Overview Nothing in this checklist prevents a platform-side security incident at an exchange. What it prevents is the other thing, the surge in phishing emails and impersonated support that reliably fOverview Nothing in this checklist prevents a platform-side security incident at an exchange. What it prevents is the other thing, the surge in phishing emails and impersonated support that reliably f
MEXC Account Security Checklist: 2FA, Anti-Phishing Code, MEXC Verify & Withdrawal Address
Overview
Nothing in this checklist prevents a platform-side security incident at an exchange. What it prevents is the other thing, the surge in phishing emails and impersonated support that reliably follows a large event. In the hot wallet incident at Binance on October 29, individual account balances did not change and the platform absorbed the loss, and the timeline and figures for that event are set out separately. As of November 1, withdrawals had been restored across 15 networks, with $4.649 billion processed against $1.01 billion in deposits between 06:00 and 15:30 UTC, and replacement of the stolen assets reaching about 95%.
The risk that actually lands on individuals begins afterwards. Search volume spikes, users are anxious, and official updates arrive frequently, and when those three coincide, forged emails, support accounts and links work best. A platform incident is absorbed by the exchange; a compromised account is absorbed by the user, and the second is precisely what settings can reduce.
Key Takeaways
Account security divides into four stages: login, notification, withdrawal and verification. At login, enable Google Authenticator two-factor authentication and save the key before completing the binding, or recovery after changing phones becomes impossible. At notification, set an anti-phishing code of one to six characters, after which every official MEXC email displays it, so any email without it or showing a different one can be identified as phishing. At withdrawal, enable the withdrawal whitelist and keep the 24-hour cooling period, which requires newly added addresses to wait a day before funds can leave. At verification, check any link, email address, phone number or social account claiming to be official through MEXC Verify.
A Platform Incident and a Compromised Account Are Different Problems
These two risks differ in who bears them, what surface is attacked and how they are prevented, and conflating them leads to effort spent in the wrong place.
A platform-side incident means the exchange's own systems were breached, through misuse of hot wallet signing authority or a compromised operational endpoint. Users cannot intervene through any personal setting, and the loss falls on the exchange's reserves and protection funds. The Binance event was of this kind, where the attacker obtained the ability to submit unauthorised withdrawal transactions, unconnected to any individual's account credentials.
A compromised account means an individual's account comes under someone else's control, usually through phishing emails harvesting verification codes, impersonated support staff directing transfers, cloned sites capturing login credentials, or clipboard hijacking substituting a withdrawal address. These losses generally fall outside an exchange's compensation, because the actions originated from the user's own account and passed normal verification.
After a large event, the success rate of the second category rises sharply. The reason is psychological rather than technical: users are anxious to confirm the state of their holdings, their guard against anything labelled official drops, and the official channels genuinely are issuing frequent updates, so real and fake messages sit on the same timeline.
Stage | Feature | What it defends against |
Login | Google Authenticator two-factor authentication | Account access after a password leak, SMS code interception |
Notification | Anti-phishing code | Forged official emails, notifications carrying malicious links |
Withdrawal | Withdrawal whitelist and cooling period | Address substitution, rapid transfers after account takeover |
Verification | MEXC Verify | Social accounts impersonating support, cloned site links |
Login: Bind Two-Factor Authentication
Two-factor authentication is the foundation. Per the help centre instructions, on the web you log in, click the user icon to open Security, and click Enable MEXC/Google Authentication. If the authenticator app is already installed click Next, and if not, scan the page's QR code to download it. In the authenticator, scan the QR code or manually enter the key shown on the page, click Get Code, enter the verification code sent to your email followed by the six-digit code from the authenticator, and submit to complete the binding.
In the app, tap the user icon on the home screen to open Security, select Google Authenticator, scan or manually enter the key, tap Next, complete the secondary security verification, then enter the six-digit code and confirm, after which the Security page shows the binding as active.
