Setting Up an Exchange Account Safely When You Follow Someone Else's Trades

A signal channel can tell you which exchange to open, but it cannot set your security for you. These are the first few switches you flip that decide whether a leaked password or a compromised bot drains the account or just annoys you.

A channel tells you to open an account on a specific exchange, sends a referral link, and within an hour you have funded the account and copied your first trade. That hour contains three or four decisions you cannot easily undo later: which second factor protects logins, whether new withdrawal addresses can move money the same day, and what an API key you paste into a bot is actually allowed to do. The channel chose the exchange. The security on top of it is entirely yours, and nobody following the trades behind you will fix it for you.

If you have not yet thought about why the channel sent you to that particular exchange in the first place, our note on why a signal channel sends you to one exchange is worth a read before you fund anything. This guide assumes you have already picked the venue and now need to lock the door behind you.

What can you never take back after the first hour?

Most of the damage in a compromised trading account is not the trade going wrong. It is the withdrawal you did not make. A password can be reset, a bad position can be closed, but crypto that has left your account to an address you do not control is gone, and no support ticket reverses it. So the first-hour decisions worth getting right are the ones that stand between an attacker and the withdrawal button — not the ones that just annoy you when you get them wrong.

That framing changes the order of what you set up. Two-factor authentication, an anti-phishing code, and a withdrawal address whitelist are not equally urgent conveniences; they are three different walls in front of the same door. Set all three before you deposit real size, because retrofitting them after a phishing email has already reached you is a race you may not win.

Why an authenticator app instead of the SMS code?

Every major exchange lets you protect logins and withdrawals with a second factor. The one they offer by default — a code texted to your phone — is the weakest of the options they list. SIM-swap attacks, where someone convinces (or bribes) your mobile carrier to move your number to their SIM, hand the attacker every SMS code you would have received. Your password leaking in an unrelated data breach is then the only other thing they need.

An authenticator app (Google Authenticator, or the exchange's own, or any TOTP app) generates the code on your device with no phone network involved, so there is nothing for a carrier to hand over. OKX says plainly in its security setup guidance that authenticator apps offer more protection than SMS and that, once enabled, the second factor is required for login and for withdrawals. Bybit and Binance walk you through the same choice when you first open the security settings. Pick the app, not the text message, and store the recovery seed the app gives you somewhere offline — if you lose the phone without it, you lock yourself out.

One consequence people forget: a second factor is only as strong as the account it is attached to. If your email is protected by SMS while your exchange is protected by an app, the attacker just resets the exchange through the weaker email. Move the whole chain — email, exchange, and password manager — onto app-based 2FA, not one link of it.

What does an anti-phishing code actually stop?

The most common way a following account gets drained is not a break-in. It is you, typing your real credentials into a page that looks exactly like the exchange because an email told you to "confirm a suspicious withdrawal." The channel's own chat, cloned support accounts, and lookalike domains all feed the same funnel.

An anti-phishing code is a short phrase you set once inside your account. From then on, every genuine email the exchange sends you carries that phrase. A phishing email cannot, because whoever sent it does not know it. Binance, Bybit, and OKX all offer this, and OKX's account security guide describes setting it under advanced security so that legitimate emails carry your code and fakes stand out. It costs you thirty seconds and turns a whole category of convincing emails into obvious forgeries — you stop reading the email's contents and start checking for the phrase, which is a far harder thing to fake.

It does nothing against a message inside Telegram, where there is no code to check, so treat any "exchange support" that direct-messages you there as fake by default. Real exchange support does not slide into your DMs.

Why whitelist withdrawal addresses before you deposit?

A withdrawal address whitelist restricts outgoing transfers to a list of addresses you approved in advance. Turn it on, add your own long-term wallet, and even someone who fully controls your logged-in session cannot send funds to their own address — it is not on the list, and adding one is itself gated behind 2FA and email confirmation.

