What is two-factor authentication (2FA)?
A second credential required at login or withdrawal in addition to your password, such as an app-generated code, a physical security key, or a device credential.
Not yet verifiedHow we verify
3 min read
In this entry
A second credential required at login or withdrawal in addition to your password, such as an app-generated code, a physical security key, or a device credential.
The premise is that passwords leak. They are reused across sites, they appear in breach dumps, and they are typed into convincing copies of real login pages. A second factor means a stolen password on its own is not enough.
The mistake is thinking all second factors are equivalent because the exchange presents them in one list. They differ enormously in what they defend against, and the most convenient option is the weakest.
How it works
Factors are grouped as something you know, something you have, and something you are. A password is the first, and the second is meant to come from a different group, which is why a security question does not qualify.
The options exchanges offer, in rough order of strength:
| Method | Resists phishing | Resists SIM swap | Notes |
|---|---|---|---|
| Security key or passkey | Yes | Yes | Bound to the site's domain |
| Authenticator app code | No | Yes | Secret never leaves the device |
| Email code | No | Yes | Only as strong as the mailbox |
| Text message code | No | No | Redirectable at the carrier |
Comparison of common second factors by the attack each does and does not stop.
The phishing column is the one that separates them. An app code can be typed into a fake site and relayed to the real one in seconds. A security key or passkey performs a challenge bound to the actual domain, so a lookalike site gets a response that is useless to it. That binding, specified in the FIDO2 and WebAuthn standards, is the reason security keys are treated as the strong option.
Most exchanges also let you require the second factor separately for withdrawals, which is worth enabling even if the session is already authenticated.
Example
Illustrative. Your password appears in a breach of an unrelated site and an attacker tries it on your exchange.
With no second factor, they are in and withdrawing within minutes. With a text message code, they attempt a carrier port-out of your number and may succeed. With an authenticator app, they need your unlocked phone or must phish the code in real time while you happen to be at the keyboard. With a hardware security key, the login fails and there is no code for you to be tricked into supplying.
Add a withdrawal whitelist and even a successful login cannot send funds to an address you have not pre-approved.
Why it matters when you buy
Security setup is the cheapest thing you will do on an exchange and it happens before the first deposit, not after. Fee differences between venues are measured in tenths of a percent, and an account takeover costs the balance. The exchange directory lists which factors each venue supports, and the guide on two-factor authentication for crypto covers the setup step by step.
Related terms
- totp: the app-generated code method
- passkey: domain-bound credentials that resist phishing
- sim swap: the attack against text message codes
- withdrawal whitelist: a second layer behind login
- phishing: how codes are captured in real time
- api key permissions: the access path 2FA does not cover
Questions
Which second factor should I use?
A hardware security key or passkey where the exchange supports it, an authenticator app where it does not, and text messages only if nothing else is offered. Enable withdrawal confirmation separately from login.
What if I lose my second factor?
You fall back to the backup codes issued at setup. Save them offline at enrollment, because without them recovery means re-verifying your identity and waiting out a security hold on withdrawals.
Does 2FA protect an API key?
No. API keys authenticate separately and bypass the login flow entirely, which is why they carry their own permission settings and should be restricted to trading, never withdrawal, unless you specifically need it.