An account that survives a leaked password

Account setup is the cheapest security you will ever buy. It takes ten minutes once and then protects the account for as long as it exists.

A name used nowhere else

Not a variation of a handle from a forum, not something similar to an old market account, not anything a search engine could connect to something you have written elsewhere. Reuse is the single most common thread in people being identified, and avoiding it costs nothing at the start and cannot be fixed later.

A password you did not invent

Generate a long one in a local password manager. Passwords people make up are shorter and more predictable than they feel, and reusing one from another site means a breach somewhere unrelated becomes a breach here.

The recovery phrase on paper

Write it down and store it away from the machine. Never type it into a web form for any reason. It is the only thing that restores the account and it is the exact thing phishing pages are built to collect.

PGP two factor

Switch it on immediately. With it enabled, a stolen password by itself opens nothing, because signing in also requires proving control of your key. It is the difference between a leaked password being an inconvenience and being the end of the account.

Small balances

Not strictly account setup, but it belongs in the same ten minutes. Whatever sits on a market is exposed to whatever happens to the market. Deposit for the order in front of you and withdraw the rest.