Binance documents this in its withdrawal whitelist help article, and the detail that matters most is the delay it describes: a whitelist withdrawal limit that suspends transfers to any newly added address for a set period. That delay is the whole point. An attacker who gets in still has to add their address and then wait out the timer, during which the confirmation emails (carrying your anti-phishing code, so you know they are real) give you a window to notice and freeze the account. Without the whitelist, the same attacker withdraws in one click.

Set this up while the account is empty and calm. Adding your cold wallet to the whitelist when there is nothing at stake is a two-minute chore; doing it under pressure after something feels wrong is exactly when mistakes happen.

What should a bot's API key be allowed to do?

Here is the decision that separates following trades from handing over your money. Copy-trading services, signal bots, and "we execute the channel's calls for you" tools all ask for an API key — a credential that lets their software act on your account without your password. An API key has permission scopes, and the scopes you grant decide how much damage a leak or a rogue operator can do.

The rule is simple and non-negotiable: a key used for trading gets read and trade permissions, and withdrawal permission stays off. Bybit's guide to creating an API key shows these as separate toggles you choose at creation; the option to leave withdrawal disabled is right there. A trade-only key lets the service see your balance and open or close positions — everything it needs to mirror a channel's signals — while being structurally unable to send a single coin off the exchange. If that key leaks tomorrow, or the service turns out to be dishonest, the worst case is bad trades you can see and stop, not an empty account.

Never enable withdrawal on a key a signal service asked for. There is no legitimate copy-trading or signal-execution product that needs to move funds out of your exchange, and any that insists on it is telling you what it plans to do. This is the single most important line in the whole setup, and it is one nobody but you can enforce. We go deeper on the mechanics in API keys and account security for traders; the short version is that permission scope is the blast radius, and you choose it.

Two more habits make the same key safer. Bind it to the service's IP address if the exchange offers IP restriction, so the key is useless from anywhere else. And label each key by which service holds it, so when you stop using a bot you know exactly which credential to delete — a forgotten key with live trade permission is a door left open on a house you moved out of.

Should a copy service get its own sub-account?

If you run more than one channel's trades, or you want the money a bot touches kept apart from the rest, a sub-account is the cleaner boundary than a shared main account with several keys. Bybit and other majors let you open sub-accounts and issue API keys scoped to just that sub-account, so a compromised or badly written bot can only reach the capital you moved into its box — not your whole balance.

This matters more the moment you accept that following someone else's trades means their software, or a third party's, is acting inside your account. The question of who actually holds your coins while that is happening is worth sitting with; our piece on custody when you copy-trade unpacks it. A sub-account does not change the custody model — the exchange still holds the keys — but it does shrink how much of your money any one service can touch, which is the part you control.

Fund the sub-account with only what that strategy is meant to trade. Topping it up is a deliberate act; leaving your entire stack in the same box a bot can trade is a default you drift into without deciding.

What order do you actually do this in?

Before the first deposit: turn on app-based 2FA, set the anti-phishing code, and enable the withdrawal whitelist with your own wallet added and the new-address delay active. That is roughly ten minutes and it is the same on Binance, Bybit, and OKX — the labels move around but the switches are all there.

Before you connect any bot or copy service: create a dedicated API key with read and trade only, withdrawal off, IP-bound if possible, ideally inside a sub-account funded with just that strategy's capital. Delete keys the moment you stop using the service that held them.

None of this promises the trades go well — following someone else's calls carries its own risks, and the venue itself carries risk worth understanding in exchange risk explained. What this setup does is make sure that when something goes wrong — a leaked password, a phishing email that fools you for a second, a bot that turns out to be less trustworthy than its channel — the failure costs you a bad trade you can see and close, not the whole account emptied to an address you will never trace. That difference is entirely within your control, and the first hour is when you decide it.

Steps and screens change as exchanges update their apps; the help pages linked above are the current sources, and the security tab in your own account is the final word on what your exchange offers today.