Why you should turn on whitelisting on your exchange. For the new guys and anyone who just hasn't thought of this scenario.

I've seen several post on here with a specific scenario where someone's email account or directly the exchange account gets hacked do to shitty password management and lack of 2 factor authentication. (DONT EVER USE SMS 2fa for crypto) By the time they realize they have been hacked the bitcoin has already been transferred out. Usually within minutes. Even if you don't want to store your BTC with a hardware wallet you should still enable whitelist even if you leave your withdrawal list blank. This effectively buys you time. Whitelist is basically pre approving addresses you own.

Additionally you should take the time to setup a hardware wallet and protect your recovery seed. By doing this you can generate a wallet address that you own and store it in your exchange account and then add it to WHITE LISTING(basically a pre approved receiving address). You white list the address so that if in the future your account gets hacked. The hacker will be unable to add a new receive address instantly. It can buy you valuable time to get your account locked down or to get control back.

When you enable whitelist on Coinbase it will put a 2 day hold on any new addresses being added to the account. Gemini it buys you a 7 day hold.

Coinbase whitelist help here

Gemini whitelist help here

This will keep the hacker from instantly transferring the money out.

The cheapest hardware wallet I have found for this is KEEPKEY for $10. I also own ledger and trezor. Keep key software shapeshift web interface is not great. However in combination with ELECTRUM I do like it. I just don't use their shapeshift.com web interface. There are probably other software wallets it works with as well.

I have this old link that still works. https://keepkey.myshopify.com/products/new-member-keepkey-hardware-wallet

Limit 1, buy 1 then wait a week and buy another if you like. I've bought like 6 over the past year for various family members that wanted me to manage a BTC wallet for them.

If anything you can use it as a 2fa security hardware key. Once you have connected to electrum and generated your seed via the keep key you can use this thing 2 factor hardware key even if you never use it as a wallet. You have to generate the keys for it to work. Cheapest hardware key I know of. It is FIDO U2F. It's also well designed to be secure against key loggers. I use it for hardware 2fa on Google, coinbase, gemini, and bitwarden.