Updated Rules checked 2026-10-18
For exchange account security, I recommend six settings: switch two-factor authentication (2FA) to an authenticator app or a passkey, set an Anti-Phishing Code, turn on the Withdrawal Whitelist, check device management and login notifications, keep withdrawal permission off on API keys, and back up your authenticator key. Most of these 13 exchanges (Binance, OKX, Bybit, Bitget, MEXC, Gate, BingX, KuCoin, HTX, XT, WEEX, Pionex and Ourbit) keep these options under “Security Center” or “Security Settings” in the avatar menu.
What many people miss is that changing security settings locks withdrawals by itself. Of the 13, 10 state in their official help pages that changing security settings such as the authenticator restricts withdrawals for 24 hours; Binance restricts them for up to 48 hours after a 2FA reset, and Pionex blocks withdrawals for 72 hours after a Google Authenticator reset. So set up your security when you have time to spare, not when you urgently need to cash out.
Another common misunderstanding is the “whitelist.” At OKX, MEXC, HTX and Pionex, the whitelist is a restriction mode: once it’s on, you can only withdraw to addresses on the list. At Gate and Bybit, the whitelist leans toward skipping verification: withdrawals to listed addresses can skip the verification codes. Same name, different function. Below I’ve organized each exchange’s official documentation into lists and comparison tables, and marked anything that isn’t stated officially.
Key points: (1) For 2FA, use an authenticator app or a passkey; Bitget officially warns that SMS verification carries the risk of SIM hijacking. (2) Passkeys verify you with your face or fingerprint; 12 of the 13 exchanges describe this feature in their official help pages, and Ourbit’s help center doesn’t state it. (3) Once set, the Anti-Phishing Code appears in official emails, and Binance, Bybit and XT state that SMS messages carry it too; treat any “official email” without this code as suspicious. (4) At OKX, MEXC and Pionex, the Withdrawal Whitelist has a 24-hour wait for new addresses; at HTX, users choose when it takes effect, and turning the whitelist off also requires review by an administrator. (5) Since 2023-01-30, Binance API keys without IP binding can only have read permission; to enable withdrawal permission, you must first set an IP restriction. (6) Back up the key when you bind Google Authenticator; Bybit states that this recovery “mnemonic phrase” is shown only once and the platform doesn’t store it.
The information below was checked against official pages on 2026-10-18 (data check date) and is provided for reference.
Which type of 2FA should you choose?
Exchanges commonly offer four kinds of 2FA: SMS codes, email codes, authenticator apps (such as Google Authenticator, which generates a 6-digit code every 30 seconds) and passkeys. Several exchanges officially recommend a passkey or an authenticator app first, with SMS further down. Bitget’s account security advice states that it “strongly recommends using Google Authenticator and Passkey” and warns that SMS verification may leak through SIM hijacking (Bitget account security best practices). Binance’s and XT’s security tips use the same sentence to recommend replacing SMS verification with a passkey or an authenticator app (Binance account security tips, XT account security tips).
The biggest risk with an authenticator app is switching phones. When you bind it, the screen shows a key or a QR code, and you need to write that key down and store it separately. Bybit calls it a “mnemonic phrase” and states that it’s shown only once, at binding, and that Bybit doesn’t store it (Bybit: How to recover your Google Authenticator code). KuCoin also states that if you saved the key, you can rebind on a new phone simply by entering the key there (KuCoin Google 2FA setup guide). Also, at KuCoin, entering a wrong Google verification code 5 times in a row locks it for 2 hours; if your codes keep showing as wrong, first check that your phone’s time is set to automatic.
What is a passkey?
A passkey is a FIDO-standard sign-in method that verifies your identity with your phone’s or computer’s own face recognition, fingerprint or screen lock, with no password or verification code to type. Pionex explains it clearly: biometric data stays on the device and is never uploaded to the server, so even someone who gets your account and password can’t pass verification without your phone; once it’s enabled, a withdrawal only needs biometric verification, with no need to enter email, SMS and Google Authenticator codes one after another (Pionex: Passkey feature overview).
