Security

Turn on two-factor authentication in Settings with an authenticator app such as Google Authenticator. Turning it on is confirmed by a code sent to your email; turning it off needs a code from the app.

With it on, the site asks for a code from the app:

• for every withdrawal;
• for a deposit from your balance and an early withdrawal of a deposit;
• for a change of the password, the email or a wallet address.

Without it, a change of the email or of a wallet address is confirmed by a code sent to your email.

Passwords are stored only as hashes: nobody can read your password, our team included.

The number of sign-in attempts is limited: after several wrong passwords for one username or from one address, new attempts are refused for a while. The codes of two-factor authentication are limited the same way.

Without “Keep me logged in” the session ends after 30 minutes without activity. With it, you stay signed in on that device for 30 days.

We send you an email when the password or the email of your account is changed, when two-factor authentication is turned on or off, and when a wallet address is saved or removed. If it was not you, change your password at once and write to support.

A withdrawal goes only to the wallet address saved for its currency in Settings. Saving or removing an address needs a code from the app or from your email, and you get an email about it.

A recovery link is sent to the email of the account and works for 24 hours. A new link can be requested 15 minutes after the previous one, and the previous link then stops working.

The site works over HTTPS: the connection between your browser and the site is encrypted. Before signing in, check the address in the address bar of the browser.

• Use a password that you do not use on other sites.
• Never tell anyone your password, the codes of the app or its recovery code, including people who say they are from our support.
• Keep the recovery code of two-factor authentication in a safe place: it restores the codes on a new phone.