Many people register on Binance to "buy crypto", and almost no one does it for "security". But what really causes veteran users to suffer losses is never the market, but their accounts. Setting up the foundation for your account security actually only takes thirty minutes — first register via the Binance website, then download the Binance official app, and then sequentially set up your anti-phishing code, 2FA, and whitelist following the order in this article. For iPhone users who have not installed the APP yet, go to the iOS install guide first to see the steps for switching your Apple ID, and do not download from third-party platforms.
1. First Recognize "Where You Are Most Likely to Be Stolen From"
The top five entry points in exchange theft cases are ranked like this:
- Clicking links in phishing emails — The email subject and sender look incredibly realistic, and clicking takes you to a fake Binance login page.
- Phishing APPs — Installing an unofficial version where your login password is intercepted and your 2FA code is forwarded by a man-in-the-middle.
- Lost devices / Old devices not logged out — Changing phones without logging out of the account, and the old device is acquired by family, friends, or a buyer on a second-hand platform.
- SIM Swap — Attackers use social engineering to get the carrier to transfer your phone number to their own SIM card, rendering SMS 2FA useless.
- Public Wi-Fi packet sniffing — Connecting to a forged Wi-Fi hotspot while logging in at a cafe or hotel, where the traffic is decrypted by a man-in-the-middle.
The commonality of these five entry points is: they can all be largely eliminated through one-time configurations. The five things discussed later in this article correspond exactly to these five entry points.
2. The First Thing: Protect Your Email as the Main Account
The true "main account" of your Binance account is your registered email. Once an attacker gains control of your email, they can reset your Binance account password via "forgot password"; even if you have 2FA enabled, they can bypass it by applying for "account recovery". Therefore, the security level of your email must be at least equal to that of your Binance account. It is recommended to:
- Register an independent email specifically for Binance, and do not mix it with any social/shopping/work emails.
- Enable 2FA on this email itself (Google Authenticator is recommended for Gmail, Microsoft Authenticator for Outlook).
- Make the email password at least 16 random characters, generated using a password manager.
- Do not use easily guessable combinations like "name + birthday" or "phone number + letters".
3. The Second Thing: Set Up the Anti-Phishing Code
The Anti-Phishing Code is a feature introduced by Binance in 2019 — you set a custom string of 6–8 characters, and Binance will attach this string to the subject line of all official emails sent to you afterwards. For example, if you set it to SBYT-42, a normal email subject will look like [SBYT-42] Withdrawal Confirmation Notification, and this string will never appear in phishing emails.
Operation path: Log in to the Binance website → Account → Security → Anti-Phishing Code. Immediately after setting it up, send yourself a withdrawal request or deposit notification to confirm that the email actually contains this code. The effectiveness of the anti-phishing code relies entirely on your habit of "checking the code before reading the email" afterwards; it is not a once-and-for-all fix after setup.
4. The Third Thing: Switch 2FA to Google Authenticator
Binance enables SMS 2FA by default, which is the weakest kind. There have been multiple cases of SIM Swap attacks in China — attackers use social engineering on carrier customer service, claiming their phone is lost and needing a replacement SIM, and after succeeding, all SMS messages are received on their new SIM card. It often takes less than half an hour from completing the SIM replacement to your account being drained.
The response: Switch to Google Authenticator (TOTP). It does not rely on a phone number, does not require a network connection, and the verification code refreshes every 30 seconds. Even if an attacker controls your phone number, they cannot use it. Binding steps:
- Download "Google Authenticator" from the App Store / Play Store, and look for the developer
Google LLC. - Log in to Binance → Security Center → Google Authenticator → Enable.
- Before scanning the QR code on the screen, manually write down the 16-character key on paper first — this is your only recovery credential when changing phones or reinstalling.
- After scanning, enter the 6-digit dynamic code displayed in the APP to complete the binding.
- After binding, Binance will require you to use 2FA for logging in, withdrawing, and modifying security settings.
Important reminder: Google Authenticator does not sync to the cloud by default, which means if you lose your phone or reinstall the OS without having written down the key, you will permanently lose access. You cannot skip the step of writing down the key.
5. The Fourth Thing: Enable the Withdrawal Whitelist
The purpose of the whitelist is: only allow funds to be transferred out to addresses you have registered in advance. Once enabled, even if your account password and 2FA are both compromised, an attacker cannot transfer funds to their own addresses.
Setup path: Account → Security → Withdrawal Whitelist → Enable. Then, one by one, add your commonly used cold wallet addresses and deposit addresses of other exchanges. After adding a new address for the first time, the system enforces a 24-hour cooldown period before it can be used; this mechanism itself is an anti-theft measure.
Many veteran users find the "24-hour cooldown" troublesome and skip enabling the whitelist, but data shows that accounts with whitelists enabled see a drop of over 90% in the probability of fund loss, even if they suffer credential stuffing or social engineering attacks. Trading a little hassle for peace of mind is worth it.
6. The Fifth Thing: Clean Up Historical Login Devices
Go to Account → Security → Device Management, and you will see a list of login records. The typical cleanup approach is:
- Immediately remove phones you have replaced, friends' computers you used, and web logins you tested.
- Keep your primary phone and commonly used computers for daily use.
- For each kept record, verify whether the login time, IP location, and device fingerprint are all reasonable.
- Enable "New Device Login Email Alerts", and any subsequent new device logins will notify you in real-time.
This step seems simple but is critical — reviews of most theft cases reveal that the attacker used an old device that was already in the "active sessions" and simply forgotten by the user.
7. After Doing These Five Things
Once these five things are done, your account has reached a security level where ordinary black-hat hackers will give up attacking. Afterwards, it is recommended to keep a 10-minute monthly "security patrol" habit:
- Check once to see if the anti-phishing code is still there (Binance occasionally resets it due to risk control).
- Check the device management for any unfamiliar sessions.
- Update your API key permissions once (if you are using API trading).
- Review your emails from the last 30 days to confirm every Binance email carries the anti-phishing code.
Frequently Asked Questions
Q: After setting an anti-phishing code, is an email without the code definitely phishing? A: In the vast majority of cases, yes. But there is one exception: the email verification message sent during registration because you don't have an account yet, so it won't have the code. Other than this single exception, any official-looking Binance email without the anti-phishing code should be treated as phishing.
Q: Which is more recommended, Google Authenticator or Authy? A: Both are fine, the difference lies in cloud syncing. Authy supports multi-device sync, which is suitable for users who change phones frequently, but cloud sync itself is a new attack surface; Google Authenticator's default local storage is safer but more troublesome when changing devices. Users demanding higher security levels are advised to use Google Authenticator + offline key backup.
Q: Will the whitelist expire for addresses already added? A: No. Added addresses are permanently valid unless you actively delete them. Only newly added addresses are subject to the 24-hour cooldown constraint.
Q: What else do I need to worry about after doing these five things? A: The biggest remaining risk is handing over your password or verification code yourself — including clicking phishing links, receiving fake customer service calls, or "verifying your account" on suspicious websites. The technical defenses are sufficient; what remains is training your anti-phishing awareness.