Binance View guide → Home：Complete Binance Guide →

Binance new-user bonus · Enjoy 20% fee rebate

Invite codeBINANBT

✅ The invite code is applied automatically when you register — no need to enter it manually

⚠️ Complete identity verification (KYC) after signup to trade & withdraw

⏳ The registration page takes 2–5 seconds to load — please wait, don't tap repeatedly.

Binance • 11/4/2026 • Updated 11/4/2026 • Author：CoinVado Research • 9 reads • 10 min

Binance Account Security 2026: 2FA & Withdrawal Whitelist

Binance account security is not just turning on 2FA. Anti-phishing codes, withdrawal whitelists, new-address locks, device management, API permissions and passkeys each close a different hole. This guide gives a six-step setup in the right order, explains the 24/48/72-hour delays, lists five common mistakes, and sets out a 30-minute stop-loss sequence if your account is compromised.

⚠️ Read this first: if you have not registered yet, use the registration link (e.g. "Register now") or invite code BINANBT — registering directly inside the app gets you none of the new-user rewards, and the $19,800 welcome package and 20% fee rebate will not apply. Security settings are free; anyone charging you to "harden your account" is a scammer.

Key takeaways (TL;DR):

The right order for Binance account security is withdrawal first, login second, devices last. Most people enable 2FA and leave the withdrawal whitelist and API permissions at their defaults.

Counterintuitive point one: 2FA protects login, not transactions you approve yourself. A phishing site can relay your username, password and code in real time and operate your session from elsewhere. 2FA is not a universal switch.

Counterintuitive point two: the setting that saves you is not more verification, it is delay. New whitelist addresses can be locked for 24/48/72 hours, and withdrawals are suspended for 24–48 hours after a password change. That "annoying" wait is the only window you get to stop a transfer.

Counterintuitive point three: a whitelist is not automatically safe. Old addresses stay valid, an attacker can add a new one, and an API key with withdrawal permission bypasses the whole thing.

Counterintuitive point four: email is the master switch. Many Binance account takeovers start with a compromised mailbox or an auto-forwarding rule, not with Binance itself.

If something looks wrong, stop the bleeding before chasing recovery. Change the password, revoke sessions, kill API keys and check the whitelist before contacting support. Clicking the "security link" in an email is often the second mistake.

Binance account security comes down to winning two races against an attacker: who can log in, and how long it takes to move funds out. 2FA answers the first; the whitelist and its delay answer the second. Doing only the first is like installing a reinforced door and leaving the safe key next to it.

This guide is based on Binance's app and web Security Center as of November 2026. It skips generic advice like "use a strong password" and focuses on which settings actually change the outcome, how the delays work, and which "safe" habits make things worse.

What Binance account security is really defending: three layers
Six-step setup: do it in this order
Step one: a dedicated email matters more than a new password
Step two: which 2FA to use and why SMS comes last
Step three: how to set and actually use an anti-phishing code
Step four: withdrawal whitelist and new-address locks
Step five: device management, API keys and third-party access
Step six: withdrawal protection and passkeys, when they fit
Five details almost everyone misses
Security advice that actually makes you less safe
The 30-minute incident response order
A five-item monthly security check
💰 Binance fee rebate: invite code BINANBT
FAQ
Further reading

What Binance account security is really defending: three layers

Account risk sits at three layers: login, withdrawal and authorisation. Each layer faces a different attack and needs a different control. Staring at only one layer is how people end up saying "but I had 2FA on" after losing funds.

Layer	What the attacker wants	Control	What failure looks like
Login	Your username, password and code	Dedicated email, strong password, authenticator 2FA, passkey, device management	Unknown login alerts, missing anti-phishing code, password changed
Withdrawal	To send your balance to their address	Withdrawal whitelist, new-address lock, withdrawal protection, 24–48-hour security lock	Unknown address in the address book, withdrawal paused, unexpected confirmation email
Authorisation	To move funds without logging in	Least-privilege API keys, IP allowlists, third-party connection reviews	API key gains withdrawal permission, calls from an unknown IP, bot places odd orders

Of the three, the withdrawal layer is the most often skipped and the authorisation layer the most underestimated. 2FA gives people confidence at the login layer, but an API key with withdrawal permission does not need a login at all.

Note: the three-layer model is this article's analytical framework, not an official Binance classification. Menu names and entry points vary by app version and region; use what the Security page shows at the time.

Six-step setup: do it in this order

Order matters: block fund outflow first, harden login second, clean up old access last. The first two steps protect you even if the rest is incomplete; the reverse is not true.

