🛡️Stay safe — crypto security basics

Step-by-step: enable 2FA on a crypto exchange

Two-factor authentication (2FA) means logging in requires both something you know (your password) and something you have (a rotating code from your phone). It is the single biggest improvement you can make to account security, and it takes about three minutes to enable.

1. 1
   Install an authenticator app

   Use Google Authenticator, Authy, or 1Password. Avoid SMS-based 2FA — SMS codes can be intercepted via SIM-swap attacks where a criminal convinces your carrier to move your number to their phone.

2. 2
   Open your exchange's security settings

   Log into the exchange (typing the URL yourself, not from a search ad) and find Security or Account Settings. Look for 'Two-factor authentication' or 'TOTP'.

3. 3
   Scan the QR code

   The exchange shows a QR code. Open your authenticator app, tap 'Add account', and scan it. A six-digit code starts rotating every 30 seconds.

4. 4
   Save the backup key

   Below the QR code, the exchange shows a long backup string. Write it down on paper and store it offline. If you lose your phone, this is the only way to recover 2FA.

5. 5
   Confirm with the current code

   Enter the six-digit code from your app to prove the setup worked. The exchange will usually show backup recovery codes — save those offline too.

6. 6
   Enable 2FA for withdrawals

   Many exchanges have a separate toggle to require 2FA for every withdrawal. Turn it on. This blocks attackers even if they get past your password.

How phishing works — three real-world examples

Phishing means tricking you into typing your credentials or seed phrase into a fake site or message. It is the number-one way ordinary people lose crypto. The attacker doesn't hack the blockchain — they hack you.

• The fake Google ad: you search for your exchange's name. The very first result is a sponsored ad with the right logo and a domain like 'coiinbase-login.com'. You log in. Your password and 2FA code are captured and replayed within seconds.
• The 'support agent' DM: you post a question in a project's Discord. Within minutes, someone with the exact same avatar as a real moderator DMs you a link to 'verify your wallet' or 'unlock your funds'. The link asks for your seed phrase. Real support never DMs first and never asks for your seed.
• The wallet pop-up: you visit a popular site, and a window appears saying 'Your MetaMask needs to re-authenticate — paste your recovery phrase'. Real MetaMask never asks for your seed phrase outside of restoring a fresh installation, and never via a webpage.

What a seed phrase is — and five rules for storing it

A seed phrase is a list of 12 or 24 ordinary English words that mathematically derive every private key in your wallet. Whoever has the words has the money. There is no recovery, no support hotline, no password reset — the words are the wallet.

• Write it on paper or steel — never in a photo, screenshot, cloud drive, email draft, password manager, or note on your phone. Anything connected to the internet eventually gets breached.
• Make two copies in two physical locations (e.g. home safe and a sealed envelope at a parent's house). Single-point-of-failure storage is how people lose everything in a single fire or flood.
• Never type it into any website, support form, or chat. The only legitimate place to enter a seed phrase is the recovery screen of the official wallet app, on a device you trust, when you are intentionally restoring a wallet.
• Test the backup. After writing it down, wipe the wallet and restore from the words before you put real money in. If you can't restore, the backup is useless.
• Treat it like a bearer instrument. The words are equivalent to a stack of cash with no name on it. Don't share, don't brag, don't tell family members the location unless you're sure they need to know.

Hot wallet vs cold wallet vs exchange custody

What to do if you suspect your account is compromised

Speed matters. Most attacks drain funds within minutes once the attacker has access. Move in this order:

1. 1
   Disconnect first

   If you're inside the wallet or exchange, log out and close the browser. If you suspect malware, take the device offline (turn off Wi-Fi).

2. 2
   Move funds from another safe device

   From a clean phone or computer, log in and withdraw whatever remains to a fresh wallet address that the attacker has never seen.

3. 3
   Rotate every password

   Email first (it controls password resets), then exchange, then anything that reused the same password. Use a password manager going forward.

4. 4
   Reset 2FA

   Generate a new authenticator secret. If you used SMS, switch to an app. Add a withdrawal whitelist if your exchange supports it.

5. 5
   Contact exchange support

   Open a ticket with timestamps and the suspicious activity. They may be able to freeze further withdrawals, but only if you act fast.

6. 6
   Document everything

   Keep screenshots, transaction hashes, and email correspondence. You will need this for police reports and any chance of recovery.