Two-factor authentication for crypto exchanges

A bank account is a ledger entry a regulated institution owes you. An exchange account holding crypto is closer to cash in someone else's safe: whoever controls the account controls the assets, and transfers are irreversible. That is why 2FA for crypto exchanges is not an optional extra: a password alone is an open vault door, and whoever walks through it never needs to be in your country.

The mechanics of two-factor authentication are covered in our overview post; this one is about exchanges: what to enable, what to avoid, and what no setting can protect you from.

Why SMS is the weak option for crypto

Crypto 2FA built on SMS looks like a second factor, but the codes travel through the least secure channel you own: your phone number. And the number need not stay attached to your phone.

In a SIM swap, the attacker gathers enough personal data to impersonate you — name, address, date of birth, card digits, much of it from old breaches. Then they contact your carrier, claim your phone was lost, and ask for the number to be moved to a SIM card they hold. If the agent accepts the story, your number rings on their device within minutes; your own phone drops off the network, and every SMS your accounts send — resets, verification codes — lands on theirs.

Exchange accounts are prime targets because the payoff is immediate and irreversible: no chargeback, no fraud desk, no clawing funds back from an emptied address. The US Federal Communications Commission now requires carriers to take steps against SIM-swap and port-out fraud — guidance at fcc.gov — but rules tighten a channel; they do not change its nature.

TOTP: the baseline every exchange supports

Every exchange in this article supports authenticator apps using TOTP, the time-based one-time password standard. No code is sent anywhere: your app and the exchange compute the same six-digit code from a shared secret and the current time — the algorithm is explained here. Setup is four steps:

1. You enable 2FA in the exchange's security settings; it displays a QR code.
2. The QR code encodes an otpauth:// URI carrying the secret, a random base32 string.
3. You scan it with your authenticator app, or type the secret manually.
4. The app produces a code every 30 seconds; the exchange asks for one to confirm enrollment.

Crypto.com's flow is typical: the app shows a QR code to scan, with an option to copy the secret by hand. From then on, the Crypto.com 2FA code is the standard six-digit TOTP code your app generates — no SMS, no phone number, nothing a carrier can redirect.

What each exchange supports

Coinbase

Coinbase calls the feature 2-step verification. The available methods are an authenticator app (TOTP, enrolled by scanning a QR code), SMS, passkeys, and hardware security keys using FIDO2/WebAuthn, such as a YubiKey. Coinbase's guidance ranks two security keys as the strongest setup, a passkey plus a security key as the practical alternative, and notes that enabling a security key replaces previously configured methods. The walk-through is in Coinbase's help center.

For most people, the right Coinbase 2FA setup is an authenticator app at minimum, and a passkey or security key for meaningful balances. Do not leave SMS as the active method.

Kraken

Kraken 2FA is more granular than most, separated by action: Sign-in 2FA for logging in, Funding 2FA for deposits and withdrawals, and a Master Key guarding account recovery. Sign-in 2FA supports passkeys — up to five — and authenticator apps. Sign-in 2FA and the Master Key also accept FIDO2 hardware security keys, while Funding 2FA works with keys using the Yubico OTP protocol. A Kraken 2FA code is the same six-digit code your TOTP app produces.

The Master Key is a second "something you have" that stays valid even if your password and sign-in 2FA fall together, blocking takeover through recovery. The Global Settings Lock freezes your settings, including saved withdrawal addresses, for a period you choose. Details: 2FA guide, Master Key, security key.

Crypto.com

The Crypto.com app uses TOTP with an authenticator app — Google Authenticator by default, Authy also supported. In the app's security settings, the Crypto.com QR code appears on screen; you scan it with your authenticator, or copy the code to add it manually. The help center article walks through it step by step. Once enabled, the 2FA code on Crypto.com covers sign-in and sensitive actions such as withdrawals.

Bitkub

Bitkub, Thailand's largest exchange, runs 2FA on Google Authenticator: enable Bitkub 2FA in your security settings, then enroll by scanning or copying the key shown. Bitkub's own materials stress 2FA for sign-in, password changes, and withdrawals — precisely the actions an attacker needs. The support pages cover common situations, from codes that stop matching to moving 2FA to a new phone.

