INDEPENDENT CRYPTO RESEARCH · NO DEPOSITS · NO GUARANTEED RETURNS

Research desk / Security

Field guide / 03

Protect the account before the market moves.

Most security failures begin with identity, recovery, or approval—not cryptography. Build layers that remain useful when you are tired, rushed, or under pressure.

1. Separate the identity layer.

Short answer: use a dedicated email, a unique password, and phishing-resistant multi-factor authentication where the service supports it.

Your exchange password should never be reused. Protect the email account behind recovery at least as strongly as the trading account. Save backup codes offline and review active sessions, trusted devices, API keys, withdrawal addresses, and forwarding rules regularly.

SMS is better than no second factor, but phone numbers can be transferred through SIM-swap attacks. Hardware security keys or passkeys can reduce exposure to credential phishing when correctly supported.

2. Treat every urgent link as hostile.

Short answer: open the service from a saved bookmark or trusted app, not from an email, search advertisement, private message, or QR code.
  • Read the entire domain, including subdomains and unusual characters.
  • Do not approve a login because a caller or chat agent tells you to.
  • Never install “support” software that gives a stranger remote access.
  • Verify withdrawal-address changes through a second channel and allow time for any lock period.

3. Make wallet actions legible.

Short answer: a wallet signature can authorise more than a login. Read the network, contract, spender, asset, and limit before approving.

Use a separate low-balance wallet for unfamiliar applications. Keep long-term holdings away from routine browser interactions. Token approvals can remain active after you leave a site; review and revoke unnecessary allowances using a trusted block explorer or wallet interface for the correct network.

A seed phrase is the wallet. Never type it into a website, support form, cloud note, or unsolicited recovery tool. Anyone with the phrase can control the assets.

4. Design recovery before you need it.

  1. Record which email, device, passkey, security key, and backup code protects each account.
  2. Store recovery material offline in more than one physically separate secure location.
  3. Document how a trusted person can find instructions without exposing the secrets themselves.
  4. Test that you can recognise the official recovery route without completing an unnecessary reset.

5. If something looks wrong

Short answer: stop authorising actions, isolate the affected account or device, preserve evidence, and contact official support through a known channel.

From a clean device, change the email and account credentials, revoke active sessions and API keys, review withdrawal addresses, and contact the relevant platform. For a wallet compromise, moving remaining assets may be appropriate, but rushing can expose the new destination or sign another malicious transaction. Seek qualified incident help when the amount is material.

Preserve transaction hashes, wallet addresses, timestamps, emails with headers, chat exports, and screenshots that show the URL. Report fraud to the appropriate regulator or law-enforcement channel and notify your bank or payment provider promptly.

Limit: This is general defensive education, not incident-response, legal, or financial advice.