Account Security Features: Reference Comparison

Entry last verified August 2026.

The table

Feature	Defeats	Default
SMS two-factor	Password theft	Frequently on
Authenticator application	Password theft, SIM swap	Off
Hardware security key	Password theft, SIM swap, phishing	Off
Withdrawal address allowlist	Immediate theft after takeover	Off
Delay on new allowlist entries	Same, with a reaction window	Off
Login and withdrawal notifications	Nothing directly, alerts you	Partially on
API key permissions and IP restriction	Compromised automation	Defaults vary

Notice that the strongest options are all off by default, and the weakest is frequently on.

The hierarchy

SMS is the weakest. Your phone number is controlled by your carrier. An attacker who convinces the carrier to transfer it receives every code, and this attack is documented and repeated.

An authenticator application defeats that entirely, because nothing is transmitted.

A hardware key additionally defeats phishing, because it verifies the site before responding. This is the only option that does, and phishing is the most common attack.

The setting people miss

Removing the phone number as a recovery option.

A stronger second factor is completely undermined by a weaker fallback on the same account. This is the most common configuration error and it is invisible unless you look.

The allowlist

Restricts withdrawals to pre-approved addresses, with a delay before new ones become usable.

This converts a successful account takeover from an instant theft into a window in which notifications might reach you. It is the single most effective setting on the list and almost nobody enables it.

API keys

Any key with withdrawal permission is a standing risk. Read-only is correct for anything that only needs to observe.

A trading-enabled key is not harmless either: an attacker can trade your balance into a thin pair against their own orders, extracting value without a withdrawal.

IP restriction, where supported, makes a stolen key useless.

What to check on any venue

Whether all seven are offered, and where they are documented.

Platforms publishing their full security model, such as a regulated European platform, have made this a five-minute review. Venues offering only SMS have made a decision about how much they invest in customer security, and that decision is informative.

The ten-minute configuration

Authenticator or hardware key. Backup codes written down. Phone number removed as recovery. Carrier port-out PIN set. Allowlist enabled with a delay. Notifications on. API keys reviewed.

That list closes the routes through which nearly every account compromise actually happens.