Dedicated email with its own 2FA: secure the master switch.
Authenticator 2FA with offline recovery codes: move from a single password factor to password plus a rotating code.
Anti-phishing code: tell genuine Binance emails apart at a glance.
Withdrawal whitelist and new-address lock: restrict where funds can go.
Device and API cleanup: remove strangers and revoke third-party access.
Withdrawal protection, passkeys and settings locks: add deliberate friction where it fits.

Each step below covers where to find it, the key parameters and when not to enable it.

Step one: a dedicated email matters more than a new password

Binding Binance to an email used only for the exchange is the foundation of everything else. Password resets, login alerts, withdrawal confirmations and anti-phishing codes all travel through that mailbox. If it is taken over, the recovery flow can bypass your 2FA.

Four things to do:

Use a separate mailbox: not the one you use for social media, shopping or other exchanges. One breach should not chain across every account.
Enable 2FA on the mailbox itself: the mailbox deserves the same protection as Binance. If it falls, the reset email becomes the attacker's key.
Turn off auto-forwarding and inbox rules: attackers often add a forwarding rule so you keep receiving mail while they read a copy. Audit rules and filters regularly.
Do not expose the address in public profiles, signatures or social bios. Phishing usually starts with knowing your email.

⚠️ Avoid work or school email for an exchange account. Losing access after a job change or graduation can make account recovery unnecessarily hard.

Step two: which 2FA to use and why SMS comes last

2FA strength runs from hardware key/passkey, to authenticator app, to SMS. Use an authenticator whenever you can.

Method	Strength	Upside	Main risk
Hardware security key (FIDO2)	Highest	Phishing-resistant; will not sign for the wrong domain	Costs money; needs a backup plan
Passkey / biometrics	High	No codes to type; strong phishing resistance	Tied to a device; rebind after switching
Authenticator app	Medium-high	Free, offline, independent of the carrier	Losing the phone or recovery codes can lock you out
SMS code	Low	Lowest barrier	SIM swap, SMS interception, carrier fraud

When you set up an authenticator, store the recovery code offline: on paper in a drawer, or on an offline hardware device. Do not keep it only as a screenshot or in a cloud note. Losing the phone and the cloud account at the same time removes both your 2FA and your way back in.

SMS can stay as a backup, but it should not be the only method. If Binance lets you disable SMS after the authenticator and recovery codes are safely stored, consider it — but first make sure a lost phone will not lock you out.

Note: available 2FA methods differ by region and account level. Use the options Binance actually shows on the Security page.

Step three: how to set and actually use an anti-phishing code

An anti-phishing code is a string only you and Binance know, included in genuine Binance emails. If an email claiming to be from Binance lacks it, treat the email as phishing. It does not stop an attacker; it gives you a one-second test when a "your account is at risk" email arrives.

Requirements:

6 to 8 characters;
at least three of these four types: uppercase letters, lowercase letters, digits and underscores;
no special characters;
avoid names, birthdays, phone numbers and sequences like 123456.

Set it in the app under Profile → Security → Anti-Phishing Code, or on the web under Account → Security → Advanced Security. Both setting and changing it require 2FA.¹

How to use it: on any email claiming to be Binance, look for the code first. If it is missing or wrong, do not click anything. Open the app or type the official domain manually. The code mainly covers email; some regions also attach it to certain SMS messages, but do not assume every channel carries it.

A common mistake is thinking "I set a code, so every email is genuine." No. An attacker can send an email with no code at all and hope you do not check. The code only works if you check it every time.

Step four: withdrawal whitelist and new-address locks

Withdrawal whitelisting means funds can only go to addresses you have pre-approved. Even an attacker inside your account cannot send them to their own wallet. It is the strongest withdrawal-layer control, but only if the new-address lock is on.

Enabling the whitelist

On the web, the path is roughly Settings → Withdrawal → Withdrawal Whitelist → Enable, confirmed with 2FA or a passkey. Add addresses under Address Management, either for a specific coin and network or as a universal address. The limit is 200 whitelisted addresses.²

What matters is not how many addresses you add, but whether each one is yours. Check the address and network character by character. On EVM chains the same address can appear on several networks, but sending on the wrong network can still be unrecoverable.

The new-address lock: the setting that buys you time

Binance offers a whitelist withdrawal limit / new-address lock: newly whitelisted addresses cannot be used for 24, 48 or 72 hours. You choose the duration, and Binance recommends leaving it on.²

The point is that an attacker who gets into your account and adds their own address still cannot move funds immediately. You get 24–72 hours to notice, change the password, revoke devices and contact support.