Check the device requirements before you set one up. OKX requires iOS 16.0.0 or later or Android 14.0 or later, and also accepts FIDO2-compatible USB security keys (OKX: How to create a passkey (app)). HTX states iOS 16 or Android 9 or later and allows up to 10 passkeys (HTX: How to create a passkey). XT supports iCloud Keychain and USB or NFC security keys, and you can also scan a QR code to create one with another phone (XT: How to create a passkey).
A few more points. Binance has a “Must verify using passkey” switch; once it’s on, login and withdrawals can only use a passkey. Binance warns that losing the passkey means you can’t log in, and asks you to turn the switch off before changing phones, changing iCloud accounts or reinstalling the app (Binance: the “Must verify using passkey” function). Deleting a passkey also counts as a security setting change: OKX restricts withdrawals for 24 hours when you reset a passkey, or remove one without verifying with another passkey, and Bybit and KuCoin also list “removing a passkey” among their 24-hour withdrawal restrictions. Pionex states that passkeys are disabled when you open the site in the built-in browser of apps such as Telegram or WeChat, so use a regular browser or the official app instead.
How do you use an Anti-Phishing Code?
An Anti-Phishing Code is a string of text you set yourself; once it’s set, the official emails the exchange sends include it. When you get an email claiming to be from the exchange, look for the code first: if it’s missing or wrong, don’t click any links in it. Where it appears and the length limits differ by exchange:
- Binance: appears in official emails and SMS; 6 to 8 characters, with at least three of uppercase letters, lowercase letters, numbers and underscores, and no special characters. On the website, set it under [Account] → [Security] → [Advanced Security] (Binance: What is an Anti-Phishing Code, updated 2026-08-28).
- Bitget: appears on the login page, in emails and in SMS; set it under “Security Center” → “Advanced Settings” → “Anti-Phishing Code” (Bitget: How to set an Anti-Phishing Code).
- MEXC: only states that it appears in official emails; 1 to 6 characters, no special characters (MEXC: How to set an Anti-Phishing Code).
- KuCoin: appears in emails and in the login window (KuCoin account security overview).
- XT: included in both emails and SMS, but for now it can only be set on the website, not in the app (XT: Set up or change your Anti-Phishing Code).
- BingX: 4 to 20 characters, set in the advanced security settings (BingX account security guide).
An Anti-Phishing Code mainly helps you identify emails and SMS; it won’t stop phone calls from fake support agents. Bitget and KuCoin show the code on the login page, so if you don’t see it when you log in, suspect the URL. Other exchanges only show it in emails or SMS, so if you click through a search ad to a fake site, there’s nothing to check against. That’s why, besides setting an Anti-Phishing Code, you should bookmark the official URL and always go in through the bookmark.
How do you set up a Withdrawal Whitelist?
The Withdrawal Whitelist is the last line of defense if your account is compromised: even if the attacker logs in, they can only send coins to addresses you added in advance. Pionex states that once the whitelist is on, you can only withdraw to specified addresses and the system rejects any other address; newly added whitelist addresses can be used only after 24 hours, and even internal transfers are subject to the whitelist (Pionex: What is the withdrawal whitelist).
Waiting times and how you turn it off vary a lot between exchanges:
- OKX: in the app, go to “Assets” → “Withdraw” → “Address book” → “Address settings” and turn on “Allowlist mode.” “New address withdrawal lock” is optional; once it’s on, you can’t withdraw to newly added addresses for 24 hours (OKX: How to use the withdrawal allowlist (app)).
- MEXC: once “Whitelist security restriction” is on, new addresses have to wait 24 hours; if you turn it on and then off again, you also have to wait 24 hours before you can withdraw (MEXC: How to set withdrawal settings).
- HTX: when you turn it on, you choose when it takes effect; for example, if you choose “takes effect after 3 days,” new addresses have to wait 3 calendar days. Shortening the effective time or turning the whitelist off both require review by a platform administrator, which HTX states takes “anywhere from a few minutes to a few days” (HTX: Withdrawal address whitelist guide (app)).
- Binance: once it’s on, you can only withdraw to whitelisted addresses; changing the whitelist (including adding an address) may suspend withdrawals for 24, 48 or 72 hours (Binance: Managing withdrawal settings).
