Why one strong password isn't enough
Taking over an exchange account doesn't require cracking the password. A convincing fake email, a fake official site at the top of the search ads, or a login left open on someone else's computer will do; the attacker only has to fool you.
So the approach is to stack several doors rather than rely on one very strong password. No single layer stops every attack, but stacked together they force an attacker to get through several in a row.
The seven layers below run from the most basic one, which you can set the moment you register, to the manual check right before a withdrawal. Binance Academy also has an article, 5 Ways to Improve Your Binance Account Security, covering RSA key pairs and IP restrictions for API keys, the anti-phishing code, stronger two-factor authentication, and the withdrawal allowlist (“whitelisting” in that article) together with a strong password.
None of these layers is a master lock. The anti-phishing code blocks email phishing, the allowlist blocks transfers after a takeover, and two-factor blocks logins with stolen credentials. Each covers one stretch, and the depth comes from setting all seven.
Layer 1: A dedicated email and a password used exactly once
This is the least visible layer, and an easy one to skip. Suppose your Binance account uses the same email address you register everywhere with, paired with a password shared with other sites. If that password has leaked from any one of those sites, attackers will try the same email and password pair on the big exchanges one after another. That is credential stuffing.
Two moves close the hole. Register a separate address you use for exchanges and almost nothing else — not for shopping, not on any public profile. Then let a password manager generate the password, and let that password exist in exactly one place. Do not invent one yourself. Human-invented passwords cluster into patterns that cracking dictionaries finished mapping years ago.
One clarification while we are here: a login password is not a second factor. It is only the first door, and the layers after it are where the real difference in security comes from.
Layer 2: Replace SMS with an authenticator app or passkey
You almost certainly have two-factor authentication (2FA) switched on already. The question here is which kind.
If your second factor is an SMS code, turn it off wherever you can and switch to an authenticator app or a passkey; where Binance requires phone verification to stay on, follow its official instructions. The biggest weakness of SMS is the SIM swap: an attacker uses social engineering to get hold of your personal details, then goes to your carrier and has your number reissued on a new SIM. Once the number has moved, you stop receiving the codes and the attacker starts receiving them, and SMS two-factor fails on the spot.
Ranked from workable to best: a TOTP code from an authenticator app such as Google Authenticator or Authy is generated on your device and owes nothing to your carrier. Above that sit passkeys and a hardware security key like a YubiKey, where the credential is bound to a physical object and a phishing page has nothing to capture. Binance supports all of them.
The reasoning behind this layer is in Is SMS 2FA Safe? Authenticator vs Passkey; if any of the terms are new, look them up in the glossary.
When you turn on TOTP, Binance gives you a backup key a dozen or so characters long (some screens call it a secret key or a recovery code). Copy it down separately and keep it safe. If the phone is lost or the app is deleted by mistake, that backup is what lets you restore the authenticator on a new device. A screenshot saved on the same phone is no backup at all.
Layer 3: The anti-phishing code for spotting fake emails
The anti-phishing code takes a minute to set, and it deals with emails that impersonate Binance.
The logic is neat. You choose a string of your own (say, a word only you know plus a few digits), and from then on every official email Binance sends you carries it. The mass-mailed fake — unusual login activity on your account, click the link to verify — can't carry it, because the sender doesn't know what you picked. So the most reliable way to use the code is in reverse: an email without it gets deleted.
The reverse doesn't hold. A code that matches only removes one doubt; it doesn't make the email, or the link inside it, trustworthy, because an email can still be forged even when the sender address looks fine. For anything that needs doing on the account, go through the official bookmark you saved yourself rather than a button in the email.
The setting is in the security settings of your Binance account: find the anti-phishing code, turn it on and enter a string you'll remember and others won't guess. For the length and the characters allowed, go by what the settings page says at the time. One thing to remember: anyone who asks you for your anti-phishing code, including someone claiming to be official support, is a scammer.
Layer 4: The withdrawal allowlist
Everything so far has been about keeping people out. This layer assumes one of them got in anyway and narrows where the coins are able to go. Said plainly, because it matters: what the allowlist buys you is reaction time, not an absolute block.
