Every question to ask before depositing on a new exchange
You have chosen the venue. This is the half-hour of setup that decides whether an account compromise costs you everything or nothing.
Every question to ask before depositing on a new exchange
Choosing an exchange is a separate job, and we have a seven-question checklist for it. This is what comes next: the account setup that decides how much an attacker can take on the day something goes wrong.
Most of it takes half an hour, once, and almost nobody does it.
1. Replace SMS two-factor authentication
SMS codes are the weakest widely offered second factor, because a SIM swap defeats them entirely and does not require any access to your devices. This is not theoretical: Coinbase reported in 2021 that funds were stolen from roughly 6,000 customer accounts through credential compromise combined with an SMS-2FA bypass. Customers were reimbursed, which was the venue's choice rather than an obligation.
Use an authenticator app at minimum, and a hardware security key if the exchange supports one. A hardware key also defeats phishing, which an authenticator app does not.
2. Whitelist your withdrawal addresses
Most exchanges let you restrict withdrawals to a fixed list of addresses, with a delay of a day or more before a new address becomes usable. Turn it on before you deposit.
This is the single most effective control available to you, because it converts a full account compromise into a race you can win: an attacker with your password and your second factor still has to wait out the delay, during which you get the notification.
3. Find the withdrawal limits before you need them
Verification tiers cap how much you can move per day, and the caps are frequently not stated up front. BitMart publishes an entry tier capped at 0.06 BTC a day and describes the higher tier's limit only as "higher". Bybit publishes tiers and limits in full, including exactly what an unverified account cannot do — better disclosure than most.
A limit you discover during a market panic is a limit you discover too late.
4. Do a test withdrawal on day one
Deposit a small amount, then immediately withdraw part of it to your own wallet. You learn three things: whether withdrawals work at all, how long they actually take, and what the fee really is rather than what the schedule says.
An exchange that makes deposits instant and withdrawals slow has told you something important, and it costs a few dollars to find out.
5. Treat API keys as live ammunition
If you create API keys for a bot or a portfolio tracker, disable withdrawal permission and restrict them to specific IP addresses. Binance's 2019 loss of 7,000 BTC — covered by its protection fund and reimbursed — began with compromised API keys.
A read-only key that leaks is an embarrassment. A withdrawal-enabled key that leaks is a loss.
6. Use a unique email address
An address used nowhere else means credential-stuffing attacks from unrelated breaches cannot reach the account, and a phishing email arriving at it is immediately suspicious. It also means that when the exchange's customer list leaks — and lists do leak — the exposure is contained.
7. Know what happens when support is needed
Before depositing, find out whether there is a published status page with uptime history, documented API rate limits, and a support channel that reaches a person. Several venues of significant size publish none of these, which is informative in itself.
An address whitelist turns a total account compromise into a race you can win. Almost nothing else you can do has that ratio.
The short version
Hardware or app-based 2FA, an address whitelist with a delay, a unique email, API keys without withdrawal rights, and a test withdrawal on the first day. Look up your tier's withdrawal limit before you need it, and keep on the exchange only what you are actively trading.
Frequently asked questions
What should I set up on a new crypto exchange account?+
App-based or hardware two-factor authentication instead of SMS, an address whitelist with a time delay before new addresses become usable, a unique email address used nowhere else, API keys with withdrawal permission disabled, and a small test withdrawal on the first day.
Why is SMS two-factor authentication unsafe?+
A SIM swap defeats it without any access to your devices. Coinbase reported in 2021 that funds were taken from roughly 6,000 accounts through credential compromise combined with an SMS-2FA bypass. An authenticator app is better; a hardware security key also defeats phishing.
What is a withdrawal address whitelist?+
A setting that restricts withdrawals to a fixed list of addresses, usually with a delay of 24 hours or more before a newly added address can be used. It means an attacker who fully compromises your account still cannot move funds to their own address immediately.
Should I do a test withdrawal before depositing a large amount?+
Yes, on day one. It confirms withdrawals work, shows how long they actually take, and reveals the real fee rather than the published one. A venue where deposits are instant and withdrawals are slow has told you something worth knowing for a few dollars.
How this was reported
ChainWatch Daily is independent and reader-funded. Stories are written by named journalists and checked against primary sources before publishing. We disclose holdings, correct errors in the open, and never accept payment for coverage.
More like this
Do you need a multisig wallet?
The threshold is the point where one recovery phrase becomes the weakest part of your setup — and where you will genuinely maintain three backups instead of one.
Air-gapped wallets: when the extra step is worth it
A device that never connects to anything removes a whole class of attack, and adds friction to every single transaction. Both halves are real.
Why the same coin costs different amounts on different exchanges
There is no single price. There is a book on each venue, and the number you see on a price site is an average of places you are not trading.