- Bybit: the “Withdrawal Address Whitelist” skips verification; there are also two separate switches, “Withdraw to Address Book Only” and “New Address Withdrawal Restriction,” and disabling the latter restricts withdrawals for 24 hours (Bybit: How to manage your withdrawal security).
- Gate: once you tick “verification-free” for a whitelisted address, withdrawals no longer need SMS, email or Google Authenticator codes or the fund password; each network is set up separately (Gate: How to set up a withdrawal address whitelist in the app).
Gate’s and Bybit’s verification-free addresses are convenient, but know the trade-off: if your account is compromised, withdrawals to these addresses need no verification code. If your whitelist only holds your own cold wallet or deposit addresses at another exchange, the risk is small; just never make an address of unknown origin verification-free. To restrict where withdrawals can go, the switch to turn on at Bybit is “Withdraw to Address Book Only.” Before you withdraw, also make sure you’ve picked the right network; for what to do if you pick the wrong one, see how to recover a wrong-network deposit.
What should you check in device management and login notifications?
Check your list of logged-in devices regularly, and log out any device you don’t recognize right away. At OKX the path is “Security center” → “Device management,” and the same guide also recommends revoking third-party apps you no longer use under “Authorization management” (OKX: Account security enhancement guide). In the Pionex app, go to your avatar → “Security settings” → “Logged-in devices”; on the website, it’s “Account security” → “Login device management” (Pionex: Unusual login alerts).
A login notification doesn’t necessarily mean your account has been stolen. Pionex states that it sends an alert whenever it detects a new IP or a new device, and switching Wi-Fi or turning on a VPN can trigger one; the location shown for an IP depends on the network provider, so it’s normal for it to differ from the city you’re actually in. What really deserves attention is a notification at a time when you did nothing at all, or a device model you don’t recognize. In that case, Pionex recommends that you, in order, change your login password, rebind Google Authenticator, make sure your registered email is secure and, if necessary, contact support to freeze withdrawals first.
Bitget adds a restriction for new devices: after a new device logs in successfully, payments and withdrawals on that device are restricted for 1 hour, while devices you used before aren’t affected (Bitget: Why are my withdrawals restricted). BingX offers a one-tap “Account Lock” that you can use immediately when you notice a login, withdrawal or security setting change that wasn’t you (BingX: Anti-Phishing Code, withdrawal whitelist and account lock). For how to get a locked or frozen account back, see what to do if your exchange account is frozen.
How do you set API key permissions safely?
API keys let bookkeeping tools, trading bots or copy-trading platforms operate your account directly, without logging in. In its help page on compromised accounts, Pionex states that if an API key leaks, the other party can place orders and even withdraw funds without logging in (Pionex: What to do if your account is compromised). The official rules at several exchanges:
| Exchange | Official rule | Source |
|---|---|---|
| Binance | Enabling withdrawal permission requires adding an IP access restriction; since 2023-01-30, keys without an IP restriction can only have read permission | How to create API keys on Binance (updated 2025-03-20) |
| OKX | Keys not bound to an IP that have trading or withdrawal permission are deleted automatically after 14 days of inactivity; each key can be bound to up to 20 IPs | API FAQ (updated 2026-09-28) |
| XT | New keys have query-only permission by default; IP binding is recommended; up to 10 keys per person, and the private key is shown only once | How to create an API key (updated 2026-08-01) |
| HTX | The withdrawal whitelist only restricts the app and website; API users aren’t bound by the whitelist and still withdraw to the addresses defined in the API | Withdrawal address whitelist guide (web) (2025-11-14) |
Source: each exchange’s official help center as linked in the table above, checked 2026-10-18.
The HTX rule deserves the most attention: the whitelist can stop someone who has stolen your account, but not a leaked API key. The safer approach is to never enable withdrawal permission on keys you give to third-party tools, bind an IP whenever you can, and delete keys you no longer use. For how to judge copy-trading platforms and bots that ask for API access, see how to spot copy-trading scams.
