Security: Protecting Your Money and Your Accounts

Security is the least exciting part of trading and the one that matters most. Most traders lose money to bad decisions, but a meaningful number lose money to hacked accounts, leaked API keys, and phishing. This page covers the basics that every trader should have in place before risking real money.

Use strong, unique passwords and two-factor authentication

• Use a different password for every exchange and broker. A password manager makes this practical.
• Turn on two-factor authentication (2FA) everywhere it is offered, preferably with an authenticator app rather than SMS.
• Never share your password or 2FA codes with anyone, including someone claiming to be support staff. Real support will never ask for them.

Treat API keys like house keys

A trading bot connects to your exchange through an API key. That key is powerful, so treat it carefully:

• Give the key the smallest permissions it needs. A bot that only places trades does not need withdrawal permission. Never enable withdrawals on an API key unless you have a specific, trusted reason.
• Use IP restrictions when the exchange offers them, so the key only works from your server or computer.
• Store keys in a safe place, never in a public code repository, a screenshot, or a chat message.
• Delete keys you no longer use, and rotate them regularly.

Keep most funds off exchanges

• An exchange account is convenient for trading, but it is also a target. Many traders keep only their active trading funds on an exchange and move the rest to a wallet they control.
• Learn the difference between a custodial wallet (the exchange holds your keys) and a non-custodial wallet (you hold your keys). Each has trade-offs, and neither is risk-free.
• Back up your wallet recovery phrase on paper, stored somewhere safe. Never store it in a photo, an email, or a cloud document.

Watch for phishing

• Phishing pages copy the look of a real exchange to steal your login. Always check the web address before you log in, and bookmark the real site.
• Be suspicious of urgent messages about your account, a "security problem", or a prize. Go to the exchange directly instead of clicking a link in the message.
• Check the sender address of any email about your account. A small change in the domain name is a common trick.

A simple security checklist

• Unique password and 2FA on every trading account.
• API keys with minimum permissions, no withdrawals, IP-restricted where possible.
• Most funds in a wallet you control, not on an exchange.
• Recovery phrase on paper, never online.
• Bookmarks for real sites, and a habit of checking the address bar.

Security is not a one-time setup. Review it every few months, and again whenever you add a new tool or exchange to your routine.