How to Buy Bitcoin Safely: A Checklist for Kenyans

Buying Bitcoin in Kenya takes about fifteen minutes. Buying it safely takes about fifteen more — and those extra minutes are what separate people who sleep well from people posting “Binance support please help” on X at 2 a.m. This page is a practical checklist, not a sales pitch: how to choose a platform, lock down your account and phone line, pay without getting scammed, store what you bought, and what to do if something goes wrong. If you want the buying steps and live prices, see our Bitcoin in Kenya guide.

Safety checklist

Print this, or screenshot it. Each line closes a door scammers use against Kenyans every week.

• I downloaded the exchange app from the link on its official website, not from an ad, SMS or WhatsApp.
• I can name the company behind the platform and the regulator that licenses or registers it.
• My exchange email has a strong password used nowhere else.
• Login and withdrawals use an authenticator app, not SMS codes.
• I have set an anti-phishing code so I can recognise real emails from the exchange.
• My M-PESA security questions are set and nobody knows my M-PESA PIN.
• On P2P I pay only from my own M-Pesa line, only to the number in the order.
• I never move a trade to WhatsApp, Telegram or a phone call.
• My seed phrase is written on paper and stored offline. I have never typed it into a website.
• I keep order numbers, M-Pesa SMS and transaction IDs in one place.

Pick the platform

Most “exchange” horror stories start with a platform that was never a real exchange: a cloned website, a fake app or an “investment platform” that shows growing balances but never lets you withdraw. The checks below take ten minutes.

On the Kenyan side: the VASPVASPVirtual Asset Service Provider: any business that exchanges, stores or transfers crypto for customers. Kenya licenses them under the VASP Act 2025. Glossary Act 2025 came into force on 4 November 2025 and requires crypto platforms serving Kenyans to be licensed by the CBK or the CMA. The transition for existing operators ended on 4 November 2026, but we have not found a public register of licensed providers, so no exchange can yet be shown to hold a Kenyan VASP licence. Until a register exists, look for platforms with strong licences elsewhere and a public statement on their Kenyan application. Our regulation guide tracks developments.

For a concrete example of what to check: CEX.IO states that it has operated since 2013 and holds over 30 licences and registrations, including an FCA-registered UK entity (FRN 1007192) — a number you can look up on the FCA’s own register. It is not licensed under Kenya’s VASP Act either. Our CEX.IO review covers it in detail.

Lock down your account

Once you have chosen a platform, the biggest risk shifts to your login and your phone number.

1. Use an authenticator app, not SMS

   Turn on 2FA2FATwo-factor authentication: a second code from an app like Google Authenticator. Safer than SMS codes, which SIM-swap fraudsters can intercept. Glossary with an authenticator app such as Google Authenticator or a similar app. SMS codes can be intercepted in a SIM swapSIM swapA fraudster convinces a mobile operator to move your number to their SIM, then receives your SMS codes and M-Pesa messages. Glossary; app codes stay on your phone. Write down the backup key the exchange shows you and store it with your seed phrase.

2. Set an anti-phishing code

   Large exchanges such as Binance, Bybit and OKX let you set a personal word that appears in every genuine email. An email without it is fake, however official it looks.

3. Whitelist withdrawal addresses

   Turn on the withdrawal whitelist so coins can only go to addresses you have pre-approved. Adding a new address usually triggers a delay — which gives you time to react if someone else is in your account.

4. Protect your M-PESA and SIM

   Set your M-PESA security questions (*334# → My Account → M-PESA PIN Manager), never share your PIN or ID number, and remember Safaricom says it only calls customers from 0722000000. We could not find a separate Safaricom “SIM swap lock” product to recommend, so your best defence is to act fast: if your line suddenly shows no network, call Safaricom on 100 from another phone and change your exchange password from a trusted device.

5. Separate your crypto email

   Use an email address for the exchange that you do not publish on CVs, social media or business cards. It makes targeted phishing much harder.

Paying without getting scammed

Most Kenyans pay for Bitcoin through P2PP2P tradingPeer-to-peer: you buy crypto directly from another person and pay them via M-Pesa or bank; the platform only holds the coins in escrow. Glossary: you send M-Pesa to a verified seller while the platform holds their coins in escrowP2P escrowThe platform locks the seller's coins while you pay. Coins are released only when the seller confirms your M-Pesa payment arrived. Glossary. The system protects you only if you stay inside its rules. Binance’s P2P policy, for example, requires the payer’s name to match the verified account name; a third-party paymentThird-party paymentPaying from an M-Pesa line or bank account that is not in your own name. P2P rules forbid it and it is a common cause of frozen accounts. Glossary can lead to the order being refused and the money refunded instead of coins released.

Buying Bitcoin directly on P2P is possible, but many Kenyans buy USDT on P2P and swap to Bitcoin inside the exchange, where the market is deeper. Either way, the payment rules are the same. Our P2P guide explains merchant badges and appeals, and M-Pesa reversal scams explains the trick most often used against sellers.

Storing what you bought

Where you keep your Bitcoin depends on how much it is and how long you plan to hold it.

When you withdraw Bitcoin to your own wallet, choose the Bitcoin network (often shown as BTC) unless you know your wallet supports something else. Some exchanges also offer “BTC” on other networks, which a normal Bitcoin wallet will not receive. Send a small test first and check it on a block explorerBlock explorerA public website (such as Tronscan or Etherscan) that shows every transaction on a blockchain. Glossary.

The seed phraseSeed phraseThe 12 or 24 secret words that can restore your wallet on any phone. Anyone who sees them can take everything. Never type them into a website or share them on WhatsApp. Glossary is everything. Never photograph it, never store it in WhatsApp, Google Drive or email, and never type it into a website — no legitimate wallet or support team will ever ask for it. Our hardware wallets guide explains where to buy a device in Kenya without being sold a tampered one.

If something goes wrong

Act quickly and in this order. Speed matters most in the first hour.

• Stop. Do not send more money to 'unlock', 'verify' or 'recover' anything.
• Secure what is left: change your exchange and email passwords from a trusted device, and freeze or disable the account through the exchange's official app if it offers that option.
• If it was a P2P trade: open an appeal inside the app with your M-Pesa SMS. Do not cancel a paid order.
• If it was M-PESA fraud: report it to Safaricom by forwarding the details to 333, or via Zuri on WhatsApp (0722 000 100). If you sent money to a wrong number yourself, forward the confirmation SMS to 456 for self-reversal.
• If your SIM went dead: call Safaricom on 100 from another line immediately.
• Report to the police and get an OB number; keep screenshots, order numbers, TxIDs and chat logs.
• Ignore 'recovery experts' who contact you — they are the second wave of the same scam.

Our crypto scams in Kenya guide lists the patterns we see most often and where to report each one. And when the time comes to sell, the same rules apply in reverse — see crypto to M-Pesa.