot; the second has no public proof-of-reserves practice at all. They read what each platform actually says about custody, noting that the first describes a specific cold-storage split for customer assets while the second's description is generic marketing language without real detail. They look into whether either advertises an insurance or protection fund, finding the first names a specific fund with disclosed size and scope while the second's "insured" claim links to nothing concrete. Finally, they search for each platform's hack history: the first had a smaller incident years earlier but disclosed it quickly and fully reimbursed affected customers; the second has no public incident history, which the reader treats as inconclusive rather than reassuring, since it could reflect either a clean record or simply less scrutiny. Taken together, the first platform clears every before-choosing item more convincingly, so that's the one the reader signs up with.

Applying the account-setup items. During onboarding, the reader skips past the SMS-based two-factor option the signup flow suggests first and instead enables an authenticator app, the strongest option this particular platform supports. In account security settings, they turn on withdrawal address whitelisting immediately, even before making a first deposit, so the setting is active from the very first funds that arrive. They complete the verification tier that matches their intended trading size rather than the highest tier available, keeping their withdrawal limit proportionate to actual use instead of maximized by default. Because they plan to eventually connect a portfolio-tracking tool, they generate an API key scoped to read-only access, explicitly declining the withdrawal permission the platform's key-creation screen offers as an option, since the tracker has no legitimate need for it.

Applying the ongoing items. A few weeks in, the reader gets a login notification from a browser and location they don't recognize; they immediately change their password, review active sessions, and confirm no withdrawal or whitelist changes occurred, treating the alert as a near-miss worth taking seriously rather than dismissing it as noise. Roughly every few months afterward, as a recurring calendar habit, they review their API keys and whitelist entries, and on one such review they find and delete a key from a trial trading bot they stopped using months earlier. When an unsolicited message arrives claiming to be exchange support asking them to "verify" their account through a link, they don't respond or click anything, instead logging in directly through their own bookmark to check for any real notification, finding none. Throughout, they keep their exchange balance sized to what they're actively trading with, periodically withdrawing gains and unused funds to their own wallet rather than letting the balance grow unchecked.

The outcome. Nothing dramatic happens in this scenario, which is the point. The checklist's job isn't to produce a story about a narrowly avoided disaster every time; it's to make each of these thirteen decisions a default habit, so that the moments where they genuinely matter — a real account-takeover attempt, a platform that turns out to be less solvent than it claimed — look procedurally identical to the moments where they don't. The reader who runs this same sequence for every exchange account they ever open is protected on the specific occasion where the platform, the login attempt, or the "support" contact turns out to be the real thing, precisely because they didn't treat that occasion any differently from the routine ones.

Which Guide Backs Up Each Checklist Item

This checklist deliberately doesn't re-derive the mechanics behind each item — every one of the thirteen other guides in this sub-group covers one piece in full depth. Use the table below to jump directly to the guide behind whichever item you want to understand more thoroughly.

