Exchange account takeovers via SIM swap and credential stuffing are the primary threat to Bitcoin on exchanges. Here's how to harden your accounts with hardware keys, whitelisting, and email security.
Exchange hacks aren't the main threat to Bitcoin holders anymore — it's account takeovers. Sophisticated attackers don't need to hack Coinbase directly when they can just log into your account with your stolen credentials or bypass SMS 2FA with a SIM swap.
Here's how to lock down your exchange accounts properly in 2026.
Credential stuffing: Attackers purchase leaked password databases (billions of email/password combinations from data breaches) and try them on exchanges. If you reuse passwords, this works.
SIM swap attacks: Attackers convince your mobile carrier to transfer your phone number to their SIM. With your number, they receive your SMS 2FA codes. Exchange accounts with only SMS 2FA are vulnerable to this.
Phishing: Fake exchange websites and emails that look identical to legitimate ones. You enter your credentials on the fake site; attacker captures them.
Malware: Keyloggers and screen capture software that record your credentials and 2FA codes as you type them.
Every exchange should have a unique, random password — not related to any other password you use anywhere.
Requirements:
Password managers: 1Password, Bitwarden (open source), or Dashlane. Your master password for the password manager should be the strongest, most memorable password you have — and never written in plain text.
Why this matters: If your email password is the same as your Coinbase password and your email is in a breach, your Coinbase account is compromised. Unique passwords ensure each breach is isolated.
Replace SMS 2FA with a hardware security key (YubiKey, Google Titan) for the strongest available two-factor authentication.
Hardware keys use the FIDO2/WebAuthn protocol:
Where to use it: Coinbase, Kraken, Gemini, Binance.US all support hardware security keys.
Keep a backup key: Register two hardware keys. Store the backup securely. If you lose your primary, you have recovery access.
If a service doesn't support hardware keys, use an authenticator app (not SMS):
Recommended apps:
Avoid: SMS 2FA for any significant Bitcoin holdings. SIM swap attacks make SMS 2FA a weak link.
When switching: When you disable SMS 2FA on an exchange, it typically requires going through a re-verification process. Do this proactively, not reactively.
Your exchange account's password reset often goes through email. If your email is compromised, all accounts that use password reset via that email can be taken over.
Harden your email:
Enable withdrawal address whitelisting on every exchange you use:
With whitelisting enabled:
This is one of the most underused security features. Enable it on every account.
Contact your mobile carrier and add a SIM lock (sometimes called a "SIM PIN" or "account PIN"):
This doesn't fully prevent SIM swap (carriers make mistakes), but it adds friction that defeats most attacks.
Enable all security notifications on your exchange accounts:
Check account activity logs monthly. If you see login activity you don't recognize, change your password and 2FA immediately.
If you suspect your exchange account has been compromised:
The most common attack is SIM swap + SMS 2FA bypass. Attackers convince your mobile carrier to transfer your phone number, receive your SMS verification codes, and log into your accounts. Switching to a hardware security key eliminates this attack vector.
Yes, but only slightly for targeted attacks. SMS 2FA defeats automated credential stuffing. It doesn't defeat targeted SIM swap attacks. For any significant Bitcoin holdings, upgrade to an authenticator app or hardware key.
Yes. YubiKey 5 NFC and Google Titan key both work with iOS and Android via NFC (tap the key near your phone's NFC reader). Some phones also support USB-C key connection.
One hardware key can be registered with multiple services. Register your primary key with all exchanges, and your backup key as a secondary. This is the correct approach — you don't need separate keys per service.
Compare secure exchanges in our Bitcoin Exchange Directory. See also: Bitcoin Exchange Withdrawal Best Practices and Bitcoin OpsEC Guide.
Get our free Beginners Guide to Buying Bitcoin plus weekly insights for long-term holders.
Address poisoning tricks users into sending Bitcoin to attacker-controlled addresses that look like familiar ones. This guide explains the attack, how to identify poisoned transactions, and the simple rules that prevent it.
Social engineering attacks steal Bitcoin without any hacking — they manipulate people into revealing seed phrases, sending funds, or compromising accounts. This guide covers every major attack type and the rules that protect against them.
Bitcoin OPSEC for high net worth individuals — physical security, multisig, SIM swap prevention, digital hygiene, and threat-specific defenses for significant Bitcoin holdings.