Recognize and avoid phishing
Phishing is the leading cause of account takeover. Attackers impersonate platforms, send urgent messages, or host convincing fake login pages. Before entering credentials, confirm the domain, look for HTTPS, and avoid following login links in unsolicited emails. Prefer bookmarks or the official app.
Warning: If anyone asks for your password, 2FA codes, or recovery phrase via email or chat, treat it as malicious and report immediately.
What to do if compromised
- From a safe device, change your account password immediately.
- Revoke active sessions and API keys; disable withdrawals if possible.
- Contact official support through verified channels and provide timestamps/screenshots to help investigation.
Long-term habits
Review settings quarterly, rotate long-lived secrets, maintain secure offline backups, and consider splitting holdings across multiple custody strategies to reduce single-account risk.