Sub-Group Guide	Checklist Item It Supports	Why
How to Choose a Secure Exchange	The entire "before choosing" phase	Covers the full evaluation framework this phase's five items are drawn from, walking through how to weigh regulatory status, transparency, and track record together rather than in isolation.
Regulatory Status and Exchange Security	"Check regulatory status and jurisdiction disclosure" (Phase 1)	Explains what licensing actually means in different jurisdictions and how to find and interpret an exchange's real regulatory disclosures instead of taking a badge or claim at face value.
Proof of Reserves Explained	"Check for published proof of reserves" (Phase 1)	Covers how proof-of-reserves attestations actually work, what they do and don't verify, and how to tell a credible practice from a superficial one.
Custodial vs. Non-Custodial Exchange Risk	"Check custody and cold-storage practices" (Phase 1) and "Keep only necessary funds on the platform" (Phase 3)	Explains the fundamental trade-off behind holding assets on an exchange at all, which is the reasoning underneath both limiting exchange balances and scrutinizing custody practices before choosing one.
Cold Storage vs. Hot Wallet Exchange Practices	"Check custody and cold-storage practices" (Phase 1)	Goes deeper into the specific mechanics of how exchanges split customer assets between hot and cold storage and what a responsible split actually looks like.
Exchange Insurance Funds Explained	"Check insurance and protection fund transparency" (Phase 1)	Covers what a named protection fund actually covers, how it's typically funded, and the difference between a real backstop and a marketing claim.
Exchange Hacks: History and Lessons	"Research the exchange's history of hacks or incidents" (Phase 1)	Documents how major past exchange breaches actually unfolded and, more importantly, how each platform's post-breach response separated the ones worth trusting again from the ones that weren't.
Exchange Two-Factor Authentication	"Enable the strongest available two-factor authentication" (Phase 2)	Ranks the available second-factor options by actual strength and explains exactly why SMS is the weakest choice most platforms still offer by default.
Withdrawal Whitelist Addresses	"Enable withdrawal address whitelisting" (Phase 2) and "Periodically review whitelist entries" (Phase 3)	Walks through how whitelisting actually works, its typical cooldown periods, and why a whitelist needs periodic review rather than being a set-once feature.
Exchange Withdrawal Limits and Security	"Set a verification tier and withdrawal limit appropriate to actual use" (Phase 2)	Covers how verification tiers and withdrawal limits relate on most platforms and how to choose a tier deliberately instead of defaulting to the maximum.
API Key Security Best Practices	"Secure API keys with minimum necessary permissions" (Phase 2) and "Periodically review API key entries" (Phase 3)	Covers permission scoping, IP restriction, and key rotation in full depth, including exactly why a leaked read-only key is a fundamentally smaller incident than a leaked withdrawal-enabled one.
Exchange Account Recovery Process	"Monitor for unusual account notifications" (Phase 3)	Explains how legitimate account-recovery flows actually work, which is the baseline knowledge that makes an unusual or unexpected recovery-related notification recognizable as a red flag.
Fake Exchange Websites	"Never respond to unsolicited support contact" (Phase 3)	Documents how cloned exchange sites and fake support channels are built and distributed, which is the specific threat the "never respond first" rule is designed to interrupt.

Notice that Phase 1 draws on the largest number of distinct guides, since evaluating a platform before committing to it genuinely spans five separate, largely independent signals. Phase 3 concentrates on fewer guides but is the phase most readers stop applying once an account feels "done," which is exactly why it gets its own dedicated emphasis throughout this checklist rather than being folded into setup.

Misconceptions Versus Reality

Misconception	Reality
Completing this checklist once when I sign up means I'm permanently protected	Several items, including monitoring account notifications, periodically reviewing API key and whitelist entries, and keeping only necessary funds on the platform, are ongoing practices, not one-time setup tasks; new exposure accumulates for as long as the account stays active
A big, well-known exchange name is itself proof of strong security	Brand recognition reflects marketing reach and market share, not verified custody practices, regulatory standing, or incident history; several of the largest historical exchange breaches happened to platforms that were widely trusted and well known at the time
Enabling any two-factor authentication is as good as enabling the strongest one available	SMS-based codes are vulnerable to SIM-swap attacks in a way authenticator apps and hardware keys are not; "some 2FA" and "strong 2FA" close meaningfully different amounts of risk despite both technically satisfying a platform's 2FA requirement
If an exchange is regulated, my funds are automatically insured against a hack	Regulatory licensing and deposit insurance or a protection fund are two separate things that need to be checked independently; being regulated in a given jurisdiction says nothing on its own about whether customer losses would actually be reimbursed
Keeping my entire portfolio on one trusted exchange is simpler and just as safe	Simplicity comes at the cost of concentration; an exchange-side hack, prolonged withdrawal freeze, or insolvency can affect an entire balance at once in a way self-custodied holdings held separately cannot

Common Mistakes

Two patterns account for most of the preventable losses among readers who otherwise know this checklist exists.

Treating exchange security setup as a one-time task rather than a recurring habit

The before-choosing and account-setup phases of this checklist get followed reasonably consistently by careful users, because they happen at a moment already associated with deliberate decision-making: picking a platform, configuring a new account. The ongoing phase has no equivalent natural trigger — nothing about a quiet, uneventful month reminds you that a whitelist entry from a year ago points to an address you no longer use, or that a notification you half-noticed and dismissed was actually worth investigating. It silently stops happening unless it's turned into a deliberate, scheduled habit, the same way a password rotation or a financial statement review would be. An account secured carefully at signup can still accumulate real exposure over months or years simply because nothing ever forced a second look.

