BitX21 / Security
Protect your account. Check every transfer.
Security starts with careful account access and transaction checks. No online service or crypto asset is free of risk.
Secure your sign-in
Use a unique password and protect the email account associated with your profile. Enable two-factor authentication where offered in account settings. Never share passwords, one-time codes or recovery information.
Identity verification
The verification flow may request identity information through the integrated verification provider. Open it from your signed-in account; do not send identity documents to an unsolicited chat or email address.
Submission is not approval. Follow the status shown in your account and any requests from the verification flow.
Check assets and networks
Confirm the asset, network, destination address and any required memo before transferring. Availability on one network does not mean another network is supported. Transfers may be irreversible.
Report suspicious activity
Contact support if you suspect unauthorized access or receive unusual payment instructions. Share a description of the issue, not a password, recovery phrase, card number or verification code.
How should you protect sign-in and recovery?
Use a password that is unique to BitX21 and protect the email address linked to the account. If the same password is reused elsewhere, a problem at another service can put this account at risk. Check the address bar before signing in, especially when arriving through a message or search advertisement.
Use the two-factor authentication settings available in your account. Keep recovery information somewhere secure and separate from routine messages. Never provide an authenticator code to someone claiming they need it to investigate a deposit. A code that authorizes a sign-in or action is not a support reference.
Sign out when you finish on a shared device, and avoid saving access credentials there. If you suspect that your email or device is compromised, secure those access points and contact support. Do not assume that changing one password automatically resolves every possible exposure.
What should you verify before a transfer?
Review the full destination, asset and network in the transaction screen. Similar token symbols can exist on different networks. A deposit address being valid in one context does not prove that it supports a different asset or route. Follow any memo or reference requirement exactly.
Check the withdrawal amount, applicable fee and expected result before confirming. If a destination was copied, compare the displayed value with the source again. Do not follow a new address supplied through an unsolicited message claiming to be a routine platform migration or account repair.
If something does not match, stop and ask support. Completed crypto transfers may be irreversible, and sending again does not undo an incorrect first transfer. Keep relevant transaction records private. Never post a recovery phrase, private key or authenticator code in a support request.
What can public security information establish?
Account controls and custody arrangements are different subjects. A two-factor authentication setting helps protect access but does not establish how assets are stored. A security illustration is decorative, not an audit report or an insurance certificate. Review specific evidence for any claim that matters to you.
Ask for current details about cold storage, withdrawal controls, independent audits or insurance if you need those facts. This page does not publish a percentage, audit result, insurance amount or certification without approved evidence. It also does not describe every asset or transaction as risk-free.
If you report suspicious activity, explain what happened and which account action is affected. Use the published contact or the security contact file, and provide further sensitive information only through a verified channel. Avoid sharing exploit details or personal transaction records publicly while seeking account help.