How to Secure Your Crypto Exchange Account in India: 6-Step Guide

To secure your crypto exchange account in India, switch on an authenticator app or passkey, set an anti-phishing code, turn on the withdrawal address whitelist, remove devices and API keys you don’t use, and never share an OTP or password with anyone. If something goes wrong, disable the account from the app and report it at once on 1930 or cybercrime.gov.in. Each step below uses the exchanges’ own settings names, so you can follow along on your phone.

Quick summary

Step	What to do	Why it helps
1	Use an authenticator app or passkey for 2FA	Codes stay on your device; SIM-swap fraud can’t intercept them
2	Set an anti-phishing code	Genuine exchange emails show your code; fake ones can’t
3	Turn on the withdrawal whitelist	Funds can only go to addresses you approved
4	Remove unknown devices	Closes old or stolen sessions
5	Delete unused API keys	Old trading-bot keys are a quiet way in
6	Never share OTP, password or seed phrase	CoinDCX and WazirX tell users never to share them

Before you start: three checks

• Open the official app only. Install the exchange app from the Play Store or App Store, or type the web address yourself. Don’t use links from SMS, WhatsApp, Telegram or ads.
• Secure your email first. Your exchange account is only as safe as the email linked to it. Give that email a unique password and its own two-step verification.
• Expect short withdrawal holds. Exchanges pause withdrawals for a while after security changes, as a safety measure. Binance, for example, disables withdrawals and P2P for 24 hours after you change your authenticator, and CoinDCX pauses INR withdrawals for 24 hours after you enable or disable 2FA. Plan changes when you don’t need to withdraw urgently.

Step 1: Turn on an authenticator app or passkey

Two-factor authentication (2FA) adds a second check after your password. App-based codes and passkeys are stronger than SMS codes, because a fraudster who takes over your SIM can receive your SMS. CERT-In warns that a sudden loss of mobile service may be a sign of a SIM-swap attempt and should be reported to your mobile provider immediately.

• Binance (app): tap your profile, go to Security > Authenticator App > Enable. For a passkey, go to Security > Passkeys (Biometrics) > Add Passkey. Binance also supports hardware security keys (USB/NFC).
• Binance (web): Profile > Account > Security, then Manage next to Authenticator App or Passkeys (Biometrics).
• CoinDCX (app): tap the profile icon, go to Security > Google Authenticator, copy the secret key into your authenticator app and enter the code. Save the secret key somewhere safe and offline.
• Other exchanges: look in the app’s Security or Account settings for “Two-Factor Authentication” or “Authenticator”. WazirX’s own security page advises users to always enable app-based 2FA.

Step 2: Set an anti-phishing code

An anti-phishing code is a short word you choose. Once it’s set, the exchange includes it in its genuine emails, so a message without your code is a warning sign.

Also read: How to Upgrade to Windows 11 26H2 Now That 24H2 Updates Have Ended

• Binance (app): tap your profile, go to Account Info > Security > Anti-Phishing Code > Create, enter your code and confirm with 2FA or passkey.
• Binance (web): Profile > Account > Security, find Anti-Phishing Code under Advanced Security and click Enable.
• Binance requires 6–8 characters using at least three of: capital letters, small letters, numbers and underscores. Binance says the code is included in all its genuine emails and SMS.
• Other exchanges: check whether the Security settings offer an anti-phishing code and set it if available. If yours doesn’t have one, the other steps matter even more.

Step 3: Turn on the withdrawal address whitelist

A whitelist means crypto can only be withdrawn to addresses you saved in advance. Even if someone gets into your account, they can’t send your coins to their own wallet without first adding it, which needs your 2FA and may trigger a temporary withdrawal hold.

• Binance (web): go to Profile > Settings, find Withdrawal Whitelist in the Withdrawal section and click Enable. Add your own wallets in Address Management and tick “Add Address to Whitelist”. Binance allows up to 200 saved addresses.
• Binance says adding or changing whitelisted addresses may suspend withdrawals for 24, 48 or 72 hours. That delay is the protection: it gives you time to notice and act.
• Other exchanges: look for “Address book”, “Saved addresses” or “Whitelist” under withdrawal or security settings.