Keeping significantly more funds on an exchange than actually needed for active trading

This is less a lapse in vigilance than a default that quietly compounds: deposits accumulate, gains stay unwithdrawn, and a balance that started as "what I'm actively trading with" gradually becomes "most of what I own," without a single deliberate decision to make that trade-off. The risk this creates isn't hypothetical caution — it's concentration risk, plain and simple. Every dollar sitting on an exchange is exposed to that specific platform's security, solvency, and operational decisions, none of which you control, in a way that self-custodied holdings are not. Treating "how much should be on the exchange right now" as a question worth revisiting periodically, rather than a decision made once and left alone, is the direct antidote.

Other frequent mistakes

Accepting the first two-factor option a signup flow suggests instead of checking what stronger options the platform actually supports.
Generating a broad, withdrawal-enabled API key for a tool that only ever needed read access, because it was the path of least resistance at setup.
Engaging with an inbound "support" message just long enough to see what it wants, rather than declining to interact with any unsolicited contact at all.
Choosing an exchange primarily on trading fees or available assets without ever checking its regulatory disclosures, proof of reserves, or incident history.

Risks, Limitations, and Exceptions

No checklist eliminates exchange risk entirely; it reduces the probability of a preventable loss without guaranteeing an outcome against every future attack technique or platform failure.
Regulatory status, proof of reserves, and disclosed insurance all reduce uncertainty but don't eliminate it; a well-regulated, transparent platform can still be breached or, in rare cases, misrepresent its own disclosures.
Withdrawal whitelisting and strong two-factor authentication meaningfully raise the bar for an attacker but depend on the platform implementing them correctly and on you actually enabling them rather than leaving defaults in place.
Monitoring account notifications only helps if you actually act on what they show; an alert that's noticed but not investigated provides no protection.
Keeping funds off an exchange shifts risk rather than eliminating it, moving it to self-custody, where you become fully responsible for your own key security and backup practices instead.
The worked example is illustrative; a real exchange evaluation and setup may surface different specific details at each checklist phase.

Practical Implementation Checklist

Before signing up anywhere, compare candidate exchanges on regulatory disclosure, proof of reserves, custody practices, insurance transparency, and hack history side by side.
At signup, enable the strongest two-factor method the platform supports rather than the one the onboarding flow suggests first.
Turn on withdrawal address whitelisting before making a first deposit, not after.
Choose a verification tier and withdrawal limit that match your actual planned use rather than defaulting to the maximum available.
Scope any API key to the minimum permissions a connected tool genuinely needs, and decline withdrawal permission unless a tool has an explicit, legitimate reason to request it.
Treat every login, password-change, or new-device notification you didn't trigger yourself as a reason to act immediately, not a notice to dismiss.
Set a recurring reminder, at least every few months, to review and prune API keys and whitelist entries you no longer use.
Never respond to, click through, or continue a conversation with any support contact that reached out to you first; always initiate contact yourself through the platform's own verified site.
Periodically withdraw funds beyond what you're actively trading with to self-custody, rather than letting an exchange balance grow unchecked.
Revisit this entire checklist, not just the ongoing items, whenever you open an account on a new exchange, rather than assuming lessons from one platform automatically carry over.

Frequently Asked Questions

Is completing this checklist once when I sign up enough to stay protected?

No. Several items on this checklist, including monitoring account notifications, periodically reviewing API key and whitelist entries, and never keeping more funds on a platform than you actively need, are ongoing practices, not one-time setup tasks. Completing the before-choosing and account-setup phases correctly protects you at the moment you join an exchange; only the ongoing phase protects you for as long as you keep using it.

What's the single most important item on this checklist if I can only do one thing?

Enable the strongest available two-factor authentication and keep only the funds you actively need on the exchange rather than your full holdings. Together they address the two failure modes that account for the most losses: an attacker taking over the account, and that takeover being able to reach everything you own instead of a bounded amount. No other single item closes as much risk at once.

How much of my crypto should I actually keep on an exchange versus in my own wallet?

Only the amount you need for active trading, staking through the exchange itself, or near-term spending. Holdings you intend to keep for the medium or long term belong in self-custody, where you control the private keys, rather than sitting as a balance on a platform that could be compromised, freeze withdrawals, or become insolvent. This trade-off between convenience and control is covered in depth in Custodial vs. Non-Custodial Exchange Risk.

