Night Study/Tools/Account security check
Is your crypto exchange account secure? Check eight settings
Eight questions about what is switched on right now. The answer comes back as an ordered list of gaps, because the order is the part that is hard to work out from a checklist.
Answer the questions above
The review updates as you go. You can leave anything blank if you do not know — unanswered items are simply left out.
About this review — how to read it
The eight questions, in full
If you would rather read the checklist than click through it, this is all of it: (1) is the email address on the account protected by its own strong second factor; (2) is the exchange password used on any other site; (3) what is the strongest second factor enrolled — hardware key or passkey, authenticator app, text message only, or none; (4) does the account still accept a text-message code as an alternative verification method; (5) are your 2FA backup codes stored somewhere that survives losing the phone; (6) does the API key list contain anything; (7) is the withdrawal whitelist switched on, with a waiting period for newly added addresses; (8) do security alerts reach you somewhere other than only the account email.
Two kinds of answer come back. A definite gap is marked Fix. An answer that is only partly safe — text-message verification on the email account, API keys you recognise but have not reviewed, alerts going to the inbox and nowhere else, or an honest "not sure" — is marked Check, because the next step is to go and look rather than to change something. Both appear in the order above, not in order of severity.
What problem this solves
A written checklist tells you what to have — the eight-setting checklist covers the same ground at length, and it explains the reasoning behind each item. What a list cannot do is tell you what to do first when six things are missing at once, and doing them in the wrong order is how people lock themselves out of their own withdrawals. This tool sorts the gaps it finds by the sequence that avoids that.
How to use it
Open your exchange account's security settings in another tab and answer from what you can see rather than from memory. Whether text-message verification is still accepted as a fallback is the answer memory gets wrong most easily.
Why the order is what it is
Settings that stop someone logging in come first, then settings that stop money leaving, then alerts. Within that, anything that requires a working second factor to configure has to come after the second factor works. The withdrawal whitelist is last in the setup order for exactly that reason, even though it is one of the most valuable settings on the list.
Where the questions come from
They follow the settings documented on the major exchanges' own security pages — second factor, anti-phishing code, withdrawal whitelist and its waiting period, API key permissions, session and device records. The reasoning behind each is set out in the settings guide.
What it does not do
It does not connect to any exchange, cannot see your account, and cannot verify any answer you give. It is a structured way of thinking about your own configuration, not an audit. There is no scoring against other people, and nothing you answer is sent or stored.
If it finds nothing
Then the account's security settings are in reasonable shape and the remaining risk is mostly in scam messages, fake support calls and your phone number. The scam message checker covers the first two.