Published · 4 min read
How to Keep Crypto Safe: 2FA, Allowlists & Custody Tips
Knowing how to keep crypto safe is just as important as knowing how to trade it. Digital assets behave like bearer instruments: once a transaction is confirmed on-chain, it generally cannot be reversed. That makes prevention — not recovery — the core of crypto security.
The encouraging news is that most losses come from a small set of avoidable mistakes. A handful of habits — strong authentication, withdrawal allowlists, phishing awareness and a deliberate custody plan — will protect you from the vast majority of threats you are ever likely to face.
Why crypto account security starts with the basics
Before anything exotic, get the fundamentals right. Use a long, unique password for every exchange account, generated and stored by a reputable password manager. Never reuse a password from another site, because breaches elsewhere are routinely replayed against crypto platforms.
Your email account deserves the same care, since it is usually the recovery path for everything else. Secure it with its own strong password and two-factor authentication, and treat any unexpected 'security alert' email with suspicion until you verify it independently.
Two-factor authentication: your first real line of defense
Two-factor authentication (2FA) means a stolen password alone is not enough to enter your account. Prefer an authenticator app that generates time-based codes on your device, or a hardware security key, over SMS codes — phone numbers can be hijacked through SIM-swap attacks.
When you enable 2FA, store the backup codes offline in a safe place. Losing your phone without backups can lock you out of your own account, which is stressful at the best of times and costly when markets are moving.
Withdrawal allowlists and account controls
A withdrawal allowlist restricts crypto withdrawals to addresses you have approved in advance, often with a time delay before a new address becomes active. Even if an attacker gets into your account, they cannot send funds to an address you never approved.
Review your account's security settings regularly: active sessions, connected devices and API keys. Revoke anything you do not recognize, and if something looks wrong, contact your platform immediately — PrimeFTX, for example, offers 24/7 human support, so a real person can help at any hour.
How to spot crypto phishing scams
Phishing remains the most common way people lose crypto. Attackers clone exchange websites, buy search ads for lookalike domains, and send urgent emails or messages designed to make you act before you think. Always reach your exchange through a bookmark you created yourself, never through a link in a message.
Two rules cover most cases: no legitimate platform will ever ask for your password, 2FA codes or wallet seed phrase; and urgency is a red flag. If a message pressures you to 'verify within 24 hours' or claims your funds are at risk, slow down and check through official channels.
Exchange custody vs self-custody wallets
With exchange custody, the platform holds your assets and you access them through your account — convenient for active trading, and protected by the controls above. With self-custody, you hold the private keys yourself, typically in a hardware wallet, which removes platform risk but makes you solely responsible: lose the seed phrase and the funds are gone.
Many people use both: a trading balance on a regulated venue and long-term holdings in self-custody. If you keep assets on an exchange, licensing matters — PrimeFTX operates authorized entities in South Africa, El Salvador and Saint Lucia, and choosing a licensed venue is a sensible part of any security checklist.
Risk warning
Trading digital assets involves a significant risk of loss, and past performance does not indicate future results. Security practices reduce risk but cannot eliminate it. Nothing in this article is investment advice; always do your own research and never trade with funds you cannot afford to lose.
Frequently asked questions
- What is the safest way to keep crypto safe on an exchange?
- Combine a unique password from a password manager, app-based or hardware-key 2FA, and a withdrawal allowlist. Review active sessions and API keys regularly, and only access the exchange through your own bookmark.
- Is SMS 2FA safe enough for crypto accounts?
- SMS is better than nothing, but it is vulnerable to SIM-swap attacks. An authenticator app or a hardware security key is a meaningfully stronger choice for crypto accounts.
- Should I keep crypto on an exchange or in a wallet?
- It depends on how you use it. Active traders keep a working balance on a licensed exchange, while long-term holdings often go to a self-custody hardware wallet. Many people split funds between both.
- How do I recognize a crypto phishing attempt?
- Look for urgency, lookalike domains and requests for secrets. No legitimate platform will ever ask for your password, 2FA codes or seed phrase. When in doubt, ignore the link and log in through your own bookmark.