Two-factor authentication for crypto accounts.

Passwords are regularly exposed through third-party data breaches, reuse across multiple sites, or simple phishing pages that forward login credentials directly to an attacker. Because crypto transactions are final and irreversible, keeping the bar for account access high matters even more.

2FA adds a factor independent of something you know (the password): something you have (a device or key) or something you are (biometrics). Even if a password is compromised, an attacker still needs the second factor to log in.

SMS-based 2FA sends a one-time code to your phone number. This is better than no 2FA, but vulnerable to SIM swapping: an attacker convinces a phone provider (often through social engineering or a bribed employee) to transfer your number to a SIM card in their possession, after which SMS codes are sent to them.

For accounts holding significant value, SMS-based 2FA is therefore not recommended as the sole layer of security. It is an improvement over a password alone, but not the strongest option available.

An authenticator app generates time-based one-time codes (TOTP) locally on your phone, without relying on the mobile network. This makes it immune to SIM swapping, though phishing remains a risk: a fake login page can ask you to enter both your password and the current code, which the attacker then relays directly to the real site.

When setting up an authenticator app, always save the recovery codes most platforms provide; without them, you lose access to the account if your phone is lost, broken or replaced. Store these recovery codes as carefully as a seed phrase: physically and offline.

A physical security key using the FIDO2/WebAuthn protocol offers the strongest protection against phishing. These keys cryptographically verify that the website they are communicating with is genuinely legitimate, so a fake page cannot complete authentication even if a user accidentally attempts to log in there.

The downside is that not every platform supports hardware keys, and you need to carry a physical device. For accounts holding significant value, such as large exchange positions, this remains the most robust protection currently available against phishing-based takeovers.

Enable 2FA on every account where it is available, not only crypto platforms but also the email address linked to those accounts; a compromised email often leads to a cascade of further compromised accounts via password-recovery flows.

Where possible, set up multiple 2FA methods as backups for each other, for example an authenticator app plus a hardware key, and store recovery codes physically separate from your devices. Avoid using the same phone number or the same email as the sole recovery method for multiple critical accounts.