Run your crypto account security audit before the next incident

The image is a live, logged-out crop of the KCEX BTC/USDT spot page, showing the order panel and the Wallets box with Deposit and Transfer.

Start with two questions

On an exchange, the platform runs the wallets and you hold a claim through your account, API keys and withdrawal requests. In self-custody, you (or your signers) hold the keys. Neither is risk-free. One carries counterparty and operational risk, the other carries key-loss and irreversible-mistake risk. The guide's test: how many independent things would an attacker need to break before funds can move?

The six layers to check

• Login: Is the password unique? Is 2FA phishing-resistant (passkey or hardware key), or SMS, which can be lost to a SIM takeover?
• Trading account: Which API keys exist, what can they do, and is there a withdrawal allowlist?
• Custody: Does what you hold on the exchange match what you actually need for trading?
• Transaction authority: Which token approvals and contract permissions are still live?
• Recovery: Is the recovery phrase stored offline, and has the recovery route been tested through official channels?
• Monitoring: Do you get transfer and login alerts, and do you actually read them?

Write the inventory down, but never put passwords, seed phrases or private keys in it.

API keys

Give each tool only the permissions it needs. Read-only is safer than trading, and trading is safer than withdrawal, but even read access shows your holdings to anyone who gets the key. Bind keys to IP addresses when that option exists. Revoke keys from tools you stopped using. Changing your password does not necessarily kill existing API keys or sessions, so check that separately.

Withdrawal allowlist

An allowlist limits withdrawals to addresses you already approved. It works best when adding an address needs a separate factor, a waiting period and a notification. If the same hijacked session can switch it off, it only looks safe. When you send, check the whole address and the network, not just the first and last characters, because clipboard malware swaps in lookalikes. For big amounts, send a small test first.

Approvals and hardware wallets

A hardware wallet protects the key, not your judgment. If you sign an unlimited token approval for a malicious contract, the device will sign it. Review approvals regularly and revoke old ones, keeping in mind that revoking usually costs network fees. If a seed phrase is actually compromised, revoking approvals is not enough. The remaining funds need a fresh wallet.

When an exchange announces an incident

1. Read the official status page and check which entity and service is affected
2. Check your balances, orders and sessions, and record anything odd with timestamps and transaction hashes
3. Strip unneeded API permissions and tighten login settings
4. Don't send funds to a "safety wallet" or sign anything an unsolicited message asks for. Scammers move fast right after incidents.

A reserve snapshot is not the same thing as your account balance, and a freeze is not the same as getting funds back.

Make it routine

Monthly: sessions, API keys, allowlist, software updates. Quarterly: test recovery without exposing the phrase. A regular check does more for you than a rushed transfer during a crisis.