With the allowlist on, withdrawals only go to addresses you added and verified beforehand. Put your own wallet and your deposit address at a second venue on it once, and ordinary withdrawals feel no different afterwards. What gets stopped is precisely what a thief wants to do — push a large balance to a fresh address immediately — because that address is not on the list, and adding one means clearing a passkey or two-factor check again, then, if you have the new-address hold switched on, waiting it out. Worth knowing as well: editing the allowlist, or switching a security feature like this off, can itself suspend withdrawals on the account for a period. That pause is an obstacle to whoever is inside and a window for you to notice and act.
Two companion settings are worth opening while you are there. The new-address hold freezes a newly added address for a period before anything can be sent to it, and that window is your chance to notice something has gone wrong. The other is quick withdrawal, which waives the second check for small amounts going to allowlisted addresses. It is more convenient, at some cost in security. I'd leave it off and verify every time.
A handful of regular addresses on the list, the new-address hold on, and left that way. Picture signing in from a machine you do not normally use and noticing a browser extension behaving oddly. What lets you stay calm is knowing the shape of the worst case: even with that machine compromised and the session stolen, nobody can pick a fresh address and send to it on the spot — they would have to go and edit the allowlist first, which leaves traces and takes time. The risk is still there; what the allowlist buys you is time to notice.
Layer 5: Devices, sessions and API keys
Security is not only about the moment you sign in. It is also about what stays behind afterwards. A few lists in the security settings deserve a look from time to time.
Device management shows every device that has signed in to the account. Remove anything you do not recognize, and anything you no longer use, such as an old phone or an old computer. Account activity gives you recent logins with time, address and region; a line you cannot account for means change the password first and investigate second. Then API keys. If you have ever run a trading bot, a copy-trading tool or a portfolio tracker, it asked you for one. Delete the keys you no longer use. An old key with withdrawal permission still attached is a back door whose owner has forgotten it exists.
The same habit belongs on-chain, where stale token approvals sit around for years for identical reasons: permissions pile up unless you go back and prune them. The method is in How to Check and Revoke Token Approvals. On the exchange side it means clearing out devices, API keys and sessions on a regular basis.
Layer 6: The habits that beat phishing
The first five are settings. You do them once. This one is a habit, and it has to travel with you, because no switch helps when the account holder types real credentials into a convincing fake.
- Reach the site through a bookmark, not through search. The result at the top of a search page, marked as an ad and labeled as the official Binance site, may be a phishing site. Type the domain by hand once, bookmark it, and use the bookmark from then on.
- Don't follow a link from an email, an SMS or a direct message to log in. To do anything on the account, open the official site from your bookmark yourself instead of a link someone gave you. Together with the anti-phishing code from layer three, an email without your code gets deleted.
- Don't treat anyone who phones or messages you first as support. Anyone claiming to be Binance support who asks you to move funds to a “safe account”, read out a code from your screen, or install remote-access software to help with an investigation is running a scam. How to respond is in the fake support section of the phishing scams article.
How to recognize fake airdrops, fake approval pop-ups, fake apps and search ad placements is covered in 13 Crypto Phishing Scams and How to Spot Them.
Layer 7: Two checks before you press withdraw
The last layer lands at the moment money actually moves. The first six protect the account. This one protects you from your own hands. A broadcast transaction is final and no support desk can pull it back (the FAQ covers the different cases of a withdrawal sent to the wrong address). So do two things before every withdrawal.
One, check the address character by character. After pasting it, don't settle for a glance that says it looks about right: check from the first character to the last, not only the start and the end. One kind of clipboard malware watches for crypto addresses: you copy your own address, and what gets pasted has been quietly replaced with the attacker's. Checking every character is the defense against that.
Two, send a test amount first. The first time you withdraw to a new address, send a small amount worth a few dollars, wait for it to arrive and confirm the address is right, then send the rest. The fee on that small transfer buys the assurance that nothing went to the wrong place, so don't skip it.
The other way withdrawals go wrong is the network selector. The same ticker on a different chain is a different contract, and choosing the wrong one can leave the transfer somewhere you cannot reach; USDT on the wrong network covers what is still recoverable. Check the network in the same breath as the address.
Why count withdrawing as part of account security at all? Because it is the step where an asset moves from the exchange into your own control. However well the account is set up, money still held by the platform isn't fully in your own hands yet.
