Exchange Account Security Settings Compared: Passkeys, Withdrawal Whitelists and Anti-Phishing Codes, Which Exchanges Support Them and How to Set Them Up After Signing Up

I have accounts at several international exchanges, including Bybit, Binance, OKX and Bitget, and each one names the options in its security center a little differently. This article sorts out exchange account security settings: which features each exchange supports, what each one protects against, and which settings to turn on, in order, after you sign up.

The short answer: turn on at least three exchange account security settings: replace SMS verification with a passkey, a physical security key or an authenticator app, turn on the withdrawal address whitelist, and set an anti-phishing code. Two more are mechanisms on the exchange’s side that you can check when choosing an exchange: whether withdrawals are suspended for a while after you change security settings, and whether there is a public bug bounty program. These five are also what the “Account security and cybersecurity” item in my rating is scored on.

This article is a summary of information and is not investment, tax or legal advice. Exchanges’ features, menu locations and rules change, and every description here shows the date it was checked; before you change any settings, go by the exchange’s current official pages.

Which account security features each exchange supports

Data checked: 2026-10-08

This table uses the same data as my exchange rating methodology. Every item is based on the exchange’s official help pages and shows the date it was checked. Where the table says “not in official docs”, I could not find the feature in the official help pages, which does not necessarily mean the exchange lacks it entirely; I will update the table if I find official documentation later.

Two things to keep in mind when reading the table:

• An exchange having a feature does not mean your account has it turned on. For the first three (passkey or hardware key, withdrawal whitelist, anti-phishing code), Binance’s and OKX’s help pages both say you have to add or turn them on yourself in the security settings.
• “Passkey or hardware key” is a single column and does not distinguish between the two. If you want to use a physical security key, first confirm that the exchange’s help pages mention it.

What each of the five account security features protects against

Passkeys or physical security keys: against someone logging in to your account

Two-factor authentication (2FA) is a second check on top of your password. Common methods are SMS verification codes, authenticator apps (such as Google Authenticator), passkeys and physical security keys.

SMS codes are the most convenient, but the phone number itself can be taken. A document from the US Federal Communications Commission (FCC) dated 25 October 2023 describes “SIM swapping”: scammers convince the victim’s carrier to move the phone number and mobile service to a phone the scammers control, and from then on the verification codes go to them.

Passkeys and physical security keys use the FIDO standards. The FIDO Alliance (checked 2026-10-12) explains that a passkey is bound to the website or app that created it and there is no shared secret between the two sides; resisting phishing is its core design goal.

Plan your backup before you start:

• Where the passkey is stored: Binance’s help page (checked 2026-10-12) says a passkey stored in iCloud Keychain syncs to all Apple devices on the same Apple ID; if you choose to store it in your Chrome profile, it is stored only on that device.
• Carry the physical security key with you: OKX’s help page (checked 2026-10-12) notes that you need the key with you to use it, and losing the device or forgetting the PIN can still cause trouble.

Withdrawal address whitelist: against money being withdrawn to an unknown address

With the whitelist on, your account can only withdraw to addresses you have added to the list in advance. Even if someone logs in to your account, they cannot withdraw straight to an address outside the list.

Take Binance’s withdrawal settings guide (checked 2026-10-12) as an example:

• With the whitelist on, you can only withdraw to addresses on the list; turning it on requires verification with a passkey or 2FA.
• The “whitelist withdrawal restriction” blocks withdrawals to newly added addresses for a period you choose. Binance recommends keeping it on: if your account is compromised and the attacker adds their own address, you have time to act.
• Turning off the whitelist withdrawal restriction, or editing the whitelist, may suspend withdrawals for 24, 48 or 72 hours.

So it is best to set up the whitelist before you urgently need to withdraw, adding the wallet addresses you use regularly first.

Anti-phishing code: telling real exchange emails from fake ones

An anti-phishing code is a string of text you set yourself, and from then on the exchange’s official emails include it. Binance’s help page (checked 2026-10-12) says it is added to official emails and text messages; OKX’s account security guide (checked 2026-10-12) says all emails.

If a message you receive has no anti-phishing code, or the wrong one, treat it as phishing: do not click the links in it; open the exchange’s app yourself or type the address by hand to check. An anti-phishing code cannot block a fake website itself; what it does is let you see at a glance whether a message really came from the exchange.

Withdrawal suspension after security changes: time to deal with an account takeover

You do not turn this one on yourself; it is a rule on the exchange’s side. If someone logs in to your account and changes the password or 2FA, withdrawals are blocked for a while afterwards, which gives you time to notice and freeze the account.

Binance’s help page (checked 2026-10-12) says that after security actions such as changing your password, withdrawals are suspended for 24 to 48 hours, cannot be lifted before the time is up, and resume automatically afterwards. The rule affects you too: if you are changing phones or resetting 2FA, avoid days when you need to withdraw.

Bug bounty program: the exchange asking security researchers to find vulnerabilities

A bug bounty program is an exchange inviting outside security researchers to report vulnerabilities in its systems, with rewards based on severity. Readers do not need to set anything up; it shows the exchange is willing to let outsiders check its systems in the open. Having a public program does not mean an exchange will not be hacked, and not having one does not mean it is unsafe; in the rating it is worth 2 points, the same as each of the other four.

