New account holders face a wall of settings described in language that assumes you already know what they do. Short version: four things to enable before your first deposit, two to skip, one to verify within the first hour.
Enable before the first deposit
1. An authenticator-app second factor. Not SMS - SIM swap attacks are cheap, and SMS is the factor most often bypassed in practice. Hardware key support is better still.
2. A withdrawal address whitelist. Rejects any withdrawal to a pre-unapproved address at the payout layer - below where a stolen session can act. The single setting that makes a stolen login useless for moving funds.
3. An anti-phishing code, if offered. A custom word in every legitimate email. A withdrawal confirmation without it is phishing, no judgement required.
4. Withdrawal and security-change notifications. Immediately, not eventually.
Skip for now
API keys, until a specific script needs one (then: withdrawals off, IP restricted). Sub-accounts, until your structure requires them. Advanced order types, until your strategy does.
Skipping is not neglect - it is refusing to widen an attack surface you do not need.
Verify within the first hour
If you entered a referral code at signup, verify it took: profile menu → referral section → the field naming your referrer. Not your own outbound code - that is always populated.
Empty means a ticket the same day. Rebind requests are adjudicated from the raw signup session, which ages out. First hours: strong odds. Weeks: usually no.
My code is BBBKK: https://www.binance.com/register?ref=BBBKK (~20% off spot fees). The verification is the part that protects it.
First week
Make a small withdrawal to a wallet you control. It confirms your whitelist config, your exit path, and the venue's normal speed - three things you want tested before you need them under pressure.
Disclosure: commission if you sign up with the code. Not financial advice.
Top comments (0)