Security features at 13 exchanges compared
In the table below, “withdrawal lock” means the withdrawal suspension each exchange officially states after you change security settings. The triggers aren’t exactly the same at every exchange; see the source pages for details.
| Exchange | 2FA types | Passkey | Anti-Phishing Code | Withdrawal whitelist | Withdrawal lock after changes |
|---|---|---|---|---|---|
| Binance | Passkey, authenticator app, SMS, email | Yes; “Must verify using passkey” available | Yes, email and SMS | Restriction mode; changes may suspend withdrawals for 24/48/72 hours | Up to 48 hours after resetting 2FA or changing the authenticator (source) |
| OKX | SMS, email, authenticator app, passkey | Yes; FIDO2 USB security keys supported | Yes, email | Allowlist mode; 24-hour lock on new addresses (optional) | 24 hours after changing the login password or verification method (source) |
| Bybit | Email, SMS, Google Authenticator, passkey | Yes | Yes, email and SMS | Whitelist is verification-free; also address-book-only withdrawals and a new-address withdrawal lock | 24 hours after 9 kinds of actions, such as changing the password, phone, email, Google Authenticator or fund password, or removing a passkey (source) |
| Bitget | SMS, Google Authenticator, passkey | Yes; Google Authenticator must be bound first | Yes, email, SMS and login page | Yes | 24 hours after resetting the password, fund password or Google Authenticator, or changing email or phone (source) |
| MEXC | Google Authenticator, SMS, email, passkey | Yes | Yes, email | Restriction mode; new addresses wait 24 hours | No withdrawals or transfers for 24 hours after unbinding Google Authenticator (source) |
| Gate | SMS, Google Authenticator, email, passkey | Yes; two verification methods must be enabled first | Yes, email | Verification-free addresses, set per network | 24 hours after binding or unbinding phone, Google Authenticator or email, or resetting the login or fund password; can’t be lifted early (source) |
| BingX | Phone, email, Google Authenticator | Yes; officially stated as currently used for login | Yes, email | Restriction mode | 24 hours after removing or changing a security item (source) |
| KuCoin | Phone, email, Google verification, passkey | Yes | Yes, email and login window | Yes; withdrawals to whitelisted addresses need only the trading password | 24 hours after 7 situations, such as deleting a passkey or changing Google verification, trading password, phone or email (source) |
| HTX | Phone, email, Google Authenticator, passkey | Yes, up to 10 | Yes (settings page); where it appears is not stated officially | Restriction mode; user chooses the effective time; turning it off requires review | 24 hours after changing a security setting in the Security Center (source) |
| XT | Google verification, SMS, email, passkey | Yes; USB/NFC security keys supported | Yes, email and SMS; can only be set on the website | Not stated officially | 24 hours on withdrawals and C2C sales after changing or unbinding verification (source) |
| WEEX | Phone, email, Google Authenticator, passkey | Yes; hardware security keys supported | Yes, email | Address management; new addresses need email confirmation | Not stated officially |
| Pionex | Email, SMS, Google Authenticator, passkey | Yes | Not stated officially | Restriction mode; new addresses wait 24 hours | 72 hours after resetting Google Authenticator (source) |
| Ourbit | Google Authenticator, email | Not stated officially | Yes, email | Not stated officially | 24 hours after resetting the Google Authenticator code (source) |
Source: each exchange’s official help center and security settings pages, checked 2026-10-18. WEEX is based on its official security settings page and account security guide; Ourbit’s Anti-Phishing Code on its official verification guide; Bitget’s whitelist on its advanced account security guide.
The table lets you work out the worst case. Take resetting a lost Google Authenticator: Binance’s review takes up to 24 hours, and withdrawals are then restricted for up to another 48 hours, so up to 72 hours in total; Pionex completes its review within 72 hours and then blocks withdrawals for another 72 hours, so up to 144 hours in total, or 6 days; OKX restricts withdrawals for 24 hours after the reset. If you choose “takes effect after 3 days” for the HTX whitelist, every new address you add takes 72 hours. Before changing phones, traveling abroad or planning to move coins, give yourself a week.
What if you change phones or lose your 2FA?