Step 4: Remove devices you don’t recognise

• Binance: under Security, open Devices and Activities > Device Management, delete any device you don’t recognise and check Account Activity for recent logins.
• CoinDCX (app): Profile > Security Settings > Verified Devices, select a device and tap Block Device. A blocked device can no longer access your account.
• Do this after you sell or replace a phone, or if you ever logged in on a shared computer.

Step 5: Delete API keys you don’t use

API keys let trading bots and portfolio apps connect to your account. Old keys are easy to forget and can be misused if they leak.

• Binance (web): Profile > Account > API Management. Remove keys you no longer use. Binance only allows withdrawal permission on a key that is restricted to trusted IP addresses, and keys without an IP restriction can only read data, so add IP restrictions to any key that trades.
• CoinDCX: according to CoinDCX’s own API guide, the API dashboard lets you bind a key to an IP address and delete keys you no longer need.
• Never give an API key withdrawal permission unless you truly need it.

Step 6: Never share OTP, password or seed phrase

Most crypto account thefts start with a convincing message or call, not a technical hack. The exchanges are clear about this:

• Binance says it will never call you or message you on WhatsApp or other social media, and warns against unsolicited messages asking for personal information or for payments to crypto addresses. You can check whether a website, email, phone number or social account really belongs to Binance with its Binance Verify tool.
• CoinDCX says it will never ask for your password, OTP, PIN, 2FA codes, private keys or seed phrase, never ask you to transfer funds to “verify” or “unlock” an account, and never ask you to install remote-access or screen-sharing apps.
• CERT-In’s advice: avoid sharing personal information, remember you never need a UPI PIN or OTP to receive money, and don’t panic, because scammers use fear and urgency to manipulate victims.

What to do if your exchange account is compromised

1. Disable the account straight away. On Binance, disable it from the official app or website: Binance’s help page lists Account Info > Security > Manage Account > Disable Account in the app and Account > Security > Account Management > Disable Account on the web. On CoinDCX (app): Account > Account Settings > Account Management > Disable Account.
2. Contact the exchange through official channels only, from inside the app or website. CoinDCX also takes fraud reports by email at digitalsecurity@coindcx.com.
3. Report the fraud immediately on the national helpline 1930 or at cybercrime.gov.in. The government runs 1930 for help with lodging online cyber complaints, and fast reporting improves the chance of stopping the money from moving on.
4. Secure everything linked to the account: change your email password, reset 2FA, and call your mobile provider if your SIM stopped working unexpectedly.
5. Be very wary of “recovery” offers. Don’t pay anyone who contacts you promising to get your crypto back for a fee; report through the exchange and 1930 / cybercrime.gov.in instead.

Frequently asked questions

Is SMS OTP enough to protect a crypto account?

SMS is better than nothing, but an authenticator app or passkey is safer, because SMS codes can be intercepted through SIM-swap fraud. Use the strongest option your exchange offers.

Why can’t I withdraw after changing my security settings?

Exchanges add a short withdrawal hold after security changes so a hacker can’t change your settings and drain the account at once. Binance holds withdrawals and P2P for 24 hours after an authenticator change, and CoinDCX pauses INR withdrawals for 24 hours after a 2FA change.

Where do I report crypto fraud in India?

Call the national cyber fraud helpline 1930 or file a complaint at cybercrime.gov.in, and tell your exchange through its official support. Report as soon as you notice the problem.

Will an exchange ever ask me to move my crypto to keep it safe?

No. CoinDCX says it will never ask you to transfer funds to “verify”, “secure” or “unlock” your account, and Binance warns against any unsolicited request to send payments to a crypto address. Treat any such request as a scam.

Bottom line

Ten minutes in your exchange’s Security settings closes the most common ways crypto accounts are emptied: switch on an authenticator or passkey, set an anti-phishing code, whitelist your withdrawal addresses, and clean out old devices and API keys. For the latest on the Binance breach, read our coverage of the Binance hack and what it means for Indian users. This guide is general security information, not financial advice; menu names can change when apps update, so follow your exchange’s own help pages if a setting looks different.

Sources

• Binance: What Is an Anti-Phishing Code and How to Set It Up
• Binance: How to Enable Withdrawal Address Whitelist
• CoinDCX Support: Will CoinDCX ever ask for my password, OTP or seed phrase?
• CERT-In Advisory CIAD-2024-0050: Preventing Online Scams
• Binance: Security Tips
• PIB (Ministry of Home Affairs): cyber crime helpline 1930

About The Author