Exchange account security settings: what to turn on, in order, after signing up

The order below is a general approach. Each exchange names its menus differently: for example, Binance has it under “Account → Security” and OKX under “Security Center”. Follow each exchange’s help pages for the actual steps.

Login and verification

1. Set a password you use only for this exchange. Do not share it with your email or other websites.
2. Use a passkey, a physical security key or an authenticator app for 2FA, and if possible do not rely on SMS codes alone. On Binance the path is Profile → Account → Security → Passkeys (Biometrics) → Add Passkey; on OKX, to add a physical key the path is Profile and settings → Security Center → Passkeys → Add passkey → Use another device or external key (both help pages checked 2026-10-12).
3. Prepare a backup: think through which account or device holds your passkey, where you keep the physical key, and how you will move your authenticator app when you change phones, before you turn them on.
4. Check logged-in devices regularly: OKX’s account security guide recommends regularly checking linked devices and removing ones you do not trust, and revoking third-party app authorizations immediately if you have any doubts about them.

Withdrawal protection

5. Turn on the withdrawal address whitelist and add the wallet addresses you use regularly first; when adding an address, make sure the coin and network are both correct.
6. Keep the withdrawal hold on new addresses: if the exchange offers an option such as “suspend withdrawals to new addresses”, keep it on.
7. Set an anti-phishing code, remember what it looks like, and check it in every message from then on.

Everyday use

8. Download apps only from official channels, and install browser extensions only from official sources. OKX’s account security guide also notes that official support will never message you first.
9. If you see activity you did not do, change your password or freeze your account right away. OKX’s account security guide lists both of these steps.
10. Send a small test before a large withdrawal, confirm the address and network are correct, then withdraw the rest. For choosing a network, see How to choose a USDT withdrawal network.

What these settings cannot protect against

Account security settings protect against “other people operating your account”. There are three kinds of risk they cannot cover:

• Problems at the exchange itself: if the exchange is badly run, hacked or suspends withdrawals, it does not matter how well your account is set up. For this, look at the exchange’s proof of reserves and its past incidents; see How to check proof of reserves.
• You sending the money out yourself: if you are tricked into making a transfer yourself, you pass every check in person, and the whitelist cannot block an address you added with your own hands.
• Tampering with a wallet you hold yourself: once you withdraw coins to a cold wallet, safety depends on the wallet itself. For the checks to run after buying a cold wallet, see the checklist in Ledger theft incident.

So beyond the settings, keep only the amount you plan to trade on an exchange, and keep long-term holdings in a wallet where you hold the private keys, which is also the approach I describe in How to choose a crypto exchange.

How account security counts in the exchange rating

In my exchange rating methodology, “Account security and cybersecurity” is 5% of the total score: each of the five items above earns 2 points, up to 10 points, all based on official help pages. Items with more weight are proof of reserves (20%), volume and depth (20%), past incidents (15%) and licences (15%); a full set of account security features does not mean the exchange is safer overall.

For one exchange’s full security features and its other rating items, see each exchange’s review, for example the OKX review, Bybit review, Binance review and Bitget review; reviews of the other exchanges are on the crypto topic page.

FAQ

Which exchange account security settings should I turn on first?

First replace SMS verification with a passkey, a physical security key or an authenticator app for two-factor authentication, then turn on the withdrawal address whitelist and the anti-phishing code. These three block, respectively, someone logging in to your account, money being withdrawn to an unknown address, and phishing emails pretending to be the exchange.

Why is a passkey safer than an SMS verification code?

The FIDO Alliance explains that a passkey is bound to the website that created it and there is no shared secret between the two sides; it is designed to resist phishing. SMS codes, by contrast, can be intercepted through a SIM swap: the US FCC explains that scammers can convince a carrier to move a victim's phone number to a phone the scammers control.

What is an anti-phishing code?

An anti-phishing code is a string of text you set yourself, and from then on the exchange's official messages include it. Binance's help page says it is added to official emails and text messages; if a message you receive lacks this string or shows the wrong one, it may be phishing.

I turned on the withdrawal whitelist, so why can't I withdraw right after adding an address?

This is deliberate protection. At Binance, for example, once the whitelist withdrawal restriction is on, a newly whitelisted address cannot receive withdrawals for a period you choose, which gives you time to act if your account is compromised; turning off or editing the whitelist may also suspend withdrawals for 24, 48 or 72 hours.

Can support lift the withdrawal suspension early after I change my password?

Binance's help page says that after security actions such as changing your password, withdrawals are suspended for 24 to 48 hours, cannot be lifted before the time is up, and resume automatically afterwards. Other exchanges have different periods and conditions, so check each exchange's help pages.

If I turn on every account security setting, is my money safe on the exchange?

Not necessarily. These settings stop other people from operating your account. They cannot stop the exchange itself from running into trouble, being hacked or suspending withdrawals, and they cannot stop you from sending money to a scammer yourself. For long-term holdings, a cold wallet where you hold the private keys is the better place.