Two details people miss:

Editing or disabling the whitelist can also trigger a 24/48/72-hour withdrawal pause. Do not plan a whitelist change on the day you need to withdraw.
Turning the new-address lock off makes new addresses immediately usable. The convenience cuts both ways.

⚠️ A whitelist is not permanent safety. If an old address stays on the list after the wallet's private key leaked, an attacker can still send funds there. Cleaning out unused addresses matters as much as adding them.

Step five: device management, API keys and third-party access

This step is about taking back what someone else may already hold: unknown devices, API keys with withdrawal permission and stale third-party connections. Changing a password without cleaning these is like changing the lock but leaving the old keys out.

Device management

Under Account → Security → Device Management you can see active and historical logins with IP, region and time. Remove anything you do not recognise; removal revokes access immediately unless the device is re-confirmed by email.³

Turn on new-device login alerts as well. An alert cannot stop a login, but it tells you immediately that someone got in.

API keys

If you use grid bots, quant tools or third-party portfolio trackers, API keys are a common leak point. Four rules:

Disable "Enable Withdrawals". It is the most dangerous permission, and almost no trading bot needs it.
Bind an IP allowlist. Only your server or fixed IP can call the key; a leaked key is useless from anywhere else.
Use one key per tool. Do not connect every service through a single key.
Delete unused keys, including keys from old servers and tools you stopped using.

Note: Binance may automatically expire long-idle API keys without IP restrictions. The exact period can change; do not rely on automatic expiry as your cleanup plan.

Third-party connections

If you have used the Binance Web3 Wallet with DApps, or connected third-party analytics, tax or portfolio tools, review and revoke connections you no longer use. Exchange 2FA does not cover on-chain approvals; the two security models need separate checks.

Step six: withdrawal protection and passkeys, when they fit

These are not mandatory for everyone, but they are valuable if you rarely withdraw or often log in from shared devices.

Withdrawal protection: voluntarily lock withdrawals for 1–7 days. Useful for long-term holders with no near-term withdrawal plans. Even a compromised account cannot move funds during the lock.
Passkey / biometric login: use the device's fingerprint or face instead of a password, reducing phishing and keylogger exposure. Keep at least one backup login method before enabling it.
Global settings lock, where offered: require extra verification before security settings can be changed, so an attacker cannot simply turn your 2FA off after getting in.

Names and availability vary by region and app version. The only test that matters: how much longer does an attacker need to move your money? The longer the delay, the more time you have to notice and react.

Five details almost everyone misses

People rarely lose funds because a feature did not exist; they lose because they enabled it and never checked these five things.

Email auto-forwarding rules. The first thing an attacker does after taking over a mailbox is often to add forwarding. You still receive mail; they read a copy with your codes and withdrawal confirmations.
SIM-swap risk on SMS 2FA. A attacker can port your number and receive the codes. An authenticator app does not depend on the carrier, which is why it is stronger.
Old addresses on the whitelist. An unused address that stays approved is a back door with the old lock still on it.
API keys without an IP allowlist. A leaked key works from anywhere; with an IP allowlist, the same key is worthless elsewhere.
Recovery codes stored only on the phone. A lost, broken or wiped phone takes your 2FA and your recovery path with it. Keep recovery codes offline and in a second location.

Security advice that actually makes you less safe

Some habits look prudent but reduce safety or remove your ability to recover.

Changing your password constantly. Binance suspends withdrawals for 24–48 hours after a password change, and the lock cannot be lifted early.⁴ Frequent changes do not make the account safer; they put you repeatedly into a no-withdrawal state and create more phishing opportunities.
Sending 2FA codes to "support". Official support never asks for codes, passwords, seed phrases or remote access. Anyone who does is a scammer.
Reusing one email for exchanges and social accounts. One breach exposes everything.
Storing passwords or seed phrases in cloud notes, chat favourites or email drafts. If that account syncs or leaks, the key and the address are in the same place.
Installing unknown "anti-theft" plugins or "security assistants". They often want to read pages or sign on your behalf, which is the risk itself.
Turning off the new-address lock for convenience. You save 24–72 hours; so does the attacker.

The 30-minute incident response order

When something looks wrong, the first principle is to stop the bleeding, not to chase recovery. Kick the attacker out and block the exit before you argue with support.

