Security Score
85/100
1 recommendation outstanding
Security
Authentication, withdrawal protection and account activity
Two-Factor
Enabled
Authenticator app · added 14 Mar 2024
6 backup codes unused
Active Sessions
3
Across 2 locations
1 unrecognised
Last Sign-In
2h ago
Chrome on macOS · San Francisco
No failed attempts in 30 days
Authentication
How you prove it's you
- Authenticator app
- Time-based codes · the strongest option available
- Hardware key
- YubiKey or any FIDO2 device
- SMS codes
- Vulnerable to SIM swapping · not recommended
- Anti-phishing code
- A phrase shown in every genuine CryptoPilot email
- Require 2FA for trades
- Confirm every order above your position cap
- Password
- Last changed 18 Apr 2026 · 94 days ago
Recommendations
Close the remaining gaps
-
Set an anti-phishing code
+15 ptsThe single largest gap in your score. Any email without your phrase is fraudulent.
-
Two-factor enabled
Using an authenticator app rather than SMS.
-
Withdrawal allowlist active
Funds can only leave to 3 pre-approved addresses.
-
No API key holds withdrawal rights
Verified across all 4 keys on your account.
- Current score
- 85 of 100
- Achievable now
- 100
Withdrawal Allowlist
Funds can only be sent to these addresses
| Label | Asset | Network | Address | Added | Status | Actions |
|---|---|---|---|---|---|---|
| Cold wallet |
BTC
|
Bitcoin | bc1q••••8f4a | 14 Mar 2024 | Active | |
| Hardware wallet |
ETH
|
Ethereum | 0x7a2••••c19e | 02 Sep 2025 | Active | |
| Bank off-ramp |
USDC
|
Ethereum | 0x3d9••••7b22 | 11 Jan 2026 | Active | |
| Exchange transfer |
SOL
|
Solana | 7xKX••••9m2p | 20 Jul 2026 | Pending · 22h |
New addresses are held for 24 hours before they can receive funds. That delay is what makes the allowlist effective — an attacker with your password still cannot add a destination and withdraw in the same session.
Security Activity
Sign-ins, credential changes and key events
| Event | Device | Location | IP address | When | Result |
|---|---|---|---|---|---|
| Sign-in | Chrome on macOS | San Francisco, US | 192.168.1.44 | 2 hours ago | Success |
| API key created | Chrome on macOS | San Francisco, US | 192.168.1.44 | 2 days ago | Success |
| Sign-in | Firefox on Windows | Frankfurt, DE | 85.214.•••.22 | 2 days ago | New device |
| Allowlist address added | CryptoPilot iOS | San Francisco, US | 192.168.1.51 | 4 days ago | Success |
| Sign-in attempt | Unknown browser | Lagos, NG | 102.89.•••.7 | 12 days ago | Blocked |
| Password changed | Chrome on macOS | San Francisco, US | 192.168.1.44 | 18 Apr 2026 | Success |
The blocked attempt from Lagos failed at the two-factor step — the password was correct, which is worth noting. If you have reused that password elsewhere, change it there too.