Account controls that limit how funds can leave an exchange

When funds sit on an exchange, the practical question is who can instruct the platform to move them. Several account controls decide this: how you log in, which devices are trusted, which destination addresses are approved and what extra checks apply to changes. Many of these are optional or off by default, so people who never visit the security menu rely on weaker protection than the platform offers. This guide explains the main controls in plain language and how to check them on Binance, OKX, Bybit or Bitget. Menu names change, so confirm paths in the official help centre.

Login strength decides who gets in

The first line of defence is the login: a unique password and a second step based on an authenticator app or a passkey. Text messages alone are weaker because they depend on a phone number that can be taken over. Check also the email linked to the account, since it can be used to reset the password. If the email falls, everything behind it is exposed.

Destination controls decide where funds go

A withdrawal whitelist lets you approve destination addresses in advance, so that a thief who gets in cannot simply send funds to a new address. Adding an address normally requires extra verification. Keep the list short and labelled, remove old entries and read the help centre to see how changes are handled, including any waiting period before a new address can be used.

Devices and sessions show who is inside

The trusted device list and recent login history reveal whether someone else has access. Remove old phones, shared computers and anything you do not recognise. If you find an unfamiliar entry, change your password at once from a trusted device and revisit your second step. Treat the list as a smoke detector: it only helps if you look at it.

Make the review routine

Review these controls monthly in a quick pass and more fully every quarter, as well as after changing phone or email. Note the date on paper so you know when you last checked. Keep on the exchange only the amount you need, because no control removes risk entirely.

Risk boundary: Russia Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

Use a unique password and an authenticator app or passkey
Secure the linked email with its own second step
Enable the withdrawal whitelist and keep it short and labelled
Remove unknown or old devices from the trusted list
Review the controls monthly and note the date on paper