The step most often skipped, and the one with the worst consequences, is backing up the key. The help centre states plainly that the key is what allows the authenticator to be recovered if the phone is lost or replaced, and that it must be saved somewhere secure before the binding is completed. Users who change phones without the key have to go through an appeal process to unbind, during which withdrawals are typically restricted. Keep the key offline rather than as a screenshot in a photo library or a message in a chat app.
Once bound, login, trading and withdrawals all require the code, which means a leaked password alone no longer allows an attacker to withdraw.
Notification: Set an Anti-Phishing Code
An anti-phishing code is the cheapest way to judge whether an email is genuine. Per the help centre setup guide, on the web click the avatar at the top right to open Security, scroll to Advanced Security settings, find Anti-Phishing Code and click Set Up, then enter the code and confirm. In the app, tap the avatar at the top left to open Security, select Anti-Phishing Code, read the pop-up and confirm, then enter the code and confirm again.
The code is one to six alphanumeric characters. The help centre specifically advises against using any password you commonly use, because this code appears in every official email and is therefore semi-public information, serving an entirely different purpose from a password.
Once set, every official email from MEXC displays the code. An email arriving without it, or showing a code different from the one you set, can be identified as phishing, and no link in it should be clicked and no personal information provided. The distinction from a verification code matters here: an anti-phishing code is fixed and permanent, used to verify that a message came from the platform, while login and withdrawal codes are single-use and expire within minutes, used to verify that an action came from you. The two are not interchangeable, and any call or message asking you to supply your anti-phishing code is fraudulent.
If you forget the code, it can be viewed in Security settings after logging in on the web. To change it, click Change next to Anti-Phishing Code under Advanced Security settings and confirm the new one, with a similar process in the app.
Withdrawal: Whitelist, Cooling Period and Two Settings to Weigh
Withdrawal controls sit under fund security settings. On the web, hover over the user icon at the top right, select Security, scroll to Advanced Security and find Fund Security Settings. In the app, tap the user icon at the top left, select Security, scroll to the bottom and open Asset Security Settings. The full help centre guide lists four options, two of which raise security and two of which trade security for convenience, so they need judging separately.
Option | Effect | Effect on security |
Withdrawal whitelist | Once enabled, withdrawals can only go to whitelisted addresses | Raises it, by blocking transfers to unknown addresses |
Whitelist security restriction | Newly added whitelist addresses must wait 24 hours before withdrawal | Raises it, by creating a window in which abnormal activity can be noticed |
Fast withdrawal | Withdrawals below a set amount skip two-factor authentication | Lowers it, since withdrawals within that limit no longer require a code |
Withdrawal protection | All on-chain withdrawals are automatically rejected during a chosen lock period | Raises it, suited to accounts left untouched for long periods |
Enabling the whitelist works as follows: turn on the Withdrawal Whitelist toggle and complete security verification, click Manage Withdrawal Addresses to open the address page, click Add Withdrawal Address, choose Normal address, enter the asset, address, network and an optional label, tick Add to Whitelist, confirm and complete verification. Multiple addresses can be entered through the bulk add function, with the whitelist option ticked before saving.
The whitelist security restriction appears once the whitelist is on, requiring newly added addresses to wait 24 hours. The help centre strongly recommends keeping it enabled, because that 24 hours is the window in which something wrong can be spotted: an attacker who has taken over an account and added their own address still cannot move funds immediately. Note that turning the restriction off also imposes a 24-hour wait before withdrawals resume, a design intended to close the path of disabling the control and acting straight away.
Fast withdrawal is the only one of the four that reduces security. It allows withdrawals below a set per-transaction limit to skip two-factor authentication, with the help centre using 500 USDT as its example. The app guidance describes it as applying to small withdrawals to whitelisted addresses, while the web guidance does not mention the whitelist requirement. Limit changes take effect after 24 hours, with verification still required until then. The trade-off between convenience and exposure belongs to the account holder, though during a period of active phishing the cost of switching it off is low.
Withdrawal protection suits accounts held long term without frequent activity. Once set, all on-chain withdrawals are automatically rejected for the chosen lock period, and an Unlock Early option can be enabled during setup to retain flexibility.