The FTX chapter: what 2FA could not fix

In November 2022, FTX froze withdrawals and filed for Chapter 11 bankruptcy in Delaware on November 11, leaving an estimated million creditors. The cause was not a wave of hacked accounts: customer funds had been commingled with the exchange's own and lent to its affiliate, Alameda Research. It was a custody and governance failure, permitted from the inside.

Questions about FTX 2FA miss the point. Customers could have used hardware security keys, flawless passwords, dedicated devices — the outcome would not have changed by a dollar, because the loss never went through their accounts. 2FA protects your account from other people; nothing you configure protects the assets from the exchange itself.

Repayment took years. A US court approved the plan in October 2024, and Reuters reported that 98% of customers would recover 119% of their account value as of November 2022. The plan took effect in January 2025, with distributions in waves since. But claims were valued at November 2022 prices: a customer who held bitcoin received its dollar value then, not the coins, and prices have risen substantially since. Made whole in cash is not made whole in assets.

The lesson is counterparty risk, and it grows with every week funds sit on an exchange. Use exchanges to buy and trade; for long-term holdings, self-custody puts the bearer asset back under your control.

Beyond login 2FA

2FA on the login screen stops most attacks. A few settings raise the cost further:

• Withdrawal address whitelisting. Most exchanges let you restrict withdrawals to pre-approved addresses. Coinbase's address book allowlist holds each new address for 48 hours before it becomes usable, and turning it off takes another 48. Kraken's Global Settings Lock freezes these settings outright. An attacker who takes over your account can sign in and stare at your balance, but cannot send it anywhere new.
• A dedicated email address. Use one address for the exchange and nothing else. It never appears in breach lists, never receives phishing mail, and is not one reset away from your other accounts. Give it its own strong 2FA.
• Separation of factors. If your exchange email and authenticator live on the same phone, one malware infection captures both the reset link and the code. An authenticator on a separate device — or a hardware key for sign-in — means one compromised device is not the whole wall.

Keeping your TOTP seeds safe

The seed — the QR code, or the base32 string under it — is the permanent key to your codes. Anyone who sees it generates your codes forever, on any device. The codes rotate every 30 seconds; the seed never does.

Seeds leak in predictable ways: a screenshot of the enrollment screen in a gallery that syncs to cloud photos; a secret pasted into a notes app that syncs everywhere; a Google Authenticator export emailed to yourself; the seed sent over chat to set up a second phone. Each hands the second factor to whoever reads that storage later.

The safe pattern is a zero-knowledge vault: secrets encrypted in your browser before upload, so the server only stores ciphertext it cannot decrypt. That is how our vault works — client-side encryption with PBKDF2 salted key derivation, HKDF key separation, and AES-256-GCM, with Argon2id protecting login. It handles TOTP, HOTP, and Steam Guard, with per-key algorithm, digits, period, and counter. It installs as a PWA and works fully offline. The free tier covers 100 folders and 100 entries; paid tiers are $24 per year or $99 for lifetime.

To see your codes without storing anything, the guest generator on our homepage takes a Base32 secret, an otpauth:// URI, a QR image, or a Google Authenticator export, computes codes instantly, and makes zero network requests. For comparing where to keep your seeds, our 2026 authenticator comparison covers the field.

Frequently asked questions

Should I use 2FA on crypto exchanges?

Yes, without exception. Exchange accounts hold bearer assets that move irreversibly — a premium target. Enable 2FA on the exchange and on the email that can reset its password; the email is the side door.

Which 2FA is best for crypto?

A hardware security key or passkey where supported — Coinbase and Kraken both take FIDO2 keys, and Kraken lets you use one as the Master Key. Otherwise, a TOTP authenticator app is the baseline. SMS is the option you replace.

Is SMS 2FA safe for crypto?

Better than a password alone, worse than every alternative. SMS codes can be intercepted through SIM swaps, which move your number to the attacker's SIM and deliver the codes to them. Use an authenticator app instead.

Can someone steal my 2FA codes?

Yes, three ways: real-time phishing pages that relay your code as you type it, malware on the device that shows the codes, and a leaked seed. The first two attack the moment; the third is permanent. Guard the seed accordingly.

What 2FA do Kraken and Coinbase support?

Kraken: passkeys and authenticator apps for sign-in, FIDO2 hardware security keys for sign-in and the Master Key, Yubico OTP keys for Funding 2FA. Coinbase: authenticator apps, passkeys, security keys, and SMS. Both rank hardware keys strongest.

Two minutes per exchange. Do it before you need it.