The seven layers at a glance
The same seven in one table: what each one blocks, and roughly what it costs in time. Work down it with the Binance security page open in another tab and tick them off.
| Layer | What it mainly blocks | Rough time |
|---|---|---|
| Dedicated email and a unique password | Credential stuffing, password reuse | About 10 minutes |
| Two-factor, moved off SMS | Logins with stolen credentials, SIM swap | About 5 minutes |
| Anti-phishing code | Email impersonating the exchange | About 1 minute |
| Withdrawal allowlist | Funds being moved out after a takeover | About 5 minutes |
| Devices, sessions and API keys | Leftover logins, forgotten API back doors | A few minutes, from time to time |
| Anti-phishing habits | Fake sites, fake support, fake links | An ongoing habit |
| Two checks before withdrawing | Wrong address, wrong network, clipboard malware | About a minute per withdrawal |
The times in the table are only there to set expectations. For the exact entry points and option names, go by Binance's official pages; menu locations in the app and on the web are adjusted from time to time. If you can't find a setting, searching the Binance help center for its name is the fastest way.
Common questions
Do I really need the anti-phishing code, and what happens if I skip it?
I strongly recommend it. The anti-phishing code is a string you choose, and once it is on, every official email Binance sends you carries it. A mass-mailed fake can't carry it, because the sender doesn't know what you picked, so the most reliable way to use the code is in reverse: an email without it gets deleted. Skip the code and a fake “unusual activity on your account, click here to verify” email looks the same as a real one and is hard to tell apart. The reverse doesn't hold: a code that matches only removes one doubt and doesn't make the link in the email safe to click, because an email can be forged even when the sender address looks fine. For anything that needs doing on the account, go through the official bookmark you saved yourself. The code doesn't stop every attack, but it screens out mass-mailed fakes, and all it costs is a minute to set a string you'll remember.
If I turn on the withdrawal allowlist, will an urgent withdrawal become painful?
No, provided you set it up before you need it. The rule is simple: coins can only leave to an address you added and verified in advance. Put your regular destinations on the list once and ordinary withdrawals feel unchanged. What the list blocks is a large transfer to a brand new address right now, which happens to be the first thing a thief reaches for. When you genuinely need a new destination, add it ahead of time and wait out the new-address hold (that restriction has to be switched on separately) rather than switching the allowlist off for one transfer, because switching it off removes the only layer that still works once somebody is already inside the account. Be aware too that editing the allowlist, or turning a security feature like this off, can itself suspend withdrawals on the account for a period. What the waiting buys you is reaction time rather than an absolute block: a stolen session cannot quietly pick a fresh address and empty the balance before you have a chance to notice.
Can I still use SMS codes for two-factor (SMS 2FA)?
Turn it off wherever you can. The weakness of SMS is the SIM swap: someone takes your personal details to your carrier and gets your number reissued on a SIM they hold, and once the number has moved, the codes go straight to their phone. A steadier choice is a time-based code (TOTP) from an authenticator app, or a step further, a passkey or a hardware security key. Where Binance requires phone verification to stay on, follow its official instructions; for the account's main second factor, switch to one that doesn't depend on a phone number.
If every security setting is done, are my coins safe on the exchange?
Doing all of it sharply reduces the odds that an attack aimed at you personally succeeds, whether that is phishing, account takeover or social engineering. It does nothing about risk at the platform level: the company itself running into trouble, a regulator freezing activity, withdrawals paused in a violent market. That is where the old line still holds, not your keys, not your coins. Keeping trading money and spending money on an exchange is perfectly normal. For an amount you plan to leave untouched for years, the safer home is a wallet whose private key you hold yourself. Those two are a division of labor rather than a contradiction.
Which of the seven to set first
If you only have time for one, turn on the withdrawal allowlist, then move two-factor off SMS; the anti-phishing code takes a minute, so set it in the same sitting. Then fill in the rest in the order above.
With all seven set, what you've blocked is attacks aimed at you personally. Platform-level risk is beyond the reach of account settings; the way to deal with it is to move the part you won't touch for a long time into a wallet whose private key you hold. For which part stays on the exchange and which part moves out, see Cold Wallet vs Hot Wallet: Key Differences.