Verification: Check Anything Claiming to Be Official
Impersonation is the most frequent attack after a large event, and it happens to be the easiest to verify. MEXC Verify checks whether a link, email address, phone number or social account belongs to an official channel, with a channel type dropdown and a search field on the page. In the app, the path is More, then MEXC Verify under Support.
The usage guide notes a detail that is easily missed: a verified result also lists the other official social accounts using the same identifier, while a phishing account may copy a legitimate official ID into its own profile text. Because of that, use the copy button to capture an account ID rather than typing what you see, since visually similar characters are a common source of error.
The moments to run a check are well defined: a direct message from someone claiming to be MEXC support, a link presented as an official campaign, a call from a supposed official number, or a new account on social media that appears official. Spending fifteen seconds on verification in those situations costs far less than dealing with the aftermath. The tool is at MEXC Verify.
One rule covers most cases: official channels never ask for a password, verification code, anti-phishing code or seed phrase through any medium, and never ask for assets to be moved to a so-called safe address. Anyone making such a request can be treated as fraudulent regardless of how official the account appears.
Exclusive View from James Mitchell
After every major exchange incident, public discussion concentrates on the platform side, while statistically the attacks that actually cost individuals their assets belong to the other category. Scale obscures frequency: a single platform incident runs to billions of dollars and occupies every headline, while the tens of thousands of phishing and impersonation attempts occurring over the same period, each costing between hundreds and tens of thousands of dollars, barely register publicly. For any specific user, the probability of the second is higher than the first by several orders of magnitude.
The highest-value item on this list is the anti-phishing code. It takes a minute to set and covers the single most common path in phishing attacks. Forged emails work because users lack a cheap test of authenticity, and the anti-phishing code supplies exactly that: a string known only to the user and the platform. Once set, judging an email shifts from checking the sender domain, hovering over links and comparing layout, to looking for one short code. Reducing the cost of a judgment to nearly zero is the most effective thing security design can do.
The 24-hour cooling period deserves separate mention. Its value lies not in preventing an attack but in creating a delay. In almost every account takeover, the attacker's first priority is moving funds quickly, because they know control may be recovered at any moment. A mandatory 24-hour wait stretches that window from minutes to a day, which is long enough for a login alert, an email notification or a change in balance to reveal the problem. Requiring the same 24 hours to disable the restriction exists precisely to close the route around the mechanism. The thinking behind this class of control is not to make an attack impossible but to make it impossible to complete before the user notices.
FAQ
Does the Binance incident affect my account at other platforms?
Not directly. A platform-side incident means the exchange's own systems were breached, which is unrelated to an individual's password or verification method. Phishing and impersonation targeting individuals does increase markedly afterwards, and that risk is what account settings reduce.
Why must the key be saved when binding two-factor authentication?
The key is what allows the authenticator to be recovered if the phone is lost or replaced. The help centre states it must be saved somewhere secure before the binding is completed, and users who change phones without it need to go through an appeal process to unbind, during which withdrawals are typically restricted.
What should an anti-phishing code be?
One to six alphanumeric characters. The help centre advises against using any password you commonly use, because the code appears in every official email and is therefore semi-public information.
What is the difference between an anti-phishing code and a verification code?
An anti-phishing code is fixed and permanent, shown in official emails to verify the sender. Login and withdrawal codes are single-use, expire within minutes, and verify that an action came from you. Any call or message asking for your anti-phishing code is fraudulent.
Can the 24-hour whitelist wait be turned off?
It can, but turning it off also requires a 24-hour wait before withdrawals resume, a design that prevents an attacker who has taken over an account from disabling the control and moving funds immediately. The help centre strongly recommends keeping it enabled.
Should fast withdrawal be enabled?
It is the only one of the four withdrawal settings that reduces security, allowing withdrawals below a set amount to skip two-factor authentication, with the help centre using 500 USDT as its example. During a period of active phishing the cost of switching it off is low, and whether to enable it depends on how frequently the account is used.