What counts as the strongest available two-factor authentication, and is SMS good enough?

SMS-based codes are better than no second factor at all, but they're the weakest widely offered option because a SIM swap hands an attacker your second factor along with your phone number. An authenticator app is meaningfully stronger, and a hardware security key is stronger still, since it can't be phished or intercepted remotely. Enable the strongest option your exchange supports, not just the first one the signup flow suggests.

How often should I review my API keys and withdrawal whitelist?

Every few months is a reasonable default, and immediately after you stop using any third-party tool, bot, or portfolio tracker that had an API key. Neither API keys nor whitelist entries expire on their own, so a stale key from an abandoned tool or a whitelist entry for an address you no longer use sits as a permanent, silent liability until someone actively removes it.

What should I do if I get a notification for an account change I didn't make?

Treat it as a live incident, not a formality. Log in directly through your own bookmark or typed URL, not any link in the notification itself, change your password immediately, review active sessions and API keys for anything unfamiliar, and contact the exchange's official support only through the channel listed on its own verified site. Do not respond to any follow-up message, call, or chat that reaches out to you first, since that's the exact pattern fake support scams use to exploit a moment of genuine alarm.

Does proof of reserves guarantee an exchange is safe?

No. Proof of reserves demonstrates that an exchange holds assets matching customer balances at the specific moment the snapshot was taken; it doesn't verify solvency against liabilities, confirm ongoing custody practices, or prevent a hack the day after publication. It's one meaningful signal among several, covered fully in Proof of Reserves Explained, not a standalone safety guarantee.

If an exchange is regulated, does that mean my funds are insured?

Not automatically. Regulatory registration typically covers licensing, reporting, and consumer-protection rules in a given jurisdiction, which is meaningfully different from deposit insurance or a dedicated protection fund that would actually reimburse customers after a hack or insolvency. Check the two separately: Regulatory Status and Exchange Security covers licensing, and Exchange Insurance Funds Explained covers what, if anything, is actually backstopped.

Sources and Methodology

This guide synthesizes practices drawn from publicly available regulatory guidance, standards documentation, and law-enforcement advisories as of mid-2026. Key sources include:

Financial Action Task Force (FATF): FATF's guidance on virtual asset service providers documents the licensing, disclosure, and jurisdictional standards this checklist's "check regulatory status" item draws on.
National Institute of Standards and Technology (NIST) Digital Identity Guidelines: NIST's authentication-strength guidance, ranking SMS, app-based, and hardware-based second factors by phishing and interception resistance, informs the two-factor authentication recommendation in Phase 2.
FBI Internet Crime Complaint Center (IC3): IC3's public advisories on cryptocurrency-related fraud document the fake customer-support and account-recovery scam patterns this checklist's "never respond to unsolicited contact" item is designed to interrupt.

The worked example in this guide is a hypothetical, illustrative scenario constructed for educational purposes and does not describe a specific real exchange, incident, or account.

This content was reviewed by the Swoopr Editorial Team in August 2026 and reflects publicly available information at that time. Exchange practices, regulatory frameworks, and attacker techniques all evolve; treat this guide as a durable framework rather than an exhaustive or permanently current list of every available platform feature.

Conclusion

Every other guide in this sub-group answers a narrower question well: how to evaluate a platform's regulatory standing, what proof of reserves actually proves, how custody and cold storage work, how strong a given two-factor method really is, how whitelisting and withdrawal limits work together, how API keys get scoped and abused, how account recovery gets hijacked, and what past exchange hacks actually teach. This page's job is different — it's the routine that ties all of that knowledge into something repeatable. Check regulatory status, proof of reserves, custody practices, insurance transparency, and incident history before choosing a platform. Enable the strongest two-factor method, address whitelisting, an appropriate withdrawal limit, and minimally scoped API keys when you set up the account. Then, on a genuine recurring schedule rather than only after a scare, monitor for unusual notifications, review keys and whitelist entries, refuse unsolicited support contact, and keep only what you actually need on the platform. None of these thirteen items require deep technical expertise. What they require is treating exchange security as a permanent, ongoing practice rather than a box checked once at signup and forgotten.