While you still have the old phone, sort everything out before you switch: rebind the authenticator on the new phone with your backed-up key, or use a code from the old authenticator to “change” the authenticator in the Security Center. If you turned on Binance’s “Must verify using passkey,” turn it off before switching. Pionex states that passkeys sync automatically as long as the new phone is signed in to the same Apple ID or Google account; if a passkey doesn’t work after syncing, delete the old one and create a new one.
If the authenticator is already lost, go through each exchange’s self-service reset process. The entry point is usually on the verification page during login:
| Exchange | Reset entry point | What you need | Review time | Withdrawal restriction after reset |
|---|---|---|---|---|
| Binance | On the verification page, “Security verification unavailable?” → tick the items you can’t use → “Confirm Reset” | Other verification methods you can still use; a new phone number or email if needed | Up to 24 hours | Up to 48 hours, including C2C sales and internal transfers |
| OKX | “Use another verification method” → “Reset 2FA” | Face verification if you’re already logged in | Not stated officially | 24 hours, including C2C selling |
| Bybit | “Security verification unavailable” → “Google Authenticator unavailable” | A code sent to your registered email or phone; a manual request if you can’t receive it | Manual requests: contacted within 1 to 3 business days | 24 hours, including P2P |
| MEXC | App: “Reset security verification” / website: “Security item lost” | Email code, contact phone number, a photo of you holding your ID, and answers about login dates, regions, trading pairs and assets | 1 business day | No withdrawals or transfers for 24 hours |
| XT | “Security verification unavailable” → “Confirm reset” | A photo of you holding your ID and a handwritten note, plus a video of your withdrawal records on another platform (up to 50MB) | Not stated officially; result sent by email | 24 hours, including P2P sales |
| Pionex | Login page “Lost security verification?” → “Start reset” | Registration month and year, nickname, and trading pairs you’ve run bots on | Within 72 hours | 72 hours |
Source: Binance (updated 2026-06-03), OKX (updated 2026-08-25), Bybit (updated 2025-11-25), MEXC, XT (updated 2026-10-06), Pionex, checked 2026-10-18.
At KuCoin, the entry point is “Forgot password” → “Google Authenticator unavailable” on the login page, and you can’t withdraw for 24 hours after the reset. The OKX, MEXC and XT reset processes ask for face verification or a photo of you holding your ID, so it’s best to complete identity verification in advance; for each exchange’s process, see KYC guides such as Binance identity verification and OKX identity verification. If support asks for your account number, just give your UID; for what a UID is, see what an exchange UID is.
What are the common ways accounts get stolen?
- Search ads and fake sites: XT’s security tips state that you shouldn’t click links in search ads, social media comments or messages from strangers, and should only go in through the official website or official app stores. Fake sites copy the login page to trick you into entering your password and verification codes.
- Fake support and remote control: someone claiming to be support asks you to install software such as TeamViewer or AnyDesk to “help with your account.” Pionex states that its support will never ask you to install remote access software; if you’ve done it, treat the device as compromised.
- SIM hijacking: the attacker impersonates you to get a replacement SIM card and receives your SMS codes. Bitget and WEEX both cite this reason when they recommend an authenticator app over SMS.
- Unofficial apps: Pionex lists downloading APKs from unofficial sources as one of the most common causes of account compromise.
- Requests for verification codes: HTX states that it will never ask for your password, SMS or email verification codes, or Google Authenticator codes (HTX: How to strengthen account security), and XT also states that it won’t ask for passwords, private keys or 2FA codes. Anyone who asks you to read out a code, send a screenshot or share your screen is a scammer.
To check whether a call, email or URL is official, use the exchange’s official verification tool; XT and Ourbit, for example, both have official verification channels. If you get a suspicious call or message in Taiwan, you can call the 165 anti-fraud hotline (165 反詐騙專線) to check. More scam methods are collected in crypto exchange scam types, and for cases where you’re asked to pay before you can withdraw, see fake exchange withdrawal scams.
