ACCOUNT SECURITY

Protect Your Account and USDT Wallet

Account, email, device and wallet security are separate control layers. Protect each one, and identify which layer is affected before taking action. A platform request, a broadcast transaction and a confirmed blockchain transfer require different responses.

Use a strong, unique password

Prioritise length and uniqueness over predictable substitutions.
Do not reuse a password from another service.
Exclude names, dates, account details and the service name.
Use a reputable password manager if appropriate.
Protect the password manager’s recovery method and test its backup process.

Use the strongest MFA available

Consider a passkey or FIDO security key when supported.
An authenticator app adds a separate factor but does not remove the need to verify the domain.
SMS or email codes add protection, although their security depends on the phone number or email account.
Store recovery codes away from the device they protect.
Review active sessions and remove unknown devices when the feature is available.

Protect your email and devices

Give the linked email its own unique password and MFA.
Keep the operating system, browser and wallet software updated.
Use a screen lock on every device.
Avoid signing in or transferring funds on public or unmanaged computers.
Do not install a requested certificate, VPN profile or remote-control tool from an unverified source.
Install apps only after checking the official publisher, domain and permissions.
Use the site’s sign-out function; clearing browser data is not a substitute for ending a session.

Recognise phishing

Common warning signs

An unexpected account-alert link
A lookalike domain
An urgent prize or restriction message
A request for a password or one-time code

High-risk requests

A request for a private key or seed phrase
A request to install remote-control software
An upfront transfer to unlock or recover funds
Pressure to act before verifying the domain

Do not use contact details inside a suspicious message. Open a verified domain independently and use the support route shown there.

Protect your USDT wallet

Keep private keys and seed phrases offline

Never enter them on an unfamiliar site or send them to support. Avoid unencrypted screenshots, chats and ordinary cloud notes. Maintain a recovery method that can be tested without exposing the secret.

Separate interaction funds from long-term holdings

A separate wallet can limit exposure, but it cannot correct a wrong network or address. Label each wallet’s purpose and recheck the asset, network and destination every time.

Review token approvals carefully

Only networks where a wallet has interacted with smart contracts may have token approvals to review. Verify the network, contract, spender and allowance before revoking anything. Revocation may cost a network fee and cannot recover assets already transferred.

First response to a suspected incident

Stop using the possibly compromised device.
From a trusted device, secure the linked email and recovery details.
Change unique passwords and revoke unknown sessions where available.
Identify whether the incident involves the account, email, wallet key, contract approval or blockchain transaction.
Record timestamps, notifications, request IDs, asset, network, addresses and transaction IDs.
Contact support through a verified route.
Review browser extensions, forwarding rules, recovery phone numbers and wallet permissions.

Match the response to the incident

Swipe horizontally to view all columns

Signal	First check	First action
Unknown login	Time, device, email and active sessions	Secure email, change unique credentials and revoke sessions
Unfamiliar withdrawal request	Request status, network, address and whether a transaction ID exists	Ask about available restrictions before broadcast; check chain status after broadcast
Unknown on-chain transaction	Transaction ID, network, addresses and confirmation status	Preserve evidence and follow the wallet or network provider’s official security process
Seed phrase entered on an unfamiliar site	Wallets, networks, time and device condition	Stop using the site and affected device; follow official wallet security guidance
Unknown token approval	Network, contract, spender and allowance	Use a trusted approval-management route on the correct network

Evidence to preserve

Date, time and time zone
Account request number and displayed status
Login or recovery notifications
Asset, network, addresses, amount and full transaction ID
Actions already taken
Support-response timeline

Redact passwords, one-time codes, private keys, seed phrases and complete recovery codes from screenshots.

Further reading: NIST authenticator guidance and CISA password guidance. External guidance and available platform controls can change.