Two-Factor Authentication (2FA) on Crypto Exchanges
If you can only do one thing for your account’s security, turn on two-factor authentication. It requires a second code in addition to your password, and it blocks most unauthorized access.
What 2FA is
Two-factor authentication (2FA) combines something you know (your password) with something you have (your phone). Even if someone finds out your password, they cannot get in without the second code.
Which method to choose
| Method | Security | Note |
|---|---|---|
| Authenticator app | High | Generates codes on your phone, with no dependence on the carrier |
| Hardware key (FIDO2/passkey) | Very high | Requires the device, great for larger accounts |
| SMS | Low to medium | Can be intercepted through a SIM swap |
| Medium | Depends on the security of the email account |
Whenever possible, prefer an authenticator app or a hardware key, and use SMS only as a supplement.
How to turn it on
- Open the exchange’s security settings.
- Choose to enable the authenticator and scan the QR code with the app.
- Enter the code to confirm.
- Store the recovery code offline, such as on a piece of paper kept somewhere safe.
- Also enable the anti-phishing code and withdrawal confirmation, if the exchange offers them.
Common mistakes
- Taking a screenshot of the QR code and leaving it in your gallery.
- Losing your phone without having the recovery code.
- Sharing the 6-digit code with “support” that contacted you.
- Using your exchange password on other sites.
2FA is also a prerequisite for creating API keys safely. For other precautions, see common crypto bot scams.
Phishing and how it gets around passwords
Scammers build pages identical to exchanges and convince you to type your login, password and even your 2FA code. To protect yourself, always go in through the official address saved in your bookmarks, enable the anti-phishing code (a text the exchange includes in its official emails) and be wary of links received by message.
Monthly security routine
- Review your API keys and delete the ones you do not use.
- Check your connected devices and sign out of any you do not recognize.
- Review the list of allowed withdrawal addresses.
- Change your password if you have any doubt about a leak.
Related guide: a crypto bot without withdrawal permission. See also all the crypto arbitrage guides.
Frequently asked questions
Does 2FA protect against everything?
No, but it blocks the vast majority of logins that use a leaked password. Stay alert to phishing and requests for codes.
What do I do if I lose my phone?
Use the recovery code you saved and follow the exchange’s recovery process. That is why it is important to store it somewhere other than your phone.
Can I use the same authenticator for several exchanges?
Yes, an authenticator app can hold many codes. Back up the recovery codes for each account.
Start with $30 in credits
Connect your exchanges with keys that can't withdraw and let the bot work. You pay 30% of the profit, and only when there is a profit.
Create my account →Read also
How to Create an API Key Without Withdrawal Permission
A general step-by-step guide to creating an exchange API key with read and trade access only, no withdrawals, plus tips for storing and revoking it.
3 min read
How to Know if a Crypto Exchange Is Trustworthy
A checklist for evaluating a crypto exchange: track record, liquidity, security, transparency, support and warning signs to check before you deposit.
2 min read
7 Common Crypto Bot Scams and How to Avoid Them
The most common scams involving crypto bots, signals and arbitrage, with warning signs and a checklist to protect yourself before sharing your API key.
3 min read
This content is for information only and is not investment advice. Trading crypto derivatives involves a high risk, including the total loss of your capital. Past results do not guarantee future results, and the figures mentioned are examples. Before trading, check whether trading crypto derivatives is allowed in your country and what your tax obligations are. Assess whether the product suits your profile before investing.