How do I confirm an account claiming to be official?
Use MEXC Verify to check the link, email address, phone number or social account. Capture the account ID with the copy button rather than typing what you see, since phishing accounts may use visually similar characters and may also copy a legitimate official ID into their own profile.
What information will official channels ask for?
None of it. Official channels never request a password, verification code, anti-phishing code or seed phrase through any medium, and never ask for assets to be moved to a so-called safe address. Anyone making such a request can be treated as fraudulent.
What should be done after completing these settings?
Review login device history and the withdrawal address list periodically, removing addresses no longer in use, and if a login or withdrawal notification arrives for an action you did not take, change the password immediately and contact official support. Account security is not a one-time configuration but something to revisit as usage patterns change.
Disclaimer
This article is for general information only and does not constitute investment, financial, legal or tax advice. Feature descriptions follow MEXC's publicly available help centre documentation and are current as of November 2, 2026, while interface layouts and setting paths may change with product updates, so the latest in-platform instructions should take precedence before making changes. Crypto assets are highly volatile and can produce losses exceeding the initial outlay. Readers should verify the original disclosures and judge independently, consulting a qualified professional where appropriate.
About the Author
James Mitchell specializes in technical analysis, market trends, and trading strategies for both Bitcoin and altcoins. Based in London, he has over 10 years of experience in financial markets. Before joining MEXC Learn, James worked as a senior analyst at a leading European investment firm, where he developed expertise in risk management and quantitative trading. His transition to cryptocurrency markets began in 2017, and he has since become recognized for his data-driven approach. He holds a Master's degree in Financial Economics from the London School of Economics. His analytical approach combines traditional technical analysis with on-chain metrics to provide readers with actionable insights.
Areas of Expertise: Technical Analysis, Market Trends and Cycles, Trading Strategies, Bitcoin and Altcoin Analysis, Risk Management.
Research References
Want the fastest access to MEXC's latest updates? Join our official Telegram group now!
Account Verification: Understand KYC | How to Complete KYC
Market Opportunity
4 Price(4)
$0.01105
$0.01105$0.01105
USD
4 (4) Live Price Chart
The articles shared on this page are sourced from public platforms and are provided for reference only. They do not represent the position or views of MEXC. All rights belong to James Mitchell. If you believe any content infringes upon the rights of a third party, please contact [email protected] for prompt removal. MEXC does not guarantee the accuracy, completeness, or timeliness of any content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be interpreted as a recommendation or endorsement by MEXC. For expert insights and in-depth analysis, visit MEXC Learn.
Latest Updates on 4
View More
Why Is Eli Lilly Stock Surging? The Numbers Behind LLY’s Record High
Eli Lilly stock hit a record high after earnings. See what drove the rally, what the headline numbers hide and what LLY investors should watch.
2026/10/29
Does the Binance Security Incident Put Your Ethereum Wallet at Risk? EIP-7702 and Wallet Delegation Explained
The Binance security incident on October 30, 2026 has pushed a relatively technical Ethereum feature into a much broader security discussion: EIP-7702 wallet delegation.
For ordinary Ethereum users, however, the most important question is not whether EIP-7702 appeared somewhere in the incident timeline. It is whether the same class of authorization risk could affect a personal wallet holding ETH, USDT, USDC or other Ethereum assets
2026/10/30
What Role Did EIP-7702 Authorizations Play in the Binance Hack?
That detail quickly pushed EIP-7702 into the center of the discussion. The Ethereum account-delegation mechanism allows a normal externally owned account, or EOA, to temporarily execute smart contract logic. In the Binance incident, blockchain researchers identified an EIP-7702 delegation shortly before assets were transferred from a Binance-linked hot wallet.
But there is an important distinction
2026/10/30
You May Also Like
HOT
Currently trending cryptocurrencies that are gaining significant market attention
Crypto Prices
The cryptocurrencies with the highest trading volume
Newly Added
Recently listed cryptocurrencies that are available for trading