How to use two-factor authentication for crypto accounts
Turn on 2FA in your crypto account settings, pick an authenticator app or hardware key over SMS codes, and keep backup codes on paper.
Vahe HakobyanEditor-in-chief
Updated Oct 5, 20263 min readFact-checked
On this page
- An authenticator app or a hardware key beats SMS codes.
- Write backup codes on paper, not in email or cloud storage.
- Not every service supports an authenticator app.
Two-factor authentication asks for a second proof beyond your password. Many people reuse the same password, and attackers take stolen login pairs from one service and try them on others, a tactic called credential stuffing. A second factor blocks that path.
What you need before you start
Gather your password and your chosen second factor before you open the settings menu. An authenticator app or a hardware security key is stronger than codes sent by text message. Some services support only SMS codes, so not every account can use an app.
How to enable two-factor authentication
Menu names differ between services, but the order is the same. Open the security settings, add your second factor, confirm it, and store the codes the service issues.
- 1Open your security settingsSign in and find the security or privacy section of the account.
- 2Add your authenticator appScan the QR code, or type the setup key if scanning fails. With a hardware key, follow the prompt and tap it.
- 3Confirm the setupEnter the rotating code, or tap the key, to prove the second factor works.
- 4Save the backup codesWrite them on paper as soon as the service shows them, and keep them out of email and cloud storage.
After setup: using and recovery
Most custodial exchanges ask for your rotating code when you sign in, withdraw funds, or change security settings. Open the app, read the current code, and type it before the countdown ends. A self-custody wallet has no login, so the lock on your phone is often the only factor.
Frequently asked questions
On a custodial exchange, contact support and start account recovery, which usually requires identity checks. A self-custody wallet has no support line, so your recovery phrase is the only way back in.
It is the weakest common option. A fraudster can port your number to a SIM card they control, read your text codes, and sign in as you. Twitter's CEO lost his account to a SIM swap in 2019.
Do not type it. Close the page, reach the service by typing its address yourself, and change your password if you already entered it.