Log in from a clean device by typing the official domain. Do not click links in emails or SMS; they may lead straight to a phishing site.
Change the password. Do not reuse or slightly modify the old one.
Revoke all devices and sessions. Remove unknown devices in Device Management and log out everywhere.
Delete or disable all API keys, especially keys with withdrawal permission and no IP allowlist.
Check the withdrawal whitelist and address book. Remove unknown addresses and confirm yours have not been swapped for lookalikes.
Check 2FA, anti-phishing code, phone and email bindings. If they were changed, follow the official recovery flow.
Contact official Binance support through the in-app support entry or the official Help Center, never a phone number from a search ad.
Decide whether to move remaining funds. Remember that a password change may trigger a 24–48-hour withdrawal lock; use that time to finish the checks.

What you see	Do first	Never do
Unknown device login alert	Change password, revoke devices, check API keys	Click "not me" in the alert email
Anti-phishing code disappeared	Treat as compromise and use official recovery	Enter a new password in the email
Unknown address in the address book	Remove it, check the whitelist, contact support	Send a small "test" transfer to it
Withdrawal paused	Read whether it is a security lock or a review	Resubmit withdrawals repeatedly or buy "unblocking"
API key placing unknown orders	Delete the key and check IP allowlists	Only change the password and leave the key

⚠️ On "recovery": Binance can see transfers inside the platform, but on-chain transfers are generally irreversible. The earlier you stop the bleeding, the more you keep; banking on post-incident recovery usually means acting too late.

A five-item monthly security check

Five minutes a month beats five days of appeals after an incident.

Any unknown devices or unusual login regions?
Do API keys still have only the permissions they need, with IP allowlists?
Are there unused or unfamiliar addresses on the withdrawal whitelist?
Is the anti-phishing code still active, and do recent official emails show it?
Can you still find your 2FA recovery codes, offline and accessible to you?

Add a quarterly check of email forwarding rules, filters, backup email and phone number. It is the most overlooked and most useful place for an attacker to hide.

💰 Binance fee rebate: invite code BINANBT

Security settings are free; what affects your long-term cost is trading fees. Register with invite code BINANBT for a 20% fee rebate. This article contains a referral link; we may earn a reward if you register through it, at no extra cost to you.

Rebate: 20% of trading fees, ongoing.
Welcome package: up to $19,800, unlocked by tasks, not cash on sign-up.
How to claim: enter BINANBT in the invite code field during registration; that is the most reliable route.
Important: registering directly inside the app gets you none of the new-user rewards. In-app registration is not linked to any referral relationship, so the $19,800 package and the 20% rebate will not apply. Use the registration link or enter BINANBT.

👉 Register on Binance and claim the 20% fee rebate

FAQ

Is 2FA enough for Binance account security?

No. 2FA mainly protects login. It does not protect codes you type into a phishing site, and it does not control API keys with withdrawal permission. At minimum, also enable the withdrawal whitelist and new-address lock and clean up API permissions.

How do I set the Binance anti-phishing code?

Go to Profile → Security → Anti-Phishing Code in the app, or Account → Security → Advanced Security on the web. The code must be 6–8 characters, use at least three of uppercase, lowercase, digits and underscores, contain no special characters, and be confirmed with 2FA.

How many addresses can I whitelist on Binance?

Up to 200 addresses. The number is not the point; every address should belong to you, and unused ones should be removed regularly.

Why must a new withdrawal address wait 24 hours?

That is the new-address withdrawal lock, configurable to 24, 48 or 72 hours. It gives a compromised account time to notice and stop a theft. You can turn it off, but then a new attacker-added address becomes usable immediately.

Why can't I withdraw after changing my Binance password?

Binance suspends withdrawals for 24–48 hours after a password change; in some cases P2P selling and payment services are also paused for 24 hours. The lock is automatic and cannot be lifted early; it expires on its own.

What should I do first if my Binance account is hacked?

From a clean device, type the official domain manually, change the password, revoke all sessions, delete API keys, check the withdrawal whitelist and then contact official support. Do not click security links in emails or SMS, and do not pay anyone who promises recovery.

Can I send my 2FA code to Binance support?

No. Official support never asks for passwords, 2FA codes or seed phrases, and never asks you to share your screen or install remote-control software. Anyone asking for those is a scammer.

How often should I review Binance security settings?

Monthly, check devices, API keys, the withdrawal whitelist, the anti-phishing code and your recovery codes. Quarterly, check email forwarding rules, filters and backup contact methods.

Table of contents