Security

Login methods#

Settings › Security › Login methods lists every way into your account: an email for sign-in links (as many addresses as you like), Discord, Telegram and passkeys (Face ID, Touch ID or a security key), which you can rename. Adding an email sends a link to it; open it to finish. The last one can't be removed, so you can't lock yourself out.

Two-factor#

Two-factor adds a second check on top of your sign-in, so someone who gets into your email or Discord still can't get in or take your keys. Settings › Security › Two-factor offers two methods. One can be on at a time: turn the other off first to switch.

Authenticator app

A 6-digit code from an app such as 1Password or Google Authenticator, new every 30 seconds. Press Set up, scan the QR code with the app or type the key in (Copy key), enter the code and press Verify. Setting it up needs a sign-in from the last 10 minutes.

Wallet signature

A browser wallet (Phantom, Backpack, Solflare, MetaMask or Rabby) signs a message instead of you typing a code. Nothing is sent and it costs nothing. Press Link beside your wallet to add it to your account, then Set up, pick the Wallet that signs if you have several, and Sign message. Wallets confirm two-factor only; they aren't a way to sign in.

Turning two-factor off, changing what it protects and making new backup codes always ask for the check first.

What it protects#

Protect everything is on by default: every action that can move funds, reveal keys or change your account asks for the second check. Turn it off to pick from seven actions yourself; the first four start ticked. An action you leave unticked goes ahead without the check.

Signing in

Every sign-in, after the email, Discord, Telegram or passkey step.

Exporting private keys

From wallets and treasuries.

Sending from a treasury

To any address outside Coinwave, and buying Pro.

Withdrawing from wallets

Every send from your wallets to an outside address, and referral claims paid to one.

Deleting wallets

Deleting wallets or groups, and emptying the trash.

Changing how you sign in

Adding or removing an email, passkey, linked wallet or account.

Launching a coin

Before the launch's buys are sent.

Backup codes#

When you turn two-factor on you get 10 backup codes, in the form xxxxx-xxxxx, and Recovery counts how many are left. Each works once in place of your second check if you lose your phone or wallet, and they aren't shown again: copy or download them somewhere safe, away from this device. On any check, Use a backup code takes one instead. New codes makes 10 more and stops the old ones working.

Confirm it's you#

Each action two-factor guards asks for the second check right before it goes: a send from your wallets or a treasury to an outside address, deleting wallets, exporting a private key, adding or removing a sign-in method, launching a coin, and signing in. With an authenticator app, type a fresh 6-digit code; it goes on its own after the last box. With Wallet signature, the check shows the wallet that signs and the message it's asked to sign, so you can match it against your wallet's prompt, then waits while you approve it. A confirmation covers that one action and expires after five minutes.

With two-factor off, or for an action you didn't tick, there's no check: a send goes as soon as you press Send, and a key export goes straight from its warning to the key. Hints such as Export private key say whether a check comes first.

Sessions#

Settings › Security › Sessions lists every device signed in, with its browser, place and when it was last active; this one is marked This device. Sign out any you don't recognise, or Sign out of all others.

Keeping your keys#

• Coinwave never asks for your keys or codes outside its own sign-in and confirmation screens, and its team never will. Anyone who does is trying to rob you.
• Exported keys are shown once and gone when the window closes. Store them offline, never in a chat or a screenshot.
• Lock wallets you don't want touched: a locked wallet can't send, trade or be used in a launch.