Rebates don’t require handing over any verification details either. On exchanges you sign up to with this site’s referral codes, the exchange pays the rebate automatically based on the referral relationship. For example, with the Binance referral code KEVINWU, the current automatic exchange rebate is 20% (updated 2026-10-23); every exchange is listed in the crypto exchange referral codes roundup. Bybit has no automatic exchange rebate that applies to this site, so you need to bind your UID through Fee Otter. This extra rebate is paid by Fee Otter, not by the exchange and not by Kevin Wu, and the rate is whatever Fee Otter’s page shows; for details, see Bybit fee rebate: Fee Otter. If any rebate site asks for your password, verification codes or API keys, don’t give them; the warning signs are collected in rebate scam warning signs.
FAQ
Is SMS or Google Authenticator safer for exchange 2FA?
An authenticator app such as Google Authenticator is safer than SMS, and a passkey is better still. Bitget officially warns that SMS verification may leak through SIM hijacking, and Binance and XT also recommend replacing SMS with a passkey or an authenticator app. If you use an authenticator app, back up the key the moment you bind it.
Where does the Anti-Phishing Code appear?
The Anti-Phishing Code mainly appears in the official emails an exchange sends. Binance, Bybit and XT state that SMS messages carry it too; Bitget also shows it on the login page, and KuCoin in the login window. MEXC only states that it appears in emails. If you get an “official email” without your Anti-Phishing Code, don’t click any links in it.
Why can’t I withdraw after changing security settings?
It’s an exchange protection mechanism that gives the real owner time to act if the account is stolen. 10 exchanges, including OKX, Bybit, Gate and KuCoin, state 24 hours; Binance restricts withdrawals for up to 48 hours after a 2FA reset, and Pionex for 72 hours after a Google Authenticator reset. Gate states that this restriction can’t be lifted early; you can only wait until the time is up.
What’s the difference between a Withdrawal Whitelist and an address book?
An address book only stores addresses you use often and doesn’t limit where you can withdraw; once a whitelist is on, you can only withdraw to addresses on the list. Pionex puts the two on separate tabs. Note that Gate’s and Bybit’s whitelists lean toward skipping verification: withdrawals to listed addresses can skip the verification codes. To restrict where withdrawals can go at Bybit, turn on “Withdraw to Address Book Only.”
What should I do before changing phones?
Before changing phones, move your authenticator to the new phone first, then deal with your passkeys. If you backed up the key, enter it on the new phone to rebind; if you didn’t, “change” the authenticator in the Security Center while the old phone still works. If you turned on Binance’s “Must verify using passkey,” Binance requires you to turn it off before you switch; otherwise you may not be able to log in.
How long until I can withdraw again after losing Google Authenticator?
It depends on the exchange: OKX restricts withdrawals for 24 hours after the reset, Binance takes up to 72 hours, and Pionex up to 6 days. OKX’s review time is not stated officially. Binance’s review takes up to 24 hours, plus a withdrawal restriction of up to 48 hours after the reset; Pionex reviews within 72 hours and then blocks withdrawals for another 72 hours. MEXC’s review takes 1 business day, followed by 24 hours with no withdrawals.
Is it safe to give an API key to a bot or bookkeeping tool?
The risk is only manageable if you enable read or trading permission but not withdrawal permission, and bind an IP. Binance requires an IP restriction before withdrawal permission can be enabled, and OKX automatically deletes keys with trading or withdrawal permission that aren’t bound to an IP and haven’t been used for 14 days. HTX’s withdrawal whitelist doesn’t restrict API withdrawals, which is all the more reason not to enable withdrawal permission casually.
What if I lose my passkey?
If you lose your passkey, log in with another verification method you’ve bound, then delete the old passkey and create a new one. Pionex states that you can choose “verify another way” on the verification page, and that deleting a passkey requires security verification with the methods bound to your account. After deletion, OKX, Bybit and KuCoin restrict withdrawals for 24 hours; if you turned on Binance’s “Must verify using passkey,” you’ll need to go through the 2FA reset process.
If your account shows unusual activity, is restricted or is frozen, see what to do if your exchange account is frozen; the exchanges’ own hack history is collected in exchange safety record. For the terms and arrival rules to know before withdrawing, see deposit and withdrawal terms explained, and for USDT withdrawal fees by exchange, see USDT withdrawal fees compared.