The Complete Binance Account Security Checklist: Every Guard to Switch On From Day One

Most people only go back and sort out their security settings after something's already gone wrong — someone logs into the account, the coins get moved out, or they click through a fake "Binance" email that looked completely real. The truth is, nearly all of that loss can be stopped by a handful of guards you set up in twenty minutes on the day you sign up. This is that list. For each guard we spell out what it protects against, how to switch it on, and the trap that's easy to fall into — you just work through it once.

First, get clear on who you're actually defending against

Before you change any settings, sort out where the threat comes from — that's the only way each guard downstream makes sense. When an exchange account gets taken over, it's almost always one of these routes:

• Credential stuffing: an email-and-password pair you reused on some other site gets leaked, and the attacker tries it against exchange logins one by one. Reuse a password and you'll be caught out sooner or later.
• Phishing: a "Binance" email that looks genuine, a fake text message, or a copycat site sitting near the top of the search results — anything to trick you into typing your login and verification code.
• Codes intercepted: an SMS code can be lifted by a SIM swap or a trojan. Relying on SMS alone for 2FA is like fitting a good lock and leaving a master key hanging outside the door.
• A compromised device: your computer or phone has some dodgy program on it that rewrites the clipboard or logs your keystrokes.
• API abuse: an API key you created to use some tool was handed too many permissions and then leaked, so a program places orders or makes withdrawals on your behalf.

The five guards below map one-to-one onto exactly these routes. They aren't independent switches — they stack, so if one gets bypassed, the next one still catches you. That's why we call them "the beast's five guards": an account that holds up never relies on a single lock, but on several doors in a row.

Guard one · Draw the line: passwords and the fund password

The first door is your password. It sounds like the most basic thing in the world, yet it's the one most people throw together without a second thought.

Login password: don't reuse it, don't make it short

The single most important point isn't "make the password complex" — it's that this password is used only on Binance and nowhere else. Credential-stuffing attacks feed on reuse: the email-and-password you used on some forum leaks, and the attacker tries the same pair against exchanges. Even a password that looks strong is a risk the moment it's been reused.

In practice: use a password manager to generate a long, random passphrase (a dozen-plus characters) just for Binance, so you don't have to remember it. If you'd rather not use a password manager, at the very least make sure this one password is different from every other account you have. Want a rough sense of how well your current password would hold up against a brute-force attempt? Try our password strength checker (estimated locally, nothing uploaded).

Fund password: don't make it the same as your login password

Binance has a separate fund password (withdrawal password), distinct from your login password, used for sensitive actions like withdrawals. The whole point of it is this: even if someone gets your login password and logs in, without the fund password they can't touch your money. So these two passwords must be set to different values — make them the same and you've set it for nothing. For how to set it and how to reset it if you forget, see the fund password piece.

Guard two · Set the eyes: two-factor authentication (2FA)

Two-factor authentication (2FA) gives you the most protection for the least effort of all five guards: with it on, a password alone won't get anyone into your account. But "2FA is on" and "2FA is set up properly" are two different things.

Binance supports several 2FA methods, and they're a long way apart on security:

• SMS codes: the most convenient, and also the weakest. Your number can be taken over by a SIM swap (an attacker social-engineers your carrier into porting the number onto someone else's SIM), and the code lands in their hands. If you can use anything else, don't lean on this alone.
• Authenticator app (such as Google Authenticator or Authy): generates a rotating code every 30 seconds on your phone, doesn't depend on mobile signal, and is far safer than SMS — the sensible default for most people.
• Security key / passkey (such as a YubiKey or your phone's biometrics): the strongest tier going. Because it's tied to a physical device or bound to your device, it shuts out phishing by design — it never hands a "code" over to any fake site.

Our advice: get an authenticator app on at the very least, and demote SMS from "the only method" to a backup. If you can, add a security key or passkey on top. For how to choose between the methods and how to set each one up, the complete 2FA guide goes into more detail, or you can use the 2FA methods comparison table to see the differences at a glance.

Guard three · Verify the message: the anti-phishing code

The first two guards stop "someone logging into your account." The third stops "you being tricked into opening the door yourself." The anti-phishing code is a private passphrase agreed between you and Binance: once you set it, every legitimate email and in-account message Binance sends you carries this code that you chose.

That makes telling real from fake dead simple: an email claiming to be from Binance with no anti-phishing code in it is almost certainly fake, so don't touch the links inside. This guard costs next to nothing (two minutes to set) yet blocks a large chunk of phishing emails. For how to set it and how to make it hard to guess, see the anti-phishing code piece.

One thing to note: the anti-phishing code only covers the emails and in-account messages Binance sends you. It won't appear in a text, a third-party messaging app, or a phone call. So if you get a call from "Binance support" or an "official" DM on Telegram, remember that Binance won't message you out of the blue and will never ask for your password or verification code. If you're unsure whether a message is genuine, run it past a few checks with our phishing message checker, or read how to confirm whether a "Binance" message is real.

Guard four · Bolt the door: withdrawal whitelist and API

The earlier guards are about "don't let anyone in." This one is about "even if they get in, they can't carry anything out" — the last guard, and the most important safety net against actual loss.

Withdrawal address whitelist

With the withdrawal address whitelist switched on, your account can only send coins to addresses you've added to the list in advance; unfamiliar addresses simply can't receive a withdrawal. That means even if someone logs in and gets past your password and 2FA, they still can't move the coins to an address of their own. For anyone holding long term, this one is close to non-negotiable.

The trade-off is that a newly added address usually takes a waiting period before it goes live (a cooling-off delay Binance put in deliberately, precisely to stop "add an address and drain it the moment the account is breached"). So add your regular withdrawal addresses ahead of time. For where the switch is and how long it takes to take effect, see how to turn on the withdrawal whitelist; for fuller withdrawal safety (checking addresses, small test sends, choosing the network), see the complete withdrawal security guide.

API permissions: grant as little as you can get away with

If you've ever used a copy-trading, quant, or portfolio-tracking tool, you've probably created an API key at some point. An API hands part of your account's controls over to a program, and the risk is granting too much and then leaking it. Three rules:

• Tick only the minimum permissions you actually need. If you're just reading prices or tracking a portfolio, don't enable trading, and definitely not withdrawals.
• Bind an IP whitelist if you can, so the key only works from a fixed server IP.
• Clear out keys you no longer use, and delete and recreate anything that looks off straight away.

For the longer version, see API key security and permissions, or use the API permission risk checker to tick through whether the permissions you've handed out are over the top.

Guard five · Repel the attacker: if you do get hacked

With the first four guards fully in place, the odds of being hacked are already very low. But there's no "absolute" in security, so the fifth guard is your plan: what to do in the first ten minutes if it actually happens. The rough order is — change your login password immediately, use emergency freeze to pause the account, revoke every API key, check for and boot off unfamiliar login devices, and contact Binance officially to start an appeal. Get the order wrong or move too slowly and you can miss the window to stop the coins leaving.

There's a lot of detail here, so we've written it up separately in the complete hacked-account recovery guide, and built a hacked-account response decision tree — when you're genuinely panicking, you just follow the steps one tap at a time. Read it now while you're calm so you know the drill, rather than opening it for the first time mid-crisis.

A checklist you can tick off

Here are the five guards boiled down into a list you can tick item by item — work through it once:

1. Your Binance login password is not used anywhere else, and it's long enough.
2. You've set a fund password, and it's different from your login password.
3. Your 2FA runs on an authenticator app or a security key, with SMS kept only as a backup.
4. The authenticator's backup recovery codes are written down offline and stored safely.
5. You've set an anti-phishing code, and you remember it only ever appears in emails and in-account messages.
6. The withdrawal address whitelist is on, with your regular addresses already added.
7. You've reviewed your API keys: minimum permissions, and anything suspicious deleted.
8. You've had a look through your login devices and booted off any you don't recognise.
9. You know where emergency freeze and hacked-account recovery live.

Too much of a chore to check them off one at a time? Use the account security check-up — answer a few questions and it gives you a security score, lists which guards you're still missing, and how to fix each one.

A few common misconceptions

We worked through the whole set of settings from scratch, following the official pages, and jotted down the spots people most often take for granted:

• "SMS verification is enough on its own" — SMS is the weakest of the options, so relying on it alone means you haven't really finished setting up.
• "Can't be bothered remembering a fund password, I'll make it the same as my login one" — that's fitting the second lock with the same key as the first.
• "The whitelist is a hassle, I'll leave it off" — it does add a step day to day, but it's the one setting that can still stop the coins after a breach, so don't skip it, especially if you hold long term.
• "The anti-phishing code is a feature I've never used, so I'll skip it" — it takes two minutes, costs next to nothing, and blocks a high share of phishing emails.
• "APIs are for programs, nothing to do with me" — if you've ever hooked up any third-party tool, you should go back and take a look at the permissions.

Common questions