Answer · confidence: partial
What safety features do crypto apps have, and which do beginners skip most?
Research question: What account protections do crypto platforms offer (two-step login, withdrawal limits, cold storage, insurance), and which ones do beginners most often skip?
Platforms commonly require app or SMS codes for login and withdrawals 16, but two-step login fails once attackers obtain both the password and the second factor, such as through malware, SIM swap, or social engineering 17. Custodians generally keep most assets in cold storage, as Bakkt does 6, and Coinbase Custody keeps private keys on hardware never connected to the internet 5. Insurance is narrower than many users assume: Binance's SAFU fund does not cover user mistakes or external scams 4, the custodians are not FDIC-insured 8, and custody insurance may not cover all possible losses 13. The records do not describe withdrawal limits, and they do not directly show which protections beginners skip most often, though only a small minority of users use anti-phishing codes or address whitelisting 7. The newest fact is dated October 2026, so the evidence is current to the present month 1.
Checked 2026-10-18. Only documented and supported facts are used.
Dig deeper on this questionSources
[1] supported
Bitget detected unauthorized transfers from some of its hot wallets and suspended withdrawals, showing that exchange hot wallets are a direct target.
"Bitget detected unauthorized transfers from some of its hot wallets on Sept. 24 and suspended withdrawals."Crypto Security Losses Surge to $1 . 26B in Q3 : CertiK (cointelegraph.com, 2026-10)
[2] supported
In a study of three major Canadian banks, mandatory two-factor authentication significantly reduced the number of compromised bank accounts, while optional two-factor authentication did not.
"Bayesian time series analysis revealed that mandatory 2FA significantly reduced the number of compromised bank accounts, whereas optional 2FA did not."Evaluating the Effectiveness of Two-Factor Authentication (2FA) in Mitigating Account Takeover Fraud: A Natural Experimental Study on Canadian Banks (2026)
[3] supported
According to Bitget, attackers exploited a third-party security product to steal internal credentials and forge withdrawal commands, so a security tool itself became the weak point.
"The company said attackers exploited a vulnerability in a third-party security product to obtain internal credentials and forge withdrawal commands."Crypto Security Losses Surge to $1 . 26B in Q3 : CertiK (cointelegraph.com, 2026-10)
[4] supported
Binance's SAFU fund covers exchange-side failures but not user mistakes or external scams.
"But SAFU only covers exchange-side failures – not user mistakes or external scams."Cryptocurrency Insurance: What's Actually Covered in 2026? - Crypto Trace Labs
[5] supported
Coinbase Custody stores private keys offline on hardware that has never been connected to the internet, which reduces the risk of theft.
"This means that the private keys, the cryptographic component that allows a user to access Crypto Assets, are stored offline on hardware that has never been connected to the internet. Storing the private key offline minimizes the risk of the Crypto Assets being stolen."424B3 Bitwise 10 Crypto Index ETF (BITW) (CIK 0001723788) 2026-06-01
[6] documented
Bakkt Crypto keeps most customer crypto assets in cold storage, and only a small share in warm or hot wallets.
"With respect to mode of storage, a small percentage of all crypto assets (generally not more than 2%) are held in warm or hot storage in order to facilitate daily settlement and customer withdrawals, while the vast majority of crypto assets are held in cold storage and accessed, as needed, to replenish the warm or hot wallets."10-Q/A Bakkt Holdings, Inc. (BKKT, BKKT-WT) (CIK 0001820302) 2024-02-08
[7] supported
Only a small minority of users use anti-phishing codes or address whitelisting, which are more advanced protections.
"Just 21.5% of users employ anti-phishing codes, and only 17.6% have turned on address whitelisting."Crypto Security Trends: Binance Survey Reveals 2FA Is Now a Standard
[8] documented
The custodians are not FDIC-insured, so assets they hold have no FDIC deposit protection.
"deposits held with or assets held by the Custodians are not FDIC-insured."424B3 Bitwise 10 Crypto Index ETF (BITW) (CIK 0001723788) 2026-06-01
[9] supported
Assets held by its custodians Coinbase Custody and BitGo are kept 100% in segregated cold storage, in unique blockchain addresses not shared with other clients.
"Assets stored by Coinbase Custody and BitGo are held 100% in segregated cold storage."10-Q/A Bakkt Holdings, Inc. (BKKT, BKKT-WT) (CIK 0001820302) 2024-02-08
[10] supported
Coinbase Custody's parent fidelity insurance covers theft of funds held in both hot and cold storage, but the Trust and Sponsor do not insure the assets themselves.
"Specifically, the fidelity program provides coverage for the theft of funds held in hot or cold storage."424B3 Bitwise 10 Crypto Index ETF (BITW) (CIK 0001723788) 2026-06-01
[11] documented
Bakkt says the amounts in warm/hot versus cold storage are monitored daily by its custody operations team and reviewed by management monthly.
"The amounts of crypto assets held in warm/hot storage and cold storage are monitored daily by our custody operations team and reviewed by management on a monthly basis."10-Q/A Bakkt Holdings, Inc. (BKKT, BKKT-WT) (CIK 0001820302) 2024-02-08
[12] documented
As of December 31, 2024, the Core Custodians were BitGo, Coinbase, Fidelity, Gemini, Komainu, and Zodia.
"are BitGo, Coinbase, Fidelity, Gemini, Komainu, and Zodia"Self-Regulatory Organizations; The Nasdaq Stock Market LLC; Notice of Filing of Proposed Rule Change, as Modified by Amendment No. 1, To Adopt Nasdaq Rule 5712 To Provide for the Listing and Trading of Commodity- and Digital Asset-Based Investment Interests and To List and Trade Shares of the Hashdex Nasdaq Crypto Index US ETF Under Proposed Nasdaq Rule 5712 (Securities and Exchange Commission, 2025-03-07)
[13] documented
Insurance programs at the custodians do not guarantee the Trust's performance and may not be sufficient to cover all possible losses.
"may not be available or sufficient to protect the Trust from all possible losses or sources of losses. The insurance programs do not cover, insure, or guarantee the performance of the Trust."424B3 Bitwise 10 Crypto Index ETF (BITW) (CIK 0001723788) 2026-06-01
[14] supported
Insolvency law is not settled for crypto held in custody, so customers could be treated as general unsecured creditors if a custodian goes bankrupt.
"As a result, there is a risk that crypto assets held in custody could be considered to be the property of a bankruptcy estate in the event of a bankruptcy, and that the crypto assets held in custody on behalf of our customers could be subject to bankruptcy proceedings and such customers could be treated as general unsecured creditors."10-Q/A Bakkt Holdings, Inc. (BKKT, BKKT-WT) (CIK 0001820302) 2024-02-08
[15] supported
Binance Wallet uses multi-party computation to remove seed phrases and split key access across three encrypted components.
"It provides multi-party computation (MPC) tech that removes seed phrases and distributes key access to three encrypted components."Crypto Security Trends: Binance Survey Reveals 2FA Is Now a Standard
[16] supported
Crypto platforms commonly require app or SMS codes for login and withdrawals, which is a form of two-step login.
"App or SMS codes for login and withdrawals."Crypto Identity Verification 2026: Key Crypto Market Trends
[17] supported
Two-step login stops failing once attackers obtain both the password and the second factor, for example through malware, SIM swap, or social engineering.
"Once criminals obtain both credentials and second-factor access (for example, through malware, SIM swap, or social engineering), MFA no longer helps."Crypto Identity Verification 